a7ab8979e7d23fd0775ea27fd817de10881a450be5d3bcc66b5b86b5c2b4abfa

Analysis

max time kernel
94s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

66a8a9580e7db1c1bab562103bf5bb33.exe
Size

72KB
MD5

66a8a9580e7db1c1bab562103bf5bb33
SHA1

1779b599845f054729eaf6edfed102380c700c65
SHA256

a7ab8979e7d23fd0775ea27fd817de10881a450be5d3bcc66b5b86b5c2b4abfa
SHA512

ee72229a10b8e521453acdd37317d538bc3285702ca4abf752e0b164147ca95ce8ed9951f1c714b07609f08d0568cba9719a90056b6d38bf0937262fe6d1955e
SSDEEP

768:5uB2DhmGE4ggd1HF3LCjcvVTsu0jkZLhz3l8CaXNaeu+RQa0pxbIWr5c3LY+/+dF:5uBbYHFuCOu0kZLhzC+ba0cWy35+J

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlhkgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jocefm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cadlbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbkbpoog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knkekn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlfpdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfcabp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffnknafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iqbbpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pefhlaie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdhbmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afgacokc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nelfeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bajqda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjmba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jiglnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdkoch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lljklo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jqlefl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbajbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Omcjep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecbjkngo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iphioh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lknojl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbicpfdk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcdciiec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihphkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kqbkfkal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeddnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iliinc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Monjjgkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hoclopne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Impliekg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgbloglj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glengm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcjcnoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qdbdcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Miaboe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oklkdi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Polppg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmalne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpfepf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hkgnfhnh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kaehljpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Licfngjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnfkdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Albpkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dbpjaeoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Glipgf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cioilg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncqlkemc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gknkpjfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hhdhon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idghpmnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fiodpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qaflgago.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmfhkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnpdegjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gflhoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Idghpmnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddligq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbpchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hffken32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgnffj32.exe

Executes dropped EXE 64 IoCs

pid	Process
1976	Bgeaifia.exe
5012	Bjfjka32.exe
3828	Cpbbch32.exe
1996	Cikglnkj.exe
5108	Cfogeb32.exe
3604	Cadlbk32.exe
8	Cjmpkqqj.exe
2440	Cgqqdeod.exe
4148	Cgcmjd32.exe
676	Dpnbog32.exe
3592	Diffglam.exe
4584	Gmcdffmq.exe
3764	Gknkpjfb.exe
1296	Gpkchqdj.exe
3480	Hjchaf32.exe
3096	Hhdhon32.exe
1124	Hnaqgd32.exe
3468	Hjhalefe.exe
2808	Hkgnfhnh.exe
4432	Hjlkge32.exe
1696	Igqkqiai.exe
3988	Ihphkl32.exe
1272	Idghpmnp.exe
4296	Ijcahd32.exe
4220	Ihdafkdg.exe
4596	Idkbkl32.exe
2752	Iqbbpm32.exe
2628	Jjjghcfp.exe
1320	Jjmcnbdm.exe
4324	Jqglkmlj.exe
4636	Jjopcb32.exe
4828	Jjamia32.exe
3264	Jqlefl32.exe
2720	Jbkbpoog.exe
1884	Kiejmi32.exe
2864	Knbbep32.exe
3564	Kgjgne32.exe
2704	Kqbkfkal.exe
4072	Kaehljpj.exe
5060	Kniieo32.exe
3276	Kecabifp.exe
1100	Knkekn32.exe
4312	Ljbfpo32.exe
4532	Licfngjd.exe
5056	Lelchgne.exe
2336	Ljkifn32.exe
2148	Mjneln32.exe
3520	Miofjepg.exe
2416	Mjpbam32.exe
1800	Miaboe32.exe
1096	Mbighjdd.exe
5104	Mlbkap32.exe
1152	Mhilfa32.exe
4544	Nbnpcj32.exe
1624	Njiegl32.exe
544	Nhmeapmd.exe
4228	Nknobkje.exe
2164	Nlnkmnah.exe
4728	Nefped32.exe
1492	Oondnini.exe
1592	Ooqqdi32.exe
3044	Ohiemobf.exe
4928	Oemefcap.exe
4508	Oeoblb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kdflmg32.dll	Pddhbipj.exe
File opened for modification	C:\Windows\SysWOW64\Cdlqqcnl.exe	Coohhlpe.exe
File created	C:\Windows\SysWOW64\Hnjjdmoc.dll	Ijcahd32.exe
File created	C:\Windows\SysWOW64\Lbbfpo32.dll	Afgacokc.exe
File created	C:\Windows\SysWOW64\Lhhmmcaa.dll	Cjecpkcg.exe
File created	C:\Windows\SysWOW64\Eiaoid32.exe	Elnoopdj.exe
File opened for modification	C:\Windows\SysWOW64\Dpnbog32.exe	Cgcmjd32.exe
File created	C:\Windows\SysWOW64\Cicdai32.dll	Jqlefl32.exe
File created	C:\Windows\SysWOW64\Lccahg32.dll	Jgkdbacp.exe
File created	C:\Windows\SysWOW64\Bgkiaj32.exe	Aopemh32.exe
File created	C:\Windows\SysWOW64\Cmmehdam.dll	Hjchaf32.exe
File opened for modification	C:\Windows\SysWOW64\Hpabni32.exe	Hpofii32.exe
File created	C:\Windows\SysWOW64\Jlgepanl.exe	Jocefm32.exe
File opened for modification	C:\Windows\SysWOW64\Jjjghcfp.exe	Iqbbpm32.exe
File created	C:\Windows\SysWOW64\Plbhknkl.dll	Glengm32.exe
File created	C:\Windows\SysWOW64\Kjeqge32.dll	Mmbanbmg.exe
File opened for modification	C:\Windows\SysWOW64\Lqbncb32.exe	Lgjijmin.exe
File created	C:\Windows\SysWOW64\Ghjnkpdc.dll	Gpbpbecj.exe
File opened for modification	C:\Windows\SysWOW64\Cadlbk32.exe	Cfogeb32.exe
File created	C:\Windows\SysWOW64\Ehighp32.dll	Idghpmnp.exe
File created	C:\Windows\SysWOW64\Miofjepg.exe	Mjneln32.exe
File opened for modification	C:\Windows\SysWOW64\Pefhlaie.exe	Polppg32.exe
File created	C:\Windows\SysWOW64\Fmikeaap.exe	Ffobhg32.exe
File created	C:\Windows\SysWOW64\Iddgpk32.dll	Hgkkkcbc.exe
File created	C:\Windows\SysWOW64\Egjgdg32.dll	Albpkc32.exe
File created	C:\Windows\SysWOW64\Pmhkafda.dll	Iebngial.exe
File created	C:\Windows\SysWOW64\Kgffoo32.dll	Igfclkdj.exe
File created	C:\Windows\SysWOW64\Ekamnhne.dll	Klhnfo32.exe
File opened for modification	C:\Windows\SysWOW64\Cioilg32.exe	Cbbdjm32.exe
File opened for modification	C:\Windows\SysWOW64\Glengm32.exe	Gpnmbl32.exe
File created	C:\Windows\SysWOW64\Pigqjdgo.dll	Qaflgago.exe
File created	C:\Windows\SysWOW64\Dfefkkqp.exe	Cjnffjkl.exe
File created	C:\Windows\SysWOW64\Nfohgqlg.exe	Ncqlkemc.exe
File opened for modification	C:\Windows\SysWOW64\Bajqda32.exe	Bdfpkm32.exe
File opened for modification	C:\Windows\SysWOW64\Lgbloglj.exe	Lnjgfb32.exe
File created	C:\Windows\SysWOW64\Okhbek32.dll	Ckbemgcp.exe
File created	C:\Windows\SysWOW64\Cfapoa32.dll	Bkmmaeap.exe
File created	C:\Windows\SysWOW64\Lnldla32.exe	Lgbloglj.exe
File opened for modification	C:\Windows\SysWOW64\Kqbkfkal.exe	Kgjgne32.exe
File created	C:\Windows\SysWOW64\Fcpjljph.dll	Lcdciiec.exe
File opened for modification	C:\Windows\SysWOW64\Ijcahd32.exe	Idghpmnp.exe
File created	C:\Windows\SysWOW64\Kaehljpj.exe	Kqbkfkal.exe
File created	C:\Windows\SysWOW64\Ieoacg32.dll	Anmfbl32.exe
File created	C:\Windows\SysWOW64\Gidbch32.dll	Cadlbk32.exe
File created	C:\Windows\SysWOW64\Mlbkap32.exe	Mbighjdd.exe
File created	C:\Windows\SysWOW64\Knfeeimj.exe	Kmfhkf32.exe
File created	C:\Windows\SysWOW64\Glipgf32.exe	Gflhoo32.exe
File created	C:\Windows\SysWOW64\Npiiffqe.exe	Nfohgqlg.exe
File opened for modification	C:\Windows\SysWOW64\Npiiffqe.exe	Nfohgqlg.exe
File created	C:\Windows\SysWOW64\Elcgieob.dll	Nbnpcj32.exe
File created	C:\Windows\SysWOW64\Lknojl32.exe	Ljobpiql.exe
File opened for modification	C:\Windows\SysWOW64\Glipgf32.exe	Gflhoo32.exe
File opened for modification	C:\Windows\SysWOW64\Jocefm32.exe	Jiglnf32.exe
File created	C:\Windows\SysWOW64\Gjmgfljg.dll	Lcjcnoej.exe
File created	C:\Windows\SysWOW64\Anmfbl32.exe	Amjillkj.exe
File opened for modification	C:\Windows\SysWOW64\Ohkkhhmh.exe	Ohhnbhok.exe
File created	C:\Windows\SysWOW64\Lfmmaj32.dll	Glipgf32.exe
File opened for modification	C:\Windows\SysWOW64\Ihphkl32.exe	Igqkqiai.exe
File created	C:\Windows\SysWOW64\Gnlkgflm.dll	Miaboe32.exe
File created	C:\Windows\SysWOW64\Gicaifkq.dll	Iphioh32.exe
File opened for modification	C:\Windows\SysWOW64\Nclikl32.exe	Mmbanbmg.exe
File created	C:\Windows\SysWOW64\Klhnfo32.exe	Kodnmkap.exe
File created	C:\Windows\SysWOW64\Iamfph32.dll	Cfogeb32.exe
File opened for modification	C:\Windows\SysWOW64\Efepbi32.exe	Eiaoid32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
676	4972	WerFault.exe	371

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhjlnlii.dll"	Oklkdi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Igajal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oclkgccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqjkhbpd.dll"	Dpnbog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nelfeo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Efgemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idaiki32.dll"	Phcgcqab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lqppgj32.dll"	Bgnffj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hjhalefe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iqbbpm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oemefcap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Onmfimga.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hgkkkcbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lljklo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Efepbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqjmdflo.dll"	Knhakh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgcaaddl.dll"	Nhmeapmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddligq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hmmfmhll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oklkdi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hhdhon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ijcahd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jjmcnbdm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aokkahlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ohkkhhmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdkgabfn.dll"	Efgemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iamfph32.dll"	Cfogeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enabbk32.dll"	Elnoopdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lljklo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hflkamml.dll"	Madjhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edommp32.dll"	Emjgim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hebqnm32.dll"	Ibcaknbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdbpil32.dll"	Cjmpkqqj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kniieo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Knkekn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fpejlmcf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Glengm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ljobpiql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ifmqfm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jqlefl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mjpbam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amoljp32.dll"	Amjillkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjkblhfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abjfai32.dll"	Anclbkbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqopkcbn.dll"	Emanjldl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnnbme32.dll"	Gfhndpol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gmcdffmq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njfkbf32.dll"	Licfngjd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cobkhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cobkhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ffnknafg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Igqkqiai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clnedaem.dll"	Njiegl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gckdpj32.dll"	Efepbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ffnknafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pehbea32.dll"	Cioilg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogigdpmb.dll"	Hfcnpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbhfhgch.dll"	Kodnmkap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lcdciiec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjecpkcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifenan32.dll"	Jebfng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bknlbhhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbmjgpgc.dll"	Bgeaifia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ophpeg32.dll"	Kiejmi32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 1976	2908	66a8a9580e7db1c1bab562103bf5bb33.exe	86
PID 2908 wrote to memory of 1976	2908	66a8a9580e7db1c1bab562103bf5bb33.exe	86
PID 2908 wrote to memory of 1976	2908	66a8a9580e7db1c1bab562103bf5bb33.exe	86
PID 1976 wrote to memory of 5012	1976	Bgeaifia.exe	87
PID 1976 wrote to memory of 5012	1976	Bgeaifia.exe	87
PID 1976 wrote to memory of 5012	1976	Bgeaifia.exe	87
PID 5012 wrote to memory of 3828	5012	Bjfjka32.exe	88
PID 5012 wrote to memory of 3828	5012	Bjfjka32.exe	88
PID 5012 wrote to memory of 3828	5012	Bjfjka32.exe	88
PID 3828 wrote to memory of 1996	3828	Cpbbch32.exe	89
PID 3828 wrote to memory of 1996	3828	Cpbbch32.exe	89
PID 3828 wrote to memory of 1996	3828	Cpbbch32.exe	89
PID 1996 wrote to memory of 5108	1996	Cikglnkj.exe	90
PID 1996 wrote to memory of 5108	1996	Cikglnkj.exe	90
PID 1996 wrote to memory of 5108	1996	Cikglnkj.exe	90
PID 5108 wrote to memory of 3604	5108	Cfogeb32.exe	91
PID 5108 wrote to memory of 3604	5108	Cfogeb32.exe	91
PID 5108 wrote to memory of 3604	5108	Cfogeb32.exe	91
PID 3604 wrote to memory of 8	3604	Cadlbk32.exe	92
PID 3604 wrote to memory of 8	3604	Cadlbk32.exe	92
PID 3604 wrote to memory of 8	3604	Cadlbk32.exe	92
PID 8 wrote to memory of 2440	8	Cjmpkqqj.exe	93
PID 8 wrote to memory of 2440	8	Cjmpkqqj.exe	93
PID 8 wrote to memory of 2440	8	Cjmpkqqj.exe	93
PID 2440 wrote to memory of 4148	2440	Cgqqdeod.exe	94
PID 2440 wrote to memory of 4148	2440	Cgqqdeod.exe	94
PID 2440 wrote to memory of 4148	2440	Cgqqdeod.exe	94
PID 4148 wrote to memory of 676	4148	Cgcmjd32.exe	96
PID 4148 wrote to memory of 676	4148	Cgcmjd32.exe	96
PID 4148 wrote to memory of 676	4148	Cgcmjd32.exe	96
PID 676 wrote to memory of 3592	676	Dpnbog32.exe	97
PID 676 wrote to memory of 3592	676	Dpnbog32.exe	97
PID 676 wrote to memory of 3592	676	Dpnbog32.exe	97
PID 3592 wrote to memory of 4584	3592	Diffglam.exe	98
PID 3592 wrote to memory of 4584	3592	Diffglam.exe	98
PID 3592 wrote to memory of 4584	3592	Diffglam.exe	98
PID 4584 wrote to memory of 3764	4584	Gmcdffmq.exe	99
PID 4584 wrote to memory of 3764	4584	Gmcdffmq.exe	99
PID 4584 wrote to memory of 3764	4584	Gmcdffmq.exe	99
PID 3764 wrote to memory of 1296	3764	Gknkpjfb.exe	100
PID 3764 wrote to memory of 1296	3764	Gknkpjfb.exe	100
PID 3764 wrote to memory of 1296	3764	Gknkpjfb.exe	100
PID 1296 wrote to memory of 3480	1296	Gpkchqdj.exe	101
PID 1296 wrote to memory of 3480	1296	Gpkchqdj.exe	101
PID 1296 wrote to memory of 3480	1296	Gpkchqdj.exe	101
PID 3480 wrote to memory of 3096	3480	Hjchaf32.exe	102
PID 3480 wrote to memory of 3096	3480	Hjchaf32.exe	102
PID 3480 wrote to memory of 3096	3480	Hjchaf32.exe	102
PID 3096 wrote to memory of 1124	3096	Hhdhon32.exe	103
PID 3096 wrote to memory of 1124	3096	Hhdhon32.exe	103
PID 3096 wrote to memory of 1124	3096	Hhdhon32.exe	103
PID 1124 wrote to memory of 3468	1124	Hnaqgd32.exe	104
PID 1124 wrote to memory of 3468	1124	Hnaqgd32.exe	104
PID 1124 wrote to memory of 3468	1124	Hnaqgd32.exe	104
PID 3468 wrote to memory of 2808	3468	Hjhalefe.exe	105
PID 3468 wrote to memory of 2808	3468	Hjhalefe.exe	105
PID 3468 wrote to memory of 2808	3468	Hjhalefe.exe	105
PID 2808 wrote to memory of 4432	2808	Hkgnfhnh.exe	106
PID 2808 wrote to memory of 4432	2808	Hkgnfhnh.exe	106
PID 2808 wrote to memory of 4432	2808	Hkgnfhnh.exe	106
PID 4432 wrote to memory of 1696	4432	Hjlkge32.exe	107
PID 4432 wrote to memory of 1696	4432	Hjlkge32.exe	107
PID 4432 wrote to memory of 1696	4432	Hjlkge32.exe	107
PID 1696 wrote to memory of 3988	1696	Igqkqiai.exe	108

C:\Users\Admin\AppData\Local\Temp\66a8a9580e7db1c1bab562103bf5bb33.exe
"C:\Users\Admin\AppData\Local\Temp\66a8a9580e7db1c1bab562103bf5bb33.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\Bgeaifia.exe
  C:\Windows\system32\Bgeaifia.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SysWOW64\Bjfjka32.exe
    C:\Windows\system32\Bjfjka32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Windows\SysWOW64\Cpbbch32.exe
      C:\Windows\system32\Cpbbch32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3828
    - - C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1996
      - C:\Windows\SysWOW64\Cfogeb32.exe
        
        C:\Windows\system32\Cfogeb32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\Cadlbk32.exe
        
        C:\Windows\system32\Cadlbk32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3604
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\SysWOW64\Cgqqdeod.exe
        
        C:\Windows\system32\Cgqqdeod.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2440
        
        C:\Windows\SysWOW64\Cgcmjd32.exe
        
        C:\Windows\system32\Cgcmjd32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4148
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:676
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Windows\SysWOW64\Gknkpjfb.exe
        
        C:\Windows\system32\Gknkpjfb.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3764
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1296
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\Windows\SysWOW64\Hhdhon32.exe
        
        C:\Windows\system32\Hhdhon32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        C:\Windows\SysWOW64\Hnaqgd32.exe
        
        C:\Windows\system32\Hnaqgd32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Windows\SysWOW64\Hjhalefe.exe
        
        C:\Windows\system32\Hjhalefe.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Windows\SysWOW64\Hkgnfhnh.exe
        
        C:\Windows\system32\Hkgnfhnh.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2808
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\SysWOW64\Igqkqiai.exe
        
        C:\Windows\system32\Igqkqiai.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Windows\SysWOW64\Ihphkl32.exe
        
        C:\Windows\system32\Ihphkl32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3988
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1272
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4296
        
        C:\Windows\SysWOW64\Ihdafkdg.exe
        
        C:\Windows\system32\Ihdafkdg.exe
        26⤵
        Executes dropped EXE
        
        PID:4220
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        27⤵
        Executes dropped EXE
        
        PID:4596
        
        C:\Windows\SysWOW64\Iqbbpm32.exe
        
        C:\Windows\system32\Iqbbpm32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2752
        
        C:\Windows\SysWOW64\Jjjghcfp.exe
        
        C:\Windows\system32\Jjjghcfp.exe
        29⤵
        Executes dropped EXE
        
        PID:2628
        
        C:\Windows\SysWOW64\Jjmcnbdm.exe
        
        C:\Windows\system32\Jjmcnbdm.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1320
        
        C:\Windows\SysWOW64\Jqglkmlj.exe
        
        C:\Windows\system32\Jqglkmlj.exe
        31⤵
        Executes dropped EXE
        
        PID:4324
        
        C:\Windows\SysWOW64\Jjopcb32.exe
        
        C:\Windows\system32\Jjopcb32.exe
        32⤵
        Executes dropped EXE
        
        PID:4636
        
        C:\Windows\SysWOW64\Jjamia32.exe
        
        C:\Windows\system32\Jjamia32.exe
        33⤵
        Executes dropped EXE
        
        PID:4828
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3264
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2720
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1884
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        37⤵
        Executes dropped EXE
        
        PID:2864
        
        C:\Windows\SysWOW64\Kgjgne32.exe
        
        C:\Windows\system32\Kgjgne32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3564
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2704
        
        C:\Windows\SysWOW64\Kaehljpj.exe
        
        C:\Windows\system32\Kaehljpj.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4072
        
        C:\Windows\SysWOW64\Kniieo32.exe
        
        C:\Windows\system32\Kniieo32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5060
        
        C:\Windows\SysWOW64\Kecabifp.exe
        
        C:\Windows\system32\Kecabifp.exe
        42⤵
        Executes dropped EXE
        
        PID:3276
        
        C:\Windows\SysWOW64\Knkekn32.exe
        
        C:\Windows\system32\Knkekn32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1100
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        44⤵
        Executes dropped EXE
        
        PID:4312
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4532
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        46⤵
        Executes dropped EXE
        
        PID:5056
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        47⤵
        Executes dropped EXE
        
        PID:2336
        
        C:\Windows\SysWOW64\Mjneln32.exe
        
        C:\Windows\system32\Mjneln32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2148
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        49⤵
        Executes dropped EXE
        
        PID:3520
        
        C:\Windows\SysWOW64\Mjpbam32.exe
        
        C:\Windows\system32\Mjpbam32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2416
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1800
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1096
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        53⤵
        Executes dropped EXE
        
        PID:5104
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        54⤵
        Executes dropped EXE
        
        PID:1152
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4544
        
        C:\Windows\SysWOW64\Njiegl32.exe
        
        C:\Windows\system32\Njiegl32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1624
        
        C:\Windows\SysWOW64\Nhmeapmd.exe
        
        C:\Windows\system32\Nhmeapmd.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:544
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        58⤵
        Executes dropped EXE
        
        PID:4228
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        59⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        60⤵
        Executes dropped EXE
        
        PID:2164
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        61⤵
        Executes dropped EXE
        
        PID:4728
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        62⤵
        Executes dropped EXE
        
        PID:1492
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        63⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        64⤵
        Executes dropped EXE
        
        PID:3044
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4928
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        66⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4776
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        68⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2368
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4272
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        71⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\Pifnhpmi.exe
        
        C:\Windows\system32\Pifnhpmi.exe
        72⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\Pcobaedj.exe
        
        C:\Windows\system32\Pcobaedj.exe
        73⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        74⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1872
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2944
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        77⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2972
        
        C:\Windows\SysWOW64\Acokhc32.exe
        
        C:\Windows\system32\Acokhc32.exe
        79⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        80⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        81⤵
        Drops file in System32 directory
        
        PID:4632
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        82⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        83⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        84⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        85⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        86⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2280
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        87⤵
        Modifies registry class
        
        PID:392
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        88⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        89⤵
        Drops file in System32 directory
        
        PID:1720
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3432
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        91⤵
        Drops file in System32 directory
        
        PID:4524
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        92⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        93⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        94⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:756
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        96⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        97⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        98⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5316
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        100⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5360
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        101⤵
        Drops file in System32 directory
        
        PID:5408
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        102⤵
        Modifies registry class
        
        PID:5460
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        103⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        104⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        105⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5656
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        107⤵
        Modifies registry class
        
        PID:5700
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        108⤵
        Drops file in System32 directory
        
        PID:5744
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        109⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        110⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        111⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        112⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        113⤵
        Drops file in System32 directory
        
        PID:5964
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6052
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        115⤵
        Drops file in System32 directory
        
        PID:6116
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        116⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        117⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5196
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        118⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5384
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        120⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        121⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5652
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        123⤵
        Drops file in System32 directory
        
        PID:5752
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5820
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        125⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        126⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        127⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6076
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        129⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        130⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        131⤵
        Modifies registry class
        
        PID:5348
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        132⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5624
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5736
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        135⤵
        Drops file in System32 directory
        
        PID:5780
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        136⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        137⤵
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        138⤵
        Modifies registry class
        
        PID:2672
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        139⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        140⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        141⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        142⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        143⤵
        Drops file in System32 directory
        
        PID:5256
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        144⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5900
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        146⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5776
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        148⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        149⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6196
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        151⤵
        Drops file in System32 directory
        
        PID:6256
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        152⤵
        Modifies registry class
        
        PID:6288
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        153⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        154⤵
        Drops file in System32 directory
        
        PID:6396
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        155⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6484
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        157⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6580
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6624
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        160⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        161⤵
        Drops file in System32 directory
        
        PID:6712
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        162⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        163⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        164⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        165⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6936
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        167⤵
        Modifies registry class
        
        PID:6972
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        168⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        169⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        170⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        171⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        172⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        173⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        174⤵
        Drops file in System32 directory
        
        PID:6312
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        175⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        176⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6612
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6648
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6372
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6776
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        181⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6916
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        183⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        184⤵
        Modifies registry class
        
        PID:1956
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        185⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        186⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        187⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        188⤵
        Modifies registry class
        
        PID:6360
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        189⤵
        Modifies registry class
        
        PID:6528
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6600
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        191⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6804
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        193⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7024
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        195⤵
        Modifies registry class
        
        PID:7152
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        196⤵
        Drops file in System32 directory
        
        PID:1712
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4528
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6380
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        199⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        200⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        201⤵
        Modifies registry class
        
        PID:6924
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        202⤵
        Modifies registry class
        
        PID:7124
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3496
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        204⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        205⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7052
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        207⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        208⤵
        Modifies registry class
        
        PID:6284
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6904
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        210⤵
        Modifies registry class
        
        PID:7096
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        211⤵
        Drops file in System32 directory
        
        PID:6636
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        212⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        213⤵
        Modifies registry class
        
        PID:6328
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        214⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        215⤵
        Drops file in System32 directory
        
        PID:7232
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7276
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7316
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7360
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        219⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        220⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        221⤵
        Modifies registry class
        
        PID:7488
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        222⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        223⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        224⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        225⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        226⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        227⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7768
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        228⤵
        Drops file in System32 directory
        
        PID:7808
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        229⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7900
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7944
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        232⤵
        Drops file in System32 directory
        
        PID:7984
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8020
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        234⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        235⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        236⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        237⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        238⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7308
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        240⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        241⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        242⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        243⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7676
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        245⤵
        Drops file in System32 directory
        
        PID:7720
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        246⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7864
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        248⤵
        Modifies registry class
        
        PID:7932
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        249⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        250⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        251⤵
        Modifies registry class
        
        PID:6964
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        252⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        253⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        254⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        255⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        256⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        257⤵
        Modifies registry class
        
        PID:7840
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        258⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        259⤵
        Modifies registry class
        
        PID:8052
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        260⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        261⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        262⤵
        Drops file in System32 directory
        
        PID:7472
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        263⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        264⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7996
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        266⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        267⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        268⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        269⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        270⤵
        Modifies registry class
        
        PID:7192
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        271⤵
        Drops file in System32 directory
        
        PID:7576
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8132
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        273⤵
        Drops file in System32 directory
        
        PID:7528
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        274⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7416
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        276⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        277⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        278⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 416
        279⤵
        Program crash
        
        PID:676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4972 -ip 4972
1⤵
PID:4328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bgeaifia.exe

Filesize
72KB

MD5
ba59036a6d54d6e686c5444600b7698e

SHA1
7bf4bf9d66de24569fbda67c0835605b67aa6e91

SHA256
6535b8ce55425c98fa77d00fe911a657753564bf0dc1a54737ace10ad13ea015

SHA512
dabe2571110e468584bd3da85f857e6dc0e9de3ec0ac8e3ab935c420f671b626a722460c82e16a5ee3d46f56fae9a1421a946778e9169b637f6394b3e0028436

Download Submit
C:\Windows\SysWOW64\Bjfjka32.exe

Filesize
72KB

MD5
1ca9e3dc51d5558fd0be5037b842202a

SHA1
80d2b10fcbb17de4933afaf66521464c9c9f6a04

SHA256
0a22689ae907946eb36bdf8706588cf615bf128e7b277cb5dc3d5b5981068f11

SHA512
c45d373dabad4d850908b86ca66f1d392788b65b2e9e4662065ae7e07698a0c8234b84ebf5f6604feb78a06e9b75ea1126fcdff53f1df65660a1cdeab8aca5f5

Download Submit
C:\Windows\SysWOW64\Bllbaa32.exe

Filesize
72KB

MD5
0892346e993529008309fa886ca7db1d

SHA1
6315bc69d66dc237c25432a1c5fa3c11a69c1288

SHA256
e03761ec5700a95cb8b83f92a19fe6e9710c20ad69d7be7cbc73abaa88f1cabd

SHA512
ccb640dff71df265a9c7a60e13b94229ed9958913a97e3ccb65b5cfda0867ff4c1ed626d6e15ecffa4e07827652189ba043659811da8f359d24f8f52a9cc99a1

Download Submit
C:\Windows\SysWOW64\Cadlbk32.exe

Filesize
72KB

MD5
01d5675a8ba6ec335466261bec54f2a4

SHA1
f086ef9724cfb0bd3d532a631fc391346691f912

SHA256
c41d1a9037a7b82bee454409f2ab64fbb8c75b59d2a1731fb1f6ebbdc79388b2

SHA512
1b6c1a724930ea5abedae53f446ba281765e212471c9a2059f1d7d94e8f52cf9059346c70a640426ea7bb17ef31ff9ffb3830024ce092e566641d0a74c165cd4

Download Submit
C:\Windows\SysWOW64\Cfogeb32.exe

Filesize
72KB

MD5
1a68f50f6b64cfa2bd15f11cd5d2226c

SHA1
66f2d574fd353eba03bdec528b66ae68dbb3fce1

SHA256
4f9a2c73fe757126f1db2c96e4e743682ef402829fe75c64b340ad8658fffa81

SHA512
4ff6f88ac74d27c03e42b7c7694e75510f07835597f181818340333b4b8c8cb04426e6becc796b90253163a2c42e9e4542692f4519a2b89f8daecd1c46b09093

Download Submit
C:\Windows\SysWOW64\Cgcmjd32.exe

Filesize
72KB

MD5
7b40ca806414e058ee30e1272b998993

SHA1
aea8d5c59dbfda8e5b0bd0523fc2ee73cbbc64de

SHA256
dcbd2aba57aa6d945f6263ca21d96c4ae066e08cc1f159ad3633a49d54b0e7ef

SHA512
40ec042ce67fe32bc185cccec4ed82d6b830f481ba4e5af95955779e1b9abd6d7bb3bdf3dfd95a1dda35e5e7f5a822929c0715b061ae358b78f73ff0e4b26e46

Download Submit
C:\Windows\SysWOW64\Cgqqdeod.exe

Filesize
72KB

MD5
d27046e8507a989a3706f66e3fa14231

SHA1
fa55c7f723e701ba4378a0041249b559558464a1

SHA256
8525e9e7eb830c9908b78bbc7f089a626278ffd69fc004b9a12bdcb08d8483f4

SHA512
8ddcfefbc305aef9a4585d662d8d57b74768ad9c8a794bcf66ce6ceec1ae9de599971935abbd78850fdf91ed513a3b024a38e5ebd692368a2773b3aaf64e9c05

Download Submit
C:\Windows\SysWOW64\Cikglnkj.exe

Filesize
72KB

MD5
7892dc607d24f434fbbc0592aeae82ac

SHA1
10cfc5edd5299b268a5a1b3a091df9252278019a

SHA256
18137774fce95641ecd3b4537768a4f3043f4966e27cf81fad803f735fde4865

SHA512
5bb18746500ddbd5d37ba4e62222f067084ca7a9820ec0c38c679937589401362a08bf2529e94532e07aa00fd8beaeb143c435ac9447102af5be11d4b52ce77d

Download Submit
C:\Windows\SysWOW64\Cjmpkqqj.exe

Filesize
72KB

MD5
1c0431116c6ef1ecc074eb14de3e2333

SHA1
e0288db0e9c36666a00aea217e620b4924f28fa3

SHA256
aa426f1b125373b3371e57a12f5154ebee0a275880be216537db9ecd96fca7dd

SHA512
05714175d69983a71c52a24e2a76c3b245246a87f91b586e11749de45c62b51944962b53347a753bcf609e424d6da54783bf7971034a7f261317d3340ed2ccc2

Download Submit
C:\Windows\SysWOW64\Cpbbch32.exe

Filesize
72KB

MD5
ebe2daadc31025f45472ba47aa166ca0

SHA1
c7dce13dd11d783e98092d7ae96fc3afcf7726f5

SHA256
241de310d4d988c325f0971f474368dc42d2231168cdb7f8918880a5dc6d8ba9

SHA512
f93eaa52aa2605a24ccba89de3d072e1a9e5190a91bc80ae7d6efe79315afab96bfc6977b20eeff9178928074c9e6bc3421f95b0a25aeb375e5cc326c665b00d

Download Submit
C:\Windows\SysWOW64\Diffglam.exe

Filesize
72KB

MD5
5f3cdcbb4b2e031a305db6dbf33f7fc2

SHA1
07fe30ff106a64b1766a40caab89c6928d8b328a

SHA256
51edb5e310790240e30d9dac10738e3a52ac2a717c7c1b754e71952b8513abe8

SHA512
a2785f99bc5144c2c208485b6887012c52f8856886afaeb693a8b6bdb676c801477eae295552918e9107b6b6689662dc9691abf3250983fcfab0a511aac1333f

Download Submit
C:\Windows\SysWOW64\Dpnbog32.exe

Filesize
72KB

MD5
6bcc6e5fb6d0fa1103393dc76d7fa50e

SHA1
02525f4c7734dc33f7ad8c837f33630b58aa37f9

SHA256
d0d2193924b6e8e3a9312ad33841c79acfb5076ec33bc91f558efe690fe0add3

SHA512
b8c9fdcfcb4b426e79e7165aacec5e4f26764b38af28f353a56dd5f1297f2c3b44c5f722558ce9c372d563d495c23ce72cd5050028936e2976c4c783203a944f

Download Submit
C:\Windows\SysWOW64\Gfhndpol.exe

Filesize
72KB

MD5
0667931e285a4601604d89563feb4c21

SHA1
420c34ea7b08fdff6006867421d33e2e9fd3a47f

SHA256
b7613f9b4b557d2364525cb7d857d33afe35d479d62b66c3be5b4e23f2da551a

SHA512
efd8f95ce4e21d38b9dd6194513e04598a5f126f765a001905fc6496a652eb5191aa8210c8538200b53c3e58db043da1eb7f7dd31b4b4ae0fa9869e7c69ac4a8

Download Submit
C:\Windows\SysWOW64\Gknkpjfb.exe

Filesize
72KB

MD5
73ccd11063ca5a9b6d03772c90fc4043

SHA1
1cb1dbc97f79af869c1d32004f6b3121edae8180

SHA256
e75565d4d6a6a77bf5d164f1767daf51f51d0a51169d82f65e315a257bfbc5c2

SHA512
9b61758d3dc49e268e1f902dba7bb3f1bbb7149efb0c4e27337519c1c642eb5b12e3d9913f447c038b98db7a5e580a872797a29440567e8344467cbbeac183e0

Download Submit
C:\Windows\SysWOW64\Gmcdffmq.exe

Filesize
72KB

MD5
a06d0e5472a3995998b13ca813d8adec

SHA1
9b421f27cd7e3c45a868edf9c25f528e10977a5d

SHA256
81cc6ad809a5b28f5cbedbc1804162d6fc36d365c9ee389d7abc18156413f651

SHA512
d8446725b6942e7fc86a6859e469960b9adcba77fcad499025cd2615aaccd71bda37feb41ea33740979a954c631f918b3b6e0f20fa95181377f6c166b1d760ee

Download Submit
C:\Windows\SysWOW64\Gpkchqdj.exe

Filesize
72KB

MD5
e2be26f1d9e850020f789d61a35fd464

SHA1
c0e7de5a28daf65d8d95ac84a8d8da11b4eecf0e

SHA256
269718b9b470480ac19dd5c0ed929a6811ce72f1ee9a924fe6b19d8aa8dd1405

SHA512
8667993f70a05fb61447fc76478c9fed24561bb9490e35739427b479a2bf390fdfed872a6c6d94fdf76304bc1bc84bf1dd80bec194c90ab2c645cfab92f3ba5b

Download Submit
C:\Windows\SysWOW64\Hhdhon32.exe

Filesize
72KB

MD5
dfa3d674d23668aaf20549fb70d50de0

SHA1
418e4827996663a54edf1d29aa85f59607230924

SHA256
848de102917ac34053a33836020e995c1cd2db39b95b74cb5a2e932b5d1024ea

SHA512
f58a1870bb9c90457dc6e49738a565d433002b5fd7130d4e3a208316ee42c822345d298ecc726d42f604239bb5487d5cb32782ff41dab77579f45375b1906a70

Download Submit
C:\Windows\SysWOW64\Hjchaf32.exe

Filesize
72KB

MD5
3ed34912ee21c3b9233d06a66eb621a0

SHA1
f532bd87625cf4a80a57007c4f40e5184d142678

SHA256
ba9ccf61d248a8d09720c07f3ad3aa01e7a66f0a8d20bc048f17cda936104a39

SHA512
0dbe959f5b5cd55a425e112d74d7a69f56ea32d6c42e2e85a7ed1661d21c4d3428ddca511f799f7387e47ddbd81aa053b23a9fa7842ee1dc308a0c5547fb741a

Download Submit
C:\Windows\SysWOW64\Hjhalefe.exe

Filesize
72KB

MD5
58baec00025cff978f5d2de7bb2a7b33

SHA1
3c7b574e3c9fdc26554fa22bdf2141d68c8b0765

SHA256
0a24294800ee8791268c66ac55a598e8d7d3d5955cf688ed7a39cc4e29dfd8b6

SHA512
0f63091513cf858b8248ba314ed56138f4ef4d82eaf49524642d5cd0449295eafe46f1d6bd62ba87680ba371f4b11ceaa60bc1fa7fe614d37b4146e56b061396

Download Submit
C:\Windows\SysWOW64\Hjlkge32.exe

Filesize
72KB

MD5
d2dc0869b90171880f345054186a3158

SHA1
98b687f65b5ad7a2934c7e2b026c1c5bda322bfa

SHA256
7b75dcaa450fc4270d053d8f43ff7b7c322d4c64c0b40be5aa73d872f7f20643

SHA512
48de5aafe5cbd6eeb4b1e3f95964e0b1f577a13e8a7654a77d1a6397582f51114df1312bca6a0654e7f1c401030b93ea79e002907c71d3c2d8b73c6ec635b0ff

Download Submit
C:\Windows\SysWOW64\Hkgnfhnh.exe

Filesize
72KB

MD5
aae0d559fc900e5066ca7187fbc8dbdf

SHA1
558e44e68964b396afcf57748955a3f7ac44afaf

SHA256
56abe3c8e930dc877be938310f5526b5e4eefd569a3d06133b3391c19e56cdf3

SHA512
e290a7106c624ff7aa5dc74669ac2845750ccef845f467ddcf3f23c9c476441020a81a42336161ab54bb87a27bb066514019f3f36bef96d0d812df1dc80c2a81

Download Submit
C:\Windows\SysWOW64\Hnaqgd32.exe

Filesize
72KB

MD5
dbfa467809acf1f89fce76f1603175a2

SHA1
246d6dbd7403bf895d10a2cadaf54cb158b0d057

SHA256
08f1cef3ebf021ebd64c6166a940f48fa8b40af766db21effa04efa1e1f486a6

SHA512
9ad82f496d2d3b20763e9d55aa78e1cd99bcc5adb5bd9570e6d2b56abd50f338f6a777c38c213eae1b5aa9e81c54bb4788047b2ca13ad10412810acfeb71f23e

Download Submit
C:\Windows\SysWOW64\Idghpmnp.exe

Filesize
72KB

MD5
c2698535f003df8a9af8994dd532c493

SHA1
47c460dc31da9933fc7981d13aef585e531898d0

SHA256
592a9679523b452e0c68cd1400a381a07544b922e2f1a644d26e611c064aea72

SHA512
f986a4be9c7f20056b1467c16d0ed66c60c94a493d1c24c4e15459744d28f6001b2b8c24fd8da6361c1a74950a042bde0d46ebf6f81771f69753b420060d1b99

Download Submit
C:\Windows\SysWOW64\Idkbkl32.exe

Filesize
72KB

MD5
a19e5c419d29f5a9996dafd176440dac

SHA1
bbbd6d3402957b0c948a995ac15d3886c0fbd657

SHA256
95e1d5ef0ca881fa0099d4f493c5af9befb6559ad2b6ba398acfd0390bd5f642

SHA512
5321120db328c4e6089171a2a0fc6c244b19214abaf3d145161eb426a3bb308b6eefb452596562424699693b077cc17f75d47d874244fe20f62010de967d162f

Download Submit
C:\Windows\SysWOW64\Igqkqiai.exe

Filesize
72KB

MD5
660362810679a5f00a287eeac7d6f45d

SHA1
3267988d21afc310c1ee3e7180d9cabd28221de9

SHA256
cd75e022e0bce517f214b9bdd5a3e539fbc418b121435eeccd35ecafc4fa96bd

SHA512
bdcd5c1a4fb9a94f008961aca55e491c173231aa5a116a23bee7973bbe5ce431d7ef4e0cd605a770799bd61d4c081ca4e33951ccf1aa5597546526d9294e0e34

Download Submit
C:\Windows\SysWOW64\Ihdafkdg.exe

Filesize
72KB

MD5
0c6447f8803d2d8df074de57f6819f2c

SHA1
f99fa8e3df96867199a1261ee45f92822d0f6ee3

SHA256
376549aa090cb0948a297720fce062a1b6a2a68e0cdb57f297cba631cd5f0481

SHA512
3a8967c760fbf128078b987a31bffcbe7e6a095bac530f4fe0c7763c3eced13f0046580f6532587093fb065e98aee41ecb819b4c96b0aed089ecfe234c5a315f

Download Submit
C:\Windows\SysWOW64\Ihphkl32.exe

Filesize
72KB

MD5
35506af6e4d5b824241936277759279e

SHA1
157204a036b6dbd1ba352ffa522fad14c28fbe7f

SHA256
c0fb0c70d4d5f75fb69a66ff1b31798e5512a909a80d547ccc868ad6b6467f4f

SHA512
e931c39d6a5029135d7d44d068b01b1fa20a6801cd163073191325d75690889362e965a61a47acaab2eb29655cffbaee26ebe4c2b1cd1b2a7c5ed604edcf284f

Download Submit
C:\Windows\SysWOW64\Ijcahd32.exe

Filesize
72KB

MD5
a5bace44c879d1c5cd2b3e5c872830c2

SHA1
bf24a81f32a0c331e80df92d46005107a93d255e

SHA256
b755825b80d23fbc36fce650c197c9659a12864e1ba449e6412048e28a916473

SHA512
527550bde8ada0da953c1c08506afa2cecef80cf61e3f7d7b33e0a9b5d26e984dac5732ab9d8ba380cf5201a9a08658804d567baccd3374bf4132f0731c50b8b

Download Submit
C:\Windows\SysWOW64\Iqbbpm32.exe

Filesize
72KB

MD5
f8e6370ad4805bc158f1dd42d665a2e6

SHA1
d18d0026b0f3d874285017ad8bca95e69fa573b6

SHA256
7618ec75cd8804aa7fd8318dc6f40c960a6c93ec8d2c2072c60214cbf7da2348

SHA512
603edb55844e5b4498f3489c98199e338af951b9f95e0a9af37efde9c9f473f859695e9b2be8f348f90a4e1b4b829867a69c1b549d4e08a94df714417d2672ba

Download Submit
C:\Windows\SysWOW64\Jjamia32.exe

Filesize
72KB

MD5
11128cf5f0b778fd3975eab01ec4f404

SHA1
991c5075c3e6d5753c39b5c8fdd0bb19e24333e6

SHA256
3e212e219aa7d95d11b049e9b494bcb1744e8fbdbebc1ba4a194e07ee8d16362

SHA512
2b4fe510b7c7d33406dea2b2978a3d6fac20812d8920a4e4896e25f5539d2abab389a5a1ec93eca511af643a4d5c93237080f6316b91da83d9cc3d191da5bdb9

Download Submit
C:\Windows\SysWOW64\Jjjghcfp.exe

Filesize
72KB

MD5
77b5ca0f0c912c884e4777bb168df028

SHA1
c4a04dfcb9f418623e7e43915dc328112e7482bf

SHA256
940ddfa121447dc09cbe4f50ea73a736b2762b15c3a0ad91da0418f4c482f3cb

SHA512
e77a2acc61c869260a8a8ab3aafc789af5759567a1bdaec5cfe8d93dff70aa21ba9e41209f61b43bf246b9b39568c1f40d98302c4bc89c140af4275fb63af9b9

Download Submit
C:\Windows\SysWOW64\Jjmcnbdm.exe

Filesize
72KB

MD5
8c794e39f8132f256e5c012a0eb4e7c7

SHA1
fcb0b0d44953bc4c08df815304ed6a7d9b00ab41

SHA256
3e4f3d5cf9044d969011c41ea78bd13b79b020386ab0ba94f1dc5c5ef5a32de2

SHA512
a07f8daf875a880baed58f340c771d0c40b82acc7a4f78fe69d1c21c2e18a4a8ddb2fb88f6bbfd169f4fa6f4805a7ead775ea699c6b8fb0a610b7d8634911aca

Download Submit
C:\Windows\SysWOW64\Jjopcb32.exe

Filesize
72KB

MD5
e043250b70a49aa07dd698a10996a96a

SHA1
0bcf4ceb8bd60fbd20a1203e41f72e3211366dc9

SHA256
88e0deac203a0d8029a21334f3ea09d074dccf6bfc64a3b609eb3b8d9d49f916

SHA512
2fcbe91926baf29ae84ff099506028bb4299ce368e7f1fba1b66da9aec069c3264cd48c55f22f27a5513f5fdf6b9bcb2eb5edfd0dda63a4473b85d6d1c239361

Download Submit
C:\Windows\SysWOW64\Jqglkmlj.exe

Filesize
72KB

MD5
1128af134958eaf34caf6d35997bc481

SHA1
eeaf9f7ac53a4e398915fa842771ff211dfd9ec0

SHA256
0545026744f9785a96432b0980be9e57910a15c5f4bd065e093f23a415f00fca

SHA512
bcc81e51f654091b0b571e82969da963172a7106cc570b98a50e7f62cf9fe33f29a47707069c3457d2be5e9f7d3229c1c11c07c88acb6ea9b8def2fcb8e09476

Download Submit
C:\Windows\SysWOW64\Kaehljpj.exe

Filesize
72KB

MD5
4adb246fa918a0186e4f6c69168aa35d

SHA1
96ea24f3713df3903c627ba239bb25a2ec46fb3e

SHA256
8e9edb60c4413bf3d2beac4aa985afa3bfa4395ed28501b4bddfddf06ab1e8cb

SHA512
1856856edb71e82d35e4bead01e04773a5219b7cb521b8d7cf1d4e0cb35d01cd1e5b45f18e0627427f02fa955d94795364a5577a842c25494fbc48d7864f5fa0

Download Submit
C:\Windows\SysWOW64\Kcllei32.dll

Filesize
7KB

MD5
6ba487d204022add1501da4325e40251

SHA1
1c104525b5e5fb4a7b2c3a18832fe99e80e43df4

SHA256
6d3a4154c370ef6de40e92e564ab1bdd39d44dc45157bd81aef1f4b6f8cb55e6

SHA512
c700f5179049b7ecf271e67dfd3c34aa7cd9ec1907adfac46cd80942e079f4df577d65d514dcd4070ae1d3222c6b67c8fd431506646298f9f8f3cc4437419c5e

Download Submit
C:\Windows\SysWOW64\Kjgeedch.exe

Filesize
72KB

MD5
0ebd03717bd19785394ecead82f3ca37

SHA1
87ef8f7dfafdd2bd39b8a4c7341d848f774a3fe7

SHA256
0707233c31e327bd7b54800b13c1d151a8f565861ec8dde6ff30f29d1a66c4af

SHA512
3d37773895495d31700332d9b1cf46e3c983a5e61b594fec7c5d0a76ddd6d632fca03128bbda5f0aebe80a136ae2d662c751fd658d9a28a5f74030637aa2d8b3

Download Submit
C:\Windows\SysWOW64\Knkekn32.exe

Filesize
72KB

MD5
b7a42485202ea5e74cbb51d9b139c62e

SHA1
9913167ed9480e8e0dd29ab5f3f5aca90931990d

SHA256
8492a83a60ea7bc6fdb23075422c192b4556acdfc40de5167fa9f1c48038c712

SHA512
54c98ff421dee018f4fc814befafe6c98262a04d0e6fd7dcc17a459b8d503afb11fb30a0e46540773f47c30bc69d39344d43abba9808c870704351bc0848a8b4

Download Submit
C:\Windows\SysWOW64\Licfngjd.exe

Filesize
72KB

MD5
a3bf32a297d685dd6170bfd79c608972

SHA1
1a66409804baf3b64ff9e2c4639593cab7a4c35c

SHA256
69d64ff665baff10213a7ecc277e7aed266f2b1aaa241358b871011f1bf1971b

SHA512
bee21e1afc79ebba65a8cd78856f6828168e5ef34832255a46a7a6da008ad956156b8fb2632f414de7a0b47711326a32e69c2a1653f685cd55e209a6f86f8996

Download Submit
C:\Windows\SysWOW64\Ljkifn32.exe

Filesize
72KB

MD5
5200b58f49ad76e9b6b7306bf8f8b9e5

SHA1
fabfdb65c878dfdb6243a52009c2f023f9d028a8

SHA256
69652e9d18f61d1dcfc7324f0df488b625ec5599c5e7fb3d80aa3010ed4aa7a5

SHA512
733f4259b04869feeb1b7f5f66ff5154b9f65b7bbdee1ce42b64d6097ffa65c843860617d3ed23b63eddfbd9bd63d1368dd21a2854c9600efed7f0f70930d9cf

Download Submit
C:\Windows\SysWOW64\Malpia32.exe

Filesize
72KB

MD5
200a8748472982b48580e59a5157a60a

SHA1
8e47d712f955a7a5f1e3d73f1057a44d71638585

SHA256
2d6c5e94260709eaa5f4ba40c2750f510a8053d415132faa9a471d8247c07e6a

SHA512
bc509da6d62eb46958c4417a96d4554f5ca9de60db8c9df92fbfb23bd62d5b7c87a3ed1398b0a80c14b6b7c5d505353c5e802f8e78cacf7c29b4fe82836d6bde

Download Submit
C:\Windows\SysWOW64\Monjjgkb.exe

Filesize
72KB

MD5
55091e3ff563373d70a0198f2f9c9ef3

SHA1
59244e00aa38a9a96537e4babc87be11eb555add

SHA256
71b407c1b7d80304aeeb0b36d2fb2a6de0ee8e022a0a152eda457e63a993a40b

SHA512
9f99dd24a551a2c27487553e4a993b8f3cd000b4597cfba88fc505fc31e32306ab48c73aaf5c17b623d4f7988450e3463b363caaf3be2873c96a069c229298e3

Download Submit
C:\Windows\SysWOW64\Njiegl32.exe

Filesize
72KB

MD5
7ed2d0de6d65a2f1511c45bf13c1cf47

SHA1
80d4d93c1ecbed39e37178f15be07d8402d04e87

SHA256
6566c4b13358bcf27a3910b9ef3d8f9a6d5293237dd7ceb745eacfb1e8356eeb

SHA512
6c3a5a03ac700677b2bcb81255fb0dfa29cda64bd3ffab456e3f03ed0c3e9172268956a36061bb4050196675946aff1bf9aa8254f2e345dcc10d6f59ca03fd28

Download Submit
C:\Windows\SysWOW64\Oklkdi32.exe

Filesize
72KB

MD5
3177847abe4eff3684f25b6cae1b4c67

SHA1
e1c47ee8c0e6812c2bae9a45da27abe4f7bf0c81

SHA256
cd445ab87a7cfcc7d098313b6565608ac2683ac61e43205b551d6628eec65a25

SHA512
2e7e7b71989615b42a746778b73f6fdf20fd79224d2d78a657733e49b0a6284c513d425962ccf575038c8af72d5b1eadd8c886511e3c7de2b26de84ebdec1ec2

Download Submit
C:\Windows\SysWOW64\Ooqqdi32.exe

Filesize
72KB

MD5
7a3a0071b92263e61ccd138e7be0fafa

SHA1
ac95156671172df5a1705fbcf484ccbac2c3192b

SHA256
9ad3b909678d043de50a9b5ba8d375cec1f84d826b67c2c7c3b2f9583ae11718

SHA512
c7e97e77695dfd532b982f5ddf2a148486207001e16c0ea43c625def1254ec736f7b6bdb0b3719a46cf5a412a17250e27f832c1fc43703ddf8cf86362e4d82ed

Download Submit
C:\Windows\SysWOW64\Pcjiff32.exe

Filesize
72KB

MD5
e6b78df176d899fd57044fab44ff370c

SHA1
3c3fb9583b0824e92163b349692551d2e4b8b560

SHA256
a9be3184ecad963d8f9099961a15b9ca4cdc24032bce99ce30b5e98b60f3ac14

SHA512
55c87b450447f3b2d546bff9209d82c2306214b29da5eced536a1613919fbadd28f4fa010b5fcbaf24825a19e22d75e929fe9926de8b32f23f33a5699cef0e67

Download Submit
C:\Windows\SysWOW64\Pcobaedj.exe

Filesize
72KB

MD5
eab32fcec38d81ae3c4b2b16c0f0bb79

SHA1
abb3a1ebbe20f62ecf33b60618af241e1fcdfd7e

SHA256
a22616d972f3b60c29e9c4e16904906453ae4f97faa52882969c0823ff6bfef7

SHA512
7203c35cdc308cea06c9ff5c668777cc5f765d38b7bc952c9c8fb3df775b19d55399453f2e91b240bf79cf66412a7e4e203e2b4867d5ff4bd3d8b448397ec465

Download Submit
C:\Windows\SysWOW64\Pnfiplog.exe

Filesize
72KB

MD5
f93b12cb97915ab47204a490f22ffc65

SHA1
bb6878c14e763074b4441cafaf63e12aef0edd73

SHA256
ecf13af3c221e7e506efda1e6f2f467032d7d784e74e8169018ad3c8a3b5355a

SHA512
86226a1c6a864182ab10758bd27728223accf1a047ed594d676d9a537fee89326c397c27ff64262df20a22ae9e2a4ae35225f4373cb6675d3d6b0e4a011652f4

Download Submit
C:\Windows\SysWOW64\Poimpapp.exe

Filesize
72KB

MD5
bdb19a335edcfbc1937cb109b0f943fa

SHA1
bcec71002ce2e211eb102a1ee2f1de163e1b25ed

SHA256
633e62b343b0482242f94d0cfb4b73c009ee07758bf7896959330a7ac237ed0f

SHA512
9a314268bc14c89249ec8d1f3e697afc90da7b65ce31648536119c5c89d5fdb68f833923f003dad4e6ca3186cf4e4357da1d1747f6b87eaab94538777dae0249

Download Submit
memory/8-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/544-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/676-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/676-622-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1096-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1100-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1124-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1152-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1272-183-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1296-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1320-232-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1492-425-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1560-407-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1592-431-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1624-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1696-167-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1800-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1884-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1976-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1996-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2148-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2164-413-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2336-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2416-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2440-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2628-223-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2704-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2720-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2752-216-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2808-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2864-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2908-461-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2908-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3044-437-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3096-128-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3264-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3276-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3468-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3480-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3520-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3564-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3592-629-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3592-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3604-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3764-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3828-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3988-175-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4072-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4148-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4220-199-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4228-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4296-191-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4312-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4324-240-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4432-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4532-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4544-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4584-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4596-207-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4636-247-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4728-419-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4828-256-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5012-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5056-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5060-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5104-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5108-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads