83f47caddf7a621e801bf35ae8f445cfcf8d9bc4085be5a729c57e687a7782e0

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83f47caddf7a621e801bf35ae8f445cfcf8d9bc4085be5a729c57e687a7782e0.exe
Size

320KB
MD5

ee5406217960210284c0202a69e228a1
SHA1

c5a6b876f637d00d8f5ef86449df0281fbfecfcc
SHA256

83f47caddf7a621e801bf35ae8f445cfcf8d9bc4085be5a729c57e687a7782e0
SHA512

050c868f9fc7734adc48e1002330473c78a388409077fc60d3e1f5b79b98044f6389a02a343920885b0f10da19ff95fc6dfccfc2dad30fa92fb76c144ae990d2
SSDEEP

6144:RPt+Sz32WPXuapoaCPXbo92ynnZlVrtv35CPXbo92ynn8sbeWDSpaH8n:RPt+SzuqFHRFbeE8n

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghlcnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnebeogl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofnckp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbdgfa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfaedkdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfbploob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgddhf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpablkhc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcmnpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mckemg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkffog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmbdbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgefeajb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpgmha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfhlejnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbceejpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmijbcpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Likjcbkc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nngokoej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflgep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kboljk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbfbkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edkdkplj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dafbne32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icplcpgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndaggimg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Balpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boepel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iiaephpc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Neeqea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmmnjfnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dojcgi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nebdoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Elppfmoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgddhf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndaggimg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpccdlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddbbeade.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elppfmoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ieolehop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jidklf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkljak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Heocnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdmpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdainc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chdkoa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbbdholl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npcoakfp.exe

Executes dropped EXE 64 IoCs

pid	Process
2144	Boepel32.exe
3640	Cdainc32.exe
4916	Cklaknjd.exe
2788	Ceaehfjj.exe
4624	Chpada32.exe
1136	Cojjqlpk.exe
2056	Cahfmgoo.exe
2644	Cdfbibnb.exe
4896	Clnjjpod.exe
4064	Colffknh.exe
1116	Cajcbgml.exe
2860	Chdkoa32.exe
3484	Clpgpp32.exe
1396	Cbjoljdo.exe
3348	Cehkhecb.exe
2452	Chghdqbf.exe
1000	Ckedalaj.exe
4248	Dbllbibl.exe
3960	Dekhneap.exe
3116	Dldpkoil.exe
1740	Dkgqfl32.exe
1032	Daaicfgd.exe
3212	Demecd32.exe
4092	Dhkapp32.exe
4972	Dkjmlk32.exe
4752	Doeiljfn.exe
2460	Dadeieea.exe
3964	Ddbbeade.exe
1064	Dhnnep32.exe
3300	Dlijfneg.exe
1872	Dkljak32.exe
1912	Dccbbhld.exe
3264	Dafbne32.exe
4332	Deanodkh.exe
1076	Dddojq32.exe
4372	Dllfkn32.exe
2340	Dkoggkjo.exe
2920	Dojcgi32.exe
2084	Dceohhja.exe
316	Dedkdcie.exe
3112	Ddgkpp32.exe
672	Dhbgqohi.exe
4424	Ekacmjgl.exe
1112	Echknh32.exe
5104	Eaklidoi.exe
3748	Eefhjc32.exe
3708	Ehedfo32.exe
768	Elppfmoo.exe
1600	Eoolbinc.exe
4404	Ecjhcg32.exe
3252	Eamhodmf.exe
1052	Edkdkplj.exe
4024	Ehgqln32.exe
1560	Elbmlmml.exe
1248	Ekemhj32.exe
2952	Eekaebcm.exe
2968	Ednaqo32.exe
3220	Eleiam32.exe
544	Ekhjmiad.exe
3528	Eocenh32.exe
3256	Ecoangbg.exe
4252	Eemnjbaj.exe
2888	Edpnfo32.exe
5056	Ehljfnpn.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Eelcja32.dll	Ehgqln32.exe
File created	C:\Windows\SysWOW64\Bejfanad.dll	Ekjfcipa.exe
File created	C:\Windows\SysWOW64\Okokppbk.dll	Kefkme32.exe
File created	C:\Windows\SysWOW64\Kmmfbg32.dll	Lbabgh32.exe
File created	C:\Windows\SysWOW64\Nngokoej.exe	Ngmgne32.exe
File created	C:\Windows\SysWOW64\Gcdmai32.dll	Ocdqjceo.exe
File created	C:\Windows\SysWOW64\Bjjplc32.dll	Kboljk32.exe
File created	C:\Windows\SysWOW64\Pdmpje32.exe	Pmfhig32.exe
File opened for modification	C:\Windows\SysWOW64\Cndikf32.exe	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Hafgeo32.dll	Gokdeeec.exe
File opened for modification	C:\Windows\SysWOW64\Hofdacke.exe	Himldi32.exe
File created	C:\Windows\SysWOW64\Jjbedgde.dll	Jianff32.exe
File created	C:\Windows\SysWOW64\Dlgnafam.dll	Dldpkoil.exe
File created	C:\Windows\SysWOW64\Jmmmebhb.dll	Aeiofcji.exe
File created	C:\Windows\SysWOW64\Bmhnkg32.dll	Balpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Bnbmefbg.exe	Bfkedibe.exe
File opened for modification	C:\Windows\SysWOW64\Cfmajipb.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Olfdahne.dll	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Kcfcjd32.dll	Cojjqlpk.exe
File created	C:\Windows\SysWOW64\Jlajgl32.dll	Chdkoa32.exe
File opened for modification	C:\Windows\SysWOW64\Chghdqbf.exe	Cehkhecb.exe
File created	C:\Windows\SysWOW64\Daaicfgd.exe	Dkgqfl32.exe
File created	C:\Windows\SysWOW64\Gohhpe32.exe	Ghopckpi.exe
File created	C:\Windows\SysWOW64\Laapnj32.dll	Ibnccmbo.exe
File opened for modification	C:\Windows\SysWOW64\Klqcioba.exe	Kefkme32.exe
File created	C:\Windows\SysWOW64\Ecoangbg.exe	Eocenh32.exe
File created	C:\Windows\SysWOW64\Ibnccmbo.exe	Ippggbck.exe
File created	C:\Windows\SysWOW64\Jpppnp32.exe	Jmbdbd32.exe
File created	C:\Windows\SysWOW64\Beglgani.exe	Balpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Chmndlge.exe	Cenahpha.exe
File created	C:\Windows\SysWOW64\Omocan32.dll	Cfpnph32.exe
File opened for modification	C:\Windows\SysWOW64\Llgjjnlj.exe	Liimncmf.exe
File created	C:\Windows\SysWOW64\Ngdmod32.exe	Ncianepl.exe
File created	C:\Windows\SysWOW64\Becbkfdh.dll	Colffknh.exe
File opened for modification	C:\Windows\SysWOW64\Cehkhecb.exe	Cbjoljdo.exe
File opened for modification	C:\Windows\SysWOW64\Daaicfgd.exe	Dkgqfl32.exe
File opened for modification	C:\Windows\SysWOW64\Jimekgff.exe	Jfoiokfb.exe
File created	C:\Windows\SysWOW64\Nnjaqjfh.dll	Bhhdil32.exe
File opened for modification	C:\Windows\SysWOW64\Ddonekbl.exe	Daqbip32.exe
File created	C:\Windows\SysWOW64\Ipnjafgo.dll	Hopnqdan.exe
File created	C:\Windows\SysWOW64\Ofqpqo32.exe	Ocbddc32.exe
File created	C:\Windows\SysWOW64\Bkjpmk32.dll	Aglemn32.exe
File created	C:\Windows\SysWOW64\Hpnkaj32.dll	Dmcibama.exe
File created	C:\Windows\SysWOW64\Eleiam32.exe	Ednaqo32.exe
File created	C:\Windows\SysWOW64\Madnnmem.dll	Liddbc32.exe
File opened for modification	C:\Windows\SysWOW64\Qqijje32.exe	Qmmnjfnl.exe
File created	C:\Windows\SysWOW64\Mkijij32.dll	Cabfga32.exe
File created	C:\Windows\SysWOW64\Ecjhcg32.exe	Eoolbinc.exe
File opened for modification	C:\Windows\SysWOW64\Elbmlmml.exe	Ehgqln32.exe
File created	C:\Windows\SysWOW64\Fcmnpe32.exe	Fkffog32.exe
File created	C:\Windows\SysWOW64\Gfbploob.exe	Gohhpe32.exe
File created	C:\Windows\SysWOW64\Pkfcej32.dll	Lbdolh32.exe
File created	C:\Windows\SysWOW64\Ohkhqj32.dll	Mdckfk32.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	Bapiabak.exe
File opened for modification	C:\Windows\SysWOW64\Dkoggkjo.exe	Dllfkn32.exe
File opened for modification	C:\Windows\SysWOW64\Elgfgl32.exe	Ehljfnpn.exe
File opened for modification	C:\Windows\SysWOW64\Olkhmi32.exe	Ofqpqo32.exe
File created	C:\Windows\SysWOW64\Kgdphnlp.dll	Hofdacke.exe
File created	C:\Windows\SysWOW64\Elogmm32.dll	Jbeidl32.exe
File created	C:\Windows\SysWOW64\Jfaklh32.dll	Kemhff32.exe
File created	C:\Windows\SysWOW64\Lljfpnjg.exe	Likjcbkc.exe
File opened for modification	C:\Windows\SysWOW64\Nngokoej.exe	Ngmgne32.exe
File created	C:\Windows\SysWOW64\Aglemn32.exe	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Jmpgldhg.exe	Jidklf32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9828	9640	WerFault.exe	448

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbnafb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpgfooop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmhnkg32.dll"	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceaehfjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Clpgpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dedkdcie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lfhdlh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oekgfqeg.dll"	Hodgkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfcbjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ambgef32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dccbbhld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmfmfg32.dll"	Eemnjbaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fcmnpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fojhkmkj.dll"	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lepncd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pemfincl.dll"	Nnjlpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhnipd32.dll"	Dddojq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iikhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpgfooop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlampmdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmmmebhb.dll"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djkahqga.dll"	Kikame32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbfbkj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgddhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcbpab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iiaephpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfhlejnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jifhaenk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgilhm32.dll"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Doeiljfn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Deanodkh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpcqcc32.dll"	Heocnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikkokgea.dll"	Lingibiq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbbdholl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcjlfqa.dll"	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjqkei32.dll"	Iicbehnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kemhff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nebdoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfjhbihm.dll"	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbllbibl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ecandfpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaheeaan.dll"	Jmknaell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eadopc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Benlnbhb.dll"	Lfhdlh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcpnhfhf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncbknfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agocgbni.dll"	Ncbknfed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmfldb32.dll"	Cdfbibnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keajjc32.dll"	Hmjdjgjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ippggbck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbnamnpl.dll"	Pggbkagp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqpgdfnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qcgffqei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebdijfii.dll"	Beglgani.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cajlhqjp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 2144	964	83f47caddf7a621e801bf35ae8f445cfcf8d9bc4085be5a729c57e687a7782e0.exe	87
PID 964 wrote to memory of 2144	964	83f47caddf7a621e801bf35ae8f445cfcf8d9bc4085be5a729c57e687a7782e0.exe	87
PID 964 wrote to memory of 2144	964	83f47caddf7a621e801bf35ae8f445cfcf8d9bc4085be5a729c57e687a7782e0.exe	87
PID 2144 wrote to memory of 3640	2144	Boepel32.exe	88
PID 2144 wrote to memory of 3640	2144	Boepel32.exe	88
PID 2144 wrote to memory of 3640	2144	Boepel32.exe	88
PID 3640 wrote to memory of 4916	3640	Cdainc32.exe	89
PID 3640 wrote to memory of 4916	3640	Cdainc32.exe	89
PID 3640 wrote to memory of 4916	3640	Cdainc32.exe	89
PID 4916 wrote to memory of 2788	4916	Cklaknjd.exe	90
PID 4916 wrote to memory of 2788	4916	Cklaknjd.exe	90
PID 4916 wrote to memory of 2788	4916	Cklaknjd.exe	90
PID 2788 wrote to memory of 4624	2788	Ceaehfjj.exe	91
PID 2788 wrote to memory of 4624	2788	Ceaehfjj.exe	91
PID 2788 wrote to memory of 4624	2788	Ceaehfjj.exe	91
PID 4624 wrote to memory of 1136	4624	Chpada32.exe	92
PID 4624 wrote to memory of 1136	4624	Chpada32.exe	92
PID 4624 wrote to memory of 1136	4624	Chpada32.exe	92
PID 1136 wrote to memory of 2056	1136	Cojjqlpk.exe	93
PID 1136 wrote to memory of 2056	1136	Cojjqlpk.exe	93
PID 1136 wrote to memory of 2056	1136	Cojjqlpk.exe	93
PID 2056 wrote to memory of 2644	2056	Cahfmgoo.exe	94
PID 2056 wrote to memory of 2644	2056	Cahfmgoo.exe	94
PID 2056 wrote to memory of 2644	2056	Cahfmgoo.exe	94
PID 2644 wrote to memory of 4896	2644	Cdfbibnb.exe	95
PID 2644 wrote to memory of 4896	2644	Cdfbibnb.exe	95
PID 2644 wrote to memory of 4896	2644	Cdfbibnb.exe	95
PID 4896 wrote to memory of 4064	4896	Clnjjpod.exe	96
PID 4896 wrote to memory of 4064	4896	Clnjjpod.exe	96
PID 4896 wrote to memory of 4064	4896	Clnjjpod.exe	96
PID 4064 wrote to memory of 1116	4064	Colffknh.exe	97
PID 4064 wrote to memory of 1116	4064	Colffknh.exe	97
PID 4064 wrote to memory of 1116	4064	Colffknh.exe	97
PID 1116 wrote to memory of 2860	1116	Cajcbgml.exe	98
PID 1116 wrote to memory of 2860	1116	Cajcbgml.exe	98
PID 1116 wrote to memory of 2860	1116	Cajcbgml.exe	98
PID 2860 wrote to memory of 3484	2860	Chdkoa32.exe	99
PID 2860 wrote to memory of 3484	2860	Chdkoa32.exe	99
PID 2860 wrote to memory of 3484	2860	Chdkoa32.exe	99
PID 3484 wrote to memory of 1396	3484	Clpgpp32.exe	100
PID 3484 wrote to memory of 1396	3484	Clpgpp32.exe	100
PID 3484 wrote to memory of 1396	3484	Clpgpp32.exe	100
PID 1396 wrote to memory of 3348	1396	Cbjoljdo.exe	101
PID 1396 wrote to memory of 3348	1396	Cbjoljdo.exe	101
PID 1396 wrote to memory of 3348	1396	Cbjoljdo.exe	101
PID 3348 wrote to memory of 2452	3348	Cehkhecb.exe	102
PID 3348 wrote to memory of 2452	3348	Cehkhecb.exe	102
PID 3348 wrote to memory of 2452	3348	Cehkhecb.exe	102
PID 2452 wrote to memory of 1000	2452	Chghdqbf.exe	103
PID 2452 wrote to memory of 1000	2452	Chghdqbf.exe	103
PID 2452 wrote to memory of 1000	2452	Chghdqbf.exe	103
PID 1000 wrote to memory of 4248	1000	Ckedalaj.exe	104
PID 1000 wrote to memory of 4248	1000	Ckedalaj.exe	104
PID 1000 wrote to memory of 4248	1000	Ckedalaj.exe	104
PID 4248 wrote to memory of 3960	4248	Dbllbibl.exe	105
PID 4248 wrote to memory of 3960	4248	Dbllbibl.exe	105
PID 4248 wrote to memory of 3960	4248	Dbllbibl.exe	105
PID 3960 wrote to memory of 3116	3960	Dekhneap.exe	106
PID 3960 wrote to memory of 3116	3960	Dekhneap.exe	106
PID 3960 wrote to memory of 3116	3960	Dekhneap.exe	106
PID 3116 wrote to memory of 1740	3116	Dldpkoil.exe	107
PID 3116 wrote to memory of 1740	3116	Dldpkoil.exe	107
PID 3116 wrote to memory of 1740	3116	Dldpkoil.exe	107
PID 1740 wrote to memory of 1032	1740	Dkgqfl32.exe	108

C:\Users\Admin\AppData\Local\Temp\83f47caddf7a621e801bf35ae8f445cfcf8d9bc4085be5a729c57e687a7782e0.exe
"C:\Users\Admin\AppData\Local\Temp\83f47caddf7a621e801bf35ae8f445cfcf8d9bc4085be5a729c57e687a7782e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\Boepel32.exe
  C:\Windows\system32\Boepel32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\Cdainc32.exe
    C:\Windows\system32\Cdainc32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3640
  - - C:\Windows\SysWOW64\Cklaknjd.exe
      C:\Windows\system32\Cklaknjd.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4916
    - - C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2788
      - C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1116
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3484
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3348
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1000
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4248
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1740
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        23⤵
        Executes dropped EXE
        
        PID:1032
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        24⤵
        Executes dropped EXE
        
        PID:3212
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        25⤵
        Executes dropped EXE
        
        PID:4092
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        26⤵
        Executes dropped EXE
        
        PID:4972
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4752
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        28⤵
        Executes dropped EXE
        
        PID:2460
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3964
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        30⤵
        Executes dropped EXE
        
        PID:1064
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        31⤵
        Executes dropped EXE
        
        PID:3300
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1872
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1912
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3264
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4332
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1076
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4372
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        38⤵
        Executes dropped EXE
        
        PID:2340
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        40⤵
        Executes dropped EXE
        
        PID:2084
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:316
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        42⤵
        Executes dropped EXE
        
        PID:3112
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        43⤵
        Executes dropped EXE
        
        PID:672
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        44⤵
        Executes dropped EXE
        
        PID:4424
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        45⤵
        Executes dropped EXE
        
        PID:1112
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        46⤵
        Executes dropped EXE
        
        PID:5104
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        47⤵
        Executes dropped EXE
        
        PID:3748
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        48⤵
        Executes dropped EXE
        
        PID:3708
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:768
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1600
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        51⤵
        Executes dropped EXE
        
        PID:4404
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        52⤵
        Executes dropped EXE
        
        PID:3252
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1052
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4024
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        55⤵
        Executes dropped EXE
        
        PID:1560
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        56⤵
        Executes dropped EXE
        
        PID:1248
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        57⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2968
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        59⤵
        Executes dropped EXE
        
        PID:3220
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        60⤵
        Executes dropped EXE
        
        PID:544
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3528
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        62⤵
        Executes dropped EXE
        
        PID:3256
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4252
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        64⤵
        Executes dropped EXE
        
        PID:2888
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5056
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        66⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        67⤵
        Drops file in System32 directory
        
        PID:4688
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        68⤵
        Modifies registry class
        
        PID:5076
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        69⤵
        Modifies registry class
        
        PID:3332
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        70⤵
        Modifies registry class
        
        PID:720
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        71⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1436
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4216
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        74⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        75⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1268
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        77⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5028
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        79⤵
        Drops file in System32 directory
        
        PID:808
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        80⤵
        Drops file in System32 directory
        
        PID:2844
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1012
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        82⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        83⤵
        Drops file in System32 directory
        
        PID:4344
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        84⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        85⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        86⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        87⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        88⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        89⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        90⤵
        Drops file in System32 directory
        
        PID:4604
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        91⤵
        
        PID:816
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        92⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        93⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        94⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        95⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        96⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        98⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        99⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        100⤵
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        102⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        103⤵
        Drops file in System32 directory
        
        PID:5636
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        104⤵
        Drops file in System32 directory
        
        PID:5688
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        105⤵
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        106⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        107⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        108⤵
        Modifies registry class
        
        PID:5856
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        109⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        111⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        112⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        113⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        114⤵
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        115⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        116⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        117⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        118⤵
        Drops file in System32 directory
        
        PID:5284
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        119⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        120⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        121⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        122⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5620
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        124⤵
        Modifies registry class
        
        PID:5676
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        125⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5868
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        127⤵
        Drops file in System32 directory
        
        PID:5932
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        128⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        129⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4172
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        131⤵
        Drops file in System32 directory
        
        PID:5180
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5276
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        133⤵
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        134⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        135⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        136⤵
        Modifies registry class
        
        PID:5748
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        137⤵
        Drops file in System32 directory
        
        PID:5844
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        138⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        139⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        140⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5248
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        142⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        143⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        144⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5900
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        146⤵
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5320
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        148⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6052
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        150⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        151⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5616
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        153⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        154⤵
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        155⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6280
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6324
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        158⤵
        Modifies registry class
        
        PID:6372
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6428
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        160⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        161⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        162⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        163⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        164⤵
        Drops file in System32 directory
        
        PID:6636
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        165⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        166⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        167⤵
        Drops file in System32 directory
        
        PID:6760
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        168⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        169⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        170⤵
        Modifies registry class
        
        PID:6884
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        171⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        172⤵
        Modifies registry class
        
        PID:6972
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        173⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        174⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        175⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        176⤵
        Drops file in System32 directory
        
        PID:7140
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        177⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        178⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        179⤵
        Drops file in System32 directory
        
        PID:6304
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        180⤵
        Modifies registry class
        
        PID:6412
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6476
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        182⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        183⤵
        Drops file in System32 directory
        
        PID:6624
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        184⤵
        Modifies registry class
        
        PID:6708
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        185⤵
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        186⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        187⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        188⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        189⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        190⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        191⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        193⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        194⤵
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        195⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6756
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        197⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        198⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        199⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        200⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        201⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        202⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        203⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7004
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        205⤵
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        206⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6828
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7088
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        209⤵
        Modifies registry class
        
        PID:6520
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        210⤵
        Drops file in System32 directory
        
        PID:6944
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7348
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7392
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7440
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7484
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        215⤵
        Modifies registry class
        
        PID:7520
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        216⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        217⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7644
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        219⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        220⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        221⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        222⤵
        Drops file in System32 directory
        
        PID:7808
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        223⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        224⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        225⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        226⤵
        Modifies registry class
        
        PID:7980
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        227⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        228⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        229⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8176
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        231⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        232⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        233⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7256
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        235⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        236⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7516
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        238⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        239⤵
        Drops file in System32 directory
        
        PID:7652
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        240⤵
        Drops file in System32 directory
        
        PID:7708
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        241⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        242⤵
        Drops file in System32 directory
        
        PID:7860
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        243⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        244⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        245⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        246⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        247⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        248⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        249⤵
        Modifies registry class
        
        PID:7404
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7468
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        251⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        252⤵
        Modifies registry class
        
        PID:7704
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        253⤵
        Modifies registry class
        
        PID:7820
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        254⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        255⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        256⤵
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        257⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        258⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        259⤵
        Drops file in System32 directory
        
        PID:7676
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7868
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        261⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        262⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        263⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        264⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        265⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        266⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        267⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7184
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        269⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        270⤵
        Modifies registry class
        
        PID:8232
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        271⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        272⤵
        Modifies registry class
        
        PID:8312
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        273⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8392
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        275⤵
        Modifies registry class
        
        PID:8440
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        276⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8484
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        277⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        278⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        279⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        280⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        281⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        282⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        283⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        284⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8888
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        286⤵
        Drops file in System32 directory
        
        PID:8928
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        287⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        288⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9056
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9096
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        291⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        292⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        293⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        294⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        295⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        296⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        297⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        298⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        299⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8704
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        301⤵
        Modifies registry class
        
        PID:7660
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        302⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8912
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        304⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        305⤵
        Drops file in System32 directory
        
        PID:9044
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        306⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9104
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9172
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        308⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8216
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        309⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        310⤵
        Drops file in System32 directory
        
        PID:8424
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        311⤵
        Drops file in System32 directory
        
        PID:8592
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        312⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        313⤵
        Drops file in System32 directory
        
        PID:8832
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        314⤵
        Drops file in System32 directory
        
        PID:8948
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        315⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9148
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        317⤵
        Modifies registry class
        
        PID:8288
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        318⤵
        Drops file in System32 directory
        
        PID:8528
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        319⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        320⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        321⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        322⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        323⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        324⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        325⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        326⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9268
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9316
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        329⤵
        Modifies registry class
        
        PID:9356
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        330⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9460
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        332⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        333⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        334⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        335⤵
        Modifies registry class
        
        PID:9644
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        336⤵
        Drops file in System32 directory
        
        PID:9680
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        337⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        338⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        339⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9876
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        341⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        342⤵
        Drops file in System32 directory
        
        PID:9976
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        343⤵
        Modifies registry class
        
        PID:10012
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        344⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10100
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10140
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        347⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        348⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        349⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        350⤵
        Modifies registry class
        
        PID:9308
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        351⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        352⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        353⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        354⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 400
        355⤵
        Program crash
        
        PID:9828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 9640 -ip 9640
1⤵
PID:9716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bfdodjhm.exe

Filesize
320KB

MD5
dc92d91098fdd19ecbdd65469535210b

SHA1
c4fee9ed17af17ee3822d54ccdef3bb936225a5e

SHA256
0361d6b28b743e5443e309d3057982990922c5905e7dd9da2a01096bc6a46633

SHA512
884f320d553e27e64a44eabe404acc2e1b758711383cd9e1c6cd61832cbba9aa25a1c576d1811bafd8bc21a00269921ae8d0f68a97ad3960201b6be776e66d52

Download Submit
C:\Windows\SysWOW64\Boepel32.exe

Filesize
320KB

MD5
74858eb67d1e54f2bb82ccfaa141338f

SHA1
506e4b521f2718ada345c312b5b9e592b4f1a59b

SHA256
072214c54eccf0591128e1d18f50a716996b07719231fda518f702bd7048edc9

SHA512
da3201afba7448aa39f26bddaa0a4bd3256541269177631094421f47ce124f06f640d947f3f36e3674b9c688f8f55d4975434e5516c9688b6ea6a6fcda17dc0e

Download Submit
C:\Windows\SysWOW64\Cahfmgoo.exe

Filesize
320KB

MD5
a1ce228ce120065f6aeb98ef75ef5c12

SHA1
54a602f0e23431ca78bf1c3468a204d106d190a0

SHA256
e4870b0c92c9e31d1924d23bb8e9eecdc03078f63e87ca611e1e74426ae13200

SHA512
9ae50c53095a118cb465e7d8b86659b6c4b500ecc2d13c276bb4ceb1b2943b9d7e4e5dbc2f48a350e5c01a3202757ed3ee8e0c08abdf4f5b1770aac4125ce327

Download Submit
C:\Windows\SysWOW64\Cajcbgml.exe

Filesize
320KB

MD5
040dee78ce9d634c1a8216023570792b

SHA1
577516b82f0142bd00b4c62d97b5343c5c1967f0

SHA256
15c3b40f9794ee4a52c88d0d8f79c1fd1ea56e322d69b25056092c0a58a9fcba

SHA512
9c2a7fbd522dd47bd55789f6b050ba7ce2029638983b1f621d51c98aafaa4eb5dc9bb442b1c932383df446fd1ba4d62c34285c79168b90efb3995967e912d6b7

Download Submit
C:\Windows\SysWOW64\Cbjoljdo.exe

Filesize
320KB

MD5
3fad9574daf7d732abaca07a292f5e19

SHA1
17da6b6231110a12fae0e0bf8645249232a4196b

SHA256
2a0adb52af2e0f10442c3905e9aff2e141735d313dac36933c13eb5279b35fae

SHA512
62594f61557721090a1c3582a26ceb47e285e5efaa9e84ddf59bf970dee6660492f713e5903537e94b1b0bd2235e8340afb19a2375adb56d0ae5687df8852fff

Download Submit
C:\Windows\SysWOW64\Cdainc32.exe

Filesize
320KB

MD5
57d4638c7b6422364cd1806ae81a9046

SHA1
b5c07a216b6a88aa1d44db0614454812c25bec48

SHA256
563e169da987683e48a8637cb42b2ecea40b24d1ec85c47b90fd9bb665bae4e4

SHA512
c471b94b1205106a5ea84941b3e6aed4820a9eddabd3c8a670807f9a719ee6a471660534defae94f58fdb59a7576b45ed18d48a19dd1138c801f16d94988f38c

Download Submit
C:\Windows\SysWOW64\Cdfbibnb.exe

Filesize
320KB

MD5
e2e7526302e22309abe613bf14849f9b

SHA1
e5b883d5c9fb3b025fa735f01e65c1c2ded36a9f

SHA256
0c6b085350f58dcc85474acc1ffebf0dee7b5513fb82a3f3e1535eba23943e33

SHA512
524ec14d4495ebebadb06e2946a514f84f56c87c6937ca34c1c2f66fa8d4f3a133be8f0451b77a655c0901e230437e6d6436227a9e23eea5a09d7538f6c85387

Download Submit
C:\Windows\SysWOW64\Ceaehfjj.exe

Filesize
320KB

MD5
4b11089dbaa8f422650e89f7d73b98e6

SHA1
bbff9b36d4c6745b0735a63f223f9dab36d8a97a

SHA256
6c1cd4f9ab326f88625439e16939eed24eb7255546dca4bdab346c4857af1e68

SHA512
34614e36321dd11f91a449d9211845c53f717437c01f261b8f28ec64093a2a22d706cef42174478af012a1444524c97e1110aec7334ce2402cfd3bcdd5cc5cb6

Download Submit
C:\Windows\SysWOW64\Cehkhecb.exe

Filesize
320KB

MD5
63c7ca4f51b1a4b9d4a74399ab10747f

SHA1
5e5ae111649e2a22b03902ad69607e63218f9268

SHA256
a63f70a7cb4e5ba564fba0e4a4dc4dc02b553e709fb5bbca3ea588f6189533d7

SHA512
c1f8e8163b6bc09de3e8788eae9075cb2c0330a3c99836080043312c8da6097f22883abbc473264474f5e05fd7b10d795c23c1e1a9d60d24b8a6610ba9c156e6

Download Submit
C:\Windows\SysWOW64\Chdkoa32.exe

Filesize
320KB

MD5
1659e8fb81b6d00d967b227a3e4e0e95

SHA1
c346c820696300cf01bcfd71ffbfc7056d097b0c

SHA256
9c909b90e7fa7585aa62ab459b8344e3de4d85f560f844d94718af21d69485d1

SHA512
0c78ce59be1f4baee223b609e5ea761c2ecff645bfb6055da0975b67f3328ae288eab622cd958816278eca253c041dea555d6a9cdb7d36db95683e49270bca21

Download Submit
C:\Windows\SysWOW64\Chghdqbf.exe

Filesize
320KB

MD5
49c86d874d9a9e2a6ee10abc10e17b5a

SHA1
96d2f89ea5bbcc8230c94a991d46eb95e2d97061

SHA256
26967f7aa4a7c95f4782c33af93cb7df29b94bca380299470d934659ddb0cc60

SHA512
2894e2028642a4f603af8f5dcc87036fb3843032d54f39d8fb9530ce07ea587ca0f1d58ca999d9964d6fb4cbca77e286a0ac4e91c3e3e83aded7b6b5b38aa1d3

Download Submit
C:\Windows\SysWOW64\Chpada32.exe

Filesize
320KB

MD5
992132735acb9aabc62fa19d52abadd0

SHA1
77605061b94481fa207327a7ffd3f65651da4152

SHA256
b273d36477bf368ca6eedf59bd0ef05e4e20c6020c89751d460fefe7989f1d3f

SHA512
b56112a9de9cb0fa62b885a33cb7d8100401a3a648932d6fbe9a6233fd83f736610455f3c1802e68cd8ec8aee74206b50c9a91cf93fb6717772d73bf031417af

Download Submit
C:\Windows\SysWOW64\Ckedalaj.exe

Filesize
320KB

MD5
6c86a7e4222c15f2765e955eccc131e2

SHA1
7a7253a31762ed11ad4a079bd1034187a2505e5f

SHA256
9e7963c25c0ecec058660dd06cadcdf567c21d726db58995ef52444565a6cac2

SHA512
2f0b2598a1c5ea587bb315492230265a9f71ac5645977ac360c62ef171016b8b9bc204df3c5ecc532ab600b22e5d298e7a562a993cc45f173c1893048a3b43a5

Download Submit
C:\Windows\SysWOW64\Ckedalaj.exe

Filesize
256KB

MD5
ff1ed852a6382649778402742d3e0a24

SHA1
3942dc62157de7f395d2c1c7cd69890f80b2951f

SHA256
2c00d45220a2a83d197ca93dd8f6911ab2ac8d618d2a4bbd52c8437d5bf1599b

SHA512
23b7531666bfc9b7b380735b9fc7beac10dc871bc75fbf520e04af41ed9b54932ec33f572c456500b9241ede49aa270c60cc9efe586ec3791b96614cbd06e5bf

Download Submit
C:\Windows\SysWOW64\Cklaknjd.exe

Filesize
320KB

MD5
4ff453f226f73233ec029e3b91037129

SHA1
1701164fb6939de4ca18bbbe06bd92c8608a80f8

SHA256
64c1e50c9ba209089b4cb39f3085c4f60a7c3b6903c0bfe95d741d94a0db5a53

SHA512
bcd3f1f292f9862a8564f26a98540a32174c25455434d668309ae4addd528d1d5674036a9d70dbebf904e7e030f92d193de48ca8af4418971c3dda62517b0c0d

Download Submit
C:\Windows\SysWOW64\Clnjjpod.exe

Filesize
320KB

MD5
b43969dc649a51682c38c68ec9735b63

SHA1
83e2fe86d50729597d655129d40d8cc32297fc68

SHA256
792660d28dd78c20167c4e25fc872c57cbbea055f28deb9fe07baa756a9024da

SHA512
7bf30ee45b78639e1238129f3e92ccdc1dc530e715900edc777a34eda1921ed0eb91a173e62e45299210df81c750b3fca85e8c1ae300a535652eec49652c22be

Download Submit
C:\Windows\SysWOW64\Clpgpp32.exe

Filesize
320KB

MD5
460005806a73e7d530b9eeb2f09de5a1

SHA1
26bbef068cbb0fa62511e532422ad252f228881b

SHA256
2d36a835e58c4c4163971f55b8bdfbc55944a8f269e8809b08701185fd71b848

SHA512
3c44137577ece9c84aed277f768cf89f9790529f3e56133e2b6ce0231aa2bfe16ec542947850bc06b6bf1a7eeddacaca496f8b5ae8fcdb8d9e68de0e529630c8

Download Submit
C:\Windows\SysWOW64\Cojjqlpk.exe

Filesize
320KB

MD5
66c31080ce39b061cb6abb6fdd001b19

SHA1
e7eb8e593662513e1833cc1e2b8a8c72006ae3c4

SHA256
e20091e3cece3ffaadc16afbb0e04c1a0718725aa3c6da655a5d8839cee1e86d

SHA512
558750103588add3cefd4391dcfb58d4b6a0b9f9335ee11f0fc6befc398d73a1a317f3669dfa2bd9656f9117359666e917b17b9496b44d1e601837d0e7b0c38c

Download Submit
C:\Windows\SysWOW64\Colffknh.exe

Filesize
320KB

MD5
6a21982c280e5f1a3a5366d29b69865b

SHA1
396f9f9b74c1c1f1f3116788dd5fb04b24a5c693

SHA256
68641efdb40233e2aa16cbc7406cae6ce143d67ea241f3a6ea281e41ea7206ff

SHA512
8055450163092de362a4005b46c7995db192e813b93efed9125581a82f036d7f545ae3d7c4e38042e71d7df207be1a3451cfac0a57bab61009af59e7aeb43aab

Download Submit
C:\Windows\SysWOW64\Daaicfgd.exe

Filesize
320KB

MD5
1ef5e40d07cf431d443161f1d656cc18

SHA1
07faf023ef2b53dbc053e397aadd24245f4b53ff

SHA256
365fd6bd5db3ef3d9eba49a94dd31aa409b6f1dd3207dc53eb7cf7ea596d208d

SHA512
588c3f915c3cd2465442354794301b7bb285f5eab221ec7cceb320bdc90fdc0bb97d0e6e4d432d70b490f7f1ddf868b2298255a7ad0a300a48cec70c35245b0d

Download Submit
C:\Windows\SysWOW64\Daaicfgd.exe

Filesize
64KB

MD5
617668b2b715a13a0377658c90ec1470

SHA1
50f4098eb7e217fcaa3e1fbe4218dacdfc836dee

SHA256
96a09fff71cb1e6f6ac36d8f19ad5a919eab83475efdab6e8e340090ec92c207

SHA512
081549c5c84d9320b20c0353a87a31320dafc9eea8f675e72f4415fe19a2579461340270846515ea2d18956588af98fff83009e7fcdb0d7f308a1a110008cc6e

Download Submit
C:\Windows\SysWOW64\Dadeieea.exe

Filesize
320KB

MD5
be16e475b7c8412c2ebbd7972444fd45

SHA1
5eec25a5007b86c5cca86c90d95397f5a5d6c09d

SHA256
430f38f869aaf8a772c5aa13fa47a639e78c6cef538ebd3a36ddf93d420f1992

SHA512
6b644867c55c0f2728ef12f57703969a907957924a9d3d37fda2ef6ca40f7309c05234805452dface71c73599eb12bb7192fd1e52107fd7707317e1d7298440e

Download Submit
C:\Windows\SysWOW64\Dadeieea.exe

Filesize
14KB

MD5
9b4584d9e765e75b2032505714955976

SHA1
b01916be985bf455ed4e2841463efc39ac715ab8

SHA256
1a5670021b25714eb5dbfbf7f324e2f72815ae245873d804e4017a32758666c9

SHA512
46eb1fd9218f5508577bd5eca422a7c5cd603ac836939f0a60113e983598a6c5d3a591d335b190c742a7a10e151c7e03c6043ef70678553c13d36e1a4dbf7920

Download Submit
C:\Windows\SysWOW64\Dbllbibl.exe

Filesize
320KB

MD5
c6a0d08b7a303890a38f6b1b6f6c0e1c

SHA1
7d68f50c2cc8cd45fe6011e128eb951c4f7268cb

SHA256
4ccf27a34b4d81284a6103a5a9833431fc0bf38ab1f0f31b0d2cbc16d9cfbfc6

SHA512
48deff8cff6990053f029ab5a3ca2057395dabb9f79aaef030209ea1954a7128a2458b70e2eb90dadcbe8742c81f3d30cffa58a32b1c7f7e0f0d5fbc84da42a6

Download Submit
C:\Windows\SysWOW64\Dccbbhld.exe

Filesize
320KB

MD5
ea9350752e99f55f5d2d806c65ac76c8

SHA1
a6e3b5689c134b710cc43ae82b4ff4ab22c982b2

SHA256
56ab8ceefd070c0004669fc005cb0bd4242a027a3c1713a24b3482c716baa9c8

SHA512
863fdfcad0a43b0b05323e7fb70e0a7f1a79519d3a554d2073296dbb6572e9aabe5d82a3de76a66c3db6e0ad13038a15bfa465ded1f0195257681cc4589043ad

Download Submit
C:\Windows\SysWOW64\Ddbbeade.exe

Filesize
320KB

MD5
eb1ee78ecb5754923aa3a4a68b234a5a

SHA1
13819e7ef23441097a5247f4f14117888aef7339

SHA256
bd430b3f42d259007b748fa4dedc3cfc2fae233e40aa3381c7b9df3b780d5772

SHA512
72d55037d0bdd3358b5312e40eda640bd2575239cab93de45e8958c8a6a817b0ac896e2c1cb8654a48659b21f7c61ae11d08631026039249d51a7d5f442ddff6

Download Submit
C:\Windows\SysWOW64\Dekhneap.exe

Filesize
320KB

MD5
48288e2c8a4e18029683f4dfe7f6b4a6

SHA1
95dd049b95b4f08ee984b6f5e1df46b84d7b291b

SHA256
a8df5d294f86c506c86f17bd3e6a9f3237757f66af825507d58a00ef0d1975b6

SHA512
ca10696d23dd45c464976956fa14da2004367117aacd48cb8c324347f6b35709a604d5520b27162741d5d55dea781574a3604ca1bf1a533ed73a0562f52f7c80

Download Submit
C:\Windows\SysWOW64\Demecd32.exe

Filesize
320KB

MD5
9fee52cfe806720cef8a12adf103c2a0

SHA1
bb78e13412a5a444df000b613b741acebfa98cc7

SHA256
c391a9d89d6ff5ab305125a7041a96b199e85c95bf405ed525d8bdd6d8f1e3c7

SHA512
6d864194c9f551960fb3f75e8a41f4facf41b319ec39c1d14f63b5c5976958b2b2dff9e13b2420219b53646f93863c20a4cab946931e5bd52836e93ca5af1c54

Download Submit
C:\Windows\SysWOW64\Dhkapp32.exe

Filesize
320KB

MD5
64f8bf9b62f38a86b7786fdbc595d08b

SHA1
6fe40eb1139d32e815c1724aa0a3dd7f9989fc8e

SHA256
232e83d30d0c5c85f9cce24f40d14b8c09da61c2fb0ccba89578db550e3b94e8

SHA512
87fd29d15e435f55b0799ce3e6736f9b33ebc6f936e4f8baf894b2d1cfdb418844be08b75165f5c247cc6e557f6a7a3a945308d2f7320051838117145153b97f

Download Submit
C:\Windows\SysWOW64\Dhnnep32.exe

Filesize
320KB

MD5
37aa350179a2e8bdd8896e2e61e357f5

SHA1
9f5f4b098d0118c1b650d44e7c9f36d8a15fd184

SHA256
5b875c6ecaa64fa96819bde6c57094afd113ef84eb9a86e21a1ed1bca18b48a5

SHA512
2fa84c37b16fcfe700b0ec2d0cfa9eb8e4fcf5280bd6522e947a7245f8c6dca26b0ea80ce1b397de94030d1e31aee89554461e8b11c5e588e28d45c0750420ca

Download Submit
C:\Windows\SysWOW64\Dkgqfl32.exe

Filesize
320KB

MD5
b022bdea614ed263f3550a15c52d0891

SHA1
b9d51399a3bc9113a65f7997b5631f8574ac8a52

SHA256
b1e90516db43f5bbe76306b13669d058aac73b0de5c7a365843b9c7e875ddff5

SHA512
2ed5e1c9cc7eccc862252933819fb62a0529ce377c3e79362afdd93ac5312a764a2ad753028b7ad203546b4e2224520bbc90a81fca39c0276c0be519441c0c60

Download Submit
C:\Windows\SysWOW64\Dkjmlk32.exe

Filesize
320KB

MD5
7232696bf7e577feb955a411b5379ab5

SHA1
fb4b7a29ec1c3c7264e61347ca75adc4d96abb8c

SHA256
b8263c73eee95e8044ef29921639e9cd1877fe61f1bfefc3f9fcc3d58d3abbd2

SHA512
93241142075c8c160a16adde2e296948f1440af498324cfc61ee72dc4da46f0ae662870d0d052fb55b8051b2b3e04f5cca23fe74ec443d454b9c6e8903940f09

Download Submit
C:\Windows\SysWOW64\Dkljak32.exe

Filesize
320KB

MD5
ba7b7a97bb1ceb4f2fe576608864cd8b

SHA1
23d2341b4ed163390c92b7a758477dcbd4c5e17c

SHA256
44d67f01a6df6fa0d779b155df2fc315c96149fb1899945ab404235f3656be94

SHA512
ab3581ef0c0e621b1e5db9d25360f2a8d30a33bf11dc843982ab4d29e9eb196f8c85e5758591bc113536b1066c005249952f91a1e19e58503579c413b5b74f67

Download Submit
C:\Windows\SysWOW64\Dldpkoil.exe

Filesize
320KB

MD5
11e4c8bc1d189c6aec5236cdb36dd574

SHA1
9c4433e9681d2b263d9059431d4e6b538c72df1a

SHA256
7c55372b25f5c2496703ea58a0e0c0abcd50f9152cf2f58c9647d71b069799b5

SHA512
7cfe56cda58a3fb4abc03f604bc97904a5a0c803f343365adb19cb8fbf1232c0f7a9e3f5166146fa5f6308ae5172ebd6c134e1d69117ed9db00ac4f9172cc59d

Download Submit
C:\Windows\SysWOW64\Dlijfneg.exe

Filesize
320KB

MD5
929ac6520c4f602519074255df494d7f

SHA1
e25ea2523ff634c5e30d1906fbc7bdacfdf7bee5

SHA256
f5f059c0d0437065254b0f5c50edebea8b661eb86eb70fce117c4a9d68d1da41

SHA512
20af3621472010242727baae74b56494eeba02dcac9684bfeb82afbdec9419c221af549a83fdbf7e0017fdc0558265ab8b38893bd9a27254b128763a589798f1

Download Submit
C:\Windows\SysWOW64\Doeiljfn.exe

Filesize
320KB

MD5
8d38875890e3695240ba28411aa3c633

SHA1
b5bc7e5fa9835f8633d29d2ab3d36a476be7f573

SHA256
e670e49c2a8e1ab387f12e35f56307bbad4a1f7b058425420f1b977eecd5297b

SHA512
fcd4c592660c14c8955b1948adac097c207c4947dc5be66e839c333b2269c97b69039e688fd82ca8fcd03de680a0d1be55de131a2a25c383edf88115e2a726b0

Download Submit
C:\Windows\SysWOW64\Qdbiedpa.exe

Filesize
320KB

MD5
8c5a9dc01dc25e56fad29e1d5fe3d689

SHA1
e22e0296622a7a5113420cbab3f8e1a06b2748a8

SHA256
b75f65ee0750b98110e12128eb9dbbf9748004f8b8f4f56f31ec7b9c6c27e07f

SHA512
e5b9d39cb5bc30a02f0a948b6d8f9d9eaf829ba53735bed7984cc71f1a88c387ee20e4d5eb92671a79298650c8c88e4341b370d0375997c38ec104406c96771a

Download Submit
memory/316-447-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/544-521-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/672-459-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/768-480-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/964-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/964-1-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1000-419-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1032-424-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1052-493-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1064-431-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1076-437-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1112-471-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1136-53-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1248-502-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1396-416-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1560-501-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1600-481-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1740-423-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1864-537-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1872-433-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1912-434-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2084-445-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2144-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2340-439-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2452-418-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2460-429-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2644-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2788-36-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2860-414-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2888-530-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2920-440-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2952-507-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2968-509-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3112-453-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3116-422-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3212-425-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3220-515-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3252-488-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3256-523-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3264-435-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3300-432-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3348-417-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3484-415-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3528-522-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3640-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3708-479-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3748-478-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3960-421-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3964-430-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4024-495-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4064-413-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4092-426-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4248-420-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4252-529-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4332-436-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4372-438-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4404-482-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4424-465-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4624-41-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4752-428-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4916-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4972-427-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5056-536-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5104-472-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads