27abb3fe7ef0b9727fd67b10676fe480e75df2ad0e6fa9d7631d627294840b4b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27abb3fe7ef0b9727fd67b10676fe480e75df2ad0e6fa9d7631d627294840b4b.exe
Size

272KB
MD5

b8825e69f1517088f2d38b16e34a5693
SHA1

cd73f62136264051af233a4620b2349cff9b9b5a
SHA256

27abb3fe7ef0b9727fd67b10676fe480e75df2ad0e6fa9d7631d627294840b4b
SHA512

de64d95cdf23cedf3763b5f6644c9a60668243f9747845d9f13b52163c766a8c007275bb6ea06ef0963c17e862f880ed065c97766235e245e548df791fe2eb11
SSDEEP

6144:yl73kDlCVXByvZ6Mxv5Rar3O6B9fZSLhZmzbByvZ6Mxv5R:y53FZByvNv54B9f01ZmHByvNv5

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bldgdago.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boepel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifgbnlmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkljak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gmlhii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jfhlejnh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndokbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odapnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkgqfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fljcmlfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcgbco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdiooblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aglemn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fckajehi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mgkjhe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfjjppmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njciko32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odkjng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opakbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Foabofnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gdjjckag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglemn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdiooblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fckajehi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gomakdcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hcbpab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmdqgd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpcfkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojllan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehimanbq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hkdbpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lphoelqn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngdmod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hbbdholl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imfdff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pnonbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fohoigfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Npfkgjdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngbpidjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ddgkpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlkagbej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfaigm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbfkbhpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pcijeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjcbbmif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcncpbmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ecjhcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iifokh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ndokbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofeilobp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dkgqfl32.exe

Executes dropped EXE 64 IoCs

pid	Process
4032	Bdmpcdfm.exe
880	Bldgdago.exe
4656	Bbnpqk32.exe
1244	Blfdia32.exe
2288	Boepel32.exe
2852	Cliaoq32.exe
1864	Ceaehfjj.exe
2452	Chpada32.exe
1228	Cbefaj32.exe
4768	Cdfbibnb.exe
4936	Cbgbgj32.exe
2252	Cdiooblp.exe
1668	Clpgpp32.exe
1816	Cehkhecb.exe
5108	Doqpak32.exe
3684	Dhidjpqc.exe
3632	Dkgqfl32.exe
728	Dboigi32.exe
3468	Demecd32.exe
1200	Ddpeoafg.exe
1500	Doeiljfn.exe
4572	Deoaid32.exe
452	Dkljak32.exe
4864	Dohfbj32.exe
2492	Dddojq32.exe
3964	Dllfkn32.exe
4108	Dceohhja.exe
3012	Ddgkpp32.exe
1912	Eolpmi32.exe
1632	Eaklidoi.exe
4852	Elppfmoo.exe
2128	Ecjhcg32.exe
3484	Elbmlmml.exe
1488	Ecmeig32.exe
940	Ehimanbq.exe
1392	Ekhjmiad.exe
3956	Ecoangbg.exe
2544	Eemnjbaj.exe
3544	Ekjfcipa.exe
2444	Eadopc32.exe
4960	Edbklofb.exe
2508	Fljcmlfd.exe
3192	Fohoigfh.exe
5028	Fafkecel.exe
4584	Fllpbldb.exe
4524	Fojlngce.exe
2260	Ffddka32.exe
2280	Flnlhk32.exe
508	Fkalchij.exe
2360	Fomhdg32.exe
872	Fdialn32.exe
2088	Flqimk32.exe
3604	Fckajehi.exe
1424	Fdlnbm32.exe
5012	Fhgjblfq.exe
3940	Foabofnn.exe
3460	Ffkjlp32.exe
4028	Glebhjlg.exe
2132	Gcojed32.exe
2840	Ghlcnk32.exe
1948	Gkkojgao.exe
1140	Gbdgfa32.exe
3020	Gdcdbl32.exe
4432	Gmjlcj32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mckemg32.exe	Mplhql32.exe
File opened for modification	C:\Windows\SysWOW64\Afhohlbj.exe	Acjclpcf.exe
File created	C:\Windows\SysWOW64\Jefbfgig.exe	Jbhfjljd.exe
File created	C:\Windows\SysWOW64\Bjokdipf.exe	Bebblb32.exe
File opened for modification	C:\Windows\SysWOW64\Jpppnp32.exe	Jlednamo.exe
File opened for modification	C:\Windows\SysWOW64\Gdeqhl32.exe	Gfbploob.exe
File created	C:\Windows\SysWOW64\Lpcqcc32.dll	Hbpgbo32.exe
File created	C:\Windows\SysWOW64\Edgbbfnk.dll	Kdeoemeg.exe
File created	C:\Windows\SysWOW64\Mgcail32.dll	Cmqmma32.exe
File opened for modification	C:\Windows\SysWOW64\Gcojed32.exe	Glebhjlg.exe
File created	C:\Windows\SysWOW64\Cecenn32.dll	Doeiljfn.exe
File created	C:\Windows\SysWOW64\Oalnaifk.dll	Fhgjblfq.exe
File opened for modification	C:\Windows\SysWOW64\Hmcojh32.exe	Helfik32.exe
File created	C:\Windows\SysWOW64\Ippohl32.dll	Jianff32.exe
File created	C:\Windows\SysWOW64\Gijloo32.dll	Kpbmco32.exe
File created	C:\Windows\SysWOW64\Mgkjhe32.exe	Mpablkhc.exe
File opened for modification	C:\Windows\SysWOW64\Ocbddc32.exe	Opdghh32.exe
File opened for modification	C:\Windows\SysWOW64\Cliaoq32.exe	Boepel32.exe
File created	C:\Windows\SysWOW64\Ifgbnlmj.exe	Iblfnn32.exe
File opened for modification	C:\Windows\SysWOW64\Jfoiokfb.exe	Icplcpgo.exe
File created	C:\Windows\SysWOW64\Gbmgladp.dll	Ngpccdlj.exe
File created	C:\Windows\SysWOW64\Cmiflbel.exe	Cjkjpgfi.exe
File opened for modification	C:\Windows\SysWOW64\Cdfbibnb.exe	Cbefaj32.exe
File created	C:\Windows\SysWOW64\Fckajehi.exe	Flqimk32.exe
File created	C:\Windows\SysWOW64\Jfoiokfb.exe	Icplcpgo.exe
File created	C:\Windows\SysWOW64\Lbdolh32.exe	Lmgfda32.exe
File opened for modification	C:\Windows\SysWOW64\Qjoankoi.exe	Qdbiedpa.exe
File created	C:\Windows\SysWOW64\Bqhimici.dll	Fljcmlfd.exe
File opened for modification	C:\Windows\SysWOW64\Kiidgeki.exe	Kemhff32.exe
File created	C:\Windows\SysWOW64\Pmdkch32.exe	Pfjcgn32.exe
File opened for modification	C:\Windows\SysWOW64\Dohfbj32.exe	Dkljak32.exe
File created	C:\Windows\SysWOW64\Iccbgbmg.dll	Ifgbnlmj.exe
File opened for modification	C:\Windows\SysWOW64\Kfmepi32.exe	Kdnidn32.exe
File created	C:\Windows\SysWOW64\Pjkolmml.dll	Fakdpb32.exe
File opened for modification	C:\Windows\SysWOW64\Hcdmga32.exe	Hoiafcic.exe
File opened for modification	C:\Windows\SysWOW64\Ikbnacmd.exe	Iicbehnq.exe
File created	C:\Windows\SysWOW64\Pncgmkmj.exe	Pgioqq32.exe
File opened for modification	C:\Windows\SysWOW64\Bgehcmmm.exe	Beglgani.exe
File opened for modification	C:\Windows\SysWOW64\Cdiooblp.exe	Cbgbgj32.exe
File opened for modification	C:\Windows\SysWOW64\Ifgbnlmj.exe	Iblfnn32.exe
File opened for modification	C:\Windows\SysWOW64\Ippggbck.exe	Ildkgc32.exe
File created	C:\Windows\SysWOW64\Chmhoe32.dll	Oneklm32.exe
File created	C:\Windows\SysWOW64\Halpnqlq.dll	Pqknig32.exe
File created	C:\Windows\SysWOW64\Bbloam32.dll	Cjkjpgfi.exe
File opened for modification	C:\Windows\SysWOW64\Cbefaj32.exe	Chpada32.exe
File opened for modification	C:\Windows\SysWOW64\Jplfcpin.exe	Jianff32.exe
File opened for modification	C:\Windows\SysWOW64\Pnlaml32.exe	Ofeilobp.exe
File opened for modification	C:\Windows\SysWOW64\Ceehho32.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Hcdmga32.exe	Hoiafcic.exe
File created	C:\Windows\SysWOW64\Dkcfedla.dll	Hbbdholl.exe
File created	C:\Windows\SysWOW64\Eonefj32.dll	Megdccmb.exe
File opened for modification	C:\Windows\SysWOW64\Nlmllkja.exe	Nnjlpo32.exe
File opened for modification	C:\Windows\SysWOW64\Oflgep32.exe	Odkjng32.exe
File opened for modification	C:\Windows\SysWOW64\Agoabn32.exe	Aadifclh.exe
File opened for modification	C:\Windows\SysWOW64\Dceohhja.exe	Dllfkn32.exe
File created	C:\Windows\SysWOW64\Pqmjog32.exe	Pnonbk32.exe
File opened for modification	C:\Windows\SysWOW64\Pncgmkmj.exe	Pgioqq32.exe
File opened for modification	C:\Windows\SysWOW64\Qnhahj32.exe	Pfaigm32.exe
File created	C:\Windows\SysWOW64\Pjngmo32.dll	Chagok32.exe
File created	C:\Windows\SysWOW64\Jgmbieme.dll	Elbmlmml.exe
File opened for modification	C:\Windows\SysWOW64\Anmjcieo.exe	Qffbbldm.exe
File opened for modification	C:\Windows\SysWOW64\Afjlnk32.exe	Aclpap32.exe
File created	C:\Windows\SysWOW64\Ccdlci32.dll	Pdpmpdbd.exe
File created	C:\Windows\SysWOW64\Ligqhc32.exe	Lekehdgp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9708	9564	WerFault.exe	419

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pcijeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcjlfqa.dll"	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fiknll32.dll"	Fafkecel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcjfkm32.dll"	Ecoangbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpmlcim.dll"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inlekh32.dll"	Eadopc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odqjbebh.dll"	Hmcojh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ikbnacmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kfmepi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lekehdgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deimfpda.dll"	Lmgfda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cbefaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Eemnjbaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhbopgfn.dll"	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdmai32.dll"	Ocdqjceo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mcmabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccdlci32.dll"	Pdpmpdbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Flnlhk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kdcbom32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pnonbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hfcicmqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phkjck32.dll"	Lmiciaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pacghh32.dll"	Iemppiab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lpcfkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Edbklofb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iblfnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmpmkplp.dll"	Jedeph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oddmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoqimi32.dll"	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Codqon32.dll"	Nepgjaeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Goaojagc.dll"	Nlmllkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpcqcc32.dll"	Hbpgbo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hbbdholl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hfqlnm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jcbihpel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ehimanbq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gbiaapdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Anadoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhnipd32.dll"	Dddojq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmgabj32.dll"	Odapnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kipkhdeq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ildkgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jlkagbej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfadpi32.dll"	Iifokh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dkljak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jihdea32.dll"	Eaklidoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jpppnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ngdmod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhidjpqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iedoeq32.dll"	Gdjjckag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Debdld32.dll"	Opakbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndkqipob.dll"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hcpclbfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hecmijim.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 4032	624	27abb3fe7ef0b9727fd67b10676fe480e75df2ad0e6fa9d7631d627294840b4b.exe	88
PID 624 wrote to memory of 4032	624	27abb3fe7ef0b9727fd67b10676fe480e75df2ad0e6fa9d7631d627294840b4b.exe	88
PID 624 wrote to memory of 4032	624	27abb3fe7ef0b9727fd67b10676fe480e75df2ad0e6fa9d7631d627294840b4b.exe	88
PID 4032 wrote to memory of 880	4032	Bdmpcdfm.exe	89
PID 4032 wrote to memory of 880	4032	Bdmpcdfm.exe	89
PID 4032 wrote to memory of 880	4032	Bdmpcdfm.exe	89
PID 880 wrote to memory of 4656	880	Bldgdago.exe	90
PID 880 wrote to memory of 4656	880	Bldgdago.exe	90
PID 880 wrote to memory of 4656	880	Bldgdago.exe	90
PID 4656 wrote to memory of 1244	4656	Bbnpqk32.exe	91
PID 4656 wrote to memory of 1244	4656	Bbnpqk32.exe	91
PID 4656 wrote to memory of 1244	4656	Bbnpqk32.exe	91
PID 1244 wrote to memory of 2288	1244	Blfdia32.exe	92
PID 1244 wrote to memory of 2288	1244	Blfdia32.exe	92
PID 1244 wrote to memory of 2288	1244	Blfdia32.exe	92
PID 2288 wrote to memory of 2852	2288	Boepel32.exe	93
PID 2288 wrote to memory of 2852	2288	Boepel32.exe	93
PID 2288 wrote to memory of 2852	2288	Boepel32.exe	93
PID 2852 wrote to memory of 1864	2852	Cliaoq32.exe	94
PID 2852 wrote to memory of 1864	2852	Cliaoq32.exe	94
PID 2852 wrote to memory of 1864	2852	Cliaoq32.exe	94
PID 1864 wrote to memory of 2452	1864	Ceaehfjj.exe	95
PID 1864 wrote to memory of 2452	1864	Ceaehfjj.exe	95
PID 1864 wrote to memory of 2452	1864	Ceaehfjj.exe	95
PID 2452 wrote to memory of 1228	2452	Chpada32.exe	96
PID 2452 wrote to memory of 1228	2452	Chpada32.exe	96
PID 2452 wrote to memory of 1228	2452	Chpada32.exe	96
PID 1228 wrote to memory of 4768	1228	Cbefaj32.exe	97
PID 1228 wrote to memory of 4768	1228	Cbefaj32.exe	97
PID 1228 wrote to memory of 4768	1228	Cbefaj32.exe	97
PID 4768 wrote to memory of 4936	4768	Cdfbibnb.exe	98
PID 4768 wrote to memory of 4936	4768	Cdfbibnb.exe	98
PID 4768 wrote to memory of 4936	4768	Cdfbibnb.exe	98
PID 4936 wrote to memory of 2252	4936	Cbgbgj32.exe	99
PID 4936 wrote to memory of 2252	4936	Cbgbgj32.exe	99
PID 4936 wrote to memory of 2252	4936	Cbgbgj32.exe	99
PID 2252 wrote to memory of 1668	2252	Cdiooblp.exe	100
PID 2252 wrote to memory of 1668	2252	Cdiooblp.exe	100
PID 2252 wrote to memory of 1668	2252	Cdiooblp.exe	100
PID 1668 wrote to memory of 1816	1668	Clpgpp32.exe	101
PID 1668 wrote to memory of 1816	1668	Clpgpp32.exe	101
PID 1668 wrote to memory of 1816	1668	Clpgpp32.exe	101
PID 1816 wrote to memory of 5108	1816	Cehkhecb.exe	103
PID 1816 wrote to memory of 5108	1816	Cehkhecb.exe	103
PID 1816 wrote to memory of 5108	1816	Cehkhecb.exe	103
PID 5108 wrote to memory of 3684	5108	Doqpak32.exe	104
PID 5108 wrote to memory of 3684	5108	Doqpak32.exe	104
PID 5108 wrote to memory of 3684	5108	Doqpak32.exe	104
PID 3684 wrote to memory of 3632	3684	Dhidjpqc.exe	106
PID 3684 wrote to memory of 3632	3684	Dhidjpqc.exe	106
PID 3684 wrote to memory of 3632	3684	Dhidjpqc.exe	106
PID 3632 wrote to memory of 728	3632	Dkgqfl32.exe	107
PID 3632 wrote to memory of 728	3632	Dkgqfl32.exe	107
PID 3632 wrote to memory of 728	3632	Dkgqfl32.exe	107
PID 728 wrote to memory of 3468	728	Dboigi32.exe	108
PID 728 wrote to memory of 3468	728	Dboigi32.exe	108
PID 728 wrote to memory of 3468	728	Dboigi32.exe	108
PID 3468 wrote to memory of 1200	3468	Demecd32.exe	109
PID 3468 wrote to memory of 1200	3468	Demecd32.exe	109
PID 3468 wrote to memory of 1200	3468	Demecd32.exe	109
PID 1200 wrote to memory of 1500	1200	Ddpeoafg.exe	110
PID 1200 wrote to memory of 1500	1200	Ddpeoafg.exe	110
PID 1200 wrote to memory of 1500	1200	Ddpeoafg.exe	110
PID 1500 wrote to memory of 4572	1500	Doeiljfn.exe	112

C:\Users\Admin\AppData\Local\Temp\27abb3fe7ef0b9727fd67b10676fe480e75df2ad0e6fa9d7631d627294840b4b.exe
"C:\Users\Admin\AppData\Local\Temp\27abb3fe7ef0b9727fd67b10676fe480e75df2ad0e6fa9d7631d627294840b4b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\Bdmpcdfm.exe
  C:\Windows\system32\Bdmpcdfm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\SysWOW64\Bldgdago.exe
    C:\Windows\system32\Bldgdago.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:880
  - - C:\Windows\SysWOW64\Bbnpqk32.exe
      C:\Windows\system32\Bbnpqk32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4656
    - - C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1244
      - C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2288
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1864
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2252
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1668
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3632
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:728
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1500
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        23⤵
        Executes dropped EXE
        
        PID:4572
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:452
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        25⤵
        Executes dropped EXE
        
        PID:4864
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2492
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3964
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        28⤵
        Executes dropped EXE
        
        PID:4108
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3012
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        30⤵
        Executes dropped EXE
        
        PID:1912
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1632
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        32⤵
        Executes dropped EXE
        
        PID:4852
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2128
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3484
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        35⤵
        Executes dropped EXE
        
        PID:1488
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:940
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        37⤵
        Executes dropped EXE
        
        PID:1392
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3956
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2544
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        40⤵
        Executes dropped EXE
        
        PID:3544
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2444
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4960
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2508
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3192
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5028
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        46⤵
        Executes dropped EXE
        
        PID:4584
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        47⤵
        Executes dropped EXE
        
        PID:4524
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        48⤵
        Executes dropped EXE
        
        PID:2260
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2280
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        50⤵
        Executes dropped EXE
        
        PID:508
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        51⤵
        Executes dropped EXE
        
        PID:2360
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        52⤵
        Drops file in System32 directory
        
        PID:1872
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        53⤵
        Executes dropped EXE
        
        PID:872
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2088
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3604
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        56⤵
        Executes dropped EXE
        
        PID:1424
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5012
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3940
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        59⤵
        Executes dropped EXE
        
        PID:3460
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4028
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        61⤵
        Executes dropped EXE
        
        PID:2132
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        62⤵
        Executes dropped EXE
        
        PID:2840
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        63⤵
        Executes dropped EXE
        
        PID:1948
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        64⤵
        Executes dropped EXE
        
        PID:1140
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        65⤵
        Executes dropped EXE
        
        PID:3020
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        66⤵
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        67⤵
        Drops file in System32 directory
        
        PID:4788
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        68⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:932
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        70⤵
        Modifies registry class
        
        PID:2564
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        71⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        72⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4700
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3924
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:112
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        76⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        77⤵
        Drops file in System32 directory
        
        PID:4964
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        78⤵
        Modifies registry class
        
        PID:4688
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        79⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        80⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2920
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        81⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        82⤵
        
        PID:640
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        83⤵
        Modifies registry class
        
        PID:4888
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2636
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        85⤵
        
        PID:772
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5148
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        87⤵
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        88⤵
        Modifies registry class
        
        PID:5232
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        89⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        90⤵
        Drops file in System32 directory
        
        PID:5320
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        91⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        92⤵
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        93⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        94⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        95⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        96⤵
        Drops file in System32 directory
        
        PID:5584
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        97⤵
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        98⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5668
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5712
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5752
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        101⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        102⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        103⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        104⤵
        Modifies registry class
        
        PID:5932
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        105⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        106⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        107⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6108
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        109⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        110⤵
        Drops file in System32 directory
        
        PID:5196
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        111⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        112⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        114⤵
        Modifies registry class
        
        PID:5484
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        115⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        116⤵
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        117⤵
        Drops file in System32 directory
        
        PID:5704
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        118⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        119⤵
        Drops file in System32 directory
        
        PID:5812
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        120⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5968
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        122⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        123⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        124⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        125⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5380
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        127⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        128⤵
        Drops file in System32 directory
        
        PID:5576
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        129⤵
        Modifies registry class
        
        PID:5676
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        130⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        131⤵
        Drops file in System32 directory
        
        PID:5920
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        132⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6116
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        134⤵
        Drops file in System32 directory
        
        PID:5212
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        135⤵
        Drops file in System32 directory
        
        PID:5420
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        136⤵
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        137⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        138⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        139⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        140⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        141⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        142⤵
        Modifies registry class
        
        PID:5824
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        143⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        144⤵
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        145⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        146⤵
        Drops file in System32 directory
        
        PID:5452
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        147⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        148⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        149⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        150⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        151⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        152⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        153⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        154⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        155⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        156⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        157⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        158⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        159⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        160⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        162⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        163⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6812
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        164⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        165⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        166⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        167⤵
        Modifies registry class
        
        PID:6968
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7012
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7064
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        170⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        171⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        172⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        173⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        174⤵
        Drops file in System32 directory
        
        PID:6328
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        175⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        176⤵
        Drops file in System32 directory
        
        PID:6448
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        177⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        178⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        179⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        180⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        181⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        182⤵
        Modifies registry class
        
        PID:6832
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        183⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        184⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        185⤵
        Drops file in System32 directory
        
        PID:7004
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7116
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        187⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6228
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        189⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        190⤵
        Modifies registry class
        
        PID:6520
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6584
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        192⤵
        Drops file in System32 directory
        
        PID:6672
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        193⤵
        Drops file in System32 directory
        
        PID:6820
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        194⤵
        Modifies registry class
        
        PID:6924
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        195⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6168
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        197⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        198⤵
        Modifies registry class
        
        PID:6496
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        199⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6736
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6976
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        202⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        203⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7108
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        205⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        206⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6392
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        208⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        209⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7284
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        211⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        212⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        213⤵
        Drops file in System32 directory
        
        PID:7416
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        214⤵
        Drops file in System32 directory
        
        PID:7460
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        215⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        216⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7580
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        218⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7668
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        220⤵
        Modifies registry class
        
        PID:7704
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        221⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        222⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        223⤵
        Modifies registry class
        
        PID:7828
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        224⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7908
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        226⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        227⤵
        Drops file in System32 directory
        
        PID:8000
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8052
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8092
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8128
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        231⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        232⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        233⤵
        Drops file in System32 directory
        
        PID:7240
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        234⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7400
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        236⤵
        Drops file in System32 directory
        
        PID:7480
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        237⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        238⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        239⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        240⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        241⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        242⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8008
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        243⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6944
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        245⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        246⤵
        Drops file in System32 directory
        
        PID:7408
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        247⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7736
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        249⤵
        Modifies registry class
        
        PID:7924
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        250⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8044
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        251⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        252⤵
        Modifies registry class
        
        PID:7492
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        253⤵
        Drops file in System32 directory
        
        PID:7816
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8060
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        255⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7864
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        257⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        258⤵
        Modifies registry class
        
        PID:8196
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        259⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        260⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        261⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        262⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        263⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8460
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        265⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        266⤵
        Drops file in System32 directory
        
        PID:8560
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        267⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        268⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        269⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        270⤵
        Drops file in System32 directory
        
        PID:8748
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8792
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        272⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8876
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        274⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        275⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        276⤵
        Drops file in System32 directory
        
        PID:9008
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        277⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        278⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        279⤵
        Modifies registry class
        
        PID:9132
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9180
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        281⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        282⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        283⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        284⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        285⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        286⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        287⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        288⤵
        Modifies registry class
        
        PID:8704
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        289⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        290⤵
        Modifies registry class
        
        PID:8844
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8912
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        292⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8968
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        293⤵
        Modifies registry class
        
        PID:9048
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        294⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        295⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        296⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8364
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        298⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8612
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        300⤵
        Modifies registry class
        
        PID:8676
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        301⤵
        Drops file in System32 directory
        
        PID:8828
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        302⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        303⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        304⤵
        Drops file in System32 directory
        
        PID:9168
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        305⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        306⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        307⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        308⤵
        Modifies registry class
        
        PID:8756
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        309⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9104
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8348
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        312⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        313⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        314⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        315⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        316⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        317⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        318⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        319⤵
        Modifies registry class
        
        PID:9232
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9276
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        321⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        322⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        323⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        324⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9504
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        326⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9564 -s 416
        327⤵
        Program crash
        
        PID:9708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 9564 -ip 9564
1⤵
PID:9640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bbnpqk32.exe

Filesize
272KB

MD5
703a103cf69cdbb03866bc50737fb477

SHA1
bd92db4b7e8de5400452772e4441030e9a92de5e

SHA256
7c176d3de5743f4bc374f9a03539b4ef522fac156e70b0d7a09e2c49cf5e936c

SHA512
cabbda2c94e14086aada3a4db115ff59db48840d3eaa441f0fab3f9ab4b95d93c84b054a55ed9d9999c186e7af8cb629bee83371e9ed5880b96401f42428ef01

Download Submit
C:\Windows\SysWOW64\Bdmpcdfm.exe

Filesize
272KB

MD5
5a8d6c87cc9956a9c461e8fd35b2e1e7

SHA1
82ebb749450f861957e105f2dad383f43c6cdfa7

SHA256
ab1f6d0d4a95b8714dc3229cf3fb1fd6d7d1bfe6821e7ad5f53c38cd266ca743

SHA512
136a0ba4b635987307393d19a480c11b8e47b7c923a594beb893a9ff0bd684e8ef13a68eda09715714f76ad6e2548d2e3b87a46fee9f26279efa2c6a82b1f79d

Download Submit
C:\Windows\SysWOW64\Bldgdago.exe

Filesize
272KB

MD5
b695b85132c5fa4df18931a0c9569b69

SHA1
15afdeab14a091bc218eb3414968bada50f1aafe

SHA256
0a79a923d279b137e208229fa72ac64b0bf92970e114ae4c0521c9647c49b99f

SHA512
87d07e90596321bf966130b4c984b99cfb2d1286f458b0c6a26a3bfbea61a4e17bd118caf5931ba49bffe56bffa690791214c5c1bc64abfc3ed58d71e1be175c

Download Submit
C:\Windows\SysWOW64\Blfdia32.exe

Filesize
272KB

MD5
f270f4e1927e5c26fd82231a37d5ad44

SHA1
a89788df8596c209aae37703b78b3e6d2947e029

SHA256
979f353552bc760c798c3b87ac1ce512ccf939d6ff8259b8c6fd380afa11c529

SHA512
b966f7046acf9f58e8309ee06ff160f5bbc9f02b3bfa630c94c67b72daca8303b9791b5ae1c306171ccb228c0c2013ea899dd8a6802ec5726437c6f61ac89160

Download Submit
C:\Windows\SysWOW64\Boepel32.exe

Filesize
272KB

MD5
87a69a8b3ed677221553dbf5ad119ae8

SHA1
70f36a080474066a9aed9d453136cb09fcbd2570

SHA256
a80f8201d45c03b847ce9d9fc1c107752453b7b6d13d5c1bdc7cf901ebf8807e

SHA512
27d865d8c91828a608b8b91a0bfcf2b31de2e5539a4f0e76019817c73dae6740a2652892e8b8d7d83f02fd4adf429ae7373fd2c00311b438659f6dc33dc530cc

Download Submit
C:\Windows\SysWOW64\Cbefaj32.exe

Filesize
272KB

MD5
5960114f1c72aad80ea113c3fca60634

SHA1
fe5791656e7df7d4cbd69e2fe9b22174d55d25cc

SHA256
ccee1f48acae8257b93d0192d4eb7a660904008c27cd7ae3cc73e95cd525444d

SHA512
e131e1d21c4b378ee03517dfdc4a8b808e50bcd18d95a487b310029a9e379f04818cfe82c2bf30167a01bd784d901cbc61a3f1b21fec472af7763140ea43bfb7

Download Submit
C:\Windows\SysWOW64\Cbgbgj32.exe

Filesize
272KB

MD5
16e74d4e8df1743d133f4729c2ae4e5e

SHA1
e5eaa487f2bcde8544a0f7f00efeb04dbb03683f

SHA256
a94eb09dede8937912a3d51bc1db364e134ade39745eb6dfbb26be5af93a3c0c

SHA512
b9d4aa56eb15a93480b940ac58b4532abb028da9009713bd9f13dfa07f84003581ab78443e29c79361228b5c9ef178c7f18301663be068b00fad7c79efe7fe80

Download Submit
C:\Windows\SysWOW64\Cdfbibnb.exe

Filesize
272KB

MD5
0a9e37e04cc0137a802c1677454c997b

SHA1
4c8d83004b8cbed84a922fead3d78caa4d238a6a

SHA256
6bed8d48c4d42486fe8a97a7977362254323179e51031556b9cc9cbad1d9ecfa

SHA512
708b15cb74f0d0a7128e3115ccac590c47091a6d0fb415f8bf4662c2764c9790e7fc4fbd10fdc48c3acd21dc5a7ce9d68b4afec28dc4abf0580998e92ef0ac60

Download Submit
C:\Windows\SysWOW64\Cdiooblp.exe

Filesize
272KB

MD5
42f661cd70becec3787bda4329a70e5e

SHA1
c9a4f8431ac422cb0b61c0744359f1c4d575b775

SHA256
de5e57b535cbad5ae7c65a3dfbf17cf67529832a968757439480299f0d81d9f0

SHA512
5da4832fa4446ab6aa107adef4b7e04dc74e73e2ef9c01199390b73fe25b2ff238afd78ff16d686bdc24f4117c9fc9835cf440c624bbac5e44348af94139ada9

Download Submit
C:\Windows\SysWOW64\Ceaehfjj.exe

Filesize
272KB

MD5
e5d298cc1d65553ba57f3df7c7513157

SHA1
5977aec3f991708736a1e9c8486137ac30942323

SHA256
b0331eff7ea5032ae5944d2b11e28d195b0700f0cc16ceb3d8e0eae04a0fd91d

SHA512
a0d003efd2d2da3dbc2d97267aa611b068882022b21b78c8ea9f99177d3b7c4f57a3681469855bbd3ae57ab986b2e67124fc54d51c53e4af1c630ce2d39a1af6

Download Submit
C:\Windows\SysWOW64\Cehkhecb.exe

Filesize
272KB

MD5
9c182fb3434bdc260da87999831077f2

SHA1
f28ccc018f4bfb105d52826c212044c77370f399

SHA256
d56da6fb333de0004dd2c4c3b0f9f146de8976d48a96b83aa618ca7f0c48364a

SHA512
31c54bd59d037e44b873cab2fd0fa305e2cfcf5721af957fc9507da073e3b9021e4966e93582181cacdc761f8e8ef298dc1846c9c06fb492eb59a319b600bfb7

Download Submit
C:\Windows\SysWOW64\Chpada32.exe

Filesize
272KB

MD5
db723ba619a96e077e733dcb3ff806ef

SHA1
85c3a161de5af67f14241a9884baba7d501d44f7

SHA256
950a10b40b68bce19b17bd648c8db03a32855278e9bb88bf8c61ca3878c6ca43

SHA512
d19716f9f4227848f48236f96cbbb7fd19bf6b2f952fc6dc1e5c5dd2dc1a7117e4eb327eaac9397233d3ed07e2c00bc14cbfbb61eb389b712b025f1c3085a5df

Download Submit
C:\Windows\SysWOW64\Cliaoq32.exe

Filesize
272KB

MD5
1b896a036151b2ddbf201d9b75871b99

SHA1
dbfbd07bbc245f580290e972ab3790a7952ac87a

SHA256
361cdfc9da832c226b1b0b067a05b8e37863521ca9f8a5ebf2695b5355d9c9ff

SHA512
d58702b0c9edfa13b0b22caaf7c5e95940c10b40a76b514f0c744b0386d9676c578dd7e18222366207087182b5034be688a7b4ad93f38ec2a276cd07b9b6155c

Download Submit
C:\Windows\SysWOW64\Cliaoq32.exe

Filesize
272KB

MD5
122d68486b5a3244195a42e2b2f3e224

SHA1
fc9459b15fe4cee9afc7ddb37181762dda470739

SHA256
6fbbc3c9325f27e4b58269ea970f3d8ad2d3d1664fb99c81390a97767d9e9b94

SHA512
2918c6ed552d9fa73a639c3be60e3ad7e2e5b9a5c90c8e4859b68cbb3c102846c40087b906dff8260645b37150b20e5704a02d48037c6ba37e62a06637d0683c

Download Submit
C:\Windows\SysWOW64\Clpgpp32.exe

Filesize
272KB

MD5
54c4eb2aa00980934d4b39bbe8456836

SHA1
6a89a81c26d28037cb865c23e6e58b1c7f8ab6a4

SHA256
25c2e47ff970ee5c790d27e00f2fe63f54c888f825e321ac9a51f7b04c0d4e8b

SHA512
3ed092815c2d4a3d6097dd36957fdb74f63a09e7c7d348b290b0936697cbbb8fc21986cc93aa1b12ad1ded528c67204d46f362b60960e5111b377f371c6e68ad

Download Submit
C:\Windows\SysWOW64\Dboigi32.exe

Filesize
272KB

MD5
a2e49b9a323ab203bc17b2787515a299

SHA1
ec7ad2cffb0edca136b60d2c8652352f1a53c984

SHA256
56a0bb410f683d93ba51e29c97a0b61dbf6b1fb237991a0337a837a12e0542b4

SHA512
f4ae82afd539668baab593f2fa01322f57c364f6e5e56c68495ac29627a78a6488c59464accc0eb0836c5bcae559e5711f08e2f1ee63c90f9840f017bd847fe0

Download Submit
C:\Windows\SysWOW64\Dceohhja.exe

Filesize
272KB

MD5
86013ff2c936178e59961017f5ebe7b5

SHA1
e7a73a1a578906abe7a539438d31f4119931d860

SHA256
803e46eba673e6611353b6cae1290541b9c01b73ee65bdcc13cd88448ada91e0

SHA512
4a260b548d6e56eac9ab45edf2c8e097c91b16ae5b0b0f24135091dd3fe6ff62630531145120d80fade906d278b6cdb3e337859d45cde1f3f94a30b49d48f9aa

Download Submit
C:\Windows\SysWOW64\Dddojq32.exe

Filesize
272KB

MD5
f1f263d5d22dd06c82d80c1a0357a577

SHA1
3098370e3d47d2696cbd24a6d9a8eed5f94a2a7b

SHA256
a22b0e9f2251d8f3a5c821f4fef84a8090a8487a3d27369189a6a7089d4c41db

SHA512
a5d9af92b6421f9f31e300723c08363f34b78aa4dba561868cdc3280aaf86390fbac71ebf12694dc55947f62c912c57341915930feea170020a19405e5e01545

Download Submit
C:\Windows\SysWOW64\Ddgkpp32.exe

Filesize
272KB

MD5
858e316de3871fbe33e3d0e0a4455d12

SHA1
b137cc790431f43dc7d2e11c96a169f4ba049b6e

SHA256
9659573a5d618efd509ec1257f3ba103e9cf6929999ef2096b3f32e1e619614a

SHA512
710468c6ad6d822b4c66cedd88ed461de81a559caa17f091cf6424a26270f0b4f1bebbbfceaaf6d2929efcb652fd20d4aab32f15ab0d8b5ff0253ace34502f04

Download Submit
C:\Windows\SysWOW64\Ddpeoafg.exe

Filesize
272KB

MD5
c909a6d1b0c8d7bdafa3abce15f5d1ad

SHA1
aacb1c419b6e266f79e59f8c2db443165b803e3b

SHA256
52ed92a20c26440a606e049f26b248a8e948840830cf8b3a5d5677c4e6dfd6d6

SHA512
031ee3475710d75a9499c96786c1c9d053aa42550aabd496f55633f514a607db8b785bf240add502abd1babfdc569782a51769dea9459fda68b1a306f97f186b

Download Submit
C:\Windows\SysWOW64\Demecd32.exe

Filesize
272KB

MD5
e16b64e8b38c9f5d975e1062dac56087

SHA1
d9b763e4eed326fbfeefc455eb9414728edf25da

SHA256
d57091c3979d46cd8ce1e4760031b4c5f5df0011afde8f762e828b489d01b822

SHA512
4d44a85fe9cd2626ae407ca49e542fdade4d99e873904bb7cbfa0d1017252f518be61780a694beb4704c6cd288f445c2b6927067ab93e4593ed09a443e42712a

Download Submit
C:\Windows\SysWOW64\Deoaid32.exe

Filesize
272KB

MD5
4014943194fc2463d6aa2779364d8740

SHA1
e2af4e09dfb24908a0453223047c75a5ad1d36a6

SHA256
270f5568005c64a941d9ecfbd7d1a0a886d936976953e2850fe88ff7d5f9c252

SHA512
7fb965cff3361c5867093d5d4c92b1c8d4f9991c7d33109a47d13917477f85aa2223041b98e8a95ed93e754e6197516b914e44a4601d7aedc7de30101323e581

Download Submit
C:\Windows\SysWOW64\Dhidjpqc.exe

Filesize
272KB

MD5
49b29af5b6f5309c93f9b09129c61e16

SHA1
e870d0343637882dfc591912bbb629ed380a7b10

SHA256
2e0fa0e2681bce51c5f9e5be5c9cace877f3453b48667419817b6088813f303e

SHA512
788c8d73ea11354831f527ca9b615997ce4a87f110bcb2d362adac6cbd693516948e448d33f9304e01669f5417de0f34ecfc2eeb3215ee15d66f3de96a89ea0a

Download Submit
C:\Windows\SysWOW64\Dkgqfl32.exe

Filesize
272KB

MD5
534adda8d8f34bf656fdbbecc11292ea

SHA1
22175eca0ec8d5a38ff0d40e4f50c0742a4e0177

SHA256
395545aa977783530d0ac9e4681f15d9ff4abe05d9cb02054569e9a544af3c31

SHA512
2a44692a33aa193bd119d7f9116182bf3e8e123007fa7b48c64b02101b86c80824bc1d7c9836273d8e03cd265a6753bbab9097c3b1e433963fa34cb5fd13f35f

Download Submit
C:\Windows\SysWOW64\Dkljak32.exe

Filesize
272KB

MD5
6aed1cf69464f55a5493e8a32fd9ec71

SHA1
58bd5ffc33787b44ebb64a1e07f460ecc8c37762

SHA256
7f20d62e9ec4cbf85595a11f66b4b36f46e1fb15ba04b77d9e834f45db410f85

SHA512
da488b4db59b08f81875d51e6cfb9a7c5de04c1b7dc816c0ce60659e45ffadf586c831a170f3ae1d0360e94a31beed2f7e0dd9565224ae05f99a875f853d797b

Download Submit
C:\Windows\SysWOW64\Dllfkn32.exe

Filesize
272KB

MD5
85e24f560858320a2cd7caac409eeaf5

SHA1
ea8e176ac4815e1e105d9bc39d9dd9794f2ccfed

SHA256
aebbb319dfa96378eda9273e71f8b9b113074192b09f891a6de6da889a8a6404

SHA512
6b7a18faa805a250d3404cb924f0e33a2e793b518819dd4bf8358f48e05f60dda9be03c61c124beb9852bbf9733e0cef62b05df953af23dd7b4b9457ec3f0d40

Download Submit
C:\Windows\SysWOW64\Doeiljfn.exe

Filesize
272KB

MD5
b2ede0db190d458855902bd1c09e43f4

SHA1
379f87525d4c8ec858d90e7b333c6ede1046153a

SHA256
b87fb7153bc6000536b03062abddc2a558a889af235f39dcec7604722371f60d

SHA512
2dec2f87ae2e14ed8f8c3aea2b7cd0b7c664d0e7b7472bcf966d173abd81704c08cf63b6ff7e5d070809490f8feefa501cb2247908dd62294cdb666956c3fe34

Download Submit
C:\Windows\SysWOW64\Dohfbj32.exe

Filesize
272KB

MD5
785d997a785a474ecfe2768c584397e7

SHA1
4893c153ded933de9f30a1eca30a787bf185ac26

SHA256
4266a458f5441ed3e8788591fa5f8e448e9fef5143a064ac89ad2aa80924c9b4

SHA512
83d243c6898220673ad19fc3c39f6ee1a377fbb5f0d952027c5653b0dd4ccc69aafdf20a1d4cf48f428fc4ffaa1db002e2b44577484e0037ebbf09f7262a2b36

Download Submit
C:\Windows\SysWOW64\Doqpak32.exe

Filesize
272KB

MD5
a9714c62981a21993b15105e4d61d4c9

SHA1
d309c979e9d0807cf6e2c8262f9af5903ab6d6b1

SHA256
944aa02651a1efa87bb7abf087f862d00b2350bb881f5d0247203d8464caf7e4

SHA512
ad1453be2ea745c16a111a0176f59baaddaa24feb360639c3f2e9070834b3521aa88153d494950b49462685494534754cf298a7621fa7faed5d0ebf627b1246c

Download Submit
C:\Windows\SysWOW64\Doqpak32.exe

Filesize
272KB

MD5
ef12b6e41a99f4a64d7213169d801487

SHA1
5806980314b377adfaa4b6f07a5630be1f03a86a

SHA256
1febd2d1dbe6e210533a9f6148e6e60345878bfc6b22c49b7b5c4ffc34308d45

SHA512
fc10e64b3e2d34cc2ec46b75f71823a602f3a7373ed77f922202669fb4854620f1884c47a7aa59094e6fd8292977678ece84c6dcd22622d94ad23d4e8ba8b4fc

Download Submit
C:\Windows\SysWOW64\Eaklidoi.exe

Filesize
272KB

MD5
df63dc7f65822c3a977a8dbca1830407

SHA1
029eb2fb7537631348c9caa9f537fb0bae23dce1

SHA256
c13a3954fa231a4c80b2eab6df8b79833cde8403334cf690055cccac0642e8d4

SHA512
8d0ff46205e7b99c142992264e969f4a706c28b90963d068df2146e1de4feb4db8e8d96ee1efb4648e7d8ef13f6ea162d68ce3a20a52acb3df2837a7480a9a50

Download Submit
C:\Windows\SysWOW64\Ecjhcg32.exe

Filesize
272KB

MD5
c95a8f3e4ba90c4fcf9c2046e62ca986

SHA1
7f66d3ee11d3d08a29cf19ff780fb0a50798ae7f

SHA256
43730cec27634e5660641fc75b1bcf4ad50f7a91f7ab95740b0dc1487ba16798

SHA512
c5665cb00a2f1d3cc5aedfdc7e316808cecfe5606ccdf9b2ef702328a21c8b7382ca9372416e3d80ae30e0a4cc69db61ca9b4506334e37808a73cb2cb5db11c9

Download Submit
C:\Windows\SysWOW64\Ekjfcipa.exe

Filesize
272KB

MD5
816200f81a458c2cb455020f52d651e1

SHA1
f8b41c1dbccc52030fc7a6dff3ad45dcb6b280f1

SHA256
f8534430a270ecbefea6287d6d82c01823dfecf1bd40016be243c77385e34faa

SHA512
d13035b300cdfdfc27033010b7ec68692c2a871fc99f958ac8ae889dde3170b391ef65d24eae7a7f6d249e22fe7ae582c37751cad81de50223971f7cce2e197f

Download Submit
C:\Windows\SysWOW64\Elppfmoo.exe

Filesize
272KB

MD5
b24bd60520cfed29f33923f1865b2b62

SHA1
0cc2aa79b0db3f5d40c315123486be28e0509e5f

SHA256
d82e1c6e7475fb0f3d6f09ddf548c3a22af758c2006de1a25990116e4e79a1ab

SHA512
6ebddc99172fd6b2e42edd9bd3260b84646eedcaad5d61de9e267921d218c46cda18549ba0ec29b19b5d643eb392394a870f77ac235aa754c7d73295cb2d8b50

Download Submit
C:\Windows\SysWOW64\Eolpmi32.exe

Filesize
272KB

MD5
c1b49086fb65d7c2174c43de04b067c0

SHA1
60eed7807a652314ee945a7e0ad045f2722f2fc3

SHA256
9bfd7e9ecb2aabcada569e759cb8af19d9205b57ee969e75c99b92b4380b3bc6

SHA512
e746a3a89a912836063a2079c0dc6936e02d18d46ffe499312669df1246dfff1a5ca5e5a4cb7fe5e55c03adfee0fd2d072aa17a00f7ff8df5607226f5c026bef

Download Submit
C:\Windows\SysWOW64\Fllpbldb.exe

Filesize
272KB

MD5
3254ff50ad57bab210cdde4f822b7da2

SHA1
fc18830b453d7446ebd89c99b2279af9739652f4

SHA256
6d8668ca51822c37539ec5dcb381e625175562eab4f9eb8de20d8c42cc3940d0

SHA512
7a3394837f82c170f4107212c88e6301c097ca1a25b3fae7b194f23a8505405c84f5118ca5f1f98bebe5be2443a67c6373aeebb63061d5587fe262693fdfbe0d

Download Submit
C:\Windows\SysWOW64\Fomhdg32.exe

Filesize
272KB

MD5
78ea82a76cbe147339b112f67ac74fe4

SHA1
161ffaa0e47d5255adf2a4d632aa2d6a25ca6906

SHA256
eec4c1f78482928f890cbad6709ed9dee8dbac77ab60e836cbd419bfd636e39a

SHA512
547a8745eeac5c2f4986674b70123b437ffec0f50ec7d7f7c023905427f207f989da6d5789d0efd008e1c734219b7af1043dd1eafe248d0d14fb5c790a00c3b6

Download Submit
C:\Windows\SysWOW64\Gomakdcp.exe

Filesize
272KB

MD5
22fc9db27c553082508d6576285929be

SHA1
f9ab72ab8a5111b842a68d93dd630007cc354f8f

SHA256
7930ff50a2dbaf6b578e422a799ebd8e6e4abb9e96e864f8f720d95acc57e243

SHA512
2eb4c5c62c069d210585be6c235c113b4eee0e008417cdedf6fa243ae1c72a70b36c2255843f4be07dfd849ea4f42c230f184e2e800feee9f55b1da1d00e7fdb

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
272KB

MD5
240c13d743e67c9e3776e3dcd8724a00

SHA1
1a7a5b0d327b2f78320016310691be1051689fa6

SHA256
32f45d7f6003d6b3a26bb3c3749f236048a83f15e9935a8c8f1bc0956f87c635

SHA512
b4784e2677999fa2edaa73f975b613a87b6cdca2e0e0d229ecab5921e18b92107f50b2a12e45a6f0aadb10e6372e7786bf1df0aebe385d24eb426a99fc17a3ff

Download Submit
C:\Windows\SysWOW64\Hmhhehlb.exe

Filesize
272KB

MD5
5384660ffbdef3e1f5257864d6f6571c

SHA1
2efbc5b1d2f60941778fd9c7d3e465479b16105d

SHA256
1f8479914f6f656398a4e7ec0f70ea86794dc7d4268f15d9e3c793a6c2711bb2

SHA512
663a5fdc5043c3c47173a0fc0c5564ec99bd0b7306fd2407b663fc60e75c9dad1cb9042f1f1d387bb2963c518fb57930d067cde801bc8a7aa59c1189aef4034b

Download Submit
C:\Windows\SysWOW64\Hobkfd32.exe

Filesize
272KB

MD5
00fb1c5358c9f8831953a15c39532f25

SHA1
63fdfe785bcb10b1a7ea4beaa27e5782eb18b0fc

SHA256
635f71727b46bab05e379db28d7c179c59bf36d0a95e45b2239570f7e86fc6a7

SHA512
d93f4bd07a52156766085907301430a83af8f2c8771525e05eb3cfdb893edcb8c34b5179966df3170e971da943b669d66a3d828bdc0c09acab5da56ddcda176f

Download Submit
C:\Windows\SysWOW64\Ilabfj32.dll

Filesize
7KB

MD5
3f26e41db071f13944e2dd6a0bc4319f

SHA1
b5406567ba1fa1b37b994f14d989d88e4df4ad11

SHA256
4c6742db615295d82b6e2075e430edcd7758a66703cb2505c3c7edee855695f4

SHA512
4a56caee1f488a512e34af4530a2be2122e4d774c8cf7f9d4bd9f32e9447815f4f605841c215f2e3dd97daad3aeefa667f6fc26755f400ee7ec21ece75902ee5

Download Submit
C:\Windows\SysWOW64\Lgokmgjm.exe

Filesize
272KB

MD5
3b7b0d81b09cce7ebcdae9155965e1a6

SHA1
9e6b07911c03e98b87882dcc6546c4b26dc457b1

SHA256
ce011906fd767c09237618a36b993138d5986396b8a4d3d51b47f80626e9253f

SHA512
fd66ea84178bc62df87a996a596dca5461299a10bd2e4bda61dfcf6f5d0482ecef91024e41e195d9e57cf60ce744ee06b255f50902549d740e747cbf531706e4

Download Submit
C:\Windows\SysWOW64\Liddbc32.exe

Filesize
272KB

MD5
27ad58ac4d5897af493930fbdc25b5a2

SHA1
ceb9aa3da91585ca7caf2e1bb51d765ca6b30c9b

SHA256
a7ffc3a63c4f951b59baba8a3e33b604ed9681a0631f76518b03213b7b300730

SHA512
1b6d31a0007e758a74fe6d4a063a1d4ad908185df263e331a28605db2e6c3a8d9e2b5c705581e76a56fdb37037af9f79abbedabd7847fee31cbf956eb272b84b

Download Submit
C:\Windows\SysWOW64\Mdehlk32.exe

Filesize
272KB

MD5
5c9ede1f06160b34bf1ac840e808321b

SHA1
90fdd80b15056f08ce38698adb008b68610125ff

SHA256
c24512add19ecdcdec7824e56fb53f42184c588e612ec8f1112dedb712d8f81d

SHA512
b36b05b49b1060e4e028e5532698eaa7ffc71a17726749655c6423c8e2215eecf844d4dfd6508b23adec5363e5d8ad9367babac8481d72dff7616763056d778d

Download Submit
C:\Windows\SysWOW64\Mpablkhc.exe

Filesize
272KB

MD5
62d84fe142397d6c096f52ca8f151d72

SHA1
15a06209e524671d192c1eb2c6f12337035b9f93

SHA256
6294922b3fb2efb1e8b36b86b51109505e44337ff190d8845a78442c312b6715

SHA512
9ea085e30fe260c8886aabdbb4f4ff5f6f18637796e964dbed3476f50398e1152d1b19bb2a1a3ac989bd8a676fd59ca93c5e4bbc135d4602ea3e3ec691601b90

Download Submit
memory/452-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/508-363-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/624-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/728-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/872-371-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/880-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/940-274-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1140-437-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1200-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1228-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1244-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1392-280-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1424-393-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1488-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1500-172-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1632-240-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1668-103-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1816-111-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1864-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1872-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1912-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1948-436-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2088-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2128-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2132-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2252-95-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2260-346-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2280-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2288-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2360-364-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2444-304-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2452-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2492-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2508-316-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2544-292-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2840-425-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2852-47-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3012-224-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3192-322-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3460-411-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3468-152-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3484-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3544-298-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3604-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3632-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3684-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3940-401-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3956-286-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3964-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4028-417-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4032-12-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4108-216-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4524-340-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4572-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4584-334-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4656-28-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4768-79-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4852-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4864-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4936-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4960-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5012-400-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5028-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5108-119-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6664-2196-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/8592-2185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/8756-2184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/8900-2190-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/9048-2199-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/9104-2182-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/9276-2172-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/9504-2167-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/9564-2166-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads