5b3f5e78d791f7a3340027baf0d8d9a5c9381222fb1091e06e70471ea67d1e05

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b3f5e78d791f7a3340027baf0d8d9a5c9381222fb1091e06e70471ea67d1e05.exe
Size

93KB
MD5

5bf38e721c85059055f1fe31de889c09
SHA1

173692d6da17b2a63449bc46058fd0293fa6c30e
SHA256

5b3f5e78d791f7a3340027baf0d8d9a5c9381222fb1091e06e70471ea67d1e05
SHA512

a4168a3d9a476dad031729b09a3a766ebba6c2fea213c301f8e301fd0f7167e7ca5d61ad4b472ccfaae3afadd7d744e531f01cb6b2f1f6464a1a02e781fd5f17
SSDEEP

1536:cxgu7mGhfUiOY2rglrnEyBOLwhgWBKydEBNLF41DA1QLsRQxRkRLJzeLD9N0iQGi:cKu7mGj2rgFEyBOLigOmhF4gbexSJdEs

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eemnjbaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilidbbgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajfoiqll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aelcfilb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hodgkc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmmjgejj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qmkadgpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dafbne32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmlhii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcmnpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Llgjjnlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cehkhecb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edbklofb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gmoeoidl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icplcpgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecjhcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbnjmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgagbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajdbcano.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cliaoq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdiooblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iehfdi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Menjdbgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afmhck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aacckjaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhfonc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnlnon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clpgpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghlcnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oncofm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aacckjaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajneip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfcicmqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ieolehop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlaegk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnnjen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cahfmgoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhbgqohi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkciihgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imakkfdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpablkhc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dbaemi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dddojq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndikf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdiooblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ncbknfed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Migjoaaf.exe

Executes dropped EXE 64 IoCs

pid	Process
3648	Ajdbcano.exe
4488	Abkjdnoa.exe
4500	Acmflf32.exe
2832	Ajfoiqll.exe
2960	Abngjnmo.exe
2136	Aelcfilb.exe
1468	Alfkbc32.exe
4948	Andgoobc.exe
1708	Aacckjaf.exe
2624	Ahmlgd32.exe
2520	Ajkhdp32.exe
4412	Abbpem32.exe
2972	Aealah32.exe
1396	Ajneip32.exe
732	Bahmfj32.exe
4360	Becifhfj.exe
1268	Bnlnon32.exe
1692	Bbgipldd.exe
992	Bhdbhcck.exe
2236	Bnnjen32.exe
5112	Balfaiil.exe
1664	Bhfonc32.exe
2392	Bopgjmhe.exe
5016	Baocghgi.exe
2908	Bhikcb32.exe
4644	Bemlmgnp.exe
3596	Bhkhibmc.exe
3684	Boepel32.exe
1784	Cacmah32.exe
3468	Cliaoq32.exe
1208	Cogmkl32.exe
1256	Ceaehfjj.exe
1152	Cojjqlpk.exe
1888	Cahfmgoo.exe
3396	Chbnia32.exe
3792	Ckpjfm32.exe
4900	Cbgbgj32.exe
3880	Cdiooblp.exe
3212	Clpgpp32.exe
4784	Conclk32.exe
3640	Cehkhecb.exe
4824	Chghdqbf.exe
844	Doqpak32.exe
2416	Dbllbibl.exe
4816	Dekhneap.exe
4612	Dhidjpqc.exe
3132	Dkgqfl32.exe
4988	Docmgjhp.exe
3712	Demecd32.exe
1052	Dlgmpogj.exe
3500	Dbaemi32.exe
1768	Deoaid32.exe
5116	Dhnnep32.exe
3824	Dlijfneg.exe
4040	Dkljak32.exe
4172	Dafbne32.exe
448	Dddojq32.exe
1508	Dllfkn32.exe
3108	Dkoggkjo.exe
1120	Dahode32.exe
4388	Dhbgqohi.exe
4536	Ekacmjgl.exe
2008	Eolpmi32.exe
4756	Eaklidoi.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Boepel32.exe	Bhkhibmc.exe
File created	C:\Windows\SysWOW64\Gfembo32.exe	Gcfqfc32.exe
File created	C:\Windows\SysWOW64\Nnqbanmo.exe	Nfjjppmm.exe
File created	C:\Windows\SysWOW64\Oqfdnhfk.exe	Onhhamgg.exe
File opened for modification	C:\Windows\SysWOW64\Gcfqfc32.exe	Gmlhii32.exe
File created	C:\Windows\SysWOW64\Kipkhdeq.exe	Klljnp32.exe
File created	C:\Windows\SysWOW64\Neeqea32.exe	Ndcdmikd.exe
File opened for modification	C:\Windows\SysWOW64\Chbnia32.exe	Cahfmgoo.exe
File created	C:\Windows\SysWOW64\Fdgdgnbm.exe	Ffddka32.exe
File opened for modification	C:\Windows\SysWOW64\Gblngpbd.exe	Gkaejf32.exe
File opened for modification	C:\Windows\SysWOW64\Leihbeib.exe	Lbjlfi32.exe
File opened for modification	C:\Windows\SysWOW64\Ldoaklml.exe	Llgjjnlj.exe
File created	C:\Windows\SysWOW64\Nngokoej.exe	Nepgjaeg.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Dhidjpqc.exe	Dekhneap.exe
File created	C:\Windows\SysWOW64\Nhgfglco.dll	Lpebpm32.exe
File opened for modification	C:\Windows\SysWOW64\Ojaelm32.exe	Ogbipa32.exe
File opened for modification	C:\Windows\SysWOW64\Pflplnlg.exe	Pdkcde32.exe
File created	C:\Windows\SysWOW64\Ebdijfii.dll	Beglgani.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Icnpmp32.exe	Ilghlc32.exe
File created	C:\Windows\SysWOW64\Onhhamgg.exe	Ognpebpj.exe
File opened for modification	C:\Windows\SysWOW64\Agjhgngj.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Hjfgfh32.dll	Qjoankoi.exe
File created	C:\Windows\SysWOW64\Ilabfj32.dll	Bhkhibmc.exe
File created	C:\Windows\SysWOW64\Dbaemi32.exe	Dlgmpogj.exe
File created	C:\Windows\SysWOW64\Gfngap32.exe	Gododflk.exe
File opened for modification	C:\Windows\SysWOW64\Gohhpe32.exe	Gmjlcj32.exe
File created	C:\Windows\SysWOW64\Hfnhlp32.dll	Jmmjgejj.exe
File created	C:\Windows\SysWOW64\Poahbe32.dll	Ddonekbl.exe
File opened for modification	C:\Windows\SysWOW64\Edkdkplj.exe	Ecjhcg32.exe
File created	C:\Windows\SysWOW64\Gjdlbifk.dll	Jcgbco32.exe
File opened for modification	C:\Windows\SysWOW64\Lmbmibhb.exe	Lbmhlihl.exe
File created	C:\Windows\SysWOW64\Lfkaag32.exe	Ldleel32.exe
File created	C:\Windows\SysWOW64\Becifhfj.exe	Bahmfj32.exe
File created	C:\Windows\SysWOW64\Ceaehfjj.exe	Cogmkl32.exe
File created	C:\Windows\SysWOW64\Kebbafoj.exe	Kbceejpf.exe
File created	C:\Windows\SysWOW64\Kmdjdl32.dll	Deokon32.exe
File opened for modification	C:\Windows\SysWOW64\Abbpem32.exe	Ajkhdp32.exe
File opened for modification	C:\Windows\SysWOW64\Icnpmp32.exe	Ilghlc32.exe
File created	C:\Windows\SysWOW64\Kdeoemeg.exe	Kipkhdeq.exe
File created	C:\Windows\SysWOW64\Ldleel32.exe	Lmbmibhb.exe
File created	C:\Windows\SysWOW64\Neimdg32.dll	Mgddhf32.exe
File created	C:\Windows\SysWOW64\Flnakb32.dll	Eaklidoi.exe
File opened for modification	C:\Windows\SysWOW64\Fkalchij.exe	Flnlhk32.exe
File created	C:\Windows\SysWOW64\Bkblkg32.dll	Ibqpimpl.exe
File opened for modification	C:\Windows\SysWOW64\Kmdqgd32.exe	Kemhff32.exe
File created	C:\Windows\SysWOW64\Medgncoe.exe	Mgagbf32.exe
File created	C:\Windows\SysWOW64\Bnpppgdj.exe	Bgehcmmm.exe
File opened for modification	C:\Windows\SysWOW64\Fhemmlhc.exe	Fakdpb32.exe
File created	C:\Windows\SysWOW64\Chbnia32.exe	Cahfmgoo.exe
File created	C:\Windows\SysWOW64\Ooajidfn.dll	Jfoiokfb.exe
File created	C:\Windows\SysWOW64\Bkjlibkf.dll	Mnebeogl.exe
File created	C:\Windows\SysWOW64\Caebma32.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Fakdpb32.exe	Fkalchij.exe
File created	C:\Windows\SysWOW64\Chmhoe32.dll	Oneklm32.exe
File created	C:\Windows\SysWOW64\Lommhphi.dll	Bfabnjjp.exe
File opened for modification	C:\Windows\SysWOW64\Boepel32.exe	Bhkhibmc.exe
File created	C:\Windows\SysWOW64\Jcbihpel.exe	Jlkagbej.exe
File created	C:\Windows\SysWOW64\Edgbbfnk.dll	Kdeoemeg.exe
File created	C:\Windows\SysWOW64\Nniadn32.dll	Lmiciaaj.exe
File opened for modification	C:\Windows\SysWOW64\Cjmgfgdf.exe	Caebma32.exe
File created	C:\Windows\SysWOW64\Dbllbibl.exe	Doqpak32.exe
File created	C:\Windows\SysWOW64\Jmnoof32.dll	Gkaejf32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8900	8716	WerFault.exe	422

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hfcicmqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mdhdajea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhidjpqc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fhgjblfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hledan32.dll"	Kemhff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kmdqgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ecjhcg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gdeqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfilim32.dll"	Pjeoglgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bemlmgnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cacmah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gkaejf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kmijbcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Odkjng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgoilo32.dll"	Ajneip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghkebndc.dll"	Hbbdholl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eheqhpfp.dll"	Iiaephpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Icgjmapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jmknaell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pnonbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jbeidl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odqjbebh.dll"	Hkfoeega.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ieolehop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfnphnen.dll"	Afjlnk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Andgoobc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bhkhibmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gogiek32.dll"	Edkdkplj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmemac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jpppnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flpafo32.dll"	Kfmepi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Odkjng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ehimanbq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jmbdbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fplmmdoj.dll"	Ldoaklml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ofnckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjpmk32.dll"	Aglemn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ofnckp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pnonbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cndikf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cogmkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pniggbmk.dll"	Ekacmjgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ekemhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Allebf32.dll"	Lbmhlihl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oolpjdob.dll"	Lfkaag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pjcbbmif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Elppfmoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhpili32.dll"	Eofbch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gcfqfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgaoidec.dll"	Pgnilpah.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poahbe32.dll"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpjgop32.dll"	Ekhjmiad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjkmdp32.dll"	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pjeoglgc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pdkcde32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 3648	3044	5b3f5e78d791f7a3340027baf0d8d9a5c9381222fb1091e06e70471ea67d1e05.exe	84
PID 3044 wrote to memory of 3648	3044	5b3f5e78d791f7a3340027baf0d8d9a5c9381222fb1091e06e70471ea67d1e05.exe	84
PID 3044 wrote to memory of 3648	3044	5b3f5e78d791f7a3340027baf0d8d9a5c9381222fb1091e06e70471ea67d1e05.exe	84
PID 3648 wrote to memory of 4488	3648	Ajdbcano.exe	85
PID 3648 wrote to memory of 4488	3648	Ajdbcano.exe	85
PID 3648 wrote to memory of 4488	3648	Ajdbcano.exe	85
PID 4488 wrote to memory of 4500	4488	Abkjdnoa.exe	86
PID 4488 wrote to memory of 4500	4488	Abkjdnoa.exe	86
PID 4488 wrote to memory of 4500	4488	Abkjdnoa.exe	86
PID 4500 wrote to memory of 2832	4500	Acmflf32.exe	87
PID 4500 wrote to memory of 2832	4500	Acmflf32.exe	87
PID 4500 wrote to memory of 2832	4500	Acmflf32.exe	87
PID 2832 wrote to memory of 2960	2832	Ajfoiqll.exe	88
PID 2832 wrote to memory of 2960	2832	Ajfoiqll.exe	88
PID 2832 wrote to memory of 2960	2832	Ajfoiqll.exe	88
PID 2960 wrote to memory of 2136	2960	Abngjnmo.exe	89
PID 2960 wrote to memory of 2136	2960	Abngjnmo.exe	89
PID 2960 wrote to memory of 2136	2960	Abngjnmo.exe	89
PID 2136 wrote to memory of 1468	2136	Aelcfilb.exe	90
PID 2136 wrote to memory of 1468	2136	Aelcfilb.exe	90
PID 2136 wrote to memory of 1468	2136	Aelcfilb.exe	90
PID 1468 wrote to memory of 4948	1468	Alfkbc32.exe	91
PID 1468 wrote to memory of 4948	1468	Alfkbc32.exe	91
PID 1468 wrote to memory of 4948	1468	Alfkbc32.exe	91
PID 4948 wrote to memory of 1708	4948	Andgoobc.exe	92
PID 4948 wrote to memory of 1708	4948	Andgoobc.exe	92
PID 4948 wrote to memory of 1708	4948	Andgoobc.exe	92
PID 1708 wrote to memory of 2624	1708	Aacckjaf.exe	93
PID 1708 wrote to memory of 2624	1708	Aacckjaf.exe	93
PID 1708 wrote to memory of 2624	1708	Aacckjaf.exe	93
PID 2624 wrote to memory of 2520	2624	Ahmlgd32.exe	94
PID 2624 wrote to memory of 2520	2624	Ahmlgd32.exe	94
PID 2624 wrote to memory of 2520	2624	Ahmlgd32.exe	94
PID 2520 wrote to memory of 4412	2520	Ajkhdp32.exe	95
PID 2520 wrote to memory of 4412	2520	Ajkhdp32.exe	95
PID 2520 wrote to memory of 4412	2520	Ajkhdp32.exe	95
PID 4412 wrote to memory of 2972	4412	Abbpem32.exe	96
PID 4412 wrote to memory of 2972	4412	Abbpem32.exe	96
PID 4412 wrote to memory of 2972	4412	Abbpem32.exe	96
PID 2972 wrote to memory of 1396	2972	Aealah32.exe	97
PID 2972 wrote to memory of 1396	2972	Aealah32.exe	97
PID 2972 wrote to memory of 1396	2972	Aealah32.exe	97
PID 1396 wrote to memory of 732	1396	Ajneip32.exe	98
PID 1396 wrote to memory of 732	1396	Ajneip32.exe	98
PID 1396 wrote to memory of 732	1396	Ajneip32.exe	98
PID 732 wrote to memory of 4360	732	Bahmfj32.exe	99
PID 732 wrote to memory of 4360	732	Bahmfj32.exe	99
PID 732 wrote to memory of 4360	732	Bahmfj32.exe	99
PID 4360 wrote to memory of 1268	4360	Becifhfj.exe	100
PID 4360 wrote to memory of 1268	4360	Becifhfj.exe	100
PID 4360 wrote to memory of 1268	4360	Becifhfj.exe	100
PID 1268 wrote to memory of 1692	1268	Bnlnon32.exe	101
PID 1268 wrote to memory of 1692	1268	Bnlnon32.exe	101
PID 1268 wrote to memory of 1692	1268	Bnlnon32.exe	101
PID 1692 wrote to memory of 992	1692	Bbgipldd.exe	102
PID 1692 wrote to memory of 992	1692	Bbgipldd.exe	102
PID 1692 wrote to memory of 992	1692	Bbgipldd.exe	102
PID 992 wrote to memory of 2236	992	Bhdbhcck.exe	103
PID 992 wrote to memory of 2236	992	Bhdbhcck.exe	103
PID 992 wrote to memory of 2236	992	Bhdbhcck.exe	103
PID 2236 wrote to memory of 5112	2236	Bnnjen32.exe	104
PID 2236 wrote to memory of 5112	2236	Bnnjen32.exe	104
PID 2236 wrote to memory of 5112	2236	Bnnjen32.exe	104
PID 5112 wrote to memory of 1664	5112	Balfaiil.exe	105

C:\Users\Admin\AppData\Local\Temp\5b3f5e78d791f7a3340027baf0d8d9a5c9381222fb1091e06e70471ea67d1e05.exe
"C:\Users\Admin\AppData\Local\Temp\5b3f5e78d791f7a3340027baf0d8d9a5c9381222fb1091e06e70471ea67d1e05.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\Ajdbcano.exe
  C:\Windows\system32\Ajdbcano.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\SysWOW64\Abkjdnoa.exe
    C:\Windows\system32\Abkjdnoa.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\SysWOW64\Acmflf32.exe
      C:\Windows\system32\Acmflf32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2832
      - C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:732
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4360
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1268
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1692
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1664
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        24⤵
        Executes dropped EXE
        
        PID:2392
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        25⤵
        Executes dropped EXE
        
        PID:5016
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        26⤵
        Executes dropped EXE
        
        PID:2908
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4644
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3596
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        29⤵
        Executes dropped EXE
        
        PID:3684
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1784
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3468
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1208
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        33⤵
        Executes dropped EXE
        
        PID:1256
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        34⤵
        Executes dropped EXE
        
        PID:1152
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1888
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        36⤵
        Executes dropped EXE
        
        PID:3396
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        37⤵
        Executes dropped EXE
        
        PID:3792
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        38⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3880
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3212
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        41⤵
        Executes dropped EXE
        
        PID:4784
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3640
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        43⤵
        Executes dropped EXE
        
        PID:4824
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:844
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        45⤵
        Executes dropped EXE
        
        PID:2416
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4816
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4612
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        48⤵
        Executes dropped EXE
        
        PID:3132
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        49⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        50⤵
        Executes dropped EXE
        
        PID:3712
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1052
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3500
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        53⤵
        Executes dropped EXE
        
        PID:1768
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        54⤵
        Executes dropped EXE
        
        PID:5116
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        55⤵
        Executes dropped EXE
        
        PID:3824
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        56⤵
        Executes dropped EXE
        
        PID:4040
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4172
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:448
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        59⤵
        Executes dropped EXE
        
        PID:1508
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        60⤵
        Executes dropped EXE
        
        PID:3108
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        61⤵
        Executes dropped EXE
        
        PID:1120
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4388
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4536
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        64⤵
        Executes dropped EXE
        
        PID:2008
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4756
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        66⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        67⤵
        Modifies registry class
        
        PID:1688
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        68⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4608
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        70⤵
        Modifies registry class
        
        PID:2332
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        71⤵
        Modifies registry class
        
        PID:4896
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        72⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        73⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        74⤵
        Modifies registry class
        
        PID:2128
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        75⤵
        Modifies registry class
        
        PID:4508
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        76⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4808
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        78⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        79⤵
        
        PID:940
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        80⤵
        Modifies registry class
        
        PID:5060
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        81⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4744
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        83⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        84⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        85⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        86⤵
        Drops file in System32 directory
        
        PID:2188
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        87⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        88⤵
        Drops file in System32 directory
        
        PID:3172
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        89⤵
        Drops file in System32 directory
        
        PID:2144
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        90⤵
        Drops file in System32 directory
        
        PID:1456
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        91⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2052
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        93⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        94⤵
        Modifies registry class
        
        PID:2272
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        95⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1304
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        97⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        98⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        99⤵
        Drops file in System32 directory
        
        PID:3444
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        100⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1056
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        102⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        103⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        104⤵
        Drops file in System32 directory
        
        PID:4128
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        105⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        106⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        107⤵
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5208
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        109⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        110⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5348
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        112⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5384
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        113⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        114⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        115⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5560
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        117⤵
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        118⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        119⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        120⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        121⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5804
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        123⤵
        Modifies registry class
        
        PID:5848
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        124⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        125⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        126⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        127⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        128⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        129⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        130⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5204
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        132⤵
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        133⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        134⤵
        Modifies registry class
        
        PID:5392
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5464
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        136⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        137⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5668
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        139⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        140⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        141⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        142⤵
        Drops file in System32 directory
        
        PID:5924
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        143⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        144⤵
        Drops file in System32 directory
        
        PID:6052
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5180
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5312
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        148⤵
        Drops file in System32 directory
        
        PID:5432
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        149⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        150⤵
        Drops file in System32 directory
        
        PID:5576
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        151⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        152⤵
        Modifies registry class
        
        PID:5876
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        153⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        154⤵
        Modifies registry class
        
        PID:6016
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        155⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5376
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        157⤵
        Drops file in System32 directory
        
        PID:5512
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        158⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        159⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        160⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        161⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        162⤵
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        163⤵
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        164⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        165⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        166⤵
        Modifies registry class
        
        PID:6076
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        167⤵
        Modifies registry class
        
        PID:5704
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        168⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        169⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        170⤵
        Drops file in System32 directory
        
        PID:6192
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        171⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        172⤵
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        173⤵
        Drops file in System32 directory
        
        PID:6324
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        174⤵
        Drops file in System32 directory
        
        PID:6364
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        175⤵
        Drops file in System32 directory
        
        PID:6408
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        176⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        177⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        178⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        179⤵
        Drops file in System32 directory
        
        PID:6580
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        180⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        181⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        182⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        183⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6744
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        184⤵
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        185⤵
        Drops file in System32 directory
        
        PID:6832
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        186⤵
        Modifies registry class
        
        PID:6872
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        187⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6960
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        189⤵
        Modifies registry class
        
        PID:7000
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        190⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        191⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        192⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        193⤵
        Drops file in System32 directory
        
        PID:5832
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        194⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        195⤵
        Drops file in System32 directory
        
        PID:6272
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6320
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        197⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        198⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        199⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        200⤵
        Drops file in System32 directory
        
        PID:6604
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        201⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        202⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        203⤵
        Modifies registry class
        
        PID:6804
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        204⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        205⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        206⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        207⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7144
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        209⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6336
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        211⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6564
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        213⤵
        Drops file in System32 directory
        
        PID:5372
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        214⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6880
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        216⤵
        Drops file in System32 directory
        
        PID:6984
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7064
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        218⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        219⤵
        Modifies registry class
        
        PID:6256
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        220⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        221⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        222⤵
        Drops file in System32 directory
        
        PID:6840
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        223⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        224⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6480
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        226⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        227⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        229⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        230⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        231⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        232⤵
        Drops file in System32 directory
        
        PID:7192
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7244
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        234⤵
        Modifies registry class
        
        PID:7284
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7324
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        236⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        237⤵
        Modifies registry class
        
        PID:7404
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        238⤵
        Drops file in System32 directory
        
        PID:7444
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        239⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        240⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7524
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7568
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        242⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        243⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        244⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        245⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        246⤵
        Drops file in System32 directory
        
        PID:7772
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        247⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        248⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        249⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        250⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        251⤵
        Modifies registry class
        
        PID:8000
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        252⤵
        Modifies registry class
        
        PID:8044
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        253⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        254⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        255⤵
        Modifies registry class
        
        PID:8176
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        256⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        257⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7236
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        258⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        259⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        260⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7500
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        262⤵
        Modifies registry class
        
        PID:7576
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        263⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7720
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        265⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        266⤵
        Drops file in System32 directory
        
        PID:7836
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        267⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        268⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        269⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        270⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        271⤵
        Modifies registry class
        
        PID:8184
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7188
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        273⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        274⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        275⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        276⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        277⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        278⤵
        Modifies registry class
        
        PID:7880
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        279⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        280⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        281⤵
        Drops file in System32 directory
        
        PID:6860
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        282⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7544
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        284⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        285⤵
        Modifies registry class
        
        PID:7888
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        286⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        287⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        288⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        289⤵
        Drops file in System32 directory
        
        PID:7856
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8080
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        291⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        292⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        293⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        294⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7680
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8200
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        297⤵
        Drops file in System32 directory
        
        PID:8236
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8288
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        299⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        300⤵
        Modifies registry class
        
        PID:8372
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        301⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        302⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8492
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        304⤵
        Modifies registry class
        
        PID:8540
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        305⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8620
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        307⤵
        Modifies registry class
        
        PID:8664
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8708
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        309⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        310⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        311⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        312⤵
        Drops file in System32 directory
        
        PID:8880
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        313⤵
        Drops file in System32 directory
        
        PID:8920
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        314⤵
        Modifies registry class
        
        PID:8964
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        315⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        316⤵
        Drops file in System32 directory
        
        PID:9044
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        317⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        318⤵
        Modifies registry class
        
        PID:9124
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        319⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9204
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        321⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        322⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        323⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        324⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        325⤵
        Modifies registry class
        
        PID:8508
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        326⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        327⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8700
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        329⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        330⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        331⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        332⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9012
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        333⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        334⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        335⤵
        Drops file in System32 directory
        
        PID:9180
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        336⤵
        Drops file in System32 directory
        
        PID:8284
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        337⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        338⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        339⤵
        Modifies registry class
        
        PID:8596
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        340⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8716 -s 408
        341⤵
        Program crash
        
        PID:8900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 8716 -ip 8716
1⤵
PID:8832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aacckjaf.exe

Filesize
93KB

MD5
4847661bc32acad8d2e7c6e48063fd7c

SHA1
ff38c5bc79f518d9e46f83f9d856e98707724fc3

SHA256
cc8ff57f8476a03e35803777e5589c8fed68aec7b40520482789d735d4784081

SHA512
6392e3d3395e9b81d121f3672d43fe15af69c2f0ae4cc72709e97103faf79b9b94e719eb7012b00e9711685758a5332bfec41e9c9c4feb49ebe6bcfa6bd18c53

Download Submit
C:\Windows\SysWOW64\Abbpem32.exe

Filesize
93KB

MD5
cef0dc7b3155f74c1a581619f30d5c0a

SHA1
9c494efa1a9f92bd4457e49ce6657a474c1a8545

SHA256
c8b9f1ce9e57217691f681fd9ee345890d809f430a22be53a08ddd565c4cafc2

SHA512
da773cbd4143a8b461f08300ef032207d992c6cc342f7eab065351521261080442e5196ef2fcab89727b6d3072e0e83b473481808ac8efea1e3a95886ba4d064

Download Submit
C:\Windows\SysWOW64\Abkjdnoa.exe

Filesize
93KB

MD5
fe342cc0911036cfc7a917d8ca43ec32

SHA1
4fa0196c922bb512633369486a84c8d6e7dcf49b

SHA256
d1d35edfb88f7f0d909b01b4e08bf7abd873999f734789195c9d1867dc37872e

SHA512
9d6c1f79c15d97372ae1e053b14cc9ee7db7cee468a9a7ebeed3ce4843c91894e776053ed3cc72827623755c3c3dd57aa92315276142cce198d881ce083e7ab2

Download Submit
C:\Windows\SysWOW64\Abngjnmo.exe

Filesize
93KB

MD5
facd09ea6cb3865fd2a30fd44f65ce2a

SHA1
10bd2362dca2d0c4b56452fdce5b60943672cca8

SHA256
cfbdb375ef403bad0db3603ae419fe319dd63b6942508d881b0f4268c472077a

SHA512
b32765bfae4ca2cf6ab3aff4ce524d51c9cd5846b2b3e10167810776966216ca48358ee8d17e876025658c870d6e0ac67a5b7abeb45f00933f905ff1bcbfba65

Download Submit
C:\Windows\SysWOW64\Acmflf32.exe

Filesize
93KB

MD5
87a705277754507a7ec0953f0cc755da

SHA1
f7522123892b1b434af09a9fa366a080b3b19b94

SHA256
523cb1650369f9b891ddaa478d8e03b41fa60135127f923023b8f070b953db52

SHA512
978212ac33818dd95e4f92211b281d1e5edcd5e025c44f93f725f4bac9ee061faa67852392d4fe20984ad87ab2fe7f5338bfcad0efb38f1b7e0713377816d90e

Download Submit
C:\Windows\SysWOW64\Aealah32.exe

Filesize
93KB

MD5
9972a56b2b7b4afb6d3b73a9ff8b20be

SHA1
b878aa19df42b6a23a9196c768d0ac190446d7ae

SHA256
f775234f13489174f9e39b86a3afbb65af134dda0426b9fccf46b81e2662545f

SHA512
077ec9ef24ae7d97867ef4a2f91db2392f8b62d029d00044ef1737ed431b15e0ee2e67cd9b008a4d8e0146fb76bb224d9ba3237ad9dbb62f172e722dffaf6f05

Download Submit
C:\Windows\SysWOW64\Aelcfilb.exe

Filesize
93KB

MD5
014cc16f1814baea76e7bd851a11275c

SHA1
479b1984dab64307b7688f9ecb72b1d47ef976be

SHA256
d8a41b41887f0a4b14754602a4cebd8f271c5c1c6c9c3b3a46cf4b550efe35ab

SHA512
e3823f1ae3178ce75115abff64c0113849bc4ccdf3f84e32288f7b545a85cf6d8b3aefb89a4f7cec6289aa676dd3de03b959e74e5beaa33c3b495b6f89f479ca

Download Submit
C:\Windows\SysWOW64\Ahmlgd32.exe

Filesize
93KB

MD5
cb692f02c52e78fbed92e89bc21a2610

SHA1
b11b2267e66e28f754ac6169092fb72f0318ab5f

SHA256
234d449f6d7f28186bb1b8d05f3774c8643e793a98d7532e4675349a34328966

SHA512
0d9e0c2167f5564adee4760e05fec19b6d963b738397c7ed8c5e8f918cd7bae29df123cccacb5650921d2a36ac453135a154cd93c653a0761bcf0ab2865d0145

Download Submit
C:\Windows\SysWOW64\Ajdbcano.exe

Filesize
93KB

MD5
902fe72ffc2909adec6c47f3d4b8394a

SHA1
a34219b65ae28fe885fd0563913c4c4bea316f97

SHA256
1247591432063222fab66c35b17599636b9d2732a7cfd8a838c595d5d77bec9c

SHA512
303428d880655f21e3566028a0cdc0a6b47944bba85be94ca097136b7481151d8e1078282e9766a16a277d607f9a74724d0e80813046fb5c917e7198d1368e83

Download Submit
C:\Windows\SysWOW64\Ajfoiqll.exe

Filesize
93KB

MD5
d2596bef01752ee3aa9c3fec16c3578d

SHA1
21513e16616aa36dae6ac02fb57b4532def81e61

SHA256
c2ae682241c4aee2ae27e4faf190512d20137b468989ee6e0d30e8d95bdaf693

SHA512
5949e2fb4fc2feba3e1b97060374ce9327e43830e15dacb778f174aecf18730f0b062de819ee68187a3767a6e1bd36cbd3b35b3524f76d76337915bc3b60b6de

Download Submit
C:\Windows\SysWOW64\Ajkhdp32.exe

Filesize
93KB

MD5
6a44b7e7e6b0ca6e69f4a5279b2d66b4

SHA1
400d333513608477241a62b03f50c46fe48817ff

SHA256
329080d1dfd79c4ae786276e5deeb954a6f7be8bdd3e8aabe7482bbb93a95deb

SHA512
632a8825bbb4ee4bd86ff1e61d75db82eed197b83d03ff88d2f5dbc1dd8c5e84cc73424befcbee4bca2f545f8a306b358c4edd647be008e0097a2532c4332661

Download Submit
C:\Windows\SysWOW64\Ajneip32.exe

Filesize
93KB

MD5
c3f4cc267201b3b933fd6961e40fd012

SHA1
bc1e9c11ff68cdecbcc0e0ffa03087c5c875b1b6

SHA256
ea5bd2e00d1121568a19294ee72a623461c720b020c0db1b51d4e610b77832fe

SHA512
41878c323f43e66e085cc369f738352f06d2da5f6776c2b292b98a015debfbb5683b516e22de246593b39761785b4c23f1b28e8bea42db32bbaf78f790e1099a

Download Submit
C:\Windows\SysWOW64\Alfkbc32.exe

Filesize
93KB

MD5
e441e09c6762a0ceb9d8d0ba08fa43f8

SHA1
74f28ff22018250951e18a8cd632ac55bff0ba78

SHA256
5c041f2480c7a6e56d29a849d99077e60788b6e4c48aeaee4b6d0e5d8f766a2b

SHA512
c61b57f3d03e9a47d60193a37412f697d71faf141848b9a13d65e52ad324b384cedad23b037911f3291d1ceffa71c5df21351de6f843bed5427e6902c772abd0

Download Submit
C:\Windows\SysWOW64\Andgoobc.exe

Filesize
93KB

MD5
245751cc4a7dbc33ef4e2177b8551314

SHA1
feafb53a9ec5a792d96bdddfc6215b7367d74c61

SHA256
5edc74cc905e09963f39ab68183680d52b1d4a59ff7c7af4d746f59cd26fd3e1

SHA512
6c80f8fdbe71ad2de3ae3cb63e0d5be74ee35cdd112ef6558b2112dc152d135d6c63fb7c06dba50d71dbecec9c12f66ad3bd0681ec0b29897aefeb7f43aa11fb

Download Submit
C:\Windows\SysWOW64\Andqdh32.exe

Filesize
93KB

MD5
56fe363dc28d49f19a1402ce3ffcaba3

SHA1
9506fa593e23f7ce135a5bda37771e586b10f77c

SHA256
5160f7396c3553846a70e100817b744a4fa7296fcbddcc8edac5caa9f611b93f

SHA512
729a9c5482cf248b5177d77e6637fe209374d6f20e6392e52839860338c0b5d53ff7466b3e1491288cf2f1cf5d0f0138fdec349d6855ee066636daa01a22e89d

Download Submit
C:\Windows\SysWOW64\Bahmfj32.exe

Filesize
93KB

MD5
fcd3a31071ca6681775a02cd5868938b

SHA1
e6cca83816c8c15a2095e05abc3ffe18a7506635

SHA256
cc7c0b4105a07161702a05d3f8f7c6fe3501eb7181156b3319652ac1ce9edbef

SHA512
75306a4ca5eabce6bb8aa6fd2a1153046a42fe4414e2165762aefdcc01db2c81007f5a4f5c0ec952e83d77b0c544d0f8380a0970b62ce77c7d614e250d901325

Download Submit
C:\Windows\SysWOW64\Balfaiil.exe

Filesize
93KB

MD5
867bb300b6a7b734c63e7003f2decc82

SHA1
602223981231682f64f9dc7ff4770ecf236e0f14

SHA256
f58c38ced96964090c3add0719f844f08a4131e4b8987feee98a7dff0615b1c6

SHA512
2e9eb530542a348c6ebd233048fc4d93b12e3afdaf6d49f4d27c03b3d6d16d07f6a8e6dfd418c6fdf562395b8d681b8e573d5b4848574591ec879617085558f9

Download Submit
C:\Windows\SysWOW64\Baocghgi.exe

Filesize
93KB

MD5
d94ec36c80cc2a86a18cdcd24ca253ab

SHA1
0c518208f2ce421452d81608fc9b4ea882c42ed3

SHA256
5465b5b34051f3b21e08ce498fb1eee090ab4ce3ffecca0152afc2b121600e93

SHA512
46669773f12dadfa40887140a909d0e12e18eb25411a4e5bbc9d34c086d152907c87c956bb17edf8ea887f5c51874e64a756a9f996869b7d27ee70d8c171019a

Download Submit
C:\Windows\SysWOW64\Bbgipldd.exe

Filesize
93KB

MD5
0d5841670d5e11e1c4f168ef54881ce1

SHA1
5da6f34f20f81b141104d6998de9560c59394dc6

SHA256
46fce486e5f3fe4da3ed0112b1f39e8a700aac529c9f2ea5080e7447393a25d5

SHA512
01f665b02121dc027f83810cf80cdd795e6b7159f874914d61e55d4ddd588165c6ad4b0cb567a1fd4c15f9bdedb51fad630f04dd88f47fdb7f72fe5e994b8007

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
93KB

MD5
e9a9285457e84b303c08319ed8ff91dd

SHA1
8683759fb21eb21454f214ece195aff0e2036c75

SHA256
c59884614060d869dd66f3ebce0a293ea70187f9f8d8ba532b738a3af17ff0a8

SHA512
5052ea0acb5d4226799b36de1013290fa084393a20a4a6f628f7e08a2fb90f3bd0d668ffc0e73122493cc95e418e429d7b3592d0ae0d832ae12acec7b1b2147e

Download Submit
C:\Windows\SysWOW64\Becifhfj.exe

Filesize
93KB

MD5
ca4ff6f248813c5217218647400f2991

SHA1
48394955ad4b5a655150c045e821ffdbdb6325f7

SHA256
b9597da630421d84dc310364c8c9d53c2001ae3515fc27b1f15d2a62462d7b00

SHA512
3deb082e3b1b9105da91dd15cd1cdd8d380e810e28657d4392ac62ae1e4bce79abc19aff929d4d261902694d40aaf04776d6edbc8a38fc86eddb60e9e12c6fac

Download Submit
C:\Windows\SysWOW64\Bemlmgnp.exe

Filesize
93KB

MD5
6296b059d008ad9cc3bed28f03b09417

SHA1
03a14d4f8b400c112c1d458f8dfd693592d80b3e

SHA256
77793048caa4b02589d67a4b47214cc4138762e220acf2e75ad99beb5da75f04

SHA512
ffc22a2092ac94b36c6e0bb5e19c9bbf1057288ac6fb2b748c2346d41c60407d40a464e6dc13696c69a7adfa23d89d673a3d8536eb960d19524110644650d947

Download Submit
C:\Windows\SysWOW64\Bhdbhcck.exe

Filesize
93KB

MD5
8638dbbfc1bc99fd3bf901b8cb350657

SHA1
18c1e2cb0d70d2ed3bd38633c795b2081ccc71cb

SHA256
20c7da462e22f9ede611f2b08cefc42ae2e8f8b3854050abcbbb3e2223577d3f

SHA512
e39d306702ad87dd3aeed74cde73dbe690c7edf10c23b4116d00497ad02947864d2ec7e41a3a31d84564b6013b8a620b7be1f926a1a53f3b1efbb9fc5f76a3bb

Download Submit
C:\Windows\SysWOW64\Bhfonc32.exe

Filesize
93KB

MD5
f568e2bd332d9833bc04e2843c99b0e1

SHA1
6091de7139bfa5dca27189a8279e006e35211e4a

SHA256
dc2c417400493dd420675f43973818a9f0a8b35615a4e33be411b3eeaecd887a

SHA512
d4faee3af56079cb2dff62bf7b734f43162e23665d76bf88023f8424ab4ddec71282466ae9fe55e788ad24eff510108e5ce88e2fd869b607eec7a5498dd76751

Download Submit
C:\Windows\SysWOW64\Bhikcb32.exe

Filesize
93KB

MD5
6c0dbd2ac40b600cf8174ce0f3a4a611

SHA1
86e66902c7304a3ee383490bef18109ec21d5795

SHA256
bf7dfcbe352a8bfa91c6704e7d20583e23583bc0e4e5a083bb950c5579f1209f

SHA512
bd575ef7e41ff16733222a48230f76b6e5fe92f0c72b70868dda90b4618205d317235ba255af871428f830f7117dee79d6c13aee22531a6220f25f2763ad2f78

Download Submit
C:\Windows\SysWOW64\Bhkhibmc.exe

Filesize
93KB

MD5
b9702754f89d86305cb15094e5ac2cc1

SHA1
65ba11d8aa19ac6048ae78ce821c8eea5eff78d7

SHA256
e41f68ac6417130e839071b203d996efdc9df8a1182d37275666dda971ce5a05

SHA512
8e50b625776597bd798c546cc0b43c77f120d46351ba00fd05a0539dabd4c8f7e91b4f32b774e695b11a49bc643a989104dbfd7eecf4904ca99b7430dc52711b

Download Submit
C:\Windows\SysWOW64\Bnlnon32.exe

Filesize
93KB

MD5
df9f4d4f4794ec6e9f79069654309127

SHA1
f216a50b3f3769eb76d8ccc58475eac3d3c15f40

SHA256
ed814205bd4f27b5c260bc60b2186772fc84f57008c3d166c1968206074c65aa

SHA512
1cab97192ef7d6fc2362ce938631f6f6d549cb30a92f9555ec184c75d50fba407e27a7eeef1defe1cf1f470ed03c68db7d9f08d254d5a14122ac0a747307a02d

Download Submit
C:\Windows\SysWOW64\Bnnjen32.exe

Filesize
93KB

MD5
3b3c251a5de7d1c4c6356e5dc2d4434b

SHA1
6cf479f2cc2ffe4d5af1f0805a6848f5fce6398c

SHA256
d00de15006e4e80ad54ef76cb6261fc448ed4ea0e9e8cff6ac1f1aed29c912da

SHA512
c86bd5a3db47ff4f3890f60274fe750a2f8ab6982ab6b845576fee4d101d379d7f9beb13ea66dde04922074da81fbfb553429f4799f9aa8151529b058fd650f3

Download Submit
C:\Windows\SysWOW64\Boepel32.exe

Filesize
93KB

MD5
26f1c1a9b3e5b2a13ea5b99a14d07d27

SHA1
88da7fe5b7285c59eae7429243500cff7e661b6b

SHA256
6b95dc045ef71d8c04ffee556c73aa5837fccc3b199be316b22cef0ddd166793

SHA512
f5bae3336fe79340c3f1292a40bcbcce6976677becc19d517e4760b30eeacfd08fed228d1aa7c93dcfd64918531798349f196d173c5afa44f37294a4d28cb137

Download Submit
C:\Windows\SysWOW64\Bopgjmhe.exe

Filesize
93KB

MD5
045f82032e484e7a8275c4424ee793b1

SHA1
c85699b220cac05f600669493ee09fbfd11d4657

SHA256
6269bc1fa407b2c341fa460bac9cb3fd316cfa73a6215c0727299a2bf07a6af7

SHA512
f37da10efb0c3024b85556b5680a05936a04f9bc1e85ca9619e0fdfb24285afb510a17b6245bd25a214893330381ca43db309f5ecab1a5ea28ca042f0d5a44a1

Download Submit
C:\Windows\SysWOW64\Cacmah32.exe

Filesize
93KB

MD5
91e3a38238b27eb95f63fc560d0c967d

SHA1
cb4c1222c2018055c7574bbc035fef5b5d0b35ac

SHA256
516de859231fd3db74bbb4e5a2fc07320a6fdbebb516c1aa4e4e79b115f25c1c

SHA512
bf35d02348fe4cc19383c7e9f2b3360dcb3d48e6207f6b2048a4d3b46083539d892459fd1955a1902ca0ddda4bb5142adf9dce2150ce803c6391068041d0222a

Download Submit
C:\Windows\SysWOW64\Ceaehfjj.exe

Filesize
93KB

MD5
49094664f7b0e70cf5d13fd1b5d2cf81

SHA1
28432a5b265759666a473a7824d69e0945340f60

SHA256
64d910942637b665c7759a622e476d31c134fa89b4ca6e26e18606ef9635439c

SHA512
58a881c3cd1f2c75327e0c696fe4a1f7e650cdb0bf8c1f2a32e7fe7e37d1218865511ea7d94effb11d1bec1e51751b7172bfbb607021efc17d5516115945ab4a

Download Submit
C:\Windows\SysWOW64\Chbnia32.exe

Filesize
93KB

MD5
f508677ff027e872a219b413a026f52f

SHA1
0644862309564f8796d2b5372859c421d197b4ce

SHA256
1579146d4276e753db006073b5b73bccecc6ecf896e18c65918a2a781ad0de3e

SHA512
9d3e6d36d8e93c5906b1ccf3293c0d099e13636fbdd31913b83a5b8b5e7f365cebc7e8b62644a1c41c12eae3f8ffe76bab4a1cf1e5e2ef51e5567173b8f55381

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
93KB

MD5
ef55ce0e36ddb6f6303afd868af03014

SHA1
a42b8185582850921b8cb68d9e464d16b9539f07

SHA256
97f344016f237b181201faafeba53fad707a48d4c7ad1d2c65ea379b7c997ddb

SHA512
7e1c3ee8c2676835c27acc00546d0252bfe22e5fa7c4574e9e4c509e43b49aad6f8824b8fd619f26217659888d2cc1eca9026b0c5d67ad065efe7e0895a39c29

Download Submit
C:\Windows\SysWOW64\Cliaoq32.exe

Filesize
93KB

MD5
79d198bc9392d88316674f96683a3cc2

SHA1
669930565f50034d7877e097e5f2e9cc735c333f

SHA256
0d43389fdfa669fa9babd3be31bf50473f8f19e73c1469626f3bc903248b8363

SHA512
12b26441223f060f1768cde2d93503266933f73157a64213bbea81a8ee27447e7e1bf57a6df9ce2d9aaeb2b2a4cdabc1ca8af710361582a5b9d7963251484c50

Download Submit
C:\Windows\SysWOW64\Cogmkl32.exe

Filesize
93KB

MD5
74482beaada30929d0b5b51c240ebf68

SHA1
89f8e8079f1aa48806067803f72ea0bbce52ad6f

SHA256
11d1987c5dc48d8e27e9cb144fe4ede67d6a13a82fbd167672880a1e33d764cb

SHA512
dcac4a17f077ee47ee45c1b7849c8f711944eff3e4c0f99a5e287068163ea3fdceeaf908b673c104078172da4cd7bab2fd1fa4dec94cee00d62eca681c707ab9

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
93KB

MD5
9023958a4e2a75f916739f343f1c42af

SHA1
e3b1182bd1dc668f9261e2d9ae64e62c213aba1d

SHA256
b53b41f4baadd1a0b892d62228e4d314e509747f68742f254147e07791e8ad9f

SHA512
08a1cdc212e5ae04a023ba706ed1e3b540fdf7fca673eacd0eed5e15e188860cfd51d07f92bad520f0c25bc433240caa5430d4b2390310b6ec5e7363e0a85375

Download Submit
C:\Windows\SysWOW64\Dhbgqohi.exe

Filesize
93KB

MD5
a39e1dd26b491cab3dccdfa2f89efe6a

SHA1
9b0276ff2706c2036ad409ab4fdc181c54dc0c51

SHA256
831f219fd60c426a84d3889861228a15baf4178a60eee9a911f7ca174ef15dc9

SHA512
ecd01ce9345d6df214d743fbbf8e8be35adfe89a01eafd27cddc7771621a96ab20af4e421c122073125ffd53cd454aae8eb46d525647f212b5153b0ab4b3bbc5

Download Submit
C:\Windows\SysWOW64\Dhidjpqc.exe

Filesize
93KB

MD5
5d52d05b3447b2b2897326ec05d06922

SHA1
f21a870ab532e8dcb57b58d8834cba59882d939d

SHA256
dd2c24e70d583dd80879a0a7e19bde34904e5681de0a2e9ba14bc3802f109785

SHA512
79ad3c3882fe2ec248399e37f1fe5aec9826c26d8c3852a2177aace0693c3c3bc00b1e90fea2912bfbe7c9c6b9523df660bbb0c61ee481127c2a4148df270e34

Download Submit
C:\Windows\SysWOW64\Doilmc32.exe

Filesize
93KB

MD5
90f57420c5282e2b691f62421b719d06

SHA1
c35c1475da1f272e734b263684de0189083188b0

SHA256
7f758389af7c93a06838d3730579118bb68aaebddfc4d43a4ece9b96214ac084

SHA512
58383f7d0afb3985232e94a97a32e828bf8bc0b52fcf45c13a6cfea0de3251b2be10f652cebd2f2773b20176c0906f753d1faba8be6041a5f06aa704efe510c5

Download Submit
C:\Windows\SysWOW64\Ecjhcg32.exe

Filesize
93KB

MD5
8aedae9c202294415f311954fade457b

SHA1
35262bd6df076b87428560c9051944459468e41d

SHA256
7413e9aecd437ca70a20c5af11b4dd3e6a3406d24ed539b3cc883f3966715699

SHA512
b89675b267c022d721c165eb5cae2a3e2608ffffced9d4c999ac51f8ce84375a96c0aa47a62f2b4344e5327b6d30f50e1985d527f782c56d8de304fbd3881f8f

Download Submit
C:\Windows\SysWOW64\Gcagkdba.exe

Filesize
93KB

MD5
aa47c7d901af4ed0b7568df228aec020

SHA1
5908db995153f1b0ebf3bf659a733158b79e728f

SHA256
97c00a67670ca36c777e600c03cba54d4d4477cbd0dbbd397fa1d4c0da602e63

SHA512
3770bdc188c4b2f57caf812944677898bda194c057b5771f14133ecb7b27dea1470a2ac336d6cd6124087ba4404a33cb29e409d03d0660875cb61a3f362df25d

Download Submit
C:\Windows\SysWOW64\Ibqpimpl.exe

Filesize
93KB

MD5
5070b290797e0fb6b03a4f4e05fba220

SHA1
d833ccf103ddc334148270ca3def2ee2a31d4e7e

SHA256
99be601fb35fce8e2032e174021682591fa46183859696de0f89118f9321956b

SHA512
97d320a72f342ebdadcf229eda8ffaa0b2fe4e9400c669d35676f3c0f1774499b12a29549fac6a6b7f494549e554fc839d61cdb115a0138a5aecb7505756fb54

Download Submit
C:\Windows\SysWOW64\Iejcji32.exe

Filesize
93KB

MD5
18c852e5b084aee70033aee02b8b253b

SHA1
bcbaa974b80cad5a8e252ab2d0cc19ec3eef9dde

SHA256
5ccc330cd6f1b774825c0bd6e804e618e46b272cfe2d4698cb7074eb3fdbba5b

SHA512
a8ee0f6465627ee0b17790366d97c1072e15b45c1a1014be4940c2a30999f969bcd4528c42071d1f470ae388bb54d32d3fa6e28350cf80d1bb1e2296fd81cb4c

Download Submit
C:\Windows\SysWOW64\Ifbbmf32.dll

Filesize
7KB

MD5
7e28d9fcebcdfe01b4f2399bd2eed701

SHA1
daeb96ecd3080eb935081a50cf2e25824a48229a

SHA256
a20cd56953863cdba52f1abfa075b6b3c9715d3e4ca0522e312c37e2cb6d6314

SHA512
2cc672e4117ba554af3c2fa27ed6d55d47b8db60815e097c9ad40309a22cff52e31ab6cf1adc3c0e34437934cd7e4a55aa99f5b2809c43c1ee8bd82681e743e7

Download Submit
C:\Windows\SysWOW64\Jmknaell.exe

Filesize
93KB

MD5
8d141e43ffc7493e39c16f4589786cf6

SHA1
dbb2c89f73c1999cb3e1f4da3482a516af65f172

SHA256
b353bea2447ace925bf1238f1cadbbaf3b570fc6b9e0074941745e13d5dc009c

SHA512
a8a37631429cb2d2596b0ab1cbb876eab9e0ae33d493fb9bce2a988ecf44458f4b0b26bb3269e352b8dbec68a2e1e25c816ccc50b67b9d3d4e3c24af1a42bfdb

Download Submit
C:\Windows\SysWOW64\Kipkhdeq.exe

Filesize
93KB

MD5
b883f311bef5a0c272580b31bb0afdc9

SHA1
4b59c0448358aafa96336187e6c6890bc0e9057e

SHA256
e32a287d403e66a81cd52babf2103bdb34c26d381db0d897cc913e9e10bb12c4

SHA512
edc7c55503c7be77ed60ed9aff45318b058e6725c5c766018a9fbd3ba5b38d6c077f8f4c045312cc73362adec85bcf8fea2fc7290fd92f97b974bed59e43dd75

Download Submit
C:\Windows\SysWOW64\Mdhdajea.exe

Filesize
93KB

MD5
ffd8c27527b2bddb56480a7f7b5933ea

SHA1
7ebbc009110741be39a1c1e56fa4ee2e0283fb6f

SHA256
b1223f73e7d6f69f5549dc013a252cd434edb473bb2b0541cc68f7ce61c25b05

SHA512
bf7413952c5efd5aed455dc8efda2992455ff2e8ca495abe625154c9dc404cd5dcbe8e6c47e66952bd84ea3b39be2c85482cca610403820ec5e2c8d9d31b36b2

Download Submit
C:\Windows\SysWOW64\Ndaggimg.exe

Filesize
93KB

MD5
90b95893d5549f20b90e82233899b9ca

SHA1
b712176a8bd8ea543580bb5d711bfb7d91e51dbe

SHA256
b63c6ed49ed0609f495e2568e976a36a3910bf2ce31b59606e8685a25e62b178

SHA512
dcd882a7f5e1d3f890765cd55905dd747f3fad18a33abdf7de1e556d78df9f1e0730eeb754e91d4a1742a90a212ea71388b4514a58d64bbc9fe63bc2c54506a2

Download Submit
C:\Windows\SysWOW64\Odkjng32.exe

Filesize
93KB

MD5
bfd9b6cd35b7eb29556c67cbf864f69e

SHA1
928a49978a2bfb9f173458bc62bae7ed22cc3c2e

SHA256
12739386a420fdb29e7a327ab654c72174d9065b9668039e0d7723894effe6d6

SHA512
7cf733017c2761f34751d7615e8f5b3bbaf9a06585940a45a3554e59f5b44af691085171855021f173b700e32d273adc4ecaf3cefd93e2153ebcd12879ffebd3

Download Submit
C:\Windows\SysWOW64\Pncgmkmj.exe

Filesize
93KB

MD5
793440c0b0749c7e21c2493f8e18eec2

SHA1
2cb67662827dcfe11ffedfed9ee08218275fef0d

SHA256
04849f4a145bbc65d410c58506102d69b4a9d6053e5e7c6aa889b6f2c7c1208f

SHA512
3b649872e245566bd79be250c36d70706ff8ba3cd21ae24d30730597dc5f2da891890e96f8161479e74a7567497095b0f1311ba2f68081eb40af802bf80de5a4

Download Submit
memory/732-130-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/992-169-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1152-278-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1208-263-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1256-272-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1268-228-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1268-147-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1396-121-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1468-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1468-143-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1664-270-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1664-187-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1692-158-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1708-161-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1708-72-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1784-319-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1784-246-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1888-285-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2136-133-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2136-48-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2236-175-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2392-202-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2520-96-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2624-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2624-167-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2832-115-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2832-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2908-212-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2908-295-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2960-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2960-124-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2972-110-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2972-196-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3044-80-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3044-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3212-320-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3396-296-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3468-254-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3468-326-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3596-305-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3596-230-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3648-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3648-89-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3684-312-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3684-238-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3792-304-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3880-318-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4360-139-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4412-179-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4412-98-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4488-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4488-106-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4500-112-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4500-23-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4644-221-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4644-302-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4784-332-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4900-310-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4948-152-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4948-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5016-284-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5016-205-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5112-184-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5112-261-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads