b5275c41060fb6204e29a1434dd00feca056abb9823577f79e5556d11e9619f5

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5275c41060fb6204e29a1434dd00feca056abb9823577f79e5556d11e9619f5.exe
Size

74KB
MD5

46126e01c3a94182997123bdafdd7b03
SHA1

c003240954db5a586b2e66ea09e012f9274b9443
SHA256

b5275c41060fb6204e29a1434dd00feca056abb9823577f79e5556d11e9619f5
SHA512

30e50a9f6ec23dc377e6df7a91806d8a33d2d2559d8ea5b7a442b7a7aacc693bbdb6e097dd2b2ed0e0ea1f1a7cefd6c5543e6761e97b0de9965ef3e18db4d0f0
SSDEEP

1536:YfakJT3DoiJWU+3E4WFCdSlIp47OtJ3NkAR8itT3cAXj0:YfaoozIlKJ3NkAbB3cAT0

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aegikj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hijooifk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oponmilc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcncpbmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajiknpjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdhfhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjdkjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eolpmi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hobkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Heocnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Likjcbkc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndcdmikd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnlaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ampkof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdcdbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kemhff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kbfbkj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opdghh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfhfan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnihcq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajkhdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chpada32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhbgqohi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kpeiioac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afjlnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcojed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kibgmdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ldjhpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lphoelqn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njciko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eolpmi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfcicmqp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfaedkdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmfmmcbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oqfdnhfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfjcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Acocaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkjmlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eamhodmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jmmjgejj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kfckahdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Liddbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmppcbjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mbfkbhpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncianepl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hopnqdan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hofdacke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofqpqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qceiaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Blfdia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ehnglm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Febgea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hfcicmqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmncnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dafbne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eekaebcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ffkjlp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iefioj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kebbafoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nljofl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbgdlq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ldanqkki.exe

Executes dropped EXE 64 IoCs

pid	Process
232	Pbpjhp32.exe
4736	Pgmcqggf.exe
2604	Pjkombfj.exe
1856	Peqcjkfp.exe
5008	Pgopffec.exe
1968	Pnihcq32.exe
3104	Qcepkg32.exe
4660	Qjpiha32.exe
2232	Qbgqio32.exe
2688	Qeemej32.exe
4936	Qnnanphk.exe
1836	Aegikj32.exe
4744	Agffge32.exe
4476	Anpncp32.exe
1980	Aanjpk32.exe
4484	Ahhblemi.exe
2520	Ajfoiqll.exe
3064	Abngjnmo.exe
2268	Aelcfilb.exe
3532	Acocaf32.exe
5068	Ajiknpjj.exe
1032	Abpcon32.exe
1128	Adapgfqj.exe
1912	Ajkhdp32.exe
2408	Aaepqjpd.exe
1864	Alkdnboj.exe
3888	Aniajnnn.exe
4496	Becifhfj.exe
3964	Bhaebcen.exe
3164	Bnlnon32.exe
2124	Bajjli32.exe
2292	Bdhfhe32.exe
1908	Bbifelba.exe
3688	Behbag32.exe
3320	Bjdkjo32.exe
4432	Bblckl32.exe
1424	Bejogg32.exe
3620	Bhikcb32.exe
1592	Bobcpmfc.exe
2064	Baaplhef.exe
5016	Bdolhc32.exe
1812	Blfdia32.exe
3068	Boepel32.exe
4308	Cacmah32.exe
4408	Chmeobkq.exe
1680	Cliaoq32.exe
3792	Cbcilkjg.exe
4140	Ceaehfjj.exe
4796	Chpada32.exe
2576	Cknnpm32.exe
764	Cecbmf32.exe
4488	Chbnia32.exe
3076	Ckpjfm32.exe
3308	Cbgbgj32.exe
1460	Cefoce32.exe
184	Chdkoa32.exe
2568	Conclk32.exe
680	Cdkldb32.exe
2424	Clbceo32.exe
4772	Daolnf32.exe
2180	Dhidjpqc.exe
3488	Dkgqfl32.exe
3060	Daaicfgd.exe
936	Dhkapp32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Igoedk32.dll	Ekcpbj32.exe
File opened for modification	C:\Windows\SysWOW64\Kebbafoj.exe	Kpeiioac.exe
File opened for modification	C:\Windows\SysWOW64\Mmnldp32.exe	Mpjlklok.exe
File created	C:\Windows\SysWOW64\Beeppfin.dll	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Dbfmkjoa.dll	Gfgjgo32.exe
File opened for modification	C:\Windows\SysWOW64\Ocbddc32.exe	Odocigqg.exe
File opened for modification	C:\Windows\SysWOW64\Cjbpaf32.exe	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Pgopffec.exe	Peqcjkfp.exe
File created	C:\Windows\SysWOW64\Njohbh32.dll	Ibjjhn32.exe
File created	C:\Windows\SysWOW64\Bnecbhin.dll	Medgncoe.exe
File created	C:\Windows\SysWOW64\Agffge32.exe	Aegikj32.exe
File opened for modification	C:\Windows\SysWOW64\Iefioj32.exe	Hfcicmqp.exe
File created	C:\Windows\SysWOW64\Glccbn32.dll	Iehfdi32.exe
File opened for modification	C:\Windows\SysWOW64\Cnffqf32.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Nedmmlba.dll	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Cnkplejl.exe	Cdfkolkf.exe
File opened for modification	C:\Windows\SysWOW64\Abngjnmo.exe	Ajfoiqll.exe
File created	C:\Windows\SysWOW64\Fhemmlhc.exe	Ffgqqaip.exe
File opened for modification	C:\Windows\SysWOW64\Aegikj32.exe	Qnnanphk.exe
File created	C:\Windows\SysWOW64\Ecandfpd.exe	Ekjfcipa.exe
File created	C:\Windows\SysWOW64\Klgqcqkl.exe	Kiidgeki.exe
File created	C:\Windows\SysWOW64\Olmeci32.exe	Onjegled.exe
File opened for modification	C:\Windows\SysWOW64\Cffdpghg.exe	Cajlhqjp.exe
File opened for modification	C:\Windows\SysWOW64\Pgopffec.exe	Peqcjkfp.exe
File created	C:\Windows\SysWOW64\Gebgohck.dll	Liddbc32.exe
File created	C:\Windows\SysWOW64\Ipenkiei.dll	Ddbbeade.exe
File created	C:\Windows\SysWOW64\Gogiek32.dll	Ehgqln32.exe
File created	C:\Windows\SysWOW64\Lgdalf32.dll	Ehnglm32.exe
File opened for modification	C:\Windows\SysWOW64\Gomakdcp.exe	Gkaejf32.exe
File opened for modification	C:\Windows\SysWOW64\Mmlpoqpg.exe	Medgncoe.exe
File created	C:\Windows\SysWOW64\Oncofm32.exe	Oflgep32.exe
File opened for modification	C:\Windows\SysWOW64\Oqfdnhfk.exe	Olkhmi32.exe
File created	C:\Windows\SysWOW64\Lcjakp32.dll	Ahhblemi.exe
File opened for modification	C:\Windows\SysWOW64\Bdolhc32.exe	Baaplhef.exe
File opened for modification	C:\Windows\SysWOW64\Hbbdholl.exe	Hodgkc32.exe
File created	C:\Windows\SysWOW64\Jlineehd.dll	Llcpoo32.exe
File opened for modification	C:\Windows\SysWOW64\Ngmgne32.exe	Npcoakfp.exe
File created	C:\Windows\SysWOW64\Odgdacjh.dll	Ngmgne32.exe
File created	C:\Windows\SysWOW64\Pjhlml32.exe	Pcncpbmd.exe
File created	C:\Windows\SysWOW64\Bqbodd32.dll	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Cecbmf32.exe	Cknnpm32.exe
File opened for modification	C:\Windows\SysWOW64\Ehljfnpn.exe	Eemnjbaj.exe
File opened for modification	C:\Windows\SysWOW64\Kmkfhc32.exe	Kfankifm.exe
File opened for modification	C:\Windows\SysWOW64\Lingibiq.exe	Lgokmgjm.exe
File opened for modification	C:\Windows\SysWOW64\Pjjhbl32.exe	Pgllfp32.exe
File created	C:\Windows\SysWOW64\Ilabfj32.dll	Blfdia32.exe
File created	C:\Windows\SysWOW64\Lpcfkm32.exe	Lfkaag32.exe
File opened for modification	C:\Windows\SysWOW64\Ofqpqo32.exe	Ocbddc32.exe
File created	C:\Windows\SysWOW64\Aqkgpedc.exe	Ampkof32.exe
File created	C:\Windows\SysWOW64\Hnicfelf.dll	Pnihcq32.exe
File created	C:\Windows\SysWOW64\Dhkapp32.exe	Daaicfgd.exe
File created	C:\Windows\SysWOW64\Deanodkh.exe	Dafbne32.exe
File created	C:\Windows\SysWOW64\Genaegmo.dll	Dhpjkojk.exe
File created	C:\Windows\SysWOW64\Ickfifmb.dll	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Aqppkd32.exe	Anadoi32.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Belebq32.exe
File created	C:\Windows\SysWOW64\Fchddejl.exe	Flnlhk32.exe
File created	C:\Windows\SysWOW64\Jcjpfk32.dll	Lgmngglp.exe
File created	C:\Windows\SysWOW64\Mpoefk32.exe	Mlcifmbl.exe
File created	C:\Windows\SysWOW64\Jbaqqh32.dll	Opdghh32.exe
File opened for modification	C:\Windows\SysWOW64\Nljofl32.exe	Nilcjp32.exe
File opened for modification	C:\Windows\SysWOW64\Ojllan32.exe	Ofqpqo32.exe
File created	C:\Windows\SysWOW64\Cjbpaf32.exe	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Cegdnopg.exe	Calhnpgn.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10104	9780	WerFault.exe	459

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnonbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Abpcon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Libddmim.dll"	Bdhfhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Neiigifj.dll"	Dahode32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ekemhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijcoimpn.dll"	Gfpcgpae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elogmm32.dll"	Jpgmha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ocnjidkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qbgqio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjdkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjdkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgcdak32.dll"	Hkdbpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qadpibkg.dll"	Ddgkpp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hioiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlineehd.dll"	Llcpoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laqpgflj.dll"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qjpiha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Imdgqfbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djnkap32.dll"	Qnhahj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oqfdnhfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlgnafam.dll"	Dhidjpqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddgkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qncbfk32.dll"	Ldanqkki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibbmq32.dll"	Neeqea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Elppfmoo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oponmilc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Amgapeea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhciec32.dll"	Ckpjfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agkbbg32.dll"	Daolnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqplhmkl.dll"	Jfcbjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flgmek32.dll"	Baaplhef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ambgef32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Peqcjkfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qnnanphk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Abngjnmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hopnqdan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jmmjgejj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	b5275c41060fb6204e29a1434dd00feca056abb9823577f79e5556d11e9619f5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gomakdcp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Imdgqfbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ocbddc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Boepel32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lbmhlihl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Medgncoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfaklh32.dll"	Kiidgeki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kplpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajkhdp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdhdajea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lafdhogo.dll"	Miifeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oncofm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ehnglm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phkjck32.dll"	Lingibiq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pqpgdfnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ahhblemi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhkapp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Deoaid32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 232	5032	b5275c41060fb6204e29a1434dd00feca056abb9823577f79e5556d11e9619f5.exe	86
PID 5032 wrote to memory of 232	5032	b5275c41060fb6204e29a1434dd00feca056abb9823577f79e5556d11e9619f5.exe	86
PID 5032 wrote to memory of 232	5032	b5275c41060fb6204e29a1434dd00feca056abb9823577f79e5556d11e9619f5.exe	86
PID 232 wrote to memory of 4736	232	Pbpjhp32.exe	87
PID 232 wrote to memory of 4736	232	Pbpjhp32.exe	87
PID 232 wrote to memory of 4736	232	Pbpjhp32.exe	87
PID 4736 wrote to memory of 2604	4736	Pgmcqggf.exe	88
PID 4736 wrote to memory of 2604	4736	Pgmcqggf.exe	88
PID 4736 wrote to memory of 2604	4736	Pgmcqggf.exe	88
PID 2604 wrote to memory of 1856	2604	Pjkombfj.exe	89
PID 2604 wrote to memory of 1856	2604	Pjkombfj.exe	89
PID 2604 wrote to memory of 1856	2604	Pjkombfj.exe	89
PID 1856 wrote to memory of 5008	1856	Peqcjkfp.exe	90
PID 1856 wrote to memory of 5008	1856	Peqcjkfp.exe	90
PID 1856 wrote to memory of 5008	1856	Peqcjkfp.exe	90
PID 5008 wrote to memory of 1968	5008	Pgopffec.exe	92
PID 5008 wrote to memory of 1968	5008	Pgopffec.exe	92
PID 5008 wrote to memory of 1968	5008	Pgopffec.exe	92
PID 1968 wrote to memory of 3104	1968	Pnihcq32.exe	93
PID 1968 wrote to memory of 3104	1968	Pnihcq32.exe	93
PID 1968 wrote to memory of 3104	1968	Pnihcq32.exe	93
PID 3104 wrote to memory of 4660	3104	Qcepkg32.exe	94
PID 3104 wrote to memory of 4660	3104	Qcepkg32.exe	94
PID 3104 wrote to memory of 4660	3104	Qcepkg32.exe	94
PID 4660 wrote to memory of 2232	4660	Qjpiha32.exe	95
PID 4660 wrote to memory of 2232	4660	Qjpiha32.exe	95
PID 4660 wrote to memory of 2232	4660	Qjpiha32.exe	95
PID 2232 wrote to memory of 2688	2232	Qbgqio32.exe	96
PID 2232 wrote to memory of 2688	2232	Qbgqio32.exe	96
PID 2232 wrote to memory of 2688	2232	Qbgqio32.exe	96
PID 2688 wrote to memory of 4936	2688	Qeemej32.exe	97
PID 2688 wrote to memory of 4936	2688	Qeemej32.exe	97
PID 2688 wrote to memory of 4936	2688	Qeemej32.exe	97
PID 4936 wrote to memory of 1836	4936	Qnnanphk.exe	99
PID 4936 wrote to memory of 1836	4936	Qnnanphk.exe	99
PID 4936 wrote to memory of 1836	4936	Qnnanphk.exe	99
PID 1836 wrote to memory of 4744	1836	Aegikj32.exe	100
PID 1836 wrote to memory of 4744	1836	Aegikj32.exe	100
PID 1836 wrote to memory of 4744	1836	Aegikj32.exe	100
PID 4744 wrote to memory of 4476	4744	Agffge32.exe	101
PID 4744 wrote to memory of 4476	4744	Agffge32.exe	101
PID 4744 wrote to memory of 4476	4744	Agffge32.exe	101
PID 4476 wrote to memory of 1980	4476	Anpncp32.exe	102
PID 4476 wrote to memory of 1980	4476	Anpncp32.exe	102
PID 4476 wrote to memory of 1980	4476	Anpncp32.exe	102
PID 1980 wrote to memory of 4484	1980	Aanjpk32.exe	103
PID 1980 wrote to memory of 4484	1980	Aanjpk32.exe	103
PID 1980 wrote to memory of 4484	1980	Aanjpk32.exe	103
PID 4484 wrote to memory of 2520	4484	Ahhblemi.exe	104
PID 4484 wrote to memory of 2520	4484	Ahhblemi.exe	104
PID 4484 wrote to memory of 2520	4484	Ahhblemi.exe	104
PID 2520 wrote to memory of 3064	2520	Ajfoiqll.exe	105
PID 2520 wrote to memory of 3064	2520	Ajfoiqll.exe	105
PID 2520 wrote to memory of 3064	2520	Ajfoiqll.exe	105
PID 3064 wrote to memory of 2268	3064	Abngjnmo.exe	106
PID 3064 wrote to memory of 2268	3064	Abngjnmo.exe	106
PID 3064 wrote to memory of 2268	3064	Abngjnmo.exe	106
PID 2268 wrote to memory of 3532	2268	Aelcfilb.exe	107
PID 2268 wrote to memory of 3532	2268	Aelcfilb.exe	107
PID 2268 wrote to memory of 3532	2268	Aelcfilb.exe	107
PID 3532 wrote to memory of 5068	3532	Acocaf32.exe	109
PID 3532 wrote to memory of 5068	3532	Acocaf32.exe	109
PID 3532 wrote to memory of 5068	3532	Acocaf32.exe	109
PID 5068 wrote to memory of 1032	5068	Ajiknpjj.exe	110

C:\Users\Admin\AppData\Local\Temp\b5275c41060fb6204e29a1434dd00feca056abb9823577f79e5556d11e9619f5.exe
"C:\Users\Admin\AppData\Local\Temp\b5275c41060fb6204e29a1434dd00feca056abb9823577f79e5556d11e9619f5.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\Pbpjhp32.exe
  C:\Windows\system32\Pbpjhp32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:232
- - C:\Windows\SysWOW64\Pgmcqggf.exe
    C:\Windows\system32\Pgmcqggf.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Windows\SysWOW64\Pjkombfj.exe
      C:\Windows\system32\Pjkombfj.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2604
    - - C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1856
      - C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2268
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3532
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1032
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        24⤵
        Executes dropped EXE
        
        PID:1128
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1912
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        26⤵
        Executes dropped EXE
        
        PID:2408
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        27⤵
        Executes dropped EXE
        
        PID:1864
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        28⤵
        Executes dropped EXE
        
        PID:3888
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        29⤵
        Executes dropped EXE
        
        PID:4496
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        30⤵
        Executes dropped EXE
        
        PID:3964
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        31⤵
        Executes dropped EXE
        
        PID:3164
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        32⤵
        Executes dropped EXE
        
        PID:2124
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2292
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        34⤵
        Executes dropped EXE
        
        PID:1908
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        35⤵
        Executes dropped EXE
        
        PID:3688
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3320
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        37⤵
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        38⤵
        Executes dropped EXE
        
        PID:1424
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        39⤵
        Executes dropped EXE
        
        PID:3620
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        40⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2064
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        42⤵
        Executes dropped EXE
        
        PID:5016
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1812
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3068
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        45⤵
        Executes dropped EXE
        
        PID:4308
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        46⤵
        Executes dropped EXE
        
        PID:4408
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        47⤵
        Executes dropped EXE
        
        PID:1680
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        48⤵
        Executes dropped EXE
        
        PID:3792
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        49⤵
        Executes dropped EXE
        
        PID:4140
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4796
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2576
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        52⤵
        Executes dropped EXE
        
        PID:764
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        53⤵
        Executes dropped EXE
        
        PID:4488
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3076
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        55⤵
        Executes dropped EXE
        
        PID:3308
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        56⤵
        Executes dropped EXE
        
        PID:1460
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        57⤵
        Executes dropped EXE
        
        PID:184
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        58⤵
        Executes dropped EXE
        
        PID:2568
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        59⤵
        Executes dropped EXE
        
        PID:680
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        60⤵
        Executes dropped EXE
        
        PID:2424
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4772
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2180
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        63⤵
        Executes dropped EXE
        
        PID:3488
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3060
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:936
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4012
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        67⤵
        
        PID:740
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        68⤵
        Modifies registry class
        
        PID:5000
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        69⤵
        Drops file in System32 directory
        
        PID:4176
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        70⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        71⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2356
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        73⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        74⤵
        Drops file in System32 directory
        
        PID:4460
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        75⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        76⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        77⤵
        Modifies registry class
        
        PID:3036
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        78⤵
        Modifies registry class
        
        PID:2608
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:744
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2244
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        81⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        82⤵
        Modifies registry class
        
        PID:2728
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        83⤵
        Drops file in System32 directory
        
        PID:3732
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        84⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2016
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        86⤵
        
        PID:904
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        87⤵
        Drops file in System32 directory
        
        PID:2844
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        88⤵
        Modifies registry class
        
        PID:2780
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        89⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        90⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4424
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        92⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        93⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        94⤵
        
        PID:812
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        95⤵
        Drops file in System32 directory
        
        PID:5144
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        96⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        97⤵
        Drops file in System32 directory
        
        PID:5228
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        98⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        99⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        100⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        102⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        103⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5536
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        105⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        106⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        107⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        108⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        109⤵
        Drops file in System32 directory
        
        PID:5752
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        110⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        111⤵
        Drops file in System32 directory
        
        PID:5848
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        112⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        113⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        114⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        115⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        116⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        117⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5132
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        119⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        120⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        121⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5392
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        123⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        124⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        125⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        126⤵
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5728
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        128⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        129⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        130⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6012
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        132⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        133⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        134⤵
        Drops file in System32 directory
        
        PID:5236
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        135⤵
        Modifies registry class
        
        PID:5360
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        136⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        137⤵
        Drops file in System32 directory
        
        PID:5564
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        138⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        139⤵
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5860
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        141⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        142⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        143⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5404
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        145⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        146⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5928
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6096
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        149⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        150⤵
        Drops file in System32 directory
        
        PID:5548
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        151⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        152⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        153⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6140
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        155⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        156⤵
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        157⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        158⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        159⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6284
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6324
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        162⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        163⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        164⤵
        Drops file in System32 directory
        
        PID:6448
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        165⤵
        Drops file in System32 directory
        
        PID:6496
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        166⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        167⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        168⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        169⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        170⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        171⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        172⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        173⤵
        Modifies registry class
        
        PID:6828
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        174⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        175⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        176⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        177⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        178⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        179⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        180⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        181⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        182⤵
        Modifies registry class
        
        PID:6228
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6308
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        184⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        185⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        186⤵
        Modifies registry class
        
        PID:6492
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        187⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6656
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        189⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        190⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        191⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        192⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        193⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        194⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        195⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        196⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6312
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        198⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6472
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        199⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        200⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        201⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        202⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7120
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6172
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6360
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        206⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        207⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        208⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6192
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        210⤵
        Drops file in System32 directory
        
        PID:6728
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        211⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        212⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        213⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        214⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7292
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7340
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7392
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        218⤵
        Modifies registry class
        
        PID:7448
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        219⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        220⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7604
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7648
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        223⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7692
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7728
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        225⤵
        Modifies registry class
        
        PID:7776
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        226⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        227⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        228⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        229⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        230⤵
        Drops file in System32 directory
        
        PID:7992
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        231⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        232⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        233⤵
        Drops file in System32 directory
        
        PID:8136
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8180
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        235⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7264
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        237⤵
        Drops file in System32 directory
        
        PID:7304
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        238⤵
        Modifies registry class
        
        PID:7444
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7520
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7600
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        241⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7684
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        242⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        243⤵
        Drops file in System32 directory
        
        PID:7796
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        244⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        245⤵
        Modifies registry class
        
        PID:7936
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        246⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        247⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        248⤵
        Drops file in System32 directory
        
        PID:8176
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        249⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        250⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        251⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        252⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        253⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        254⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        255⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        256⤵
        Modifies registry class
        
        PID:8004
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        257⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        258⤵
        Drops file in System32 directory
        
        PID:7068
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        259⤵
        Drops file in System32 directory
        
        PID:7460
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        260⤵
        Drops file in System32 directory
        
        PID:7644
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6856
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        262⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        263⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        264⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        265⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7836
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        267⤵
        Modifies registry class
        
        PID:8016
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        268⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        269⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8168
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7964
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        272⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        273⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        274⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8328
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        276⤵
        Modifies registry class
        
        PID:8368
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        277⤵
        Drops file in System32 directory
        
        PID:8416
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        278⤵
        Modifies registry class
        
        PID:8456
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        279⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        280⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8580
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        282⤵
        Drops file in System32 directory
        
        PID:8616
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        283⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8668
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8708
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        285⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        286⤵
        Drops file in System32 directory
        
        PID:8796
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8840
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        288⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        289⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        290⤵
        Drops file in System32 directory
        
        PID:8960
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        291⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        292⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        293⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        294⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9172
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        296⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8228
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        298⤵
        Modifies registry class
        
        PID:8296
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        299⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8412
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        301⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        302⤵
        Modifies registry class
        
        PID:8544
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8608
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        304⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        305⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        306⤵
        Drops file in System32 directory
        
        PID:8880
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        307⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        308⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        309⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        310⤵
        Modifies registry class
        
        PID:8532
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8676
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        312⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        313⤵
        Drops file in System32 directory
        
        PID:8916
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        314⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        315⤵
        Modifies registry class
        
        PID:9100
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        316⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8264
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        318⤵
        Modifies registry class
        
        PID:8288
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        319⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        320⤵
        Modifies registry class
        
        PID:8588
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        321⤵
        Modifies registry class
        
        PID:8848
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9032
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        323⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        324⤵
        Drops file in System32 directory
        
        PID:8256
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        325⤵
        Modifies registry class
        
        PID:8352
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        326⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        327⤵
        Modifies registry class
        
        PID:9016
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        328⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        329⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        330⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        331⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        332⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        333⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8200
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        335⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        336⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        337⤵
        Drops file in System32 directory
        
        PID:9340
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9376
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        339⤵
        Modifies registry class
        
        PID:9416
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        340⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        341⤵
        Drops file in System32 directory
        
        PID:9500
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        342⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        343⤵
        Drops file in System32 directory
        
        PID:9596
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        344⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        345⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        346⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        347⤵
        Drops file in System32 directory
        
        PID:9768
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        348⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        349⤵
        Drops file in System32 directory
        
        PID:9852
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        350⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9896
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        351⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        352⤵
        Drops file in System32 directory
        
        PID:9972
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        353⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        354⤵
        Modifies registry class
        
        PID:10056
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        355⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        356⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        357⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        358⤵
        Drops file in System32 directory
        
        PID:10220
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        359⤵
        Modifies registry class
        
        PID:9252
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        360⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        361⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        362⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        363⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        364⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        365⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        366⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        367⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9780 -s 408
        368⤵
        Program crash
        
        PID:10104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 9780 -ip 9780
1⤵
PID:9928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaepqjpd.exe

Filesize
74KB

MD5
f9afc9aad45b4fef7ece7e11e08fd656

SHA1
c59e543b10962139599004a14de57c730788bf91

SHA256
5d4a52738fbca97d514de4f72e5fb9cb2b0ba26371e1315f0e61511173c4f0af

SHA512
c8133cfeac89f18a2836af584bc113007fd3e36df7831cde3ac54f0a4a7c72f36ad3f8ac0c5e76edf807ec73a016f7eaa44a06bdf471e604e7920faae707a379

Download Submit
C:\Windows\SysWOW64\Aanjpk32.exe

Filesize
74KB

MD5
0265df98fc90bc8f2e56d06e76f60576

SHA1
ec3a7a843622b5a52ea1d65ad1e755aa5f5877fd

SHA256
21d7f21659ca7bac9c5ed341957f2d1b78a81379aa0e9a46064580d4dd6cf0a6

SHA512
353fd3c9a12d06a82b7b3f34d2644f0e0609c4dbf37247b447eb7eee14676ce5056b3750343e6d229629c73c7f32b1c76437e744d18426067e6b02cedb8bfb4d

Download Submit
C:\Windows\SysWOW64\Abngjnmo.exe

Filesize
74KB

MD5
04694173f3698abe223c0d846bd389ab

SHA1
9992ca30a5092f67351ae4d36e4636c057168827

SHA256
4df38dbafad72d6d676a1dadd38ff09a0b9117c01993141b5510e98978b8f7c9

SHA512
9d2ff07734fc2ecbe2b696140c06935cfce2f4e838e7737744eb33096e181d0e9c8b82dafc27104147716bda48773d5aec5cfa8582f94ea1c33bc7066f3ecec8

Download Submit
C:\Windows\SysWOW64\Abpcon32.exe

Filesize
74KB

MD5
422e86a84965b41f3bddb8df1cd351c6

SHA1
bd1d57c16cf35489d5c29b9be98655d9ffbbe439

SHA256
43ea1d366d99c1047725353e2420b7df41e143028162db3826b8f443b8544f9d

SHA512
dea536c6050984a02e48b2441345855eb8ec723497d4aed05638fcbb84544e9b8bdf54a15638524ad804fbc987c2866dd2f7880eb0041a7fc9c53ee982f51067

Download Submit
C:\Windows\SysWOW64\Acocaf32.exe

Filesize
74KB

MD5
47ab717cb5a694077b7ce9de78daff4d

SHA1
0f31d8c864a4bc722bdf5dda15c12d602a9073e1

SHA256
f947a49e37a0e40a8c33f35adbc4cca85eb91f9d7765b8b25e24dbe65594dfca

SHA512
f7a408036eaa48b34d4ebbeaa4b59773e2498e9ca375956937a24c6bdc3fdc172584cf02ef5c1cfbcf729573b7e915abb8b5b3e0e2beb4ba6ff6fef86c93b46b

Download Submit
C:\Windows\SysWOW64\Acqimo32.exe

Filesize
74KB

MD5
de18f2149760188fa0748b8277cb3268

SHA1
d3c68cb1a4bfd95b31acb6db541c0a04dd0bcde0

SHA256
249cafb60c19dc46aaeeafc3d1b92837b1bcef8a56dde9d0bc1eefe2c850253a

SHA512
c8ee76b135665681775a0020641fbacd73e309cc84c2ab852cb8792e7d291daf646cbd50f244396b440150c317231c9f19c471c3a03be03c1677210babe9122d

Download Submit
C:\Windows\SysWOW64\Adapgfqj.exe

Filesize
74KB

MD5
81c4a4fbe0490a6d1a3409bb9b704aeb

SHA1
f1e48925d1dd4d48a4a2466ef43f1af8729d0209

SHA256
c63a67f71e94363d288cd4ce64a1b829493f112aa8f0dfe9a5334e34005ecdef

SHA512
e9d60f406cea15585444893f9e61fd9702366e8ab8f8e67beb0f92c876d9d1a0c5ea9e0a496964d75afcc1b965b5cdbb3d624861c253bb62e7be0017d2448d3e

Download Submit
C:\Windows\SysWOW64\Aegikj32.exe

Filesize
74KB

MD5
060087c2fd464aa7768c779e7b774cf3

SHA1
7776bf6f025c57d64316f373f26d8b01c3c1ac9b

SHA256
440e7f81da8e3defaf59a6e1e0b1f7aebf2054bd3e88c5892610aceed0a7ef1a

SHA512
4b3d998f198d70c5b3e147540d1f20689802bbabfb518a36ccc5b16c9c3530f144b2a0814f836c9d1fe304c956d275f7b536610849a12b267faf7e9263b7ef46

Download Submit
C:\Windows\SysWOW64\Aelcfilb.exe

Filesize
74KB

MD5
6e793e262f77acbc47a4cbdcb6d1cb4e

SHA1
781cda578f0ecfe0f6d63ac868cb0b07b5abc568

SHA256
09ce04ad0dffefba7aeb4a6eaccb8c3ed493cfdad11d6639f5ec4d23c551e0d4

SHA512
d8e814c2542ae07e393e692b4e79bb0729cc31fa441417e8a62821ff1531d5f0ff177a2abc97f08b98021500d56ca6f7ba07dd0c82616390bdea5bc5b4cc0b69

Download Submit
C:\Windows\SysWOW64\Agffge32.exe

Filesize
74KB

MD5
d7bffd12014a758ab9f65e26188ffc56

SHA1
22bd2fb852b10b1b2515e6f3aaa628177911daf7

SHA256
5f58614fc485137c042744b609661dfb5c50e94ab448b1d4ac7102533e13e152

SHA512
dbc6f9227f896bb298d32f8d8eb8a11b4c141751afd0e8d9d092aa628bf0f5595985d06a1cf2007650a2868904f862f28e60624b5c0cc81d1ab22269add8f5d5

Download Submit
C:\Windows\SysWOW64\Ahhblemi.exe

Filesize
74KB

MD5
c03e9b37bf8dbb539c9c72a4f75743ef

SHA1
099ba6fb39aac1db57fee8a42fc7a96dc4e90dea

SHA256
ab7d79cd35a1c5981cb415e1433d222c9902a2127f58d4ea106cee87a2ad3e9a

SHA512
cfeea7d1ae79d6ee5c8232c00c5f64233a9b1bdb7f869ea62c19038a64dffae2cb257fcb14ca305f6afb637e8450795c08167f8020a5ee7e1ac555eb1c74634b

Download Submit
C:\Windows\SysWOW64\Ajfoiqll.exe

Filesize
74KB

MD5
1f8e3b9d5380d9ee1e1ae1e5a4236f5a

SHA1
cee20cb650ef1a297a250147a495971d315fd706

SHA256
c1627dca6ff3f3b49ec99073062c808e95b7cc6ead24dec72bf68a6a318aad43

SHA512
b7e7a5c12baa76a37efe9513ec2f740c0299aede98dd8ba66acc24f8eaec9a29ffc048f623a187fe7e6fd800b73d0b7b3ff32ef1f24fa506dfd867e0ce9d8efb

Download Submit
C:\Windows\SysWOW64\Ajiknpjj.exe

Filesize
74KB

MD5
7dd6ef354e7b322e837c5f6c6aad5080

SHA1
c278bc44bfa72896d2812a787430c56323a59175

SHA256
7a6e22f1d2708b08252d1870ce9d5d7f6b66b76a3d6e36bb9a56fa9cc27425f9

SHA512
ca59fea03f26fdb543e58164cdc35e699d1eeb9ef0536b93087973657dd5b7a70822ee26e2cfa26acd63790858ad2d1feaa0e3bf01d5300da171bb6ad379d733

Download Submit
C:\Windows\SysWOW64\Ajkhdp32.exe

Filesize
74KB

MD5
bb7d9e1e34885af08cb2851fd20a830d

SHA1
1469fca1fcf8ed28270412310dd9e081c943ba86

SHA256
94f6ce65fb6a988973f00de7d5a6c84093d502d50b925baf5538c394b9957c0e

SHA512
3cc295e4cf2fab6e4fe126463baf930fc8eb233dac6aceb1cd6c3bb05cddf77a426eb9607105f155d4d55db97ef8fd9c541a85cfaef554a79343587070747d6c

Download Submit
C:\Windows\SysWOW64\Alkdnboj.exe

Filesize
74KB

MD5
bd37fa7566d9a254580694512e10ec3a

SHA1
a9ffeac3ff666ee69ca86ab03fc6ad6bc3c5f5d3

SHA256
21d93fcc25292e647c82ca4860fcddac82111ee983e6becced6b9fd1021f30c3

SHA512
79c940f515f349d9bb7d5eceb61c210a1951963ecd256801fb142491945e6b0b7d9dbf69e4fcd7d8e204d5550fb49774690f14ceed7b0b323bf41999b20302ba

Download Submit
C:\Windows\SysWOW64\Aniajnnn.exe

Filesize
74KB

MD5
f61950aebe52cd09c0f832ff45f95ebc

SHA1
a3b053fef68980959ef95f5234b74b7c0b8623ec

SHA256
36910ac6f8546fe4b0d048453195e181052955948447e8b3d8f170514eac0835

SHA512
a787337dda81324d7a02be728f489b00171842b64c86e7cf3c839d0cad8ed395e6ce0144dedb916272d5df51a3a3318d302872f89438e5954489d54c745959b8

Download Submit
C:\Windows\SysWOW64\Anpncp32.exe

Filesize
74KB

MD5
f3a029643f1082ed50325d0930148dbc

SHA1
13963b7a9a6d8d3205eb6d3112c92f6046c9f121

SHA256
a5dc9bcb445559c189060803b5d32ad90e19440ca51d20488d6ff601928a2879

SHA512
5fc1ef46ca70126dde775499eba27641c5ad285b40f215ad48029a465891676fc16a0c03600870ff6dc829c6e9c0a12dfbf8869fc8875a584b1aa95050cc4796

Download Submit
C:\Windows\SysWOW64\Bajjli32.exe

Filesize
74KB

MD5
7012de93c8c46dee93394924c9373812

SHA1
c2bc06bf378acd5e4465d5456f437cc61e14284f

SHA256
3fa79400c41d9dc04ad560f744dd0bfe2842e8d15e2db5f8b9937930608465d1

SHA512
5bc927da934ad5e7aae885cfa1def632f8b5f35fd6f3f2d4b5fa592dc55ed25dfd8ad61a2c3d6b78a98f2128c151c4f2aa3b7d185ac0f3e136f4f65789a90de6

Download Submit
C:\Windows\SysWOW64\Bdhfhe32.exe

Filesize
74KB

MD5
cc0da4f910da69db9f9e3c0410e142af

SHA1
34bd9b9b592918820950d95ac9ef976c5f0a95ed

SHA256
8256fbb6a8d7ecf994b9906e75064889822f928836f375751dbf506cb748e0b2

SHA512
7fc269514b6d2ccedeb15d6d164cde3435c18e561784df07523b6c08f0f12bfad78c8b115b215da39a1a7f9272f023341b6cc4b1566ca6a6849d52d486535fa0

Download Submit
C:\Windows\SysWOW64\Becifhfj.exe

Filesize
74KB

MD5
11bcb1f196d4ee51cebd3bdf6cf8e577

SHA1
6b3f756a511f25298f97a6b15aa4f93b064368d6

SHA256
da684c7fbb8a222307095d391548ee2aa649943cccc06e1be38b93dcecdc96ef

SHA512
5b0a1c7859b83e1a6e26ae455ada3e84955e443563ff56cb105cbdab74a731da3e5de462b42ae3018d9741233d9e03b8f5cbd8056f9eb095b0b2c5e3ed0d5438

Download Submit
C:\Windows\SysWOW64\Bhaebcen.exe

Filesize
74KB

MD5
529c5026d24318fd888732d632e259fe

SHA1
b16653f84a26b7402dd565029eaae1bf4e649277

SHA256
b54b8cf8fc9cb653d56054c7b07250af18a4cbbb54a660afaf7d9ab000f3fbfe

SHA512
6fdf724ba581b4fafe06cc9b2d312ab1dcd165f340d629a4b04aa2a97164dbf2908fbebc66c80c6d232b2b14448452472a778cb8fcefed3c7f5cd26179000bf1

Download Submit
C:\Windows\SysWOW64\Bnlnon32.exe

Filesize
74KB

MD5
92fd7d3570fa1010c8e252e27be67d7e

SHA1
461bf1a503d4164de57427f4384ace50f1ba13c5

SHA256
af0d488163ba4f26e15e2182be604c68afcf39f40512e2f8ba61c8b6653d892b

SHA512
aa8fef7aec8309d40e036a5f7ccf2a89960e1c7b4865deec023359a4a74844015e7d3913a6f503b9366c7a63d025559c505539e9d9514f83ba71f73945ae9e9b

Download Submit
C:\Windows\SysWOW64\Bnmcjg32.exe

Filesize
74KB

MD5
931729f4d4e0e7bac15460abb69c2dfb

SHA1
a366b5dec6d9ea61b93beefdf7a220725b981128

SHA256
0789f32ccfe6c06799cd3da8d606e68b1aa253fba2ecf134d7a3fcfb61ee7dc8

SHA512
3faef866109d87b23d40fa37befbb58d10300faf66364c0a9f694c5305f977e97cb2954dd89394cdeaf64c88578c3c954f0fa3e53fc6b8ab3246ed4e096e884b

Download Submit
C:\Windows\SysWOW64\Cdabcm32.exe

Filesize
74KB

MD5
826fd67a279289d0da56ad765d96a716

SHA1
12e5b51de28f1509d88ad439c25e572770062f7e

SHA256
1a9b68b0ad9924f0e0f3beadb795148813af0cdbd150058ec84faf8bf13f2066

SHA512
f449bc349aaf846c5c88b2120b413eb1b743b036266e567f16b426666c772d5026b5877f3c4a2d75a6314a0dd8e26857a0099009c89b0ee123f10e1e6bd330db

Download Submit
C:\Windows\SysWOW64\Cjbpaf32.exe

Filesize
74KB

MD5
2502bd9cc43ca8fba35242a3df5147bd

SHA1
975b7f5583d49c6c4013efa5704b3e17ebc8b82e

SHA256
43e4c9f69df9471b0c05561ae2fd1b3326d259cd1a5fc6a0672961a94cab7ad5

SHA512
31105a6e5ee9b3f958fc9453c4c593777f017428401aa27159f29952af689c8b34327f16ecec36b7b711403550c048a1c14fdee1b3535d3eed517cbbe73971e1

Download Submit
C:\Windows\SysWOW64\Ddakjkqi.exe

Filesize
74KB

MD5
a2c427660fb0100d2a525dcbc34c9597

SHA1
d39fec78bbb05236a76a52cb3c69e6a016fceecc

SHA256
900b56ccd67d3797ce971e9097feedaf00b932ca4e46da728032cf9bfb19b78a

SHA512
2a3bf442569cb8e21000f75826e99771027206f8a360f52876eec4c969af5b9cc530c203cb4eb2b1e743b78e492cca7c2c97065adb9569f348fc530b326c9950

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
74KB

MD5
1a66a7fb5250b45d73add7aafc72eecc

SHA1
3ab05f4c34317f6ca06c3f748e6b2d2a42627145

SHA256
6e3937ade54853a677c7bfa2cdbd70d76fa043f708ea0e7c53346fa8a8649bb7

SHA512
81ca166aa4d9ca4a91e5bcd1cc4b5dcc13da4d8adfb5cd51ee004acfc165d6864c2e38629543b5982c77c5433804641becfc10abff6f55a88e761f399b46e0c4

Download Submit
C:\Windows\SysWOW64\Dnhqigge.dll

Filesize
7KB

MD5
85c96a2f67418b712a605895cea95310

SHA1
a881c8e9abe141b6a27edd052dc7d427c6633edb

SHA256
7cee30826870a81a6d3844106edc2513ea08a5665df7910435a7fe4a712333d0

SHA512
4dc64444567f3871e4c4276defda60e712539eb25d2b3d3fb3cc6310a78dcbbf36b3f44efebda8e8dc1dbffc2f4c115ac2e27d74c99cbd054cfcde7b0f127fe6

Download Submit
C:\Windows\SysWOW64\Fohoigfh.exe

Filesize
74KB

MD5
e7a0dfe02125d1c0444dd1da7ecf60fb

SHA1
a74d6c4619a45eb9aca2fbc138e24516af1f902c

SHA256
72233b1fdd6796c929f5829696a0b1ec2c5b8e999c2fae8148cb7995b937c784

SHA512
cfd97f24477d718bd065a2e2ddf025e873cca915eb900fbc54c7fce83b6c112171dbb36374a213443f04fe506a393052b6ca3e8c0126bf361a061053ac736423

Download Submit
C:\Windows\SysWOW64\Mmnldp32.exe

Filesize
74KB

MD5
6bc3418d200a2dffc0fe7bd6d123edcc

SHA1
620e4b6bbb5afcb85dbfb83c6d0ab7868e289d5b

SHA256
a16c20987921ca41e7925812a173229d890d977cee9e5950e44c2ce88ac3424a

SHA512
ca51675ea93c3f037c384c6cacc770dfc8bac296bc591c284c66ed5af027e91fd9ce01cbfa14c96024ab74db98af7c0469d9916fb2944cbbef637ee36a6fc16c

Download Submit
C:\Windows\SysWOW64\Pbpjhp32.exe

Filesize
74KB

MD5
295225f683fef485eaec8d6b71db9cbf

SHA1
715b1b6c132b757c6985fef63414dcc5ac446ec8

SHA256
7ee023596e50db0c3bf349921c6a48f39779424df9aaf21b94c67ffe3bcc1294

SHA512
421a6c59f913651a2524efc25058c74ff19c2f1d1b6eb9d289a3ffacc8097af47125a137b8bde5479001782f35f6b04125ad44d420aca70f42c3a59d31838270

Download Submit
C:\Windows\SysWOW64\Peqcjkfp.exe

Filesize
74KB

MD5
daf535e772c93e101000a1b667d94af7

SHA1
9d394123257327331ddfcfdd34101af11ddb6841

SHA256
95c585b9f6e7679551a53f6ff7438f17f85ae77fac06adf9a9b83b2586051762

SHA512
071cae2db0439a36137ecec4d58287477e6a6458e2f00321eaaa597f380363dc3b3bb4f1b3bf481079de18dae0125a9e0a967cfe5a661e64b4c6ac6af34908f8

Download Submit
C:\Windows\SysWOW64\Pgmcqggf.exe

Filesize
74KB

MD5
a042e39917bf3f87335f6ae724296480

SHA1
79d719d6a40db95902d5fd32a02ffa1ffffa5a2e

SHA256
5ccd8abe6eeba545cabf316477ab7c59063eafde5b1679127db4a5344eddaf60

SHA512
6907ed93cec9e64a545d5f2f08ba711ff69fd22675f4feae7654df8977ac9adcea4c701ba38cd9b4c6dc3dd8b1217591a2702d6cc0694841eb2497efe7f9f5c0

Download Submit
C:\Windows\SysWOW64\Pgopffec.exe

Filesize
74KB

MD5
d92d1c74cea19213a16c289c26d4f26a

SHA1
bc4def6da7a8ee2cbfe53e059b70b5c3d2ca5468

SHA256
db0d782f1c6f0d30fb4f55d357fdaf44ba1c8ee170352e170a8b94f8091928b7

SHA512
fb0e5b8cae0ee36cc2316d72f07591bca8f7139e186ca3c196fed8208d138e73551cad9b77a71eaf277abccf2631ba4723614d5bb7a522fea36d28c56d859d4b

Download Submit
C:\Windows\SysWOW64\Pjkombfj.exe

Filesize
74KB

MD5
a3979f61e0455ac23c1dddcda0e6be21

SHA1
ee8a063ca6ee79e9de0b736694431a14bc3c9638

SHA256
09771188eaa1b7977ccd377359ca3b6d8754e335bc53bda480eff476a6510a3e

SHA512
2929bbece0fd33f236febf9341a4bd8d2b6c54994aa7c4c5c1fb290a5df395fabb4ca12a6a5eb254c2bc78826ffabd015632486c213fc294e099c905cae11c23

Download Submit
C:\Windows\SysWOW64\Pnihcq32.exe

Filesize
74KB

MD5
c4ef3d6054f132568f373160f83ab54c

SHA1
7621fea442bd6b4af654ef810ac222ad977e83fd

SHA256
81680c07e999ac5e9e64f5a9c7ad2685985fffd0dfbecfcf527fcb5376fe961a

SHA512
1f60792952c6ca85709e4dc4d1f61bf50fd040d4e7332902107abafecc7491f813d513463b12141b898866d1a3589b2970281687e6bf7fb1a25285290d5eba50

Download Submit
C:\Windows\SysWOW64\Qbgqio32.exe

Filesize
74KB

MD5
dfddff127649fef70fda976b1a8bd397

SHA1
4e0fdab4aec1ef30efbf3adeb56bcb4111567013

SHA256
8c4e628fa631e0968e4f4c6272867d19e403587e8611e91c2a2c4c6e527f6b71

SHA512
5de6aa0c91eaa41b81dfeec938c031fa1f640e053f703042f250aa2bc3848d837186a9442b6c9fc6cacb61d872683b21e4c31a27bc3da70c018ea7e534bdf4d5

Download Submit
C:\Windows\SysWOW64\Qcepkg32.exe

Filesize
74KB

MD5
2d3fc65bc9ec81ed6e422f376433bcb0

SHA1
e8981fb2b347af2792b0c282023daccac3cb32df

SHA256
a31272dc48f991b5e1d7819bdd50d3077bad9aae58884838c6e45f8328c1b309

SHA512
b29c4908abd7cdeab249fdcab13e34c983770f5f5b2d7556f779779f1bbb65f633f600d9eb1670a88e4636196b80b529968b298f9d49c65ba002c4e14c834dd1

Download Submit
C:\Windows\SysWOW64\Qeemej32.exe

Filesize
74KB

MD5
5c871a37705796ee653622f01f130df0

SHA1
290733fa2e2e777c7ae534eeccb102b1703633b2

SHA256
7af8a537def55ed0a9b408855280df6bf2168313be69b1cf7f675989ff46bf0a

SHA512
04c7fb063425716fab65d0d332854662d0661814aca75647ab3079db1aad4dbc18e850db7005b3b3c3e180c1058c294993017dd21517c7f77f1413d8abb6f361

Download Submit
C:\Windows\SysWOW64\Qjpiha32.exe

Filesize
74KB

MD5
bf64ed4d80748a6a0f8a8e14590bf345

SHA1
e59d25b374ef53bbd852a9549b380f4c8024044c

SHA256
8b1fbb677932583717e06b102f80b0028b2c38c16105a1a1bc5408aa2a8dcc59

SHA512
1125a211df5cd66d3db452ea2854bdf0dadcd7aaaa85efc699ff6beb4e690ef65b8ed54e6f192eb49fb5a96e3585543c91417ceddea7c072b48497a41854f3db

Download Submit
C:\Windows\SysWOW64\Qnnanphk.exe

Filesize
74KB

MD5
ab485ce45854fbc7e816e0db7a0790e5

SHA1
585f5110fbe6f7fb1730aae25f8e67100f4b6e40

SHA256
c1285a473cb66e20f4fea7e4d65f2d49061bc87da96058ca49d05d91416b18be

SHA512
f5fda0138157a838f9aaa651c07ec36c07eb93548b3239142da25f4283107379f9fc63186562d426531a6b9954d89b3583d8fd18b048ca5e87b20ee43ffc9d02

Download Submit
memory/184-400-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/232-7-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/680-416-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/764-370-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1032-180-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1128-183-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1424-286-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1460-394-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1592-298-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1680-340-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1812-320-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1836-96-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1856-32-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1864-208-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1908-266-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1912-192-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1968-48-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1980-119-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2064-304-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2124-247-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2180-434-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2232-72-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2268-151-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2292-255-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2408-200-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2424-418-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2520-136-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2568-406-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2576-364-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2604-23-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2688-80-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3060-447-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3064-147-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3068-322-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3076-382-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3104-55-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3164-240-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3308-393-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3320-278-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3488-436-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3532-160-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3620-292-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3688-268-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3792-346-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3888-216-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3964-232-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4140-352-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4308-328-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4408-334-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4432-280-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4476-112-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4484-128-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4488-376-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4496-224-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4660-64-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4736-20-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4744-104-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4772-428-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4796-358-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4936-87-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5008-39-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5016-310-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5032-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5068-172-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads