740839e006ed846de23e5987b31be5245d78db46b3dfe184b2cbce59f5f075bc

Analysis

max time kernel
146s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a3ed3bb3fae496ed6f7e1d5a063bae73.exe
Size

242KB
MD5

a3ed3bb3fae496ed6f7e1d5a063bae73
SHA1

81a628dcdaf43f4666dbfe4c90df2c0b7dcd5064
SHA256

740839e006ed846de23e5987b31be5245d78db46b3dfe184b2cbce59f5f075bc
SHA512

df57a079854f3fd118cb3af941f1ca9081b0ec25ccb93a5a7783a8f06c39f205d7e1ff395839552d8a28a46c9f312a557cf980a338bb152855f2f7c9bd17c154
SSDEEP

3072:q2nDJC5tI+FbZlSmMc5qLktMsv8tcBrw7V6V8ZLB6V16VKcWmjRrzKbKcWmjRrzd:PQc+3T8qBrw7V66LB6X62UyHEYa0

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nenbjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olanmgig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdfehh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lieccf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plkpcfal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llmhaold.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cacmpj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkaqgjme.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlbllc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bopocbcq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpbdopck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmkgkapm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkalplel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmqiec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Malgcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dimenegi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncofplba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldgnbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlphbnoe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aakebqbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iggjga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bljlfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igpdfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilmmni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mchppmij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkkldg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phedhmhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgninn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnkpnclp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmcclm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qaalblgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Plkpcfal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hakidd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmhlijpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccmgiaig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijcjmmil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlhljhbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjhloj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lenicahg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckmehb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbgnemjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmnhcb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Memalfcb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbpkkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cioilg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inkaqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgfmeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilafiihp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	a3ed3bb3fae496ed6f7e1d5a063bae73.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Malgcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oadfkdgd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkhjph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ingpmmgm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbbagk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abponp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfngdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlieda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmoiqneg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeaanjkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkomneim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkmioc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oidhlb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkgiimng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcecjmkl.exe

Executes dropped EXE 64 IoCs

pid	Process
1340	Ihbdplfi.exe
4584	Jkjcbe32.exe
2988	Jklphekp.exe
3168	Jkomneim.exe
4856	Jqlefl32.exe
3644	Jbkbpoog.exe
2328	Kelkaj32.exe
1972	Kbpkkn32.exe
4864	Kjkpoq32.exe
32	Keqdmihc.exe
1628	Kjmmepfj.exe
4836	Kageaj32.exe
3208	Kkmioc32.exe
932	Ljbfpo32.exe
972	Licfngjd.exe
5036	Lieccf32.exe
1680	Laqhhi32.exe
1244	Ljilqnlm.exe
1412	Lacdmh32.exe
3376	Lhmmjbkf.exe
4932	Mbbagk32.exe
2804	Milidebi.exe
4004	Mbenmk32.exe
232	Mecjif32.exe
4780	Mbgjbkfg.exe
3056	Miaboe32.exe
4564	Malgcg32.exe
4164	Nihipdhl.exe
1524	Njiegl32.exe
4452	Neafjdkn.exe
468	Nbefdijg.exe
3796	Nhbolp32.exe
3984	Nlphbnoe.exe
4380	Oidhlb32.exe
408	Olbdhn32.exe
4068	Oblmdhdo.exe
3528	Oldamm32.exe
4352	Ohkbbn32.exe
4372	Oadfkdgd.exe
2660	Pcepkfld.exe
2648	Plndcl32.exe
1168	Phedhmhi.exe
636	Pamiaboj.exe
2156	Phganm32.exe
5052	Pkenjh32.exe
4512	Papfgbmg.exe
3472	Pkhjph32.exe
2100	Qepkbpak.exe
1104	Qljcoj32.exe
2288	Qebhhp32.exe
2512	Ahqddk32.exe
3612	Aaiimadl.exe
4016	Ajpqnneo.exe
4616	Aakebqbj.exe
736	Ahenokjf.exe
964	Ackbmcjl.exe
2788	Alcfei32.exe
4360	Abponp32.exe
2792	Akhcfe32.exe
2496	Bfngdn32.exe
1732	Bljlfh32.exe
976	Bbgeno32.exe
3412	Bcfahbpo.exe
2084	Bjpjel32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Neclenfo.exe	Nnicid32.exe
File opened for modification	C:\Windows\SysWOW64\Pmlmkn32.exe	Plkpcfal.exe
File created	C:\Windows\SysWOW64\Iljpgl32.exe	Ihgnfnjl.exe
File created	C:\Windows\SysWOW64\Ebkibb32.dll	Olbdhn32.exe
File created	C:\Windows\SysWOW64\Fofdkcmd.exe	Epehnhbj.exe
File opened for modification	C:\Windows\SysWOW64\Dikihe32.exe	Dflmlj32.exe
File created	C:\Windows\SysWOW64\Bfjkjgbh.dll	Ebjcajjd.exe
File created	C:\Windows\SysWOW64\Bfpfngma.dll	Gigaka32.exe
File created	C:\Windows\SysWOW64\Ifaepolg.exe	Hfcinq32.exe
File opened for modification	C:\Windows\SysWOW64\Kkkldg32.exe	Kmhlijpm.exe
File opened for modification	C:\Windows\SysWOW64\Jgbjbp32.exe	Jlmfeg32.exe
File opened for modification	C:\Windows\SysWOW64\Mjdebfnd.exe	Mgehfkop.exe
File opened for modification	C:\Windows\SysWOW64\Hlhccj32.exe	Hkfglb32.exe
File opened for modification	C:\Windows\SysWOW64\Nnkpnclp.exe	Nhahaiec.exe
File created	C:\Windows\SysWOW64\Lhmmjbkf.exe	Lacdmh32.exe
File created	C:\Windows\SysWOW64\Ajpqnneo.exe	Aaiimadl.exe
File created	C:\Windows\SysWOW64\Hmcldf32.dll	Dpgnjo32.exe
File created	C:\Windows\SysWOW64\Gaigbkko.dll	Fpjcgm32.exe
File opened for modification	C:\Windows\SysWOW64\Lclpdncg.exe	Lqndhcdc.exe
File created	C:\Windows\SysWOW64\Llmhaold.exe	Aeaanjkl.exe
File created	C:\Windows\SysWOW64\Hkfglb32.exe	Hpabni32.exe
File created	C:\Windows\SysWOW64\Lcjcnoej.exe	Lmpkadnm.exe
File created	C:\Windows\SysWOW64\Jekeodnf.dll	Lmpkadnm.exe
File opened for modification	C:\Windows\SysWOW64\Njiegl32.exe	Nihipdhl.exe
File created	C:\Windows\SysWOW64\Cioilg32.exe	Ccbadp32.exe
File opened for modification	C:\Windows\SysWOW64\Dimenegi.exe	Dfoiaj32.exe
File created	C:\Windows\SysWOW64\Ecgamkhq.dll	Inlihl32.exe
File created	C:\Windows\SysWOW64\Nfamlc32.dll	Jdodkebj.exe
File created	C:\Windows\SysWOW64\Kcbkpj32.exe	Ihheqd32.exe
File opened for modification	C:\Windows\SysWOW64\Lfqjhmhk.exe	Lkiiee32.exe
File created	C:\Windows\SysWOW64\Gigaka32.exe	Fideeaco.exe
File created	C:\Windows\SysWOW64\Pbmmao32.dll	Gdcliikj.exe
File opened for modification	C:\Windows\SysWOW64\Ahqddk32.exe	Qebhhp32.exe
File opened for modification	C:\Windows\SysWOW64\Gdcliikj.exe	Gmiclo32.exe
File opened for modification	C:\Windows\SysWOW64\Hhpheo32.exe	Hembndee.exe
File created	C:\Windows\SysWOW64\Mbldhn32.exe	Mlbllc32.exe
File opened for modification	C:\Windows\SysWOW64\Giinpa32.exe	Gdlfhj32.exe
File opened for modification	C:\Windows\SysWOW64\Mmkkmc32.exe	Mgobel32.exe
File opened for modification	C:\Windows\SysWOW64\Mnegbp32.exe	Mfnoqc32.exe
File opened for modification	C:\Windows\SysWOW64\Kcphpdil.exe	Jkhpogij.exe
File opened for modification	C:\Windows\SysWOW64\Kelkaj32.exe	Jbkbpoog.exe
File opened for modification	C:\Windows\SysWOW64\Papfgbmg.exe	Pkenjh32.exe
File created	C:\Windows\SysWOW64\Mepfiq32.exe	Mminhceb.exe
File opened for modification	C:\Windows\SysWOW64\Oaqbkn32.exe	Ojgjndno.exe
File created	C:\Windows\SysWOW64\Cpqnog32.dll	Gedohfmp.exe
File created	C:\Windows\SysWOW64\Dmdhcddh.exe	Dblgpl32.exe
File created	C:\Windows\SysWOW64\Lepglifa.dll	Dmdhcddh.exe
File created	C:\Windows\SysWOW64\Pcleml32.dll	Jgbjbp32.exe
File opened for modification	C:\Windows\SysWOW64\Nnbnhedj.exe	Nlcalieg.exe
File created	C:\Windows\SysWOW64\Olfghg32.exe	Oaqbkn32.exe
File created	C:\Windows\SysWOW64\Kmjinjnj.exe	Kkkldg32.exe
File created	C:\Windows\SysWOW64\Mecjif32.exe	Mbenmk32.exe
File created	C:\Windows\SysWOW64\Aaiimadl.exe	Ahqddk32.exe
File created	C:\Windows\SysWOW64\Lkalplel.exe	Lcjcnoej.exe
File created	C:\Windows\SysWOW64\Pkbjjbda.exe	Pdhbmh32.exe
File created	C:\Windows\SysWOW64\Mnegbp32.exe	Mfnoqc32.exe
File created	C:\Windows\SysWOW64\Oidhlb32.exe	Nlphbnoe.exe
File opened for modification	C:\Windows\SysWOW64\Lekmnajj.exe	Lclpdncg.exe
File created	C:\Windows\SysWOW64\Ceeojndk.dll	Fajgfiag.exe
File created	C:\Windows\SysWOW64\Fkldkg32.dll	Nmgjia32.exe
File created	C:\Windows\SysWOW64\Mjnafk32.dll	Miaboe32.exe
File created	C:\Windows\SysWOW64\Bljlfh32.exe	Bfngdn32.exe
File created	C:\Windows\SysWOW64\Ckpbnb32.exe	Cbgnemjj.exe
File created	C:\Windows\SysWOW64\Iggjga32.exe	Ilafiihp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7596	7396	WerFault.exe	388

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qoelkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aehbmk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oflpld32.dll"	Oblmdhdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emdajb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfdbpjmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlbllc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnbcohkd.dll"	Emphocjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncofplba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mqdcnl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hakidd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjipmoai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlmfeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmlmkn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ifaepolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kelkaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olbdhn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ejfeng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcjcnoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omjpeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pickil32.dll"	Olfghg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jofabneq.dll"	Malgcg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eplgeokq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emphocjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gigaka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kodapf32.dll"	Lknojl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahenokjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlbdab32.dll"	Lqndhcdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lclpdncg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmcldhfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghpldkpc.dll"	Nhbolp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkhjph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpofii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Milidebi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffaong32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncofplba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkjmbk32.dll"	Pkhjph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahenokjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igliicdk.dll"	Alcfei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cijpahho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lknojl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elcgieob.dll"	Nihipdhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljaoeini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdliee32.dll"	Oadfkdgd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kclgmq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmoiqneg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgbkgmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dimenegi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emkndc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pkbjjbda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qklmpalf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfqdid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nogoacbd.dll"	Midoph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbgnemjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eplgeokq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebjcajjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdafpj32.dll"	Kgninn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldgnbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkbado32.dll"	Ingpmmgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdfehh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgmakofh.dll"	Eifhdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpggodfg.dll"	Fideeaco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmfhkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehofhdli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbgeno32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 1340	2568	a3ed3bb3fae496ed6f7e1d5a063bae73.exe	87
PID 2568 wrote to memory of 1340	2568	a3ed3bb3fae496ed6f7e1d5a063bae73.exe	87
PID 2568 wrote to memory of 1340	2568	a3ed3bb3fae496ed6f7e1d5a063bae73.exe	87
PID 1340 wrote to memory of 4584	1340	Ihbdplfi.exe	88
PID 1340 wrote to memory of 4584	1340	Ihbdplfi.exe	88
PID 1340 wrote to memory of 4584	1340	Ihbdplfi.exe	88
PID 4584 wrote to memory of 2988	4584	Jkjcbe32.exe	89
PID 4584 wrote to memory of 2988	4584	Jkjcbe32.exe	89
PID 4584 wrote to memory of 2988	4584	Jkjcbe32.exe	89
PID 2988 wrote to memory of 3168	2988	Jklphekp.exe	91
PID 2988 wrote to memory of 3168	2988	Jklphekp.exe	91
PID 2988 wrote to memory of 3168	2988	Jklphekp.exe	91
PID 3168 wrote to memory of 4856	3168	Jkomneim.exe	92
PID 3168 wrote to memory of 4856	3168	Jkomneim.exe	92
PID 3168 wrote to memory of 4856	3168	Jkomneim.exe	92
PID 4856 wrote to memory of 3644	4856	Jqlefl32.exe	93
PID 4856 wrote to memory of 3644	4856	Jqlefl32.exe	93
PID 4856 wrote to memory of 3644	4856	Jqlefl32.exe	93
PID 3644 wrote to memory of 2328	3644	Jbkbpoog.exe	94
PID 3644 wrote to memory of 2328	3644	Jbkbpoog.exe	94
PID 3644 wrote to memory of 2328	3644	Jbkbpoog.exe	94
PID 2328 wrote to memory of 1972	2328	Kelkaj32.exe	95
PID 2328 wrote to memory of 1972	2328	Kelkaj32.exe	95
PID 2328 wrote to memory of 1972	2328	Kelkaj32.exe	95
PID 1972 wrote to memory of 4864	1972	Kbpkkn32.exe	96
PID 1972 wrote to memory of 4864	1972	Kbpkkn32.exe	96
PID 1972 wrote to memory of 4864	1972	Kbpkkn32.exe	96
PID 4864 wrote to memory of 32	4864	Kjkpoq32.exe	97
PID 4864 wrote to memory of 32	4864	Kjkpoq32.exe	97
PID 4864 wrote to memory of 32	4864	Kjkpoq32.exe	97
PID 32 wrote to memory of 1628	32	Keqdmihc.exe	98
PID 32 wrote to memory of 1628	32	Keqdmihc.exe	98
PID 32 wrote to memory of 1628	32	Keqdmihc.exe	98
PID 1628 wrote to memory of 4836	1628	Kjmmepfj.exe	99
PID 1628 wrote to memory of 4836	1628	Kjmmepfj.exe	99
PID 1628 wrote to memory of 4836	1628	Kjmmepfj.exe	99
PID 4836 wrote to memory of 3208	4836	Kageaj32.exe	100
PID 4836 wrote to memory of 3208	4836	Kageaj32.exe	100
PID 4836 wrote to memory of 3208	4836	Kageaj32.exe	100
PID 3208 wrote to memory of 932	3208	Kkmioc32.exe	101
PID 3208 wrote to memory of 932	3208	Kkmioc32.exe	101
PID 3208 wrote to memory of 932	3208	Kkmioc32.exe	101
PID 932 wrote to memory of 972	932	Ljbfpo32.exe	102
PID 932 wrote to memory of 972	932	Ljbfpo32.exe	102
PID 932 wrote to memory of 972	932	Ljbfpo32.exe	102
PID 972 wrote to memory of 5036	972	Licfngjd.exe	103
PID 972 wrote to memory of 5036	972	Licfngjd.exe	103
PID 972 wrote to memory of 5036	972	Licfngjd.exe	103
PID 5036 wrote to memory of 1680	5036	Lieccf32.exe	104
PID 5036 wrote to memory of 1680	5036	Lieccf32.exe	104
PID 5036 wrote to memory of 1680	5036	Lieccf32.exe	104
PID 1680 wrote to memory of 1244	1680	Laqhhi32.exe	105
PID 1680 wrote to memory of 1244	1680	Laqhhi32.exe	105
PID 1680 wrote to memory of 1244	1680	Laqhhi32.exe	105
PID 1244 wrote to memory of 1412	1244	Ljilqnlm.exe	106
PID 1244 wrote to memory of 1412	1244	Ljilqnlm.exe	106
PID 1244 wrote to memory of 1412	1244	Ljilqnlm.exe	106
PID 1412 wrote to memory of 3376	1412	Lacdmh32.exe	107
PID 1412 wrote to memory of 3376	1412	Lacdmh32.exe	107
PID 1412 wrote to memory of 3376	1412	Lacdmh32.exe	107
PID 3376 wrote to memory of 4932	3376	Lhmmjbkf.exe	108
PID 3376 wrote to memory of 4932	3376	Lhmmjbkf.exe	108
PID 3376 wrote to memory of 4932	3376	Lhmmjbkf.exe	108
PID 4932 wrote to memory of 2804	4932	Mbbagk32.exe	109

C:\Users\Admin\AppData\Local\Temp\a3ed3bb3fae496ed6f7e1d5a063bae73.exe
"C:\Users\Admin\AppData\Local\Temp\a3ed3bb3fae496ed6f7e1d5a063bae73.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\Ihbdplfi.exe
  C:\Windows\system32\Ihbdplfi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\SysWOW64\Jkjcbe32.exe
    C:\Windows\system32\Jkjcbe32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Windows\SysWOW64\Jklphekp.exe
      C:\Windows\system32\Jklphekp.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2988
    - - C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3168
      - C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3644
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2328
        
        C:\Windows\SysWOW64\Kbpkkn32.exe
        
        C:\Windows\system32\Kbpkkn32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\SysWOW64\Kjkpoq32.exe
        
        C:\Windows\system32\Kjkpoq32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:32
        
        C:\Windows\SysWOW64\Kjmmepfj.exe
        
        C:\Windows\system32\Kjmmepfj.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1628
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\SysWOW64\Kkmioc32.exe
        
        C:\Windows\system32\Kkmioc32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:932
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:972
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1244
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3376
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\SysWOW64\Milidebi.exe
        
        C:\Windows\system32\Milidebi.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2804
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4004
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        25⤵
        Executes dropped EXE
        
        PID:232
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        26⤵
        Executes dropped EXE
        
        PID:4780
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3056
        
        C:\Windows\SysWOW64\Malgcg32.exe
        
        C:\Windows\system32\Malgcg32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4564
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4164
        
        C:\Windows\SysWOW64\Njiegl32.exe
        
        C:\Windows\system32\Njiegl32.exe
        30⤵
        Executes dropped EXE
        
        PID:1524
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        31⤵
        Executes dropped EXE
        
        PID:4452
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        32⤵
        Executes dropped EXE
        
        PID:468
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3796
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3984
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4380
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:408
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4068
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        38⤵
        Executes dropped EXE
        
        PID:3528
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        39⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4372
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        41⤵
        Executes dropped EXE
        
        PID:2660
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        42⤵
        Executes dropped EXE
        
        PID:2648
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1168
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        44⤵
        Executes dropped EXE
        
        PID:636
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        45⤵
        Executes dropped EXE
        
        PID:2156
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5052
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        47⤵
        Executes dropped EXE
        
        PID:4512
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3472
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        49⤵
        Executes dropped EXE
        
        PID:2100
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        50⤵
        Executes dropped EXE
        
        PID:1104
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2288
        
        C:\Windows\SysWOW64\Ahqddk32.exe
        
        C:\Windows\system32\Ahqddk32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2512
        
        C:\Windows\SysWOW64\Aaiimadl.exe
        
        C:\Windows\system32\Aaiimadl.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3612
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        54⤵
        Executes dropped EXE
        
        PID:4016
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4616
        
        C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:736
        
        C:\Windows\SysWOW64\Ackbmcjl.exe
        
        C:\Windows\system32\Ackbmcjl.exe
        57⤵
        Executes dropped EXE
        
        PID:964
        
        C:\Windows\SysWOW64\Alcfei32.exe
        
        C:\Windows\system32\Alcfei32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2788
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4360
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        60⤵
        Executes dropped EXE
        
        PID:2792
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2496
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1732
        
        C:\Windows\SysWOW64\Bbgeno32.exe
        
        C:\Windows\system32\Bbgeno32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:976
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        64⤵
        Executes dropped EXE
        
        PID:3412
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        65⤵
        Executes dropped EXE
        
        PID:2084
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        66⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        67⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3464
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        69⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4012
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        71⤵
        Modifies registry class
        
        PID:816
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        72⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        73⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        74⤵
        Drops file in System32 directory
        
        PID:1684
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3112
        
        C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2564
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1228
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        78⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        79⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        80⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        81⤵
        Drops file in System32 directory
        
        PID:852
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        82⤵
        Drops file in System32 directory
        
        PID:3688
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3108
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        84⤵
        Drops file in System32 directory
        
        PID:1708
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        85⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5152
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        87⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        88⤵
        Drops file in System32 directory
        
        PID:5248
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5296
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        90⤵
        Drops file in System32 directory
        
        PID:5348
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        91⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        92⤵
        Modifies registry class
        
        PID:5444
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        93⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        94⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        95⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        96⤵
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        97⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        98⤵
        Modifies registry class
        
        PID:5712
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        99⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        100⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        101⤵
        Modifies registry class
        
        PID:5832
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        102⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        103⤵
        Modifies registry class
        
        PID:5916
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        104⤵
        Modifies registry class
        
        PID:5960
        
        C:\Windows\SysWOW64\Ffmfchle.exe
        
        C:\Windows\system32\Ffmfchle.exe
        105⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        106⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        107⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        108⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        109⤵
        Modifies registry class
        
        PID:5168
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5224
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        111⤵
        Drops file in System32 directory
        
        PID:5328
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        112⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        113⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        114⤵
        Drops file in System32 directory
        
        PID:5512
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        115⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        116⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        117⤵
        Drops file in System32 directory
        
        PID:5760
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        118⤵
        Drops file in System32 directory
        
        PID:5824
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        119⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        120⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        121⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        122⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        123⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        124⤵
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        125⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        126⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        127⤵
        Drops file in System32 directory
        
        PID:5468
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        128⤵
        Drops file in System32 directory
        
        PID:5604
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        129⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        130⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        131⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6108
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2116
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        134⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5424
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        136⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        137⤵
        Drops file in System32 directory
        
        PID:5944
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5140
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5580
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5736
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        141⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        142⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        143⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        144⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        145⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6120
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        147⤵
        Drops file in System32 directory
        
        PID:6184
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        148⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        149⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        150⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6312
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        151⤵
        Drops file in System32 directory
        
        PID:6364
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        152⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        153⤵
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        154⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        155⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        156⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6628
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        158⤵
        Modifies registry class
        
        PID:6676
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        159⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6760
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        161⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        162⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6892
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        164⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        165⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        166⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        167⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        168⤵
        Modifies registry class
        
        PID:7140
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        169⤵
        Modifies registry class
        
        PID:4280
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        170⤵
        Drops file in System32 directory
        
        PID:6192
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        171⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6248
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6324
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        173⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6388
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        174⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6428
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        175⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        176⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6652
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        178⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        179⤵
        Drops file in System32 directory
        
        PID:6772
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        180⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        181⤵
        Drops file in System32 directory
        
        PID:6904
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        182⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7036
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7076
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5560
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        186⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        187⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        188⤵
        Drops file in System32 directory
        
        PID:6424
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        189⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        190⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        191⤵
        Drops file in System32 directory
        
        PID:6860
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        192⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7160
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        194⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        195⤵
        Drops file in System32 directory
        
        PID:6684
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6528
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        197⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        198⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        199⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        200⤵
        Drops file in System32 directory
        
        PID:7024
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        201⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        202⤵
        Drops file in System32 directory
        
        PID:7184
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7224
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        204⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        205⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7340
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        207⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        208⤵
        Drops file in System32 directory
        
        PID:7428
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        209⤵
        Drops file in System32 directory
        
        PID:7468
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        210⤵
        Modifies registry class
        
        PID:7508
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        211⤵
        Modifies registry class
        
        PID:7544
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        212⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7620
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        214⤵
        Modifies registry class
        
        PID:7660
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7700
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        216⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7776
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        218⤵
        Drops file in System32 directory
        
        PID:7816
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        219⤵
        Modifies registry class
        
        PID:7856
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7896
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        221⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7968
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        223⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        224⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        225⤵
        Modifies registry class
        
        PID:8088
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        226⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        227⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        228⤵
        Modifies registry class
        
        PID:6836
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7028
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7492
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        231⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        232⤵
        Drops file in System32 directory
        
        PID:7612
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        233⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        234⤵
        Modifies registry class
        
        PID:7884
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        235⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        236⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7100
        
        C:\Windows\SysWOW64\Ddmhhd32.exe
        
        C:\Windows\system32\Ddmhhd32.exe
        238⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\Fjeplijj.exe
        
        C:\Windows\system32\Fjeplijj.exe
        239⤵
        
        PID:548
        
        C:\Windows\SysWOW64\Inkaqb32.exe
        
        C:\Windows\system32\Inkaqb32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5360
        
        C:\Windows\SysWOW64\Memalfcb.exe
        
        C:\Windows\system32\Memalfcb.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7460
        
        C:\Windows\SysWOW64\Ofijnbkb.exe
        
        C:\Windows\system32\Ofijnbkb.exe
        242⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\Aehbmk32.exe
        
        C:\Windows\system32\Aehbmk32.exe
        243⤵
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Bmkjig32.exe
        
        C:\Windows\system32\Bmkjig32.exe
        244⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Eippgckc.exe
        
        C:\Windows\system32\Eippgckc.exe
        245⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\Fgfmeg32.exe
        
        C:\Windows\system32\Fgfmeg32.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4900
        
        C:\Windows\SysWOW64\Hfcinq32.exe
        
        C:\Windows\system32\Hfcinq32.exe
        247⤵
        Drops file in System32 directory
        
        PID:1752
        
        C:\Windows\SysWOW64\Ifaepolg.exe
        
        C:\Windows\system32\Ifaepolg.exe
        248⤵
        Modifies registry class
        
        PID:916
        
        C:\Windows\SysWOW64\Lmqiec32.exe
        
        C:\Windows\system32\Lmqiec32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3440
        
        C:\Windows\SysWOW64\Nolekd32.exe
        
        C:\Windows\system32\Nolekd32.exe
        250⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\Pfdbpjmi.exe
        
        C:\Windows\system32\Pfdbpjmi.exe
        251⤵
        Modifies registry class
        
        PID:4056
        
        C:\Windows\SysWOW64\Qdipag32.exe
        
        C:\Windows\system32\Qdipag32.exe
        252⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\Dfqdid32.exe
        
        C:\Windows\system32\Dfqdid32.exe
        253⤵
        Modifies registry class
        
        PID:4608
        
        C:\Windows\SysWOW64\Epehnhbj.exe
        
        C:\Windows\system32\Epehnhbj.exe
        254⤵
        Drops file in System32 directory
        
        PID:884
        
        C:\Windows\SysWOW64\Fofdkcmd.exe
        
        C:\Windows\system32\Fofdkcmd.exe
        255⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Goadfa32.exe
        
        C:\Windows\system32\Goadfa32.exe
        256⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\Ioppho32.exe
        
        C:\Windows\system32\Ioppho32.exe
        257⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\Ihheqd32.exe
        
        C:\Windows\system32\Ihheqd32.exe
        258⤵
        Drops file in System32 directory
        
        PID:5868
        
        C:\Windows\SysWOW64\Kcbkpj32.exe
        
        C:\Windows\system32\Kcbkpj32.exe
        259⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Kakednfj.exe
        
        C:\Windows\system32\Kakednfj.exe
        260⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Liifnp32.exe
        
        C:\Windows\system32\Liifnp32.exe
        261⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Ldgnbg32.exe
        
        C:\Windows\system32\Ldgnbg32.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:820
        
        C:\Windows\SysWOW64\Mpchbhjl.exe
        
        C:\Windows\system32\Mpchbhjl.exe
        263⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\Pgbkgmao.exe
        
        C:\Windows\system32\Pgbkgmao.exe
        264⤵
        Modifies registry class
        
        PID:5504
        
        C:\Windows\SysWOW64\Aamipe32.exe
        
        C:\Windows\system32\Aamipe32.exe
        265⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Aglnnkid.exe
        
        C:\Windows\system32\Aglnnkid.exe
        266⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Ehofhdli.exe
        
        C:\Windows\system32\Ehofhdli.exe
        267⤵
        Modifies registry class
        
        PID:6732
        
        C:\Windows\SysWOW64\Fajgfiag.exe
        
        C:\Windows\system32\Fajgfiag.exe
        268⤵
        Drops file in System32 directory
        
        PID:736
        
        C:\Windows\SysWOW64\Gknkkmmj.exe
        
        C:\Windows\system32\Gknkkmmj.exe
        269⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\Gedohfmp.exe
        
        C:\Windows\system32\Gedohfmp.exe
        270⤵
        Drops file in System32 directory
        
        PID:5052
        
        C:\Windows\SysWOW64\Hembndee.exe
        
        C:\Windows\system32\Hembndee.exe
        271⤵
        Drops file in System32 directory
        
        PID:412
        
        C:\Windows\SysWOW64\Hhpheo32.exe
        
        C:\Windows\system32\Hhpheo32.exe
        272⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\Hkaqgjme.exe
        
        C:\Windows\system32\Hkaqgjme.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3304
        
        C:\Windows\SysWOW64\Hakidd32.exe
        
        C:\Windows\system32\Hakidd32.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1628
        
        C:\Windows\SysWOW64\Ihgnfnjl.exe
        
        C:\Windows\system32\Ihgnfnjl.exe
        275⤵
        Drops file in System32 directory
        
        PID:1496
        
        C:\Windows\SysWOW64\Iljpgl32.exe
        
        C:\Windows\system32\Iljpgl32.exe
        276⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Iohlcg32.exe
        
        C:\Windows\system32\Iohlcg32.exe
        277⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\Jlafhkfe.exe
        
        C:\Windows\system32\Jlafhkfe.exe
        278⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Jflgfpkc.exe
        
        C:\Windows\system32\Jflgfpkc.exe
        279⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Jhjcbljf.exe
        
        C:\Windows\system32\Jhjcbljf.exe
        280⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Jkhpogij.exe
        
        C:\Windows\system32\Jkhpogij.exe
        281⤵
        Drops file in System32 directory
        
        PID:5368
        
        C:\Windows\SysWOW64\Kcphpdil.exe
        
        C:\Windows\system32\Kcphpdil.exe
        282⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Kjipmoai.exe
        
        C:\Windows\system32\Kjipmoai.exe
        283⤵
        Modifies registry class
        
        PID:7272
        
        C:\Windows\SysWOW64\Kmhlijpm.exe
        
        C:\Windows\system32\Kmhlijpm.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7528
        
        C:\Windows\SysWOW64\Kkkldg32.exe
        
        C:\Windows\system32\Kkkldg32.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5492
        
        C:\Windows\SysWOW64\Kmjinjnj.exe
        
        C:\Windows\system32\Kmjinjnj.exe
        286⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Kcfnqccd.exe
        
        C:\Windows\system32\Kcfnqccd.exe
        287⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Kkabefqp.exe
        
        C:\Windows\system32\Kkabefqp.exe
        288⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Lmcldhfp.exe
        
        C:\Windows\system32\Lmcldhfp.exe
        289⤵
        Modifies registry class
        
        PID:7960
        
        C:\Windows\SysWOW64\Lkiiee32.exe
        
        C:\Windows\system32\Lkiiee32.exe
        290⤵
        Drops file in System32 directory
        
        PID:6360
        
        C:\Windows\SysWOW64\Lfqjhmhk.exe
        
        C:\Windows\system32\Lfqjhmhk.exe
        291⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Midoph32.exe
        
        C:\Windows\system32\Midoph32.exe
        292⤵
        Modifies registry class
        
        PID:5912
        
        C:\Windows\SysWOW64\Mlbllc32.exe
        
        C:\Windows\system32\Mlbllc32.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7940
        
        C:\Windows\SysWOW64\Mbldhn32.exe
        
        C:\Windows\system32\Mbldhn32.exe
        294⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7396 -s 408
        295⤵
        Program crash
        
        PID:7596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 7396 -ip 7396
1⤵
PID:7480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaenbd32.exe

Filesize
242KB

MD5
7648d61846bca16c80a1893b4194c1b5

SHA1
91e279805215f7b11f76a9ca2ebc595971ba9edc

SHA256
2bc805260f419e4bb633761dab7c3b4052d52c0aa9c969c5433d78e0308c0b35

SHA512
e0167f1e89634b346c30ac17407c2f55134200ac3545df8e71d7ab12b8840b63a0d8652689bfb92dbfa841834b78b7a785e538d1b75e2fbab2a2f634de176207

Download Submit
C:\Windows\SysWOW64\Aglnnkid.exe

Filesize
64KB

MD5
aef85377ebd992a609d1336a8b0b0d7e

SHA1
73d2048c768d894ff6efa46a9271ae94dc1098b9

SHA256
19d7fe8b7b3604425ea06e09d393a938ab9182f9a074bd1a0955ce6961859c02

SHA512
a9a851962557b21210988e511bfdf0befec0def5b04da4771df8802b75a18c381f4600186ef5f1d7bcada50acc568477dc3c849fb7edf5cb9c822324c99172aa

Download Submit
C:\Windows\SysWOW64\Cfnqklgh.exe

Filesize
242KB

MD5
9f18b48cf8a2619f4aa91aed6ce7962d

SHA1
3ebbd7da72da55f8bfb52f8a7e6c4597d9ed4f82

SHA256
bb4d88b7b6ac9c9c1abb6ff5cd57683cc48c905f727ef187b8503cac76f8dbbc

SHA512
c144888f70dfac009cc1166a6a8cb18235d725b34e9bcbfa04439411001dfa208abd530f0dad93758348951ab40fbba44cbd414185ef10c78422bd8f0664ff48

Download Submit
C:\Windows\SysWOW64\Fajgfiag.exe

Filesize
242KB

MD5
991b25020d629317606d58fd01fcf92b

SHA1
591d1c17208e6ee5d49325e98e0046086a62456a

SHA256
cd3a4efb018cdbe8973419db4160c02b288698128fc93460549d71463940c81a

SHA512
0c6fe2ef62f0fc181c16c11927b4c87dea3bbba0df901ea494d1c811c8af99a46a2fec071f193ad68fa05a16c65717e977e8fc00173bd79d316572ce63213cfb

Download Submit
C:\Windows\SysWOW64\Ffmfchle.exe

Filesize
242KB

MD5
144d3d0948dcc6fad689a6c43888d99b

SHA1
07b608233dff8d291bc2d4c2fbe857bdb7250109

SHA256
5e63f0eaff98116d3f457bd75728608fb0b5d1a14971bfe8883e854aea5e3b17

SHA512
056a6197c526eff4f1a4be7635a63c477a546f6680d1629d5defacd6ca6aae6e66a4ce88956224a9d4199105d3d5065a33cccf03a406b74e72a2e90bdc4ae9e4

Download Submit
C:\Windows\SysWOW64\Gedohfmp.exe

Filesize
242KB

MD5
b52dfc2e4bd4ba6b92453af7de560131

SHA1
62438a049c2f6edab4d4739665184c038ab1cb72

SHA256
e1bfce4b2c5430e8a04adc17f493e511ef317a48914a857c74481d58f5d4b73c

SHA512
cf1a9d26cdb3da423572906a1580cac925dc9f742e21c2acacf9a987c14a7bd5a934c0d2eb99e56d28f6af2ae5948f48e5a431b036e0951404838808276974f0

Download Submit
C:\Windows\SysWOW64\Goadfa32.exe

Filesize
242KB

MD5
3ee51602c105dff9ebdf0b726fb81eb5

SHA1
4bd56363aa4ffe00880e3e1fcf2e339cf074433b

SHA256
9ac2f9f971c90dad0ee9a7ae1d4226c2d128f0063126f8252904407319678416

SHA512
dedeb30e0829f6af404fef3314519742c6222cf3be6470a39c312a16a3dc18a6c8e82faaf3c7fb0400a857363570aaecc9a2e63cfb160056ef0d8ec923c18b44

Download Submit
C:\Windows\SysWOW64\Hakidd32.exe

Filesize
242KB

MD5
08bc1663cfb07302f9e847518300a65e

SHA1
506ee091a3c5064cd5efbd938ac8fd25d7d25867

SHA256
374afaf154c33daa659fb96b13b67a82de9c1628b38315b96baa332b886b9d98

SHA512
957d5cf5289d29b4bf2b5d61a29db571a9ab97410ab508494cdd1061ba8dca3a548c2eae8617f1daf2620f664444a95548ffd98e2842509eab514c0ccedc1592

Download Submit
C:\Windows\SysWOW64\Hgfapd32.exe

Filesize
242KB

MD5
d6e1701a10cf7c90a029913aafbf09bc

SHA1
f3d9dfbebed8ac4c2e04065eb1173aee6fc27974

SHA256
d562aa6c69114b1b0262ddf89b3b91931c8cca7f7dd9a1fe14f90807af3937c8

SHA512
2b5751634645444fe1870387441cc7060252c2b90cb5aee13208ab9c2f6dacacc34cd6d6ced6568835375434f4296542eeea7d005b365dd1514cda9fb35ef6f6

Download Submit
C:\Windows\SysWOW64\Hhpheo32.exe

Filesize
242KB

MD5
e98a60790a229808a2797db85e5abf98

SHA1
0eef1037d243c0d6e9afca648a6c7575adf0f704

SHA256
cf4cb4e60ae4146d9f454f0d02c1e1aa58b46ed799a740d587ea105176ce3ffc

SHA512
bac41523a59ef57f85e81c5e3fb080121116c9a0e499b3c1c5c6061793a3d4bcf317d8657399fe122ee8b925920cadfdc9a1a5022b6abea6c1e45376e414c07c

Download Submit
C:\Windows\SysWOW64\Ihbdplfi.exe

Filesize
242KB

MD5
68e5033e1d0c261a9a486a419cb26cc5

SHA1
ee9de8e6f28542aba56b0282ce03ec789cb1279b

SHA256
3cf72e07bb5882f1986c2986f3682b9bba9ae240808cafc20a06c8b9ea2d80ef

SHA512
5830edb056efff1766157b5dc131d2ac35add6a9c4c5814a1acce9dcf28cb01b2c04cc1b81b9a515be84a854635608f338e3e9cbdaee17133ecf064c77a54e9e

Download Submit
C:\Windows\SysWOW64\Jbkbpoog.exe

Filesize
242KB

MD5
86e151f08bf022385b618aa6c147b086

SHA1
64c47828adab7435148d1e18085eed6c6c355f6c

SHA256
43a3be2e36c4198240cc1c4978795ab027ddca869e121ab8821bff7439094752

SHA512
0f9a30d5eeb055d678470b486db1fac673c2111e221606b0250f4dd07e8a590b4ff98850a007d0203a1d149d6fa61f9f8d500e9dbd067279900ff96d73fadf1e

Download Submit
C:\Windows\SysWOW64\Jkjcbe32.exe

Filesize
242KB

MD5
771cf0dc8ef05b7ab648036a0e36c8ae

SHA1
14708e120c293c60648722aaed76801791ea31f9

SHA256
9722458dd1b3e538886eae07c0e09deb7ca41685caf93d068b8aad4d0b178a39

SHA512
8a1c4d9d1152045a71855285464babc6c6ec68e6c04b551e6de0d5867d21fbdc96affd5dc2cb1bc533ae8056ffbd07fc386de3800eadcc89cb872a9ad5ef9fe9

Download Submit
C:\Windows\SysWOW64\Jklphekp.exe

Filesize
242KB

MD5
7e55de558fc668f1cd7f5870e8d94ace

SHA1
33dee9f95dadc5114eb5cb3a5f8dcb58a611701f

SHA256
b1cd9275854a98390b8593e8b7d4624d2d8cb0084f4eb65ce8bb35d6ccbd333f

SHA512
10e1d595b04f935278a550a2b16feb576820fe1a1e7abb3dce1a6e716b6a6d049b15149064e63e30f4c7d0acdd78b78b7cd9ffeb673c91fe67c9b5f02e023db1

Download Submit
C:\Windows\SysWOW64\Jkomneim.exe

Filesize
242KB

MD5
61770d80d2a11134a9cf90c78778a3da

SHA1
17bd2b31ec6381b73cb77795103a3a68fecf2144

SHA256
21c857229257bb027c8788dff427ef3440a138c4937dc42ba5d2b562f6e228a6

SHA512
0b1aeed5985af5dd145c043df1a0fef816f2567d2e0d43a0bf673225ab25b70de6111c40dd60238de7d4b3a2afd0b8d5e4c38a22e06239dec5bd57652e838526

Download Submit
C:\Windows\SysWOW64\Jqlefl32.exe

Filesize
242KB

MD5
99b4c918a457fa612c303fac51b218b7

SHA1
ded990668a47281e447347e0011cdf17b5749469

SHA256
ab6d49e2f0cc807a47e23c94dd98608670e62c61daab0b6bb4859b920c221508

SHA512
509b5a6ea992491fb808ecdbc1d9863148f12ad261f0905eb38b64947cad96d3fee8796e9511c78ef60572379e94d2fc434623c816484beb5316b2dc77fda063

Download Submit
C:\Windows\SysWOW64\Kageaj32.exe

Filesize
242KB

MD5
e7a13daae76c6fa6094d62864d5383cf

SHA1
a2a402f3ff64da705c0f2213a00c07071a65c48a

SHA256
ee8339972a555cb742a3bf2dac4bda9df0e6d02c9b8f0500b6d4481b28e0020f

SHA512
c1e699b458c71aa4925ac0368d7b0a87e7ab0bcef5ee2b3563a1d57aa9d55a0de84283f645b91f9b0302c31c8e32d6238e4d15564bb1d6da05a7962ff248e6a9

Download Submit
C:\Windows\SysWOW64\Kbpkkn32.exe

Filesize
242KB

MD5
4e265c2b596113847f5e9f9ceb93b516

SHA1
5b8822313195858e2964460c7355888b658b93dd

SHA256
e5a3d2b307e7a98fa42876e4deb76f6b60fe972a80d53900b99bc860a97ac98a

SHA512
7738fcdfd5575c809d95fe40369e4c6791612437588a214f2a510199f19143f678add5a09da1d694013fe3c67252f2cc02440d04711d169e24415a79abe630fd

Download Submit
C:\Windows\SysWOW64\Kcbkpj32.exe

Filesize
242KB

MD5
9c479f7823ef98e1a13f3a36e576fb5e

SHA1
a9d21cba400ffeb9655133bce1da60ced07d0acf

SHA256
3ea88bb282f3aa7668d33bb1c1deafa58ef1a6e0cbe82fb39bd2ca8a34f92e12

SHA512
ef0e464cf186004fe183f3180fc81061cdfcc4d58293f96915aab342b852e3f5dbb7812cc5723024dc53728a32eafe8666e31244c81628ee58bcbf85c60e548e

Download Submit
C:\Windows\SysWOW64\Kelkaj32.exe

Filesize
242KB

MD5
c72f3eceed7c63d6e4aa185d345fc438

SHA1
5750341c22e6bf819e3980cf6359a2f17e62a88c

SHA256
0379b11d66ff7044b81fef9341a55cfc42923a3a84524b9fbd6452a9a94a3e09

SHA512
697ec9e5618a71cce729341436741a8ae1f7bdb00fdbd509376fdf7963984a06ea267fdd96b7673f678854c90df2064f083f7338a1a97ee8d7b69450f33dde89

Download Submit
C:\Windows\SysWOW64\Keqdmihc.exe

Filesize
242KB

MD5
ce8347612de4fc805e62a197e504ea0b

SHA1
c279c5a5b2afc7789763c40b73045223b05d1059

SHA256
0205e584b087348e9c766bf064dfef82056604f94ee6c66aff9d9c66e6b92507

SHA512
7118b66afceb28a518b9fb31ce4570fa11c4d62411528aa63919c91547bdcbd40b2f84eeb074b6a004194f72b715de088ab2aae3532e85734b88c1449b95f924

Download Submit
C:\Windows\SysWOW64\Kjkpoq32.exe

Filesize
242KB

MD5
07a7acbade80a6f8d197ec167e6c5643

SHA1
d2579c1619727def96eaae1a2a1c092c912c0252

SHA256
2ec3e7a39b742995545d262eda67da4bcdd6fcb6dd065030d6f725d32ae7e55b

SHA512
994b9ae20468cd295caaf77bc77087764c9f28155bf2047d4b8ce2e1f27c619752fe3363570d15b4985f057d32438856740a82bb3d2febd19bc57ca5d57bfa97

Download Submit
C:\Windows\SysWOW64\Kjmmepfj.exe

Filesize
242KB

MD5
505e2547ff2354167fe00a0166eefe45

SHA1
70a7a4815170cb8bd639b59bff63a7ef3b444cfc

SHA256
c73ec4f075ea2ac083fc3801bb9889cf1ae8454db9107177fff036b9b0eba9f8

SHA512
da57d95793d1e4d58e56af2e850dac96d65ec73647ad729e2ba8dad2182ad8054231a50622d687bde94e5f369b5bba30ac14d2e71daf4dec6aff5a32786d80ec

Download Submit
C:\Windows\SysWOW64\Kkabefqp.exe

Filesize
242KB

MD5
f4122f3c264924cd0fe3f9fa587ba2ee

SHA1
390d2cf9e7465b9ed0427e82b7956909de95a561

SHA256
406b903a8975daa9d57e2608fcf2b845f7a4669ea0a80fb3ec051e3f73837255

SHA512
688e854f58a7b7079871a6a202e88063ca05e298a30120f65a179356f81686586455d5c53d6f4a45ea7355155db39727d62ac013b127972c2b5af90ef180d438

Download Submit
C:\Windows\SysWOW64\Kkmioc32.exe

Filesize
242KB

MD5
b5b161cd0e7873ec02c62a2b4999edaa

SHA1
6a2086e3cf40ddb8f318dbae4a1d78407b70caf0

SHA256
e12b84c1770e680d044958f57723439231bc920ccbff8f4b776f23e61c8944ec

SHA512
f09859f994c21dcdd468f2dbad314d5eeebc3f0dd46e6407f65fc00f0a4b62ae0a637921d949345f9035c5b7c3c43da6e40c64c9fa4c510af607e6ec2e204092

Download Submit
C:\Windows\SysWOW64\Lacdmh32.exe

Filesize
242KB

MD5
87440576e188d899bce779ef0b07577e

SHA1
98bb88526baba4808fb506c225a6a754ade4777d

SHA256
58718dbcea9f62f0e1e4adce7549b951e1107e1042f16affef4a0a4178fb12ff

SHA512
bf9ef493122a7a89f402b5bb5f6a5d3f2b573e372a3c3eaadf704339fbdc83569353f14d67ce18107594ce9174a62da71f7b8cd9d32b969ce0a392815001929e

Download Submit
C:\Windows\SysWOW64\Laqhhi32.exe

Filesize
242KB

MD5
fb65431f61b561400b4cfbe051452d71

SHA1
e6f1e7f733f24489579d90dff07ea3924e5e0db4

SHA256
20b5a384f5ef191a7f95682e9412e905957fa9854d22e9fafdd72da5375c6d97

SHA512
ec5ec7c56bbe27e216c6d4b65f8dc28ac026d32e32be62319e544c7dc54337c501dd87a01239f2573889d844a3084ff0cbf02e14244267f70bee6c376c9f6edb

Download Submit
C:\Windows\SysWOW64\Ldgnbg32.exe

Filesize
192KB

MD5
3dccf3fb1f00b7f22919fa96f3005c72

SHA1
89d9a9ed39296233d14667138ee315225bea1164

SHA256
d955fd2c1b161f1aa65fbde305a6e21de7b1521ff8fc699cd35df56fb1644af6

SHA512
9fd5d5e0cad71489813f1d6f5d96565ad63527d58bfb8c8a26a628afffda3759c9dd9c34f7b8753ec94bda75f98acec0d755c152b75928e9427e0d67de992031

Download Submit
C:\Windows\SysWOW64\Lhmmjbkf.exe

Filesize
242KB

MD5
ec6cec236c85796e2666a4280d673c5b

SHA1
083c14fced93530fe50815c64c0ebc010265c840

SHA256
86b868a4e3a218376b977fd4c348412a2c6b75b08f48084b355de1bb55e24ea7

SHA512
36d2556d20e55fc562838c01fc15d7970475894ae4438b0ac87e4a88847f7336c79a9b305ab16e9ab1268592245870081f88852eb504d25293d08ca1f60985e9

Download Submit
C:\Windows\SysWOW64\Licfngjd.exe

Filesize
242KB

MD5
0d991e51f788afa1de6e67c90aee2370

SHA1
39c100443b2af1576b1dd6753146d3e71a1452a9

SHA256
fe885a6127b3b21bcc59f6ebd09dc1d3c81e625a5797adef94e5ab3ec4cd9b7e

SHA512
f810a8363b9bf4230879d2311a4fa88c979a034311442d8438d30ca2a8f0202e344c0f1bb740dfd58cc118c646d605e907c12f6b92ac7ae4ff4fb82f28fb08ee

Download Submit
C:\Windows\SysWOW64\Lieccf32.exe

Filesize
242KB

MD5
cea37e091ff9c1c472788a3878ecc991

SHA1
9f6effc422c94135e3a3893abfa117e1b6fed0e8

SHA256
4ed60a409760d33c03646fea718b10b567aa0ca04cf31b43667bfd6b83fb78fa

SHA512
7d9d5b411383fba8f5f2119d8107cd6ae287ea0e5963832825dc196f072486ee8515936c46e21fd0c7ce10ad7a5040d5baa4a2a9ec268763d7e6f0d053c714e6

Download Submit
C:\Windows\SysWOW64\Liifnp32.exe

Filesize
242KB

MD5
214cd345e499b43bcb9bf9041c7fee41

SHA1
a8f8940115ddd42602eef9d66273ee1f7e1d87e2

SHA256
ab739bed0a232c95037ed99c9f4b2a0b7abd659e59a336ac04f253818b7dfff2

SHA512
76876528385e062ff38f6ee20671557f098f3b80b7d3f987c84f6ac8eab36b5257141f5e9faf57a9615f799a0f5c2a14721969c01b1a821eb8b3516943673d27

Download Submit
C:\Windows\SysWOW64\Ljbfpo32.exe

Filesize
242KB

MD5
513bb5c0fa4896919bd0af98e7066411

SHA1
6a69b3e6bd064b525d1ab23df015a54cd8eca18c

SHA256
1a2a90b81269eeb3316aaeea115cc7e77e6bd3eda13fcc7ffb0742e9a0dade7a

SHA512
b7a3ec363360c5eec85a5dfebc0f09a1ac0761bddb59ac5e5dc32335bf35a29b2e1b17399d9eb3a11c050705143a85c3aa3ac21d8f0e2e35246ecf9a08ed2509

Download Submit
C:\Windows\SysWOW64\Ljilqnlm.exe

Filesize
242KB

MD5
38f90f12ab48c23583c1dd9320b84bc8

SHA1
5b4e00a76bc3f6a8473c18b8a23084288bf13fc4

SHA256
b235faddd8a04876be445222551dfb10dc2ba3f2039daeec03a91158aebd4c90

SHA512
c4549d73bce08c2f23950ae2d5f8eb24eb25f171709727d5ae0deb2c3de56e6aa50d8a7410df489bce52685f9c16e66e7a5f73b7c08ae3e6e4957cafe7f81d59

Download Submit
C:\Windows\SysWOW64\Lkiiee32.exe

Filesize
242KB

MD5
bbe253db9367238109b0e8fb46509bf8

SHA1
d42b9b1054e3243cec0d369b102093ccd4f3c361

SHA256
4e5bd24f6d8768f2cc822f24dab3bf5509854f0a77258320bab8717d8c4580ba

SHA512
07d4f14219512b2fadae78644eb104a02bfa78623b4b73febdc32371fad06b043558d0d031b1f24cea4ae666a5bf3b57ccf62eaf1a383e1f49a7474c3fcae4e8

Download Submit
C:\Windows\SysWOW64\Malgcg32.exe

Filesize
242KB

MD5
d31b29f51ea0e2039dadb6b65313f4e1

SHA1
efd7c496b003f35a1cfbd82fb956cc92ea282689

SHA256
32653580521741102be3291f131adb6cb91daadea2d90f105944199ae0026ad4

SHA512
0c210f4ac45b1a9d3b7e08a8d741034c2845830d9488c4c0e283eb5b8f778e3c0ad9e4649018dd75bca2b3fef863b2f180fa8b1a155d8143542253733778642d

Download Submit
C:\Windows\SysWOW64\Mbbagk32.exe

Filesize
242KB

MD5
6c670f9deede2e3c5b13cf8cd0ffb545

SHA1
3d45dfff4f654c33c12ec3b25a57f82f0aae0de7

SHA256
bf6a4f3181ad0f7ae4fcda09b5b1d94d287ca994ef305465dc81dfbdd85023b6

SHA512
4b48a43e08090a73487731256e9aedfb96bc014656c51eade05408bebe721011233cbfb35fca617122afaa5a96016872fcea969f4e8926338e83344b9b96925f

Download Submit
C:\Windows\SysWOW64\Mbenmk32.exe

Filesize
242KB

MD5
f7bb2572bc124e83ddfd4fa11bf863c1

SHA1
5f8d8a58ea64baf864be4e61c1cbc8da5af9f82e

SHA256
e22efee67c5f6516353f99657065040356fab035e0a620064222a3cda8a9fe7a

SHA512
c1123776be2ed7cb62ff3917dc644abd9d49a2f4d47f5f4a055f1fbd6889b71d6ed32f9a6e66e180c098d5ea2db33269f06b720acd8ba4074a624a63949a68b2

Download Submit
C:\Windows\SysWOW64\Mbgjbkfg.exe

Filesize
242KB

MD5
aa6780a99f12eef908f8207c0087bc65

SHA1
ca4005649152809c3989effda00ea3c5cb92d0f8

SHA256
b5abae50f2a1db11b67839a4492d9063924e5cce9e24ca32f63d8d7faffffcca

SHA512
913e302b75a4aef3aa5f345ba8aa9b9ae8ceb61ad33dd29685e4da155c0de81c099145647771a301943ba045ef41f01e17d99534a5ff2f8310982b5474f0872e

Download Submit
C:\Windows\SysWOW64\Mecjif32.exe

Filesize
242KB

MD5
6f9ec62af16f508c6c43f230e2fc4a2d

SHA1
df69d994f8b2bca6e4772ae0b9832e8f705d2d12

SHA256
149e15488830a8983fe2723a084cf10b0457cf4b7008f163aa1c4fa5701a3851

SHA512
af0f3d61e8c6b3f537bcac48351ff1635a04b0b186829ba5312589321b220271d68bfe4b7bf7713fa47356780ca03d82f4359ac09a67923933d488d615fb4cf9

Download Submit
C:\Windows\SysWOW64\Miaboe32.exe

Filesize
242KB

MD5
a231e26a3d29bc630036f703d352d1f0

SHA1
03d0804d17d5e5a462065dacb6cac3c1db9e1627

SHA256
647951718e3eb9d553b6f804ab11b0e60d3382848bb5e90c49eb49cb3b7c8a4d

SHA512
2926899280b43ec275835c7f42b172fdfef73fbe1e05c285bb95bca945b5247136d21aced1115302b7ee176899d5ecbbaf57da9c09ecdf074590f4364062ba5a

Download Submit
C:\Windows\SysWOW64\Milidebi.exe

Filesize
242KB

MD5
1b2878daeecf8dee1decf596c4d4fbd9

SHA1
45f0a0d04f2408a4a2177ee0e908eb70013657de

SHA256
45b0ff6d9354aa789064965cb9b3a47b3e79e5dea33a42d62c3a4d787d59ad72

SHA512
095fadaf38be616cba01f401dbbf8de86c8997bd8b5a6e5dcbb95d4ad11077c1d8ba65096e61f63351ed9956ba5cb871bef9fc5caa070d405e535e815a575ae7

Download Submit
C:\Windows\SysWOW64\Nbefdijg.exe

Filesize
242KB

MD5
059680f94cfd4b3f7ce97f36689345e3

SHA1
296207239bc66161838d6ef6d90a4a775c761bf0

SHA256
9d21572c6cddd64690e1fbae63abe385ad20100b9ac7f1c2a0bc455ad5fcd1c1

SHA512
f2ae2b43cfc39e0cf40b5cf260e0a7df64b90cfafc0cee67e541b16997149057d3c42a9ae2c96257c4bb1289103ccfb45c57f33c70a2564a16eec90aa2480be7

Download Submit
C:\Windows\SysWOW64\Neafjdkn.exe

Filesize
242KB

MD5
7d6e1d4ad6ab6a109e76854122954694

SHA1
81e1642736fe0740334a3e5120fcd61cf36b7dc1

SHA256
965578fab09ea643513a9a3ea582a8a85bdaf6db108c52aaf81ad5480358be88

SHA512
b79afe86785116ad5a1355a7bdf4a6184da724ac27c88a197a36f72f6ef52c17e8f0543d01cecc14e38b8e4d1492e110d7318f0d7eacb4af5264563b40799505

Download Submit
C:\Windows\SysWOW64\Nhbolp32.exe

Filesize
242KB

MD5
4a09a71a5dab298751e15ef1066dfab2

SHA1
196180af3214e8d5e2097f73fade48941992fc72

SHA256
c5cb818e444509e8673bcf537c828b4dc44aacba3d3284e5e9f5f3bd70cbf917

SHA512
7b295727af3bda69c050284e8e8dd6114aa345aab4a2c9acf5d523da77e3a7f42cb664ac05b9f9d1a5a5338bfa9078017a55af12953edec884a81f44a8396610

Download Submit
C:\Windows\SysWOW64\Nihipdhl.exe

Filesize
242KB

MD5
394a0b785acfd7b7619104452e3554aa

SHA1
b014284e3a5fab8798cb539c9718349615aa34c5

SHA256
bac94293484280c1a41eb70e70a3673072f012703e859d2278630646272c6784

SHA512
c4102b9ebdb06a8ca72075285f68c4052832647a01c3765b030b78b8b5a2646ae27d2e37cf772bb1c33c87f82bbdd86c969d954b721166555d00032288d1e065

Download Submit
C:\Windows\SysWOW64\Njiegl32.exe

Filesize
242KB

MD5
2cb51821f81db6485e329b3df3b25bd0

SHA1
00b1f2750eefe60cfc3d89f7d6871a1e97cdbd97

SHA256
54007fe0087b293dde440be25f7c92707cda513775c2c52515b2d04698fb5291

SHA512
6ad74e178e0eb151e029fb4635d3fce6199a0623fe7c94492575f2b79c468441773a776391d89bf319efd3771c399d928c37c310f85a97c1b0fa7d67af71538e

Download Submit
C:\Windows\SysWOW64\Ohkbbn32.exe

Filesize
242KB

MD5
5377971e6a07220752d3dd5b9efb9263

SHA1
79039faa861c466f9d18fd371b97462f2fcf89d7

SHA256
559492cd20d27549586d4875bded33f4321b33fc4e464a63d1ef49fb61e69f80

SHA512
4c647a20e69002e2fe6b46eeef1da6a1ec5b88f5b34164caf515179cc8b5963b480e076a1d0c7cc4aebd6a7f001141faf7b86a329ae1c191337c7c2160d99931

Download Submit
C:\Windows\SysWOW64\Oldamm32.exe

Filesize
242KB

MD5
c8dfd7124c0de311db8f37d564de5734

SHA1
dc9b7425790f0e5db8176677fed31f1751005572

SHA256
f15ed0bfac9282d82f21f36b2e97cab92ad19fc28158b54c56d9958a4c04646c

SHA512
5801ceb89eb9c4f4574e4fa5e135b250e973fe8ef2186d2c25a4d590afc2a37c013038d574421ffa5988941c98bd9ce817095004867a8ae34d8e3708caa78504

Download Submit
C:\Windows\SysWOW64\Pkbjjbda.exe

Filesize
242KB

MD5
7bc64477061748eee40502dde149c46e

SHA1
2b59746221b6833920eaca0206683c7ca373442e

SHA256
fcc4f693e8d694aaea7707f4ce265ea24930891ea9487629e810aa154b8441a1

SHA512
e31268f17697d493224ee5413dc43dbc695f4689884d6bb37a6cf2d6b8b4ba4aa23f3d0b579c435e4f63f00445dd99e6d0613d9f0317a202e53fcbf0330e51e2

Download Submit
memory/32-93-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/408-273-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/468-246-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/636-322-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/736-396-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/932-113-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/964-398-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/972-122-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/976-433-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1104-362-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1168-315-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1244-153-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1340-8-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1412-158-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1524-230-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1628-99-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1680-142-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1732-427-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1972-65-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2084-444-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2100-351-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2156-327-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2288-367-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2328-57-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2496-421-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2568-81-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2568-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2568-1-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2648-309-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2660-303-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2792-419-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2988-24-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3056-207-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3168-32-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3208-106-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3276-450-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3376-162-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3464-462-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3472-345-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3528-285-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3612-378-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3644-48-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3796-254-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3968-456-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3984-261-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4004-189-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4016-380-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4068-279-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4164-225-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4352-291-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4360-409-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4372-297-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4380-269-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4452-239-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4512-339-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4564-215-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4584-21-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4616-386-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4836-102-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4856-40-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4864-73-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4932-177-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5036-134-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5052-333-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads