abf9ea55ef98aefe0d231ddf497e967fb47da4e23c11088f56c1a01590ead6f9

Analysis

max time kernel
146s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

abf9ea55ef98aefe0d231ddf497e967fb47da4e23c11088f56c1a01590ead6f9.exe
Size

192KB
MD5

e3f1712eca716827f6650261a9be97f7
SHA1

d410883daea849e28ebd9d6e87a2659f74dc3a68
SHA256

abf9ea55ef98aefe0d231ddf497e967fb47da4e23c11088f56c1a01590ead6f9
SHA512

9c7f6f8ab264763ffacba79be782d6e56b66be6429a783ed844536bec61fc3e18cf90b2bec6dbbe91d48a30cb550b02aa1ea9fc21ccce49edd4fdc5dc5042cb6
SSDEEP

3072:JcpzN2k55mUC7t+vej6+JB8M6m9jqLsFmsdYXmLlcJVIZen+Vcv2JBwwRBkBnRec:2pz8knmU3vej6MB8MhjwszeXmr8SeT

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgpmmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmdlmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjgeedch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hplbickp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jofalmmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adhdjpjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qljcoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkbmqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gifkpknp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlkipgpe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgccinoe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjlopc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Panhbfep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apjkcadp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehhpla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Allpejfe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbhboolf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfjdqmng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Flkdfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Geaepk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gojiiafp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgcihgaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpfkpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpkmal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpgnjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjokgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qkipkani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjodla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agimkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iipfmggc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhmeapmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjokgg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Poliea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipeeobbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lggejg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmpfbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nognnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjjnifbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijcjmmil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnfgcd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iomoenej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfqlfb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdojjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fagjfflb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbefdijg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljaoeini.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nghekkmn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odalmibl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkibgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpfkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cadlbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gojiiafp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjgeedch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdjgha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgnomg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnelok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnpabe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Digehphc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpphjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbcfhibj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fneggdhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jiglnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhfppabl.exe

Executes dropped EXE 64 IoCs

pid	Process
4392	Qjlnnemp.exe
1336	Qjnkcekm.exe
1980	Ajqgidij.exe
4816	Amodep32.exe
3248	Agdhbi32.exe
1056	Ackigjmh.exe
3264	Bfjnjcni.exe
2704	Cjhfpa32.exe
3492	Cadlbk32.exe
1472	Cjmpkqqj.exe
1236	Caghhk32.exe
3568	Cjomap32.exe
1432	Cgcmjd32.exe
4528	Dmpfbk32.exe
776	Dfhjkabi.exe
1108	Diffglam.exe
1912	Ejpfhnpe.exe
2264	Eidbij32.exe
1440	Epokedmj.exe
3768	Eangpgcl.exe
364	Ehhpla32.exe
4840	Fkihnmhj.exe
1068	Facqkg32.exe
660	Fmjaphek.exe
4972	Fagjfflb.exe
2588	Hkeaqi32.exe
228	Hglaej32.exe
4172	Hacbhb32.exe
3760	Iklgah32.exe
4256	Ijadbdoj.exe
2356	Jnfcia32.exe
2384	Jbfheo32.exe
2368	Jkomneim.exe
2968	Jibmgi32.exe
3252	Jbkbpoog.exe
2948	Kghjhemo.exe
1648	Knbbep32.exe
3120	Kelkaj32.exe
768	Lhmmjbkf.exe
3532	Mbenmk32.exe
2752	Mbighjdd.exe
3792	Mhfppabl.exe
3780	Mifljdjo.exe
4648	Naaqofgj.exe
2480	Nhmeapmd.exe
608	Nognnj32.exe
2132	Nbefdijg.exe
628	Nkqkhk32.exe
1100	Nhdlao32.exe
2524	Olbdhn32.exe
1944	Oaompd32.exe
2600	Oaajed32.exe
5016	Olgncmim.exe
4780	Oeoblb32.exe
232	Qljcoj32.exe
3140	Qaflgago.exe
3412	Allpejfe.exe
2140	Acfhad32.exe
1776	Ahcajk32.exe
4508	Alcfei32.exe
4124	Dpphjp32.exe
4980	Dmdhcddh.exe
2592	Dmfeidbe.exe
2352	Dfoiaj32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Iklgah32.exe	Ihnkel32.exe
File opened for modification	C:\Windows\SysWOW64\Lgccinoe.exe	Lqikmc32.exe
File created	C:\Windows\SysWOW64\Njinmf32.exe	Nelfeo32.exe
File opened for modification	C:\Windows\SysWOW64\Kodnmkap.exe	Kjgeedch.exe
File created	C:\Windows\SysWOW64\Lmnbjama.dll	Opclldhj.exe
File opened for modification	C:\Windows\SysWOW64\Ijadbdoj.exe	Iklgah32.exe
File opened for modification	C:\Windows\SysWOW64\Allpejfe.exe	Qaflgago.exe
File opened for modification	C:\Windows\SysWOW64\Ikbfgppo.exe	Ipmbjgpi.exe
File opened for modification	C:\Windows\SysWOW64\Fiaael32.exe	Fnlmhc32.exe
File opened for modification	C:\Windows\SysWOW64\Lcdciiec.exe	Lljklo32.exe
File opened for modification	C:\Windows\SysWOW64\Lhmmjbkf.exe	Kelkaj32.exe
File created	C:\Windows\SysWOW64\Gedapeof.dll	Kmaopfjm.exe
File created	C:\Windows\SysWOW64\Qaflgago.exe	Qljcoj32.exe
File created	C:\Windows\SysWOW64\Mdfggeba.dll	Emkndc32.exe
File opened for modification	C:\Windows\SysWOW64\Ddgplado.exe	Dkokcl32.exe
File opened for modification	C:\Windows\SysWOW64\Hlnjbedi.exe	Hedafk32.exe
File opened for modification	C:\Windows\SysWOW64\Agimkk32.exe	Adkqoohc.exe
File created	C:\Windows\SysWOW64\Naaqofgj.exe	Mifljdjo.exe
File opened for modification	C:\Windows\SysWOW64\Jlhljhbg.exe	Jnelok32.exe
File created	C:\Windows\SysWOW64\Kjgeedch.exe	Kgiiiidd.exe
File created	C:\Windows\SysWOW64\Ieoigp32.dll	Adhdjpjf.exe
File opened for modification	C:\Windows\SysWOW64\Iklgah32.exe	Ihnkel32.exe
File created	C:\Windows\SysWOW64\Hebqnm32.dll	Ibcaknbi.exe
File created	C:\Windows\SysWOW64\Bhpofl32.exe	Baegibae.exe
File created	C:\Windows\SysWOW64\Gojiiafp.exe	Geaepk32.exe
File created	C:\Windows\SysWOW64\Odalmibl.exe	Ohhnbhok.exe
File created	C:\Windows\SysWOW64\Pdjgha32.exe	Opclldhj.exe
File created	C:\Windows\SysWOW64\Ikbfgppo.exe	Ipmbjgpi.exe
File created	C:\Windows\SysWOW64\Bnnkgo32.dll	Koaagkcb.exe
File created	C:\Windows\SysWOW64\Plikcm32.dll	Bmeandma.exe
File created	C:\Windows\SysWOW64\Elmlokdl.dll	Fplpll32.exe
File created	C:\Windows\SysWOW64\Amdcghbo.dll	Jofalmmp.exe
File created	C:\Windows\SysWOW64\Cmkmlmnl.dll	Gfhndpol.exe
File created	C:\Windows\SysWOW64\Aamebb32.dll	Cgnomg32.exe
File created	C:\Windows\SysWOW64\Qlimed32.exe	Qkipkani.exe
File created	C:\Windows\SysWOW64\Fdnpclpq.dll	Jdfjld32.exe
File created	C:\Windows\SysWOW64\Jfegnkqm.dll	Dkokcl32.exe
File created	C:\Windows\SysWOW64\Gddedlaq.dll	Lljklo32.exe
File opened for modification	C:\Windows\SysWOW64\Adhdjpjf.exe	Amnlme32.exe
File created	C:\Windows\SysWOW64\Edflhb32.dll	Ipmbjgpi.exe
File created	C:\Windows\SysWOW64\Jcikgacl.exe	Jdfjld32.exe
File opened for modification	C:\Windows\SysWOW64\Dkokcl32.exe	Cnkkjh32.exe
File opened for modification	C:\Windows\SysWOW64\Amnlme32.exe	Akpoaj32.exe
File opened for modification	C:\Windows\SysWOW64\Adkqoohc.exe	Amqhbe32.exe
File created	C:\Windows\SysWOW64\Kodapf32.dll	Lgccinoe.exe
File created	C:\Windows\SysWOW64\Cjgjmg32.dll	Hmmfmhll.exe
File created	C:\Windows\SysWOW64\Bmdjdfgl.dll	Fkihnmhj.exe
File created	C:\Windows\SysWOW64\Pjcmhh32.dll	Dfoiaj32.exe
File created	C:\Windows\SysWOW64\Nmhbnnof.dll	Ajqgidij.exe
File created	C:\Windows\SysWOW64\Anbpqqmm.dll	Mifljdjo.exe
File opened for modification	C:\Windows\SysWOW64\Nlhkgi32.exe	Njinmf32.exe
File created	C:\Windows\SysWOW64\Mennkfdm.dll	Caghhk32.exe
File created	C:\Windows\SysWOW64\Nddbqe32.dll	Jgpmmp32.exe
File opened for modification	C:\Windows\SysWOW64\Cklhcfle.exe	Cdbpgl32.exe
File created	C:\Windows\SysWOW64\Qekpedip.dll	Fjjnifbl.exe
File opened for modification	C:\Windows\SysWOW64\Opclldhj.exe	Ofkgcobj.exe
File created	C:\Windows\SysWOW64\Chfegk32.exe	Cnaaib32.exe
File created	C:\Windows\SysWOW64\Hcmbee32.exe	Hkbmqb32.exe
File created	C:\Windows\SysWOW64\Cjpekc32.dll	Pahilmoc.exe
File opened for modification	C:\Windows\SysWOW64\Ahgcjddh.exe	Qlimed32.exe
File created	C:\Windows\SysWOW64\Ofhknodl.exe	Oakbehfe.exe
File created	C:\Windows\SysWOW64\Gpihol32.dll	Fmjaphek.exe
File created	C:\Windows\SysWOW64\Nocckb32.dll	Epokedmj.exe
File opened for modification	C:\Windows\SysWOW64\Fbcfhibj.exe	Fpejlmcf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4016	4232	WerFault.exe	364

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Illfdc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Offnhpfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eiobceef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffaong32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cggkemhh.dll"	Qobhkjdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdmfllhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehqkihfg.dll"	Njinmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oaabap32.dll"	Ipeeobbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cglbhhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgcihgaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Elgaeolp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjgeedch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmpfbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oclkgccf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hedafk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hlnjbedi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mifljdjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jphkkpbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Knenkbio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klahfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljhnlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmndpq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpelhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qikoka32.dll"	Geaepk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	abf9ea55ef98aefe0d231ddf497e967fb47da4e23c11088f56c1a01590ead6f9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fkihnmhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mieced32.dll"	Mbighjdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjlfmfbi.dll"	Cdmfllhn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jkomneim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bndfbikc.dll"	Bnfihkqm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Knenkbio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Offnhpfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnmkfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjgjmg32.dll"	Hmmfmhll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amqhbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qiginoqd.dll"	Agdhbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Momkkhch.dll"	Fdglmkeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qobhkjdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgddkelm.dll"	Bhpofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmdhcddh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Emkndc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dibkjmof.dll"	Gflhoo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mbighjdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oaompd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlhljhbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dojqjdbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmaopfjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhocin32.dll"	Qaflgago.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aafkfgeh.dll"	Jiglnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opclldhj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Knbbep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfcen32.dll"	Acfhad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnflfgji.dll"	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcjppk32.dll"	Hacbhb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmpqfq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqmmmmph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bepdhaek.dll"	Bfjnjcni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Allpejfe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Plkpcfal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpphjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gepgfb32.dll"	Ffnknafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Konidd32.dll"	Fnlmhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lqmmmmph.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 4392	1224	abf9ea55ef98aefe0d231ddf497e967fb47da4e23c11088f56c1a01590ead6f9.exe	86
PID 1224 wrote to memory of 4392	1224	abf9ea55ef98aefe0d231ddf497e967fb47da4e23c11088f56c1a01590ead6f9.exe	86
PID 1224 wrote to memory of 4392	1224	abf9ea55ef98aefe0d231ddf497e967fb47da4e23c11088f56c1a01590ead6f9.exe	86
PID 4392 wrote to memory of 1336	4392	Qjlnnemp.exe	88
PID 4392 wrote to memory of 1336	4392	Qjlnnemp.exe	88
PID 4392 wrote to memory of 1336	4392	Qjlnnemp.exe	88
PID 1336 wrote to memory of 1980	1336	Qjnkcekm.exe	89
PID 1336 wrote to memory of 1980	1336	Qjnkcekm.exe	89
PID 1336 wrote to memory of 1980	1336	Qjnkcekm.exe	89
PID 1980 wrote to memory of 4816	1980	Ajqgidij.exe	90
PID 1980 wrote to memory of 4816	1980	Ajqgidij.exe	90
PID 1980 wrote to memory of 4816	1980	Ajqgidij.exe	90
PID 4816 wrote to memory of 3248	4816	Amodep32.exe	91
PID 4816 wrote to memory of 3248	4816	Amodep32.exe	91
PID 4816 wrote to memory of 3248	4816	Amodep32.exe	91
PID 3248 wrote to memory of 1056	3248	Agdhbi32.exe	92
PID 3248 wrote to memory of 1056	3248	Agdhbi32.exe	92
PID 3248 wrote to memory of 1056	3248	Agdhbi32.exe	92
PID 1056 wrote to memory of 3264	1056	Ackigjmh.exe	93
PID 1056 wrote to memory of 3264	1056	Ackigjmh.exe	93
PID 1056 wrote to memory of 3264	1056	Ackigjmh.exe	93
PID 3264 wrote to memory of 2704	3264	Bfjnjcni.exe	94
PID 3264 wrote to memory of 2704	3264	Bfjnjcni.exe	94
PID 3264 wrote to memory of 2704	3264	Bfjnjcni.exe	94
PID 2704 wrote to memory of 3492	2704	Cjhfpa32.exe	95
PID 2704 wrote to memory of 3492	2704	Cjhfpa32.exe	95
PID 2704 wrote to memory of 3492	2704	Cjhfpa32.exe	95
PID 3492 wrote to memory of 1472	3492	Cadlbk32.exe	96
PID 3492 wrote to memory of 1472	3492	Cadlbk32.exe	96
PID 3492 wrote to memory of 1472	3492	Cadlbk32.exe	96
PID 1472 wrote to memory of 1236	1472	Cjmpkqqj.exe	97
PID 1472 wrote to memory of 1236	1472	Cjmpkqqj.exe	97
PID 1472 wrote to memory of 1236	1472	Cjmpkqqj.exe	97
PID 1236 wrote to memory of 3568	1236	Caghhk32.exe	98
PID 1236 wrote to memory of 3568	1236	Caghhk32.exe	98
PID 1236 wrote to memory of 3568	1236	Caghhk32.exe	98
PID 3568 wrote to memory of 1432	3568	Cjomap32.exe	99
PID 3568 wrote to memory of 1432	3568	Cjomap32.exe	99
PID 3568 wrote to memory of 1432	3568	Cjomap32.exe	99
PID 1432 wrote to memory of 4528	1432	Cgcmjd32.exe	100
PID 1432 wrote to memory of 4528	1432	Cgcmjd32.exe	100
PID 1432 wrote to memory of 4528	1432	Cgcmjd32.exe	100
PID 4528 wrote to memory of 776	4528	Dmpfbk32.exe	101
PID 4528 wrote to memory of 776	4528	Dmpfbk32.exe	101
PID 4528 wrote to memory of 776	4528	Dmpfbk32.exe	101
PID 776 wrote to memory of 1108	776	Dfhjkabi.exe	102
PID 776 wrote to memory of 1108	776	Dfhjkabi.exe	102
PID 776 wrote to memory of 1108	776	Dfhjkabi.exe	102
PID 1108 wrote to memory of 1912	1108	Diffglam.exe	103
PID 1108 wrote to memory of 1912	1108	Diffglam.exe	103
PID 1108 wrote to memory of 1912	1108	Diffglam.exe	103
PID 1912 wrote to memory of 2264	1912	Ejpfhnpe.exe	104
PID 1912 wrote to memory of 2264	1912	Ejpfhnpe.exe	104
PID 1912 wrote to memory of 2264	1912	Ejpfhnpe.exe	104
PID 2264 wrote to memory of 1440	2264	Eidbij32.exe	105
PID 2264 wrote to memory of 1440	2264	Eidbij32.exe	105
PID 2264 wrote to memory of 1440	2264	Eidbij32.exe	105
PID 1440 wrote to memory of 3768	1440	Epokedmj.exe	106
PID 1440 wrote to memory of 3768	1440	Epokedmj.exe	106
PID 1440 wrote to memory of 3768	1440	Epokedmj.exe	106
PID 3768 wrote to memory of 364	3768	Eangpgcl.exe	107
PID 3768 wrote to memory of 364	3768	Eangpgcl.exe	107
PID 3768 wrote to memory of 364	3768	Eangpgcl.exe	107
PID 364 wrote to memory of 4840	364	Ehhpla32.exe	108

C:\Users\Admin\AppData\Local\Temp\abf9ea55ef98aefe0d231ddf497e967fb47da4e23c11088f56c1a01590ead6f9.exe
"C:\Users\Admin\AppData\Local\Temp\abf9ea55ef98aefe0d231ddf497e967fb47da4e23c11088f56c1a01590ead6f9.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\Qjlnnemp.exe
  C:\Windows\system32\Qjlnnemp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\Qjnkcekm.exe
    C:\Windows\system32\Qjnkcekm.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Windows\SysWOW64\Ajqgidij.exe
      C:\Windows\system32\Ajqgidij.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1980
    - - C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4816
      - C:\Windows\SysWOW64\Agdhbi32.exe
        
        C:\Windows\system32\Agdhbi32.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Windows\SysWOW64\Ackigjmh.exe
        
        C:\Windows\system32\Ackigjmh.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1056
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\SysWOW64\Cjhfpa32.exe
        
        C:\Windows\system32\Cjhfpa32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2704
        
        C:\Windows\SysWOW64\Cadlbk32.exe
        
        C:\Windows\system32\Cadlbk32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1472
        
        C:\Windows\SysWOW64\Caghhk32.exe
        
        C:\Windows\system32\Caghhk32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1236
        
        C:\Windows\SysWOW64\Cjomap32.exe
        
        C:\Windows\system32\Cjomap32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Windows\SysWOW64\Cgcmjd32.exe
        
        C:\Windows\system32\Cgcmjd32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1432
        
        C:\Windows\SysWOW64\Dmpfbk32.exe
        
        C:\Windows\system32\Dmpfbk32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SysWOW64\Dfhjkabi.exe
        
        C:\Windows\system32\Dfhjkabi.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:776
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Windows\SysWOW64\Ejpfhnpe.exe
        
        C:\Windows\system32\Ejpfhnpe.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Windows\SysWOW64\Eangpgcl.exe
        
        C:\Windows\system32\Eangpgcl.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3768
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:364
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4840
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        24⤵
        Executes dropped EXE
        
        PID:1068
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:660
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4972
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        27⤵
        Executes dropped EXE
        
        PID:2588
        
        C:\Windows\SysWOW64\Hglaej32.exe
        
        C:\Windows\system32\Hglaej32.exe
        28⤵
        Executes dropped EXE
        
        PID:228
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4172
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        30⤵
        Drops file in System32 directory
        
        PID:1176
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3760
        
        C:\Windows\SysWOW64\Ijadbdoj.exe
        
        C:\Windows\system32\Ijadbdoj.exe
        32⤵
        Executes dropped EXE
        
        PID:4256
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        33⤵
        Executes dropped EXE
        
        PID:2356
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        34⤵
        Executes dropped EXE
        
        PID:2384
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2368
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        36⤵
        Executes dropped EXE
        
        PID:2968
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        37⤵
        Executes dropped EXE
        
        PID:3252
        
        C:\Windows\SysWOW64\Kghjhemo.exe
        
        C:\Windows\system32\Kghjhemo.exe
        38⤵
        Executes dropped EXE
        
        PID:2948
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1648
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3120
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        41⤵
        Executes dropped EXE
        
        PID:768
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        42⤵
        Executes dropped EXE
        
        PID:3532
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2752
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3792
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3780
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        46⤵
        Executes dropped EXE
        
        PID:4648
        
        C:\Windows\SysWOW64\Nhmeapmd.exe
        
        C:\Windows\system32\Nhmeapmd.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2480
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:608
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2132
        
        C:\Windows\SysWOW64\Nkqkhk32.exe
        
        C:\Windows\system32\Nkqkhk32.exe
        50⤵
        Executes dropped EXE
        
        PID:628
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        51⤵
        Executes dropped EXE
        
        PID:1100
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        52⤵
        Executes dropped EXE
        
        PID:2524
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1944
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        54⤵
        Executes dropped EXE
        
        PID:2600
        
        C:\Windows\SysWOW64\Olgncmim.exe
        
        C:\Windows\system32\Olgncmim.exe
        55⤵
        Executes dropped EXE
        
        PID:5016
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        56⤵
        Executes dropped EXE
        
        PID:4780
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:232
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3140
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3412
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2140
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        61⤵
        Executes dropped EXE
        
        PID:1776
        
        C:\Windows\SysWOW64\Alcfei32.exe
        
        C:\Windows\system32\Alcfei32.exe
        62⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4124
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4980
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        65⤵
        Executes dropped EXE
        
        PID:2592
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        66⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2352
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2932
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        68⤵
        Modifies registry class
        
        PID:2728
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        69⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1540
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        70⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        71⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        72⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        73⤵
        
        PID:888
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        74⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        75⤵
        Modifies registry class
        
        PID:820
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        76⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        77⤵
        Drops file in System32 directory
        
        PID:2420
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2636
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2892
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        80⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        81⤵
        Modifies registry class
        
        PID:3280
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        82⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        83⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        84⤵
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        85⤵
        Drops file in System32 directory
        
        PID:5260
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        86⤵
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        87⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        88⤵
        Modifies registry class
        
        PID:5420
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5476
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        90⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        91⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        92⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        93⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        94⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        95⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Ipjedh32.exe
        
        C:\Windows\system32\Ipjedh32.exe
        96⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        97⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5876
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        99⤵
        Drops file in System32 directory
        
        PID:5920
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        100⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        101⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6060
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        103⤵
        Modifies registry class
        
        PID:6108
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        104⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5172
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        106⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5336
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        108⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        109⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        110⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        111⤵
        Drops file in System32 directory
        
        PID:5588
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        112⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        113⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        114⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        115⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        116⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        117⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        118⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        119⤵
        Drops file in System32 directory
        
        PID:6132
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5236
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5312
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        122⤵
        Modifies registry class
        
        PID:4424
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        123⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        124⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5768
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5960
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6068
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        128⤵
        Drops file in System32 directory
        
        PID:4080
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        129⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5344
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        130⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5712
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        132⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        133⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        134⤵
        Drops file in System32 directory
        
        PID:5356
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5040
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        136⤵
        Modifies registry class
        
        PID:4428
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        137⤵
        Drops file in System32 directory
        
        PID:5760
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5808
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        139⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5140
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        141⤵
        Drops file in System32 directory
        
        PID:424
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        142⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        143⤵
        Modifies registry class
        
        PID:1360
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        144⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        145⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        146⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        147⤵
        Drops file in System32 directory
        
        PID:5592
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        148⤵
        Drops file in System32 directory
        
        PID:6092
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        149⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6072
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        151⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        152⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        153⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6292
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        155⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        156⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        157⤵
        Modifies registry class
        
        PID:6428
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6472
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        159⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        160⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6552
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        161⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        162⤵
        Drops file in System32 directory
        
        PID:6640
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6692
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        164⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        165⤵
        Modifies registry class
        
        PID:6772
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        166⤵
        Modifies registry class
        
        PID:6812
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6888
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        169⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6932
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        170⤵
        Modifies registry class
        
        PID:6972
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7020
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        172⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        173⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7104
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7148
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        175⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6224
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6280
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        178⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        179⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6484
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        181⤵
        Drops file in System32 directory
        
        PID:6560
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        182⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        183⤵
        Modifies registry class
        
        PID:6688
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        184⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6848
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6876
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6952
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        188⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7092
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        190⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        191⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        192⤵
        Modifies registry class
        
        PID:6348
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        193⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        194⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        195⤵
        Modifies registry class
        
        PID:6656
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        196⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        197⤵
        Drops file in System32 directory
        
        PID:6860
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        198⤵
        Drops file in System32 directory
        
        PID:6964
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7052
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        200⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        201⤵
        Modifies registry class
        
        PID:6332
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6504
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        203⤵
        Drops file in System32 directory
        
        PID:6668
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        204⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        205⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        206⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        207⤵
        Modifies registry class
        
        PID:6588
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6840
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        209⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        210⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        211⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        212⤵
        Modifies registry class
        
        PID:7160
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        213⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        214⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6300
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7212
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        217⤵
        Modifies registry class
        
        PID:7252
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        218⤵
        Drops file in System32 directory
        
        PID:7292
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        219⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        220⤵
        Modifies registry class
        
        PID:7380
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        221⤵
        Drops file in System32 directory
        
        PID:7424
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        222⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7468
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7508
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        224⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        225⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7636
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        227⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        228⤵
        Modifies registry class
        
        PID:7724
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        229⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        230⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        231⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        232⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        233⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7980
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        235⤵
        Drops file in System32 directory
        
        PID:8020
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        236⤵
        Drops file in System32 directory
        
        PID:8068
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8112
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        238⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8152
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        239⤵
        Drops file in System32 directory
        
        PID:7180
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7232
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        241⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        242⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        243⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        244⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        245⤵
        Drops file in System32 directory
        
        PID:7592
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7648
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7720
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7776
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        249⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        250⤵
        Drops file in System32 directory
        
        PID:7880
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        251⤵
        Modifies registry class
        
        PID:7960
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        252⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8036
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        254⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        255⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        256⤵
        Modifies registry class
        
        PID:7012
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        257⤵
        Modifies registry class
        
        PID:7284
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        258⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        259⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        260⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7688
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        262⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        263⤵
        Drops file in System32 directory
        
        PID:7800
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        264⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        265⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        266⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1336
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        268⤵
        Modifies registry class
        
        PID:7300
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7388
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        270⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        271⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 404
        272⤵
        Program crash
        
        PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4232 -ip 4232
1⤵
PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ackigjmh.exe

Filesize
192KB

MD5
77208a9641476b6a8b769d1bd4ad7733

SHA1
e03c5f45b2249fa5c750c77bca75af067c2f9560

SHA256
061914a8dd5a09294aa657181e93c30c43c268c8b320f18a3b5755be5d00eedc

SHA512
d21d29fa7db16e11d3bb7181a493d998a18fa0120cb8dd0448425eddba8eabca98c1a52697bcd39f8f743aeea6baf607815d1c221eb1f30e5f56d661cf179842

Download Submit
C:\Windows\SysWOW64\Agdhbi32.exe

Filesize
192KB

MD5
d9a7a18c0d9a24a5c461d73cb454221b

SHA1
fb3401ce2ceef4bcaca7edb925fbcd388bb962c8

SHA256
1843e6740b29fb61f49f7ffeb4b5317bf83d167e9636c9447fc2057e1f574ecc

SHA512
ac69a7bbd2ee2b25ca1ec53ddfaec254cbd67b9f98e9ef1390a559e8a506549a5b259dc7678c7ad9291590286de60b3336a19ecb868388668b8ddce1b8342bd4

Download Submit
C:\Windows\SysWOW64\Ajqgidij.exe

Filesize
192KB

MD5
e66f639ef5e656e1bacacd87d6e63b39

SHA1
0d04494dd01b1c4dc48fd25d2b8e931931f44aa4

SHA256
847a104efe2260569cf38911e78214dbc96f3c59c982c5e912edf9319b99974b

SHA512
dc9d462cf70b858084aa2ff48d9ae29f1fa44ba33087ce62614f03e1139be25121c291719623b7912ed452644a7ea43ec46cacfc063d5ef1e858a579afdd05c5

Download Submit
C:\Windows\SysWOW64\Alcfei32.exe

Filesize
192KB

MD5
7cad228377013487972f83c27915f4e0

SHA1
4631b14b09b16387b447da1722e9a873f4247107

SHA256
5d658dcdf18ec6a61c0a0d159ea7beedda8cf02271d86557f636c25a47f9d883

SHA512
e1d2a0d5410f46c029093bbf680444c0a642a41c85751fe84333dcdf27aaa2f61574013f4d33d1a9fa3f68a69dd4078762bc84c60827f429b6c7240651771ead

Download Submit
C:\Windows\SysWOW64\Amodep32.exe

Filesize
192KB

MD5
5cbbacf36b70dd7a95844929611a30a9

SHA1
9a98d0c495fe73867cce6392e3ebbd370c12de6b

SHA256
9ecbbf287085c9238c2e3f1563252a6186938b0b0be9fd12baf6ccc67bd72eef

SHA512
35b54ea4c6abdb72afbdc7183afc3cc8b497d52996a345e35e6895a44ce0e8f496d9d96b485a84feb549ef3a3ad3ac8cd9279b92484efcc60bc0a074679f458c

Download Submit
C:\Windows\SysWOW64\Bfjnjcni.exe

Filesize
192KB

MD5
32604b6eaec337b90dbb6f4c8b343b0d

SHA1
03c107ef23ad39881de9462144006d1f2a754999

SHA256
535e20e007324c365036bbf900489425c61faed1d3e001e61d8bde7230998274

SHA512
d5726c74c8423ed7361a3828ee343851f3ae9025d8a19ca868882204165920c6be9df06d420179b7008c8806221baf330d9f6daeb7f039f15d77b68b0344b186

Download Submit
C:\Windows\SysWOW64\Bhhiemoj.exe

Filesize
192KB

MD5
219e2c2cf56f3f7b1858e985850750f7

SHA1
f261fa49b7c30f6794e689bd81f2ce6b74feaf00

SHA256
237c6c90c91991d3dac599c27c0d862590eb0dc3070b708587fdde501dde06a4

SHA512
53772f30a108d50a04dcf0afef865c65bf2a05c504887192c3ad79f084ff51af596869134760bf431add936bc3278fc3a30fa3913ee43011524298d34310fcdc

Download Submit
C:\Windows\SysWOW64\Cadlbk32.exe

Filesize
192KB

MD5
bcf60e51a3691ef09406b9dde67509c1

SHA1
dbda52cbb13222dda5f0c448aa11411b19816dcb

SHA256
e452f8383a0374c801be6c3b9aa45e1e29f530d396a5b47c2497e5283550d55f

SHA512
dfc763cddf92125ccb7824f0b3b53b3ba2ed22feb1423e869f3a0e2a207c053e32e4fabe8029b8b42852d6043debdc3a275401e9db10fe79504e4dfb6aedfb32

Download Submit
C:\Windows\SysWOW64\Caghhk32.exe

Filesize
192KB

MD5
16c1cae9e9807c7f0f55be2228f4a3f9

SHA1
36bc4c8aec6d372070098e8b6149089726e7de35

SHA256
0d9d33a593e192678d095f3924b68b9b9fb5ec49bae09df439be80f8c64e2905

SHA512
f77b8ec7fe656b0c2db6b905c251d28eafc8735e2a556fde056834a2addbbc283a38230a8f2459812f8de2a18fadbb164481a9d7054e4c627b8d7b0eb6a09b18

Download Submit
C:\Windows\SysWOW64\Cgcmjd32.exe

Filesize
192KB

MD5
f44f9ac87847af6e161259f528281ab0

SHA1
7fe3e294d62fc1a8ff89c5ec361fdfbdbcbb71cb

SHA256
222f99b65671cbc619633de4a25d18007c1b476dc19b073d0b22739a67a16e9c

SHA512
722616c09fb363a48780b36df7db2bcee9dd1d0e4e76bb043204f1bd414568801ba3e5033744e43b43e776134ed555d4a6907c359bba7a684c20b3fc35636b4e

Download Submit
C:\Windows\SysWOW64\Cjhfpa32.exe

Filesize
192KB

MD5
47c075dc62a9a7807208201f8590a003

SHA1
74cccd1eff307a23395caf4a6530c537914eef86

SHA256
38578bde09be21b246d5e34aba4c0c8a51f9f7e51182c477c62f148a0c78214b

SHA512
35a4bbe0b0af59eb56538851fe3d5517a4891056ca48570eb1684eec729c41132622bdd02dea2d130aadeba21a9b52ac563832253b6b4fb09dd2ea25c89d74ba

Download Submit
C:\Windows\SysWOW64\Cjmpkqqj.exe

Filesize
192KB

MD5
3e9403c5fce36b2d062385504f8bd010

SHA1
8289d8dcda6375adbca439ebce88bdae9a8463eb

SHA256
20fb474c58adbee563ceedb5d1b7dcb6491fa8c72782b44dd1f94c7a2750ad02

SHA512
8337cdf8ee49af8448593e6334a277338d157a131b7e851547ddbc8b1767bea224a3252b9e8a44c6bbcd69b1cdfd0286aff6b06e7de94a5c2a8278eaf40bcabe

Download Submit
C:\Windows\SysWOW64\Cjomap32.exe

Filesize
192KB

MD5
46c38b338e84640084e9eda01685dea6

SHA1
28acdd0ceb10aead8d424e669bc9b22d1b3f8820

SHA256
9af191ba72d1f0a0e46df80aafea5b36cd52b1c9c23244f7dc10955bc7e1d4f4

SHA512
f7cdc67a4b1707074d81f1d1f771d718f7a288c050846703ddc5bc900f8a290f419630de0e276402c9725488afa71aa3255b194b36d9ed1bd27ba290c861305e

Download Submit
C:\Windows\SysWOW64\Dbbffdlq.exe

Filesize
192KB

MD5
9bb469a3be16b8ecf7fd1ac5e31b84d3

SHA1
122ad33bd4e622316e7a0aad7ee5b6b123ca916d

SHA256
3384e7f59af997b577723aa2e91d6fd483450346fd155cb6f1e9d8bc14171fd7

SHA512
59e7df9ba8b66cef2a445cb0c8d7a2a24ad24681e6b83c0a2ca0a54df090c365889014ff3911bf75097138ca7b206575549d9129ecbca2d8b4dd10ca09284502

Download Submit
C:\Windows\SysWOW64\Ddgplado.exe

Filesize
192KB

MD5
f315424f0ee1df6cda20090d368b8ee3

SHA1
9e17671131bd12676f56d7d00542c46fb1016e2d

SHA256
09f5752e9274ffeb1fd80c15f85d2fc86776b0f05c12b9b26e4ba3f99da61ce4

SHA512
d6a16421c444106544dfb0542b5b7fb9f32857bc94c04bb8e4a8f209471580d5ee27e8c156ed763bcaa96641d1f09354f4ab1f944c4887ff6e65fd061c47cc7d

Download Submit
C:\Windows\SysWOW64\Dfhjkabi.exe

Filesize
192KB

MD5
eaea900f2225aae71f59bd754a673efa

SHA1
85db80e69bcbf99c04e048f653cebfa60bb9d06e

SHA256
51130c53bb0834029610a54cd45b2192b10fab26c7d8dbcaf44421132b11d029

SHA512
766c4e51986022f45b5dd452ce6287bbc296d8e9549680d1e736fa6b01bce515207a393908fe46641b46b4c00dc698da96c4fcb0848c999f6eab2e70590ec0a6

Download Submit
C:\Windows\SysWOW64\Dfoiaj32.exe

Filesize
192KB

MD5
c4a906d7fb5406b858e508b263fdde15

SHA1
e52f2ecaea5adf4a61ad47c66916d577648d48bf

SHA256
29f8be55ce67d4e55be814d11ab8ba12872b4ca051e741e91fe86efac6fd56ba

SHA512
d03b25b243d561b8ee3cfd50b5321e64eb74cd085d5edd09d7dd5f3b3eac6011b09ba045084ce79d69bda5f484be058e73fa981897cb0ae13522383f08944b9e

Download Submit
C:\Windows\SysWOW64\Diffglam.exe

Filesize
192KB

MD5
13abf835d9a99e11071bef9b4266b5a1

SHA1
d7f68e912b7bb530893813d07bc132d2dfd1dfa8

SHA256
15d33ab326a216a86210c15acb4b36824510181011cf849c694431a130bdf2b9

SHA512
172a9bab22a2a0b9ea3b73955a6dd8423918fa9684a35afd9d49fc760908b099a364c61ad9c05c1de492205e8942a0c4d08f2ef33ef3899103e0f9ac87e529b4

Download Submit
C:\Windows\SysWOW64\Dmpfbk32.exe

Filesize
192KB

MD5
f6b961aeae148c95b2ebb0217470741b

SHA1
be32927e72cb306140389b107a562eb17e8a497a

SHA256
f988a36d77d6d51980919cf01ec8a5ef4e6053bd34ac5fe6ad95ba895b1b271b

SHA512
686bb1b3ab5a4a565741ddd60b28692a37e0d999f3c3ab6a82e9472e42c90c3fa729a2264f04ef539713f8ce5a823f7dc8991c29c72a1b768e34d9fd6845cc2e

Download Submit
C:\Windows\SysWOW64\Eangpgcl.exe

Filesize
192KB

MD5
ce9c1654a6e3a151086e238964b8adc8

SHA1
73bd1a398a47eb4f4e522aa05ddad2d1d74dc11b

SHA256
ac5745ac668aad88177f62314e585621285fbe6fe66ecd6d1f94535e77eac4dc

SHA512
92cd90a50ac975f04391298a709f4ac7aab6302551378927a95c8bdf2b2fecb8c08dae69ea7f308ce32cc92d717312e8330d8132ef11c9d7e5efcce3a300d4c8

Download Submit
C:\Windows\SysWOW64\Efhlhh32.exe

Filesize
192KB

MD5
925de9fd1166eab5d88dcc1743b14f6b

SHA1
940ecd40d3a99cc126599f606506f1e390f02c66

SHA256
92138997e4a50ac6ef8648659637d6996c4e2a06a0ecc9b1dde91c6d02b976c9

SHA512
56dd24f42aee1ac06d7c03b4608e0dfef0218e2495726b1f05c11b16bf8645efa361e2be15d05ed1424d30ea53ec441083536fc071648c608930d49954cb9ab4

Download Submit
C:\Windows\SysWOW64\Ehhpla32.exe

Filesize
192KB

MD5
775e32bafe5b29e8a289817e861fbe20

SHA1
e3d4a9ad622fdc3f49bd73e2d6a079e90c58828c

SHA256
c33b247a1b361a7794daf67015889fe6ba1d948fee7e43bf14dbac4e0c2f65c7

SHA512
0071b5cf259f95889914e79f975679eb374cfa07c2020dae6e91ac818bae828ea45cff7c9e87a3f44ee99fcede9acf8885915c6ee0df8a981add6416672086cd

Download Submit
C:\Windows\SysWOW64\Eidbij32.exe

Filesize
192KB

MD5
968687092e544032199128db3318d084

SHA1
a6ccc0b4f5fe85abd2e0da4cfa8abac32cb3f8d1

SHA256
00a779293eb2b52eac27db9d1ebb86e19b63fd54fa198ab7fa3deef9346abb68

SHA512
a928c2d2ea34bee9958d4a82d99bd6264ea80b26ace94c1300cb80b70407b6e0d8863c4fd7b30ed2551090df62b194911a2aa224834f14036e8ca05e9464c53e

Download Submit
C:\Windows\SysWOW64\Ejpfhnpe.exe

Filesize
192KB

MD5
ad5d643de1981e279344d5c5325fa2bd

SHA1
cee75c4c0d61ad4a9f181634f025fb73360fdfc7

SHA256
aabe243ad59a4824c90c134b215469397308be1a37dab71b274016f9fc5ee188

SHA512
3425db9485eb893aa302ac1555e7f46becfd2e19bd7a43b2ac44c7fbf26eda9b52f2da593bab53fe1908a052405061f8023477ad636d4e7a379cae358a84408e

Download Submit
C:\Windows\SysWOW64\Emkndc32.exe

Filesize
192KB

MD5
cd4349d64eb7e885cd94909da0ef7b2e

SHA1
4fecafa79ec83f2d6cb743f2c833ca24cb4a8cba

SHA256
779fb3385aa8b2ec389c615c7b28fbf7126c2452bac1a2d696ee89f1db9ce69a

SHA512
3aa0cd7eb02b1cd8851593a0c25aa9da56c6e4ddaec1e49cce9a5493a6fc6d1f53f1fb1cbfd8f312f55905e9ff93cc39554e4c8a749787603f709d4cc4bdfe64

Download Submit
C:\Windows\SysWOW64\Epokedmj.exe

Filesize
192KB

MD5
b09077892d78b17b0c069bbc0f18003c

SHA1
e99ed48cad67780151e1612cd55bd98ff697937b

SHA256
374e533d016cc39c8c1be8e5d896bcbc790a3237d9f5647bd38fbc5c2410c4fa

SHA512
3fde5515797d04c298f67f9373cc98474d1f7b01980a416e22eaccc6f97995e0fe5c5ffa84d9993ed58a6245b0ae107cbf45438662dae45756c4a3a14dbb6fd2

Download Submit
C:\Windows\SysWOW64\Facqkg32.exe

Filesize
192KB

MD5
38eb41111151564d6bbff2e51ddad08b

SHA1
2018c730dff545beed8832db41b8848b838a439e

SHA256
d586648b98292168b0b6350c0cfcd0dc5ecd85d194374dec839dfdbf916545db

SHA512
f41b0d6231f0ca243b27f542a6fd72a5319eefc3b8d092682bf77b5e49b497e8d6b1072eebfd94987f8e0b57b74e9eafb46b3f8af9a219d46be0d76f163565b3

Download Submit
C:\Windows\SysWOW64\Fagjfflb.exe

Filesize
192KB

MD5
bc3f3aefd7dafddda2c94b2880aa4f5d

SHA1
bab38a0f17c830a4b1a93db8736bcffce671fcda

SHA256
581e11537c3fd1ebdec9872ee34acf8a92e3a5c847d99b74cb80ec005abd1ef9

SHA512
3936501c3ed8e328f745025c964d4d21a19495d4b7ce089e1940bcdd7d15aaf4796888efbcd186d7fc0670ae21842f9325f7d3ce1621c66dcf6192d6d4387a37

Download Submit
C:\Windows\SysWOW64\Ffqhcq32.exe

Filesize
192KB

MD5
c9dec002502eb2e1ae2fccae49770d20

SHA1
b64b7b1107478787c3d9bcf9929950aab51d3126

SHA256
8cb567b33790eec1674f17c6d9cdb941d0fd797674915600d70e3113cdc3235d

SHA512
9e4893c22660cb0f6556a4b6d4b94ecca2017c6b8804442db41432dcaaa222300f746d9d4367109791d47952c25825863c24b19ea47f1b802f1e9f8134d1ef68

Download Submit
C:\Windows\SysWOW64\Fkihnmhj.exe

Filesize
192KB

MD5
046d58a7fd19303a24527eb9b2b22e44

SHA1
64671c8621e77b1883fed62d637e033c469c5725

SHA256
9b6883d8ab00bccb31429a73bf92e411203919146a6343faa3c60492945a8cf8

SHA512
5f36ff851085c99bb4904953a76a0eb50bd811ea9dfb277cfe9cb8fd935964a9c97057ca8911fbaa895c5b1580f9d04c429bdf518bdb1ba44ab3189e90d445f5

Download Submit
C:\Windows\SysWOW64\Fmjaphek.exe

Filesize
192KB

MD5
9bbcfece9b15b06058522c588d1d9d5a

SHA1
680060e4e6c8ffa902ce095c1fa8d8f82e71367d

SHA256
3109cb16f586458f7c436b10a6cd438631ac9bd93f75bbe8e0050abe52005420

SHA512
f121b08dc52244f5227d6d88b853d611abc01c4527e4ef2055404be8aba3a9eef5bc28374f7ad0cafa7b4459be4af75b07d1a1043e92be76c8939d35d19472fc

Download Submit
C:\Windows\SysWOW64\Gflhoo32.exe

Filesize
192KB

MD5
7e7eb3e1ee2df40f856d1f4ce67d41b5

SHA1
203fd1d7b88bdb91e0d42a7bcc1caaa9583a0aac

SHA256
43e747296f42ef148dd80ed5bca27b3d2cf303a2daacb09a600dd16ca6534664

SHA512
a3c156997f01e53f1f4826afd6fa989d6846eb59250cedb8beb059bb22373972d3d7b0a5a533e76bcc39b0467611d64e1200e13473b4ff788ceb72cbff6597ce

Download Submit
C:\Windows\SysWOW64\Hacbhb32.exe

Filesize
192KB

MD5
49789a8a9a73cc70d5d01126abbf072c

SHA1
af91987721040a533c3a8f7a90ddfcfae9c4c857

SHA256
3363ce074ad2e50a7e9888dc04be464aeaafe5885bff97c5f676729076d07bf3

SHA512
73b5b1f758211a446b342ddf41380c5c236b3487cb2a26d9bceb431496fe184c230431af0ba9906d954b3a8a0b0780034d725d9c3d1d13bad6a1df13600ca7b2

Download Submit
C:\Windows\SysWOW64\Hglaej32.exe

Filesize
192KB

MD5
ff93c0b02ea05369a4a7387c1d5f629b

SHA1
169f2c9b54f07c4cdba88e827ccd10358f6233f1

SHA256
ef268f42a81c87e383424b87f010911cbe1dafb5e73d26d5b67d091d8edf8897

SHA512
9977076541a10ea42ea32c998a73114049231706d54957c2f9de0459e002cfb4d5b74223f3a73deda68dd19efcb41016ada781ca4315b0ddc834cb1988dc8a0c

Download Submit
C:\Windows\SysWOW64\Hkeaqi32.exe

Filesize
192KB

MD5
efeeef2a49ca5559e89127dacd85b05b

SHA1
95ac4722212dbf6edfb1926f8a1497e0f2f1a755

SHA256
9ecaae2caaa9d19994265d9bd9f402602490b24c72def95199a450cf0856f156

SHA512
646ebb98659f2860458cd506e472f71f1498cd99ca94953e0942a9ed3a113ea2b6fd5247267205cf536624eb19d6822a59f671a6051d60283da041a14e2be2cb

Download Submit
C:\Windows\SysWOW64\Hlepcdoa.exe

Filesize
192KB

MD5
4693b611e3a02b95af2a509b221ace3f

SHA1
140e06c2f05d09b38eb2c0b80052f7799fba1fba

SHA256
83585c10dbeab3a4aae6c758c83dac587720c9478a27d8547bca46a601216029

SHA512
c08d68bd3dfefb28c46208a62866fec433068503054da416e7ae2926ad12f1de29dea35c8afa56236e3f707407af3e08204484fe5bf95f936414f0bf2b471873

Download Submit
C:\Windows\SysWOW64\Iepaaico.exe

Filesize
192KB

MD5
db378e4d0e8b0d25a32bed6fd7f18b64

SHA1
75bd3e50dc14e101bbb7853b05da448d23ab3945

SHA256
2977fcc5278126392bc5c625eec3351bb190107d35a87b36338a0737fdd8a3bc

SHA512
4812f3580ca8fd718b57822d6c895b94b0207fc761af1571fba58a3ed963d65a7586fe301f01d8f390e9310555173da471927b45337389c35f7b955b6e248c70

Download Submit
C:\Windows\SysWOW64\Ijadbdoj.exe

Filesize
192KB

MD5
9d2ef27ca7ac23901a96cd547f6bbca6

SHA1
3c89f5a69a7e37c4b6aec595a435a4ed67dc8733

SHA256
842f37219ff30af102d1753f6707987e933e4ba2aa50a58b932c78e2d2c18516

SHA512
566c3b890ac7712c3b91e477dc4c02ef1e1f91979a4358ca84ea4748baaffccf2675e98e00c1bf93c321115cfecfee8956f6f4776407ec199395570eedb8179d

Download Submit
C:\Windows\SysWOW64\Iklgah32.exe

Filesize
192KB

MD5
5e8f4d6e90421dcdeda85a64508d2374

SHA1
32e5b5a846429faa5c73ecbc9645d8af6d3eaac8

SHA256
2b16c38d97f24c0b3a9971126a6e2289f2a913a008aed5f19e5a8df1cbd4f4ba

SHA512
e2f40dc10e259bf705d97e3a77757f4a87127fb3a1dc08e0ab30d8c5c0e67795e7ac084aed95f0ae453cc2bf6cef500fdcd7c22e33c5d1ffb53ececa4eae8873

Download Submit
C:\Windows\SysWOW64\Iomoenej.exe

Filesize
192KB

MD5
f30303079998b58f7be0194a3bfb056c

SHA1
e890688add7caf15bc5e60bb8ed24db831927d2f

SHA256
9df4ce323136d94f76d7322491d005b7b0145aaba81b83b3b2b4372c4d355db0

SHA512
c1c4c31e5d8a50980d9a3ae69a1bbb214e69b949736d4866c99ca3a08a31fc2fc1ee83251cc16d112bc93a8067ab8d85e224e0a2c317702c39d2f6ce05a41b77

Download Submit
C:\Windows\SysWOW64\Jbfheo32.exe

Filesize
192KB

MD5
ee41d070771d9bbd75fe3452ed9fc9c2

SHA1
1cc1626472891a3396cb9834428bda5fdc658168

SHA256
e5395a3d3494fff5a4961dadb4f884df1c29003d5c9d2cbc840ec4ad840021aa

SHA512
7f899627d5154f4635fe34a9980c8ded4dc716ce361374a792b458880319e37b2e7f47808e1a3cd85e09f2f7d7174907d98ff10b0543b5a71567f0b354c34f39

Download Submit
C:\Windows\SysWOW64\Jkomneim.exe

Filesize
192KB

MD5
d3de088069fd07eeb6a102fe7727ca5b

SHA1
a7302b0a21a6fe4a72fd2b1e2faa56243f8f9c38

SHA256
e4aea124b7058250f5da4948a1b8e4a8478507ee06ef7965d14bd28cf53d93fb

SHA512
3cb6ac171c5fa9f0a5a5b4cd682209cb9c02789ac16dbe3bb527563b632cb36ae1cd37eb2836a0dc9db870ad8284630c6cd232b03a9bc7541ce4d984657a51d9

Download Submit
C:\Windows\SysWOW64\Jlolpq32.exe

Filesize
192KB

MD5
50261ddb14b91da081b65c3492b6a74f

SHA1
bd7f52b9215a39ce34306b296620ff4439c0ebe9

SHA256
4ee4a3f1ac4618af78f36be02b5eeeee37b5724e8f9ca19b2446f7ea58ff1270

SHA512
85b1fd083101e366fe1f20de776994f2462535ce8a1ebb7cd9770e61b61dc5f42688b83f2989158ca1908144ff5580a642c9895e03187c0ecfb82f042c4008b9

Download Submit
C:\Windows\SysWOW64\Jnfcia32.exe

Filesize
192KB

MD5
62954f401ebbb41cd7f392dbf0c339f8

SHA1
049b655f303a29df3399b321c603557533b3e13a

SHA256
6b6be1dbbf4de72cdfb70baf5d6665b9da49b1da4f9f2ad30a81ddc68c515667

SHA512
0b9584ec52f82f3e0c26e14d86deb76e6a95bd2b5c0773d815e52628bf524edbbad8f7ddca8a3de1f595110b7a9e8cddbaa34b9e5dff3a01986570786aca3d47

Download Submit
C:\Windows\SysWOW64\Jngbjd32.exe

Filesize
192KB

MD5
6da46154344d0f07e74a7ab7b4170b34

SHA1
c49eda086050b7c0fb3fbc10ef2ad0eaeaf4a8c6

SHA256
b646fb72180314c405800401a4f50dc1b2bda128d880dcb9fa76728c26fc3409

SHA512
03e0567bd5fb799a8a3e628ade47ac6abc3035af86324e007486c2359933a69d15adcf92e5f0d91ae8e92b441be2da7cdaeed1ad9c2acb6c769d1404c82a5eca

Download Submit
C:\Windows\SysWOW64\Naaqofgj.exe

Filesize
192KB

MD5
ae3d042b1e1e0cd1584e87bddb257bb8

SHA1
1834feadd910a0e852045124c0459c553814bf62

SHA256
e857385b0980c95624379e486aa107141e53b278e33c12acd4da0c42adf6a014

SHA512
378b21ac05ae1609464a136d938dbeeae891c5623a20b9855522d58100ee5c95162c62fdff2c86051edf0fd36c9f83799e32cb04fd638d2efe7be0a032c7a5ad

Download Submit
C:\Windows\SysWOW64\Nbefdijg.exe

Filesize
192KB

MD5
a55b77f1f45ff79354b4b5dfef7bccaa

SHA1
9805d76573a2cd21eb3d50b9b484bab9b3eb7c0a

SHA256
f7fa73d3b2ce8272b33449d9dfe93891d9e91fc78e56c42aecb2c3c88d36e225

SHA512
11ae8953b502c95208f929b7912221eb9a2ce04840ac559533587b3cb2dc825f82cac2a0b5d52621b9d7e3fa9452f52abfbe6712a6902056433c833eade24dc5

Download Submit
C:\Windows\SysWOW64\Oaajed32.exe

Filesize
192KB

MD5
01e32017e62d633971fbb15e3a5ab1b1

SHA1
4205ba0cb1dd94881599497d9034e933ee1ac199

SHA256
5642ada717c0ca397636610483ebe373539fa2c8e6fc39e9aa515f7aadcc0ed8

SHA512
0b381ea7d1295c048af24bdee39a0c9217d9641ee5bf50d47bffce46bd7b1e29b748ac512edb5673e39304aec9b12f34a093fa31f990a9df16bf9c92ab7caa91

Download Submit
C:\Windows\SysWOW64\Olbdhn32.exe

Filesize
192KB

MD5
f2b10a16ab637e55ec543990a817d924

SHA1
6c8e5d054d10493da20c02cc307d9d8aa6deac59

SHA256
a49c6b87737803eebc8485fb6621907e2e1647389f044715691e1f5e384cbf7a

SHA512
e86b5ce8a67c04dcf084a5d5d78159289271db6c3879cd2bfa8e31b7c9be6412183e6ecbfe3fffbe75250c0fd32045e87fb9126e79012c70a5edab9f68dd7cdf

Download Submit
C:\Windows\SysWOW64\Pmaffnce.exe

Filesize
192KB

MD5
9416c030a9d78b51a78f002adf067865

SHA1
3fe0875eb288e6703b8fa90901df38be86b46915

SHA256
692bb1d83d0c4e4a53b61c0ef2c735e7efaa2c03f40f1b3ca5003dc3f73f020e

SHA512
fe217188f9dbd9ff9bdd6f0d66c19ea5bd0ceb5ecbbc2272c3fc82b039bf144bdca9ea9a98c6b5a049bdca1138b093e58733c805336e12b5341cd7f6a2c39233

Download Submit
C:\Windows\SysWOW64\Qjlnnemp.exe

Filesize
192KB

MD5
7706d099bfd747714ba9eb44e407c7c7

SHA1
31ebb03e1ded23ab0bd2be78b505cae17f79d75b

SHA256
916c96dc185033fcd783f39095321079036edb8104bcac870008aa8bdfe429fa

SHA512
94911d49bdf8129a3cecbabd1fea43091f3f7eaa65a940e0829794e72e47ae2d99431bc1e1e9d6b672b34bb6d966b37dc11bfaadecefab7e307c5219e6ab81cf

Download Submit
C:\Windows\SysWOW64\Qjnkcekm.exe

Filesize
192KB

MD5
6df9d969f8acbe758b4351a98df31c75

SHA1
962c044a4402f46418df9d411f9ec3f709501e45

SHA256
5a64d7bb326ad2629a40984005d822a52b6939232a2cf4e1a66327958f5bf38e

SHA512
a13337c6982e9ff5edbc6beedda2cdc18aa8ef83a43d1789455b00f71743eebc41ddfecba412ff9f7c9163e2e65712195cc8ec97f770633f6aaa4b5c59633632

Download Submit
C:\Windows\SysWOW64\Qlimed32.exe

Filesize
192KB

MD5
18b1d89d8e8841037a7e09b129639ec9

SHA1
a0b54dde48e8e9d57bba2558229bdabfb84e2850

SHA256
1e2487a9785965f3bee3e2a2b11d3499ac0a13dba5115df76996b60828133e1d

SHA512
a3a488e9e536bdd4ff4d60084bacfb2924614ddf01256ee21e73f9bc5f065b9728c4008addf5f66875e7c7a2a2a8eafc6519fd23c6fc7cc6a714e9f6ca63d68d

Download Submit
memory/228-216-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/232-401-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/364-169-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/608-342-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/628-354-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/660-192-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/768-300-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/776-121-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1056-49-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1068-184-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1100-360-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1108-129-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1176-225-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1224-5-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1224-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1236-93-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1336-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1432-105-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1440-152-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1472-85-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1648-288-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1776-420-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1912-137-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1944-372-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1980-29-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2132-348-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2140-414-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2264-144-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2356-248-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2368-264-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2384-257-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2480-336-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2524-366-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2588-208-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2600-378-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2704-65-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2752-312-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2948-282-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2968-270-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3120-298-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3140-402-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3248-41-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3252-280-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3264-61-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3412-408-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3492-73-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3532-306-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3568-97-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3760-233-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3768-161-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3780-324-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3792-318-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4124-432-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4172-224-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4256-241-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4392-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4508-427-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4528-113-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4648-330-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4780-390-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4816-32-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4840-177-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4972-200-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5016-384-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads