21cf074ebdd36a367c022b6c7c653726fe4948e59278093dc303e87db85b42cd

Analysis

max time kernel
173s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 05:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2b0365d01833a09b03170ce8cf0bf18d.exe
Size

109KB
MD5

2b0365d01833a09b03170ce8cf0bf18d
SHA1

9c0765e25968d161e12db27bd04a97334144b3be
SHA256

21cf074ebdd36a367c022b6c7c653726fe4948e59278093dc303e87db85b42cd
SHA512

ec35af5723befa161dd8db98cbb742d968a76c3258d9ccd04aabe2062bc5b630c219f1014ec2548bf2dd2c012676373ae56209c3dc68b61f2121ab5749bb776e
SSDEEP

3072:XIBVjhYgTDeifo+8fo3PXl9Z7S/yCsKh2EzZA/z:4bj2KDZo+go35e/yCthvUz

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Leenanik.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhpepoel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2b0365d01833a09b03170ce8cf0bf18d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjlgnh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glghhmdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nanmhf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpdhdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qecgcfmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baepjpea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmnbpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kagbmkch.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnebfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqdgan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lofklp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qjdpoacp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhfmic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdmcnnnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kklkej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kjepcqnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kjhccf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohggah32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qlmhfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ednajepe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Objphn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nconal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkgnpn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aehghn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gfemfhje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Andqia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cipppc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Naejcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nonajj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfgcjpdk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmhkpacg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckjbbbga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ahofidlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Idhgkcln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bkobfdao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djelqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oanfodmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mbqkfhfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kqpoja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Medggidb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aaenlj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnacfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Leenanik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oqdgan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ackiqpce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcdcbokq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nadlnoaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gagebknp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Algbfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Licfgmpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdfeandd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cbqlpabf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncakglka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ehpamnaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oagpne32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akpojpic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oocdme32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggnenagl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeoppbge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aocmbdco.exe

Executes dropped EXE 64 IoCs

pid	Process
392	Nblfee32.exe
1000	Abmhbplf.exe
2520	Aofemaog.exe
3736	Bckddn32.exe
2932	Cphgca32.exe
4724	Dlcaca32.exe
4804	Ejjgic32.exe
2072	Fnacfp32.exe
4728	Gagebknp.exe
456	Habeni32.exe
4468	Idhgkcln.exe
1360	Jknocljn.exe
1084	Kkgbjkac.exe
2480	Kklkej32.exe
2852	Lamjbc32.exe
1216	Lqfpoope.exe
2980	Mglhgg32.exe
4560	Ogmaneoa.exe
2500	Qecgcfmf.exe
2536	Aiclodaj.exe
4252	Algbfo32.exe
1388	Alioloje.exe
4160	Bhibgo32.exe
3696	Clldhljp.exe
1376	Damflb32.exe
1596	Dhlhcl32.exe
1008	Eomfae32.exe
3260	Ffekom32.exe
1464	Fifdqhal.exe
3520	Fckhnaab.exe
2592	Gpkliaol.exe
1312	Ijcecgnl.exe
4480	Jaljaoii.exe
4768	Kgmlde32.exe
3632	Mjcghm32.exe
2308	Mdhkefnj.exe
4080	Nglala32.exe
5012	Odidld32.exe
1928	Pjalpida.exe
3672	Qlmhfj32.exe
1208	Baepjpea.exe
696	Blkdgheg.exe
2160	Balfko32.exe
3252	Bblcda32.exe
2636	Chhkmh32.exe
4708	Cbqlpabf.exe
3064	Chpangnk.exe
4376	Docmqp32.exe
2124	Elkfed32.exe
2516	Ednajepe.exe
4364	Fhngfcdi.exe
3724	Ffdddg32.exe
4400	Gdqgfbop.exe
1128	Gfpcpefb.exe
232	Hkaedk32.exe
1492	Hbknqeha.exe
3244	Hkdbik32.exe
572	Hodgei32.exe
5112	Jidkek32.exe
4972	Kpncbemh.exe
4780	Kmijliej.exe
2152	Kbebdpca.exe
4568	Lgkakm32.exe
5036	Mphoob32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Genbjogo.dll	Bkgekock.exe
File created	C:\Windows\SysWOW64\Bhgncmbq.dll	Piocoi32.exe
File created	C:\Windows\SysWOW64\Ikaebnoj.exe	Hkohmnal.exe
File opened for modification	C:\Windows\SysWOW64\Kagbmkch.exe	Iglhhhmm.exe
File created	C:\Windows\SysWOW64\Dlcaca32.exe	Cphgca32.exe
File created	C:\Windows\SysWOW64\Ldffcmjf.dll	Bblcda32.exe
File created	C:\Windows\SysWOW64\Pmgcidqm.exe	Oanfodmk.exe
File opened for modification	C:\Windows\SysWOW64\Kmijliej.exe	Kpncbemh.exe
File opened for modification	C:\Windows\SysWOW64\Jcphkhad.exe	Jkdcffci.exe
File opened for modification	C:\Windows\SysWOW64\Kjhccf32.exe	Kqpoja32.exe
File created	C:\Windows\SysWOW64\Qgeoah32.exe	Pdkcinco.exe
File created	C:\Windows\SysWOW64\Ckifpg32.dll	Cfmijkhj.exe
File created	C:\Windows\SysWOW64\Okgofl32.dll	Afocdkac.exe
File created	C:\Windows\SysWOW64\Mdneki32.exe	Mdkhficp.exe
File opened for modification	C:\Windows\SysWOW64\Gdqgfbop.exe	Ffdddg32.exe
File created	C:\Windows\SysWOW64\Chmofekk.dll	Nconal32.exe
File created	C:\Windows\SysWOW64\Pceife32.dll	Mcbpcm32.exe
File created	C:\Windows\SysWOW64\Apmhbf32.exe	Akpojpic.exe
File created	C:\Windows\SysWOW64\Flekbm32.exe	Elilgo32.exe
File opened for modification	C:\Windows\SysWOW64\Iacbbh32.exe	Hkgnpn32.exe
File created	C:\Windows\SysWOW64\Dffclo32.dll	Jcphkhad.exe
File created	C:\Windows\SysWOW64\Ffiblg32.exe	Fldnoo32.exe
File created	C:\Windows\SysWOW64\Nnccmddi.exe	Ncifdlii.exe
File opened for modification	C:\Windows\SysWOW64\Bdojdd32.exe	Bkgekock.exe
File opened for modification	C:\Windows\SysWOW64\Abdfdp32.exe	Akjnhehc.exe
File created	C:\Windows\SysWOW64\Liickdeg.dll	Leenanik.exe
File opened for modification	C:\Windows\SysWOW64\Onnmmipj.exe	Oeehdcij.exe
File created	C:\Windows\SysWOW64\Nlbkifhp.dll	Hdclbopg.exe
File created	C:\Windows\SysWOW64\Ljdanq32.dll	Aeoppbge.exe
File opened for modification	C:\Windows\SysWOW64\Ggmlefcd.exe	Glghhmdn.exe
File created	C:\Windows\SysWOW64\Hapgkmbf.dll	Ffdddg32.exe
File opened for modification	C:\Windows\SysWOW64\Lkmihi32.exe	Lebalokn.exe
File created	C:\Windows\SysWOW64\Mjahfl32.exe	Maggggaf.exe
File created	C:\Windows\SysWOW64\Kklkej32.exe	Kkgbjkac.exe
File created	C:\Windows\SysWOW64\Bfkeej32.dll	Ackiqpce.exe
File created	C:\Windows\SysWOW64\Dgfbgipl.dll	Lebalokn.exe
File created	C:\Windows\SysWOW64\Bdnoniae.dll	Jpdhdl32.exe
File created	C:\Windows\SysWOW64\Pmjfjn32.dll	Kjhccf32.exe
File created	C:\Windows\SysWOW64\Naejcl32.exe	Nbqmbo32.exe
File opened for modification	C:\Windows\SysWOW64\Jpdhdl32.exe	Jcphkhad.exe
File created	C:\Windows\SysWOW64\Hbhbfh32.dll	Bkobfdao.exe
File created	C:\Windows\SysWOW64\Fdiijemd.dll	Ffiblg32.exe
File opened for modification	C:\Windows\SysWOW64\Acnjbpdb.exe	Qfepnmjn.exe
File created	C:\Windows\SysWOW64\Gdqgfbop.exe	Ffdddg32.exe
File opened for modification	C:\Windows\SysWOW64\Hkgnpn32.exe	Hpaibe32.exe
File opened for modification	C:\Windows\SysWOW64\Ochafm32.exe	Nddklhke.exe
File created	C:\Windows\SysWOW64\Jgpfjnig.dll	Flekbm32.exe
File created	C:\Windows\SysWOW64\Jqofjd32.dll	Ogndki32.exe
File created	C:\Windows\SysWOW64\Hlkfle32.exe	Faeihogj.exe
File created	C:\Windows\SysWOW64\Ciaiem32.dll	Lqfpoope.exe
File created	C:\Windows\SysWOW64\Edfofg32.dll	Nahdkffc.exe
File opened for modification	C:\Windows\SysWOW64\Ehpamnaj.exe	Ddfikaeq.exe
File created	C:\Windows\SysWOW64\Qcobjk32.exe	Qlejnqbj.exe
File created	C:\Windows\SysWOW64\Ncplekbq.exe	Nnccmddi.exe
File created	C:\Windows\SysWOW64\Acnjbpdb.exe	Qfepnmjn.exe
File created	C:\Windows\SysWOW64\Gekckpgl.exe	Fgbmliee.exe
File created	C:\Windows\SysWOW64\Ccinggcj.exe	Bicjjncd.exe
File opened for modification	C:\Windows\SysWOW64\Ddbfkh32.exe	Ckjbbbga.exe
File created	C:\Windows\SysWOW64\Oemcac32.exe	Ndmghqpo.exe
File created	C:\Windows\SysWOW64\Pdmpck32.exe	Pqknbmhc.exe
File opened for modification	C:\Windows\SysWOW64\Cipppc32.exe	Bqfokblg.exe
File created	C:\Windows\SysWOW64\Mcbpcm32.exe	Lcdcbokq.exe
File created	C:\Windows\SysWOW64\Ncifdlii.exe	Mnhdae32.exe
File created	C:\Windows\SysWOW64\Cmpine32.dll	Iglhhhmm.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlmpoh32.dll"	Aofemaog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oanfodmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mokogcbg.dll"	Glghhmdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Beglljko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acjnfh32.dll"	Blkdgheg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kiejfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ohfafn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ffiblg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abdflhfh.dll"	Odbpcpli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngnill32.dll"	Damflb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmjfjn32.dll"	Kjhccf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bginkk32.dll"	Qcobjk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dpmknf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Faeihogj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kagbmkch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bllhppld.dll"	Aocmbdco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nblfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhodilni.dll"	Fnacfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeffbpak.dll"	Gfpcpefb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gdglfqjd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pknqhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jhlgpp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddfikaeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knboee32.dll"	Gdqgfbop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfggoh32.dll"	Pmgcidqm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jaljlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlindcmm.dll"	Ogmaneoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bqfokblg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddbfkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hbenio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kagbmkch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gecedf32.dll"	Mdhkefnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Idbfhiko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mlhidg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phldlh32.dll"	Dfgcjpdk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qpahghbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlbkifhp.dll"	Hdclbopg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dbkpokhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apildl32.dll"	Galcjkmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iacbbh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdkhficp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbkdla32.dll"	Idhgkcln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifefggbd.dll"	Cbqlpabf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdiijemd.dll"	Ffiblg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opnefa32.dll"	Akmjmefq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cpklja32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jaljaoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpoknjfd.dll"	Pimkkfka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afpjoaeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbmaeqda.dll"	Nonajj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qakkgnpi.dll"	Chhkmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdahkafp.dll"	Beomhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Beomhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdlkho32.dll"	Qpolahdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Akjnhehc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ldckkdfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bblcda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjlgnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjeefpma.dll"	Cipppc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lhpepoel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lakfodjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jaljaoii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gdqgfbop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hpaibe32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 392	4580	2b0365d01833a09b03170ce8cf0bf18d.exe	99
PID 4580 wrote to memory of 392	4580	2b0365d01833a09b03170ce8cf0bf18d.exe	99
PID 4580 wrote to memory of 392	4580	2b0365d01833a09b03170ce8cf0bf18d.exe	99
PID 392 wrote to memory of 1000	392	Nblfee32.exe	100
PID 392 wrote to memory of 1000	392	Nblfee32.exe	100
PID 392 wrote to memory of 1000	392	Nblfee32.exe	100
PID 1000 wrote to memory of 2520	1000	Abmhbplf.exe	101
PID 1000 wrote to memory of 2520	1000	Abmhbplf.exe	101
PID 1000 wrote to memory of 2520	1000	Abmhbplf.exe	101
PID 2520 wrote to memory of 3736	2520	Aofemaog.exe	102
PID 2520 wrote to memory of 3736	2520	Aofemaog.exe	102
PID 2520 wrote to memory of 3736	2520	Aofemaog.exe	102
PID 3736 wrote to memory of 2932	3736	Bckddn32.exe	103
PID 3736 wrote to memory of 2932	3736	Bckddn32.exe	103
PID 3736 wrote to memory of 2932	3736	Bckddn32.exe	103
PID 2932 wrote to memory of 4724	2932	Cphgca32.exe	104
PID 2932 wrote to memory of 4724	2932	Cphgca32.exe	104
PID 2932 wrote to memory of 4724	2932	Cphgca32.exe	104
PID 4724 wrote to memory of 4804	4724	Dlcaca32.exe	105
PID 4724 wrote to memory of 4804	4724	Dlcaca32.exe	105
PID 4724 wrote to memory of 4804	4724	Dlcaca32.exe	105
PID 4804 wrote to memory of 2072	4804	Ejjgic32.exe	106
PID 4804 wrote to memory of 2072	4804	Ejjgic32.exe	106
PID 4804 wrote to memory of 2072	4804	Ejjgic32.exe	106
PID 2072 wrote to memory of 4728	2072	Fnacfp32.exe	107
PID 2072 wrote to memory of 4728	2072	Fnacfp32.exe	107
PID 2072 wrote to memory of 4728	2072	Fnacfp32.exe	107
PID 4728 wrote to memory of 456	4728	Gagebknp.exe	108
PID 4728 wrote to memory of 456	4728	Gagebknp.exe	108
PID 4728 wrote to memory of 456	4728	Gagebknp.exe	108
PID 456 wrote to memory of 4468	456	Habeni32.exe	109
PID 456 wrote to memory of 4468	456	Habeni32.exe	109
PID 456 wrote to memory of 4468	456	Habeni32.exe	109
PID 4468 wrote to memory of 1360	4468	Idhgkcln.exe	110
PID 4468 wrote to memory of 1360	4468	Idhgkcln.exe	110
PID 4468 wrote to memory of 1360	4468	Idhgkcln.exe	110
PID 1360 wrote to memory of 1084	1360	Jknocljn.exe	111
PID 1360 wrote to memory of 1084	1360	Jknocljn.exe	111
PID 1360 wrote to memory of 1084	1360	Jknocljn.exe	111
PID 1084 wrote to memory of 2480	1084	Kkgbjkac.exe	112
PID 1084 wrote to memory of 2480	1084	Kkgbjkac.exe	112
PID 1084 wrote to memory of 2480	1084	Kkgbjkac.exe	112
PID 2480 wrote to memory of 2852	2480	Kklkej32.exe	113
PID 2480 wrote to memory of 2852	2480	Kklkej32.exe	113
PID 2480 wrote to memory of 2852	2480	Kklkej32.exe	113
PID 2852 wrote to memory of 1216	2852	Lamjbc32.exe	114
PID 2852 wrote to memory of 1216	2852	Lamjbc32.exe	114
PID 2852 wrote to memory of 1216	2852	Lamjbc32.exe	114
PID 1216 wrote to memory of 2980	1216	Lqfpoope.exe	115
PID 1216 wrote to memory of 2980	1216	Lqfpoope.exe	115
PID 1216 wrote to memory of 2980	1216	Lqfpoope.exe	115
PID 2980 wrote to memory of 4560	2980	Mglhgg32.exe	116
PID 2980 wrote to memory of 4560	2980	Mglhgg32.exe	116
PID 2980 wrote to memory of 4560	2980	Mglhgg32.exe	116
PID 4560 wrote to memory of 2500	4560	Ogmaneoa.exe	117
PID 4560 wrote to memory of 2500	4560	Ogmaneoa.exe	117
PID 4560 wrote to memory of 2500	4560	Ogmaneoa.exe	117
PID 2500 wrote to memory of 2536	2500	Qecgcfmf.exe	118
PID 2500 wrote to memory of 2536	2500	Qecgcfmf.exe	118
PID 2500 wrote to memory of 2536	2500	Qecgcfmf.exe	118
PID 2536 wrote to memory of 4252	2536	Aiclodaj.exe	119
PID 2536 wrote to memory of 4252	2536	Aiclodaj.exe	119
PID 2536 wrote to memory of 4252	2536	Aiclodaj.exe	119
PID 4252 wrote to memory of 1388	4252	Algbfo32.exe	120

C:\Users\Admin\AppData\Local\Temp\2b0365d01833a09b03170ce8cf0bf18d.exe
"C:\Users\Admin\AppData\Local\Temp\2b0365d01833a09b03170ce8cf0bf18d.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\Nblfee32.exe
  C:\Windows\system32\Nblfee32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:392
- - C:\Windows\SysWOW64\Abmhbplf.exe
    C:\Windows\system32\Abmhbplf.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - C:\Windows\SysWOW64\Aofemaog.exe
      C:\Windows\system32\Aofemaog.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2520
    - - C:\Windows\SysWOW64\Bckddn32.exe
        
        C:\Windows\system32\Bckddn32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3736
      - C:\Windows\SysWOW64\Cphgca32.exe
        
        C:\Windows\system32\Cphgca32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Windows\SysWOW64\Dlcaca32.exe
        
        C:\Windows\system32\Dlcaca32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\SysWOW64\Ejjgic32.exe
        
        C:\Windows\system32\Ejjgic32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\Fnacfp32.exe
        
        C:\Windows\system32\Fnacfp32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Windows\SysWOW64\Gagebknp.exe
        
        C:\Windows\system32\Gagebknp.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\SysWOW64\Habeni32.exe
        
        C:\Windows\system32\Habeni32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\SysWOW64\Idhgkcln.exe
        
        C:\Windows\system32\Idhgkcln.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\SysWOW64\Jknocljn.exe
        
        C:\Windows\system32\Jknocljn.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1360
        
        C:\Windows\SysWOW64\Kkgbjkac.exe
        
        C:\Windows\system32\Kkgbjkac.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Windows\SysWOW64\Kklkej32.exe
        
        C:\Windows\system32\Kklkej32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\SysWOW64\Lamjbc32.exe
        
        C:\Windows\system32\Lamjbc32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Windows\SysWOW64\Lqfpoope.exe
        
        C:\Windows\system32\Lqfpoope.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Windows\SysWOW64\Mglhgg32.exe
        
        C:\Windows\system32\Mglhgg32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\SysWOW64\Ogmaneoa.exe
        
        C:\Windows\system32\Ogmaneoa.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\Qecgcfmf.exe
        
        C:\Windows\system32\Qecgcfmf.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\SysWOW64\Aiclodaj.exe
        
        C:\Windows\system32\Aiclodaj.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2536
        
        C:\Windows\SysWOW64\Algbfo32.exe
        
        C:\Windows\system32\Algbfo32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\SysWOW64\Alioloje.exe
        
        C:\Windows\system32\Alioloje.exe
        23⤵
        Executes dropped EXE
        
        PID:1388
        
        C:\Windows\SysWOW64\Bhibgo32.exe
        
        C:\Windows\system32\Bhibgo32.exe
        24⤵
        Executes dropped EXE
        
        PID:4160
        
        C:\Windows\SysWOW64\Clldhljp.exe
        
        C:\Windows\system32\Clldhljp.exe
        25⤵
        Executes dropped EXE
        
        PID:3696
        
        C:\Windows\SysWOW64\Damflb32.exe
        
        C:\Windows\system32\Damflb32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1376
        
        C:\Windows\SysWOW64\Dhlhcl32.exe
        
        C:\Windows\system32\Dhlhcl32.exe
        27⤵
        Executes dropped EXE
        
        PID:1596
        
        C:\Windows\SysWOW64\Eomfae32.exe
        
        C:\Windows\system32\Eomfae32.exe
        28⤵
        Executes dropped EXE
        
        PID:1008
        
        C:\Windows\SysWOW64\Ffekom32.exe
        
        C:\Windows\system32\Ffekom32.exe
        29⤵
        Executes dropped EXE
        
        PID:3260
        
        C:\Windows\SysWOW64\Fifdqhal.exe
        
        C:\Windows\system32\Fifdqhal.exe
        30⤵
        Executes dropped EXE
        
        PID:1464
        
        C:\Windows\SysWOW64\Fckhnaab.exe
        
        C:\Windows\system32\Fckhnaab.exe
        31⤵
        Executes dropped EXE
        
        PID:3520
        
        C:\Windows\SysWOW64\Gpkliaol.exe
        
        C:\Windows\system32\Gpkliaol.exe
        32⤵
        Executes dropped EXE
        
        PID:2592
        
        C:\Windows\SysWOW64\Hcpjpn32.exe
        
        C:\Windows\system32\Hcpjpn32.exe
        33⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Ijcecgnl.exe
        
        C:\Windows\system32\Ijcecgnl.exe
        34⤵
        Executes dropped EXE
        
        PID:1312
        
        C:\Windows\SysWOW64\Jaljaoii.exe
        
        C:\Windows\system32\Jaljaoii.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4480
        
        C:\Windows\SysWOW64\Kgmlde32.exe
        
        C:\Windows\system32\Kgmlde32.exe
        36⤵
        Executes dropped EXE
        
        PID:4768
        
        C:\Windows\SysWOW64\Mjcghm32.exe
        
        C:\Windows\system32\Mjcghm32.exe
        37⤵
        Executes dropped EXE
        
        PID:3632
        
        C:\Windows\SysWOW64\Mdhkefnj.exe
        
        C:\Windows\system32\Mdhkefnj.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2308
        
        C:\Windows\SysWOW64\Nglala32.exe
        
        C:\Windows\system32\Nglala32.exe
        39⤵
        Executes dropped EXE
        
        PID:4080
        
        C:\Windows\SysWOW64\Odidld32.exe
        
        C:\Windows\system32\Odidld32.exe
        40⤵
        Executes dropped EXE
        
        PID:5012
        
        C:\Windows\SysWOW64\Pjalpida.exe
        
        C:\Windows\system32\Pjalpida.exe
        41⤵
        Executes dropped EXE
        
        PID:1928
        
        C:\Windows\SysWOW64\Qlmhfj32.exe
        
        C:\Windows\system32\Qlmhfj32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3672
        
        C:\Windows\SysWOW64\Baepjpea.exe
        
        C:\Windows\system32\Baepjpea.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1208
        
        C:\Windows\SysWOW64\Blkdgheg.exe
        
        C:\Windows\system32\Blkdgheg.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:696
        
        C:\Windows\SysWOW64\Balfko32.exe
        
        C:\Windows\system32\Balfko32.exe
        45⤵
        Executes dropped EXE
        
        PID:2160
        
        C:\Windows\SysWOW64\Bblcda32.exe
        
        C:\Windows\system32\Bblcda32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3252
        
        C:\Windows\SysWOW64\Chhkmh32.exe
        
        C:\Windows\system32\Chhkmh32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2636
        
        C:\Windows\SysWOW64\Cbqlpabf.exe
        
        C:\Windows\system32\Cbqlpabf.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4708
        
        C:\Windows\SysWOW64\Chpangnk.exe
        
        C:\Windows\system32\Chpangnk.exe
        49⤵
        Executes dropped EXE
        
        PID:3064
        
        C:\Windows\SysWOW64\Docmqp32.exe
        
        C:\Windows\system32\Docmqp32.exe
        50⤵
        Executes dropped EXE
        
        PID:4376
        
        C:\Windows\SysWOW64\Elkfed32.exe
        
        C:\Windows\system32\Elkfed32.exe
        51⤵
        Executes dropped EXE
        
        PID:2124
        
        C:\Windows\SysWOW64\Ednajepe.exe
        
        C:\Windows\system32\Ednajepe.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2516
        
        C:\Windows\SysWOW64\Fhngfcdi.exe
        
        C:\Windows\system32\Fhngfcdi.exe
        53⤵
        Executes dropped EXE
        
        PID:4364
        
        C:\Windows\SysWOW64\Ffdddg32.exe
        
        C:\Windows\system32\Ffdddg32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3724
        
        C:\Windows\SysWOW64\Gdqgfbop.exe
        
        C:\Windows\system32\Gdqgfbop.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4400
        
        C:\Windows\SysWOW64\Gfpcpefb.exe
        
        C:\Windows\system32\Gfpcpefb.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1128
        
        C:\Windows\SysWOW64\Hkaedk32.exe
        
        C:\Windows\system32\Hkaedk32.exe
        57⤵
        Executes dropped EXE
        
        PID:232
        
        C:\Windows\SysWOW64\Hbknqeha.exe
        
        C:\Windows\system32\Hbknqeha.exe
        58⤵
        Executes dropped EXE
        
        PID:1492
        
        C:\Windows\SysWOW64\Hkdbik32.exe
        
        C:\Windows\system32\Hkdbik32.exe
        59⤵
        Executes dropped EXE
        
        PID:3244
        
        C:\Windows\SysWOW64\Hodgei32.exe
        
        C:\Windows\system32\Hodgei32.exe
        60⤵
        Executes dropped EXE
        
        PID:572
        
        C:\Windows\SysWOW64\Jidkek32.exe
        
        C:\Windows\system32\Jidkek32.exe
        61⤵
        Executes dropped EXE
        
        PID:5112
        
        C:\Windows\SysWOW64\Kpncbemh.exe
        
        C:\Windows\system32\Kpncbemh.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4972
        
        C:\Windows\SysWOW64\Kmijliej.exe
        
        C:\Windows\system32\Kmijliej.exe
        63⤵
        Executes dropped EXE
        
        PID:4780
        
        C:\Windows\SysWOW64\Kbebdpca.exe
        
        C:\Windows\system32\Kbebdpca.exe
        64⤵
        Executes dropped EXE
        
        PID:2152
        
        C:\Windows\SysWOW64\Lgkakm32.exe
        
        C:\Windows\system32\Lgkakm32.exe
        65⤵
        Executes dropped EXE
        
        PID:4568
        
        C:\Windows\SysWOW64\Mphoob32.exe
        
        C:\Windows\system32\Mphoob32.exe
        66⤵
        Executes dropped EXE
        
        PID:5036
        
        C:\Windows\SysWOW64\Medggidb.exe
        
        C:\Windows\system32\Medggidb.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2364
        
        C:\Windows\SysWOW64\Nconal32.exe
        
        C:\Windows\system32\Nconal32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3004
        
        C:\Windows\SysWOW64\Ncakglka.exe
        
        C:\Windows\system32\Ncakglka.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:220
        
        C:\Windows\SysWOW64\Nloikqnl.exe
        
        C:\Windows\system32\Nloikqnl.exe
        70⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\Oqdgan32.exe
        
        C:\Windows\system32\Oqdgan32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3788
        
        C:\Windows\SysWOW64\Ognpoheh.exe
        
        C:\Windows\system32\Ognpoheh.exe
        72⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\Pqknbmhc.exe
        
        C:\Windows\system32\Pqknbmhc.exe
        73⤵
        Drops file in System32 directory
        
        PID:1824
        
        C:\Windows\SysWOW64\Pdmpck32.exe
        
        C:\Windows\system32\Pdmpck32.exe
        74⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\Qnfdlpqd.exe
        
        C:\Windows\system32\Qnfdlpqd.exe
        75⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Eehnnb32.exe
        
        C:\Windows\system32\Eehnnb32.exe
        76⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Emcbcd32.exe
        
        C:\Windows\system32\Emcbcd32.exe
        77⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Fgbmliee.exe
        
        C:\Windows\system32\Fgbmliee.exe
        78⤵
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\Gekckpgl.exe
        
        C:\Windows\system32\Gekckpgl.exe
        79⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Ghpehjph.exe
        
        C:\Windows\system32\Ghpehjph.exe
        80⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Idbfhiko.exe
        
        C:\Windows\system32\Idbfhiko.exe
        81⤵
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Iohjebkd.exe
        
        C:\Windows\system32\Iohjebkd.exe
        82⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Jgakkb32.exe
        
        C:\Windows\system32\Jgakkb32.exe
        83⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Mbqkfhfh.exe
        
        C:\Windows\system32\Mbqkfhfh.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5588
        
        C:\Windows\SysWOW64\Nboggf32.exe
        
        C:\Windows\system32\Nboggf32.exe
        85⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Oocdme32.exe
        
        C:\Windows\system32\Oocdme32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5688
        
        C:\Windows\SysWOW64\Phqbaj32.exe
        
        C:\Windows\system32\Phqbaj32.exe
        87⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Phekliab.exe
        
        C:\Windows\system32\Phekliab.exe
        88⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Ackiqpce.exe
        
        C:\Windows\system32\Ackiqpce.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5820
        
        C:\Windows\SysWOW64\Bogcqpdd.exe
        
        C:\Windows\system32\Bogcqpdd.exe
        90⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Bjlgnh32.exe
        
        C:\Windows\system32\Bjlgnh32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5908
        
        C:\Windows\SysWOW64\Bqfokblg.exe
        
        C:\Windows\system32\Bqfokblg.exe
        92⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Cipppc32.exe
        
        C:\Windows\system32\Cipppc32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6048
        
        C:\Windows\SysWOW64\Gpmgph32.exe
        
        C:\Windows\system32\Gpmgph32.exe
        94⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Galcjkmj.exe
        
        C:\Windows\system32\Galcjkmj.exe
        95⤵
        Modifies registry class
        
        PID:228
        
        C:\Windows\SysWOW64\Gaqmej32.exe
        
        C:\Windows\system32\Gaqmej32.exe
        96⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Ggnenagl.exe
        
        C:\Windows\system32\Ggnenagl.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5188
        
        C:\Windows\SysWOW64\Hpaibe32.exe
        
        C:\Windows\system32\Hpaibe32.exe
        98⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4044
        
        C:\Windows\SysWOW64\Hkgnpn32.exe
        
        C:\Windows\system32\Hkgnpn32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4740
        
        C:\Windows\SysWOW64\Iacbbh32.exe
        
        C:\Windows\system32\Iacbbh32.exe
        100⤵
        Modifies registry class
        
        PID:4804
        
        C:\Windows\SysWOW64\Igpkjo32.exe
        
        C:\Windows\system32\Igpkjo32.exe
        101⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\Ihpgda32.exe
        
        C:\Windows\system32\Ihpgda32.exe
        102⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Idfhibdn.exe
        
        C:\Windows\system32\Idfhibdn.exe
        103⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\Jhlgpp32.exe
        
        C:\Windows\system32\Jhlgpp32.exe
        104⤵
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Kiejfo32.exe
        
        C:\Windows\system32\Kiejfo32.exe
        105⤵
        Modifies registry class
        
        PID:4656
        
        C:\Windows\SysWOW64\Kqpoja32.exe
        
        C:\Windows\system32\Kqpoja32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:772
        
        C:\Windows\SysWOW64\Kjhccf32.exe
        
        C:\Windows\system32\Kjhccf32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5532
        
        C:\Windows\SysWOW64\Lebalokn.exe
        
        C:\Windows\system32\Lebalokn.exe
        108⤵
        Drops file in System32 directory
        
        PID:3552
        
        C:\Windows\SysWOW64\Lkmihi32.exe
        
        C:\Windows\system32\Lkmihi32.exe
        109⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Leenanik.exe
        
        C:\Windows\system32\Leenanik.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5664
        
        C:\Windows\SysWOW64\Lbinkb32.exe
        
        C:\Windows\system32\Lbinkb32.exe
        111⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Licfgmpa.exe
        
        C:\Windows\system32\Licfgmpa.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2244
        
        C:\Windows\SysWOW64\Mbpdkabl.exe
        
        C:\Windows\system32\Mbpdkabl.exe
        113⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Mlhidg32.exe
        
        C:\Windows\system32\Mlhidg32.exe
        114⤵
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Malgmm32.exe
        
        C:\Windows\system32\Malgmm32.exe
        115⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Nlfeeelm.exe
        
        C:\Windows\system32\Nlfeeelm.exe
        116⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Nbqmbo32.exe
        
        C:\Windows\system32\Nbqmbo32.exe
        117⤵
        Drops file in System32 directory
        
        PID:2496
        
        C:\Windows\SysWOW64\Naejcl32.exe
        
        C:\Windows\system32\Naejcl32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6008
        
        C:\Windows\SysWOW64\Objphn32.exe
        
        C:\Windows\system32\Objphn32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6084
        
        C:\Windows\SysWOW64\Oidhehcl.exe
        
        C:\Windows\system32\Oidhehcl.exe
        120⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Ohiefdhd.exe
        
        C:\Windows\system32\Ohiefdhd.exe
        121⤵
        
        PID:392
        
        C:\Windows\SysWOW64\Pimkkfka.exe
        
        C:\Windows\system32\Pimkkfka.exe
        122⤵
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Qlejnqbj.exe
        
        C:\Windows\system32\Qlejnqbj.exe
        123⤵
        Drops file in System32 directory
        
        PID:2668
        
        C:\Windows\SysWOW64\Qcobjk32.exe
        
        C:\Windows\system32\Qcobjk32.exe
        124⤵
        Modifies registry class
        
        PID:4196
        
        C:\Windows\SysWOW64\Acclejeb.exe
        
        C:\Windows\system32\Acclejeb.exe
        125⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Bicjjncd.exe
        
        C:\Windows\system32\Bicjjncd.exe
        126⤵
        Drops file in System32 directory
        
        PID:1680
        
        C:\Windows\SysWOW64\Ccinggcj.exe
        
        C:\Windows\system32\Ccinggcj.exe
        127⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Cjbfdakf.exe
        
        C:\Windows\system32\Cjbfdakf.exe
        128⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\Cobkbhgk.exe
        
        C:\Windows\system32\Cobkbhgk.exe
        129⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Cijpkmml.exe
        
        C:\Windows\system32\Cijpkmml.exe
        130⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\Dpmknf32.exe
        
        C:\Windows\system32\Dpmknf32.exe
        131⤵
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Dfgcjpdk.exe
        
        C:\Windows\system32\Dfgcjpdk.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Djelqo32.exe
        
        C:\Windows\system32\Djelqo32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3312
        
        C:\Windows\SysWOW64\Gdglfqjd.exe
        
        C:\Windows\system32\Gdglfqjd.exe
        134⤵
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Giinjg32.exe
        
        C:\Windows\system32\Giinjg32.exe
        135⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\Gikkof32.exe
        
        C:\Windows\system32\Gikkof32.exe
        136⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\Hdclbopg.exe
        
        C:\Windows\system32\Hdclbopg.exe
        137⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3380
        
        C:\Windows\SysWOW64\Hdehho32.exe
        
        C:\Windows\system32\Hdehho32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1596
        
        C:\Windows\SysWOW64\Ikkppgld.exe
        
        C:\Windows\system32\Ikkppgld.exe
        139⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Idceim32.exe
        
        C:\Windows\system32\Idceim32.exe
        140⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Iloimopp.exe
        
        C:\Windows\system32\Iloimopp.exe
        141⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Igdnkhoe.exe
        
        C:\Windows\system32\Igdnkhoe.exe
        142⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Jkdcffci.exe
        
        C:\Windows\system32\Jkdcffci.exe
        143⤵
        Drops file in System32 directory
        
        PID:1976
        
        C:\Windows\SysWOW64\Jcphkhad.exe
        
        C:\Windows\system32\Jcphkhad.exe
        144⤵
        Drops file in System32 directory
        
        PID:1960
        
        C:\Windows\SysWOW64\Jpdhdl32.exe
        
        C:\Windows\system32\Jpdhdl32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4404
        
        C:\Windows\SysWOW64\Jkimae32.exe
        
        C:\Windows\system32\Jkimae32.exe
        146⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Jdaajkfd.exe
        
        C:\Windows\system32\Jdaajkfd.exe
        147⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\Kckgff32.exe
        
        C:\Windows\system32\Kckgff32.exe
        148⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Kjepcqnd.exe
        
        C:\Windows\system32\Kjepcqnd.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1216
        
        C:\Windows\SysWOW64\Lnohemjm.exe
        
        C:\Windows\system32\Lnohemjm.exe
        150⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Maggggaf.exe
        
        C:\Windows\system32\Maggggaf.exe
        151⤵
        Drops file in System32 directory
        
        PID:4376
        
        C:\Windows\SysWOW64\Mjahfl32.exe
        
        C:\Windows\system32\Mjahfl32.exe
        152⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Ngehoqdn.exe
        
        C:\Windows\system32\Ngehoqdn.exe
        153⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\Nanmhf32.exe
        
        C:\Windows\system32\Nanmhf32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4952
        
        C:\Windows\SysWOW64\Oagpne32.exe
        
        C:\Windows\system32\Oagpne32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2260
        
        C:\Windows\SysWOW64\Oeehdcij.exe
        
        C:\Windows\system32\Oeehdcij.exe
        156⤵
        Drops file in System32 directory
        
        PID:3776
        
        C:\Windows\SysWOW64\Onnmmipj.exe
        
        C:\Windows\system32\Onnmmipj.exe
        157⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\Ohfafn32.exe
        
        C:\Windows\system32\Ohfafn32.exe
        158⤵
        Modifies registry class
        
        PID:4720
        
        C:\Windows\SysWOW64\Oanfodmk.exe
        
        C:\Windows\system32\Oanfodmk.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1036
        
        C:\Windows\SysWOW64\Pmgcidqm.exe
        
        C:\Windows\system32\Pmgcidqm.exe
        160⤵
        Modifies registry class
        
        PID:1516
        
        C:\Windows\SysWOW64\Plhcglil.exe
        
        C:\Windows\system32\Plhcglil.exe
        161⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\Paelpcgc.exe
        
        C:\Windows\system32\Paelpcgc.exe
        162⤵
        
        PID:456
        
        C:\Windows\SysWOW64\Pknqhh32.exe
        
        C:\Windows\system32\Pknqhh32.exe
        163⤵
        Modifies registry class
        
        PID:1704
        
        C:\Windows\SysWOW64\Pdfeandd.exe
        
        C:\Windows\system32\Pdfeandd.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4588
        
        C:\Windows\SysWOW64\Pajekb32.exe
        
        C:\Windows\system32\Pajekb32.exe
        165⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Qaoofaoi.exe
        
        C:\Windows\system32\Qaoofaoi.exe
        166⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Adfnhlfa.exe
        
        C:\Windows\system32\Adfnhlfa.exe
        167⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\Aehghn32.exe
        
        C:\Windows\system32\Aehghn32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1496
        
        C:\Windows\SysWOW64\Boqlqd32.exe
        
        C:\Windows\system32\Boqlqd32.exe
        169⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\Bldljh32.exe
        
        C:\Windows\system32\Bldljh32.exe
        170⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Bnfiapfj.exe
        
        C:\Windows\system32\Bnfiapfj.exe
        171⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Beomhm32.exe
        
        C:\Windows\system32\Beomhm32.exe
        172⤵
        Modifies registry class
        
        PID:3900
        
        C:\Windows\SysWOW64\Bohbackj.exe
        
        C:\Windows\system32\Bohbackj.exe
        173⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\Bddjijia.exe
        
        C:\Windows\system32\Bddjijia.exe
        174⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Bkobfdao.exe
        
        C:\Windows\system32\Bkobfdao.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1304
        
        C:\Windows\SysWOW64\Bahkcn32.exe
        
        C:\Windows\system32\Bahkcn32.exe
        176⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\Cfmijkhj.exe
        
        C:\Windows\system32\Cfmijkhj.exe
        177⤵
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Ckjbbbga.exe
        
        C:\Windows\system32\Ckjbbbga.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5112
        
        C:\Windows\SysWOW64\Ddbfkh32.exe
        
        C:\Windows\system32\Ddbfkh32.exe
        179⤵
        Modifies registry class
        
        PID:5076
        
        C:\Windows\SysWOW64\Dohkhq32.exe
        
        C:\Windows\system32\Dohkhq32.exe
        180⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\Diclff32.exe
        
        C:\Windows\system32\Diclff32.exe
        181⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Dbkpokhf.exe
        
        C:\Windows\system32\Dbkpokhf.exe
        182⤵
        Modifies registry class
        
        PID:3800
        
        C:\Windows\SysWOW64\Dnbadlnj.exe
        
        C:\Windows\system32\Dnbadlnj.exe
        183⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\Emenhcdf.exe
        
        C:\Windows\system32\Emenhcdf.exe
        184⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Fldnoo32.exe
        
        C:\Windows\system32\Fldnoo32.exe
        185⤵
        Drops file in System32 directory
        
        PID:6128
        
        C:\Windows\SysWOW64\Ffiblg32.exe
        
        C:\Windows\system32\Ffiblg32.exe
        186⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3480
        
        C:\Windows\SysWOW64\Ffnkggld.exe
        
        C:\Windows\system32\Ffnkggld.exe
        187⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Fmhcda32.exe
        
        C:\Windows\system32\Fmhcda32.exe
        188⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Lofklp32.exe
        
        C:\Windows\system32\Lofklp32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5760
        
        C:\Windows\SysWOW64\Lngkjhmi.exe
        
        C:\Windows\system32\Lngkjhmi.exe
        190⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Lcdcbokq.exe
        
        C:\Windows\system32\Lcdcbokq.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5220
        
        C:\Windows\SysWOW64\Mcbpcm32.exe
        
        C:\Windows\system32\Mcbpcm32.exe
        192⤵
        Drops file in System32 directory
        
        PID:4516
        
        C:\Windows\SysWOW64\Mnhdae32.exe
        
        C:\Windows\system32\Mnhdae32.exe
        193⤵
        Drops file in System32 directory
        
        PID:2368
        
        C:\Windows\SysWOW64\Ncifdlii.exe
        
        C:\Windows\system32\Ncifdlii.exe
        194⤵
        Drops file in System32 directory
        
        PID:5244
        
        C:\Windows\SysWOW64\Nnccmddi.exe
        
        C:\Windows\system32\Nnccmddi.exe
        195⤵
        Drops file in System32 directory
        
        PID:5352
        
        C:\Windows\SysWOW64\Ncplekbq.exe
        
        C:\Windows\system32\Ncplekbq.exe
        196⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Nnfpbcbf.exe
        
        C:\Windows\system32\Nnfpbcbf.exe
        197⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Nadlnoaj.exe
        
        C:\Windows\system32\Nadlnoaj.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5524
        
        C:\Windows\SysWOW64\Ogndki32.exe
        
        C:\Windows\system32\Ogndki32.exe
        199⤵
        Drops file in System32 directory
        
        PID:5448
        
        C:\Windows\SysWOW64\Onochbjl.exe
        
        C:\Windows\system32\Onochbjl.exe
        200⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Ohggah32.exe
        
        C:\Windows\system32\Ohggah32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5288
        
        C:\Windows\SysWOW64\Pmnbpm32.exe
        
        C:\Windows\system32\Pmnbpm32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3832
        
        C:\Windows\SysWOW64\Pnmojp32.exe
        
        C:\Windows\system32\Pnmojp32.exe
        203⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\Qpolahdj.exe
        
        C:\Windows\system32\Qpolahdj.exe
        204⤵
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Qjdpoacp.exe
        
        C:\Windows\system32\Qjdpoacp.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5256
        
        C:\Windows\SysWOW64\Qpahghbg.exe
        
        C:\Windows\system32\Qpahghbg.exe
        206⤵
        Modifies registry class
        
        PID:5384
        
        C:\Windows\SysWOW64\Ahjmne32.exe
        
        C:\Windows\system32\Ahjmne32.exe
        207⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\Amgefl32.exe
        
        C:\Windows\system32\Amgefl32.exe
        208⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\Afpjoaeo.exe
        
        C:\Windows\system32\Afpjoaeo.exe
        209⤵
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Aaenlj32.exe
        
        C:\Windows\system32\Aaenlj32.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Ahofidlb.exe
        
        C:\Windows\system32\Ahofidlb.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5692
        
        C:\Windows\SysWOW64\Aagkaj32.exe
        
        C:\Windows\system32\Aagkaj32.exe
        212⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\Akpojpic.exe
        
        C:\Windows\system32\Akpojpic.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4924
        
        C:\Windows\SysWOW64\Apmhbf32.exe
        
        C:\Windows\system32\Apmhbf32.exe
        214⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Akblpo32.exe
        
        C:\Windows\system32\Akblpo32.exe
        215⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Bhfmic32.exe
        
        C:\Windows\system32\Bhfmic32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6228
        
        C:\Windows\SysWOW64\Bopefnnf.exe
        
        C:\Windows\system32\Bopefnnf.exe
        217⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Bkgekock.exe
        
        C:\Windows\system32\Bkgekock.exe
        218⤵
        Drops file in System32 directory
        
        PID:6312
        
        C:\Windows\SysWOW64\Bdojdd32.exe
        
        C:\Windows\system32\Bdojdd32.exe
        219⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Ddfikaeq.exe
        
        C:\Windows\system32\Ddfikaeq.exe
        220⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6412
        
        C:\Windows\SysWOW64\Ehpamnaj.exe
        
        C:\Windows\system32\Ehpamnaj.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6452
        
        C:\Windows\SysWOW64\Faeihogj.exe
        
        C:\Windows\system32\Faeihogj.exe
        222⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Hlkfle32.exe
        
        C:\Windows\system32\Hlkfle32.exe
        223⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Hbenio32.exe
        
        C:\Windows\system32\Hbenio32.exe
        224⤵
        Modifies registry class
        
        PID:6596
        
        C:\Windows\SysWOW64\Ihkigd32.exe
        
        C:\Windows\system32\Ihkigd32.exe
        225⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Kojdflkl.exe
        
        C:\Windows\system32\Kojdflkl.exe
        226⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Klpaep32.exe
        
        C:\Windows\system32\Klpaep32.exe
        227⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Kidbnd32.exe
        
        C:\Windows\system32\Kidbnd32.exe
        228⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Liikiccg.exe
        
        C:\Windows\system32\Liikiccg.exe
        229⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Lhpepoel.exe
        
        C:\Windows\system32\Lhpepoel.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6856
        
        C:\Windows\SysWOW64\Lomjbikf.exe
        
        C:\Windows\system32\Lomjbikf.exe
        231⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Lakfodjj.exe
        
        C:\Windows\system32\Lakfodjj.exe
        232⤵
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Nciojeem.exe
        
        C:\Windows\system32\Nciojeem.exe
        233⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Nbnlkbje.exe
        
        C:\Windows\system32\Nbnlkbje.exe
        234⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Piocoi32.exe
        
        C:\Windows\system32\Piocoi32.exe
        235⤵
        Drops file in System32 directory
        
        PID:7076
        
        C:\Windows\SysWOW64\Qfepnmjn.exe
        
        C:\Windows\system32\Qfepnmjn.exe
        236⤵
        Drops file in System32 directory
        
        PID:7124
        
        C:\Windows\SysWOW64\Acnjbpdb.exe
        
        C:\Windows\system32\Acnjbpdb.exe
        237⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Afocdkac.exe
        
        C:\Windows\system32\Afocdkac.exe
        238⤵
        Drops file in System32 directory
        
        PID:6200
        
        C:\Windows\SysWOW64\Afapjk32.exe
        
        C:\Windows\system32\Afapjk32.exe
        239⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Aplahpdo.exe
        
        C:\Windows\system32\Aplahpdo.exe
        240⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Cienhc32.exe
        
        C:\Windows\system32\Cienhc32.exe
        241⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Ckfggf32.exe
        
        C:\Windows\system32\Ckfggf32.exe
        242⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Dphikllo.exe
        
        C:\Windows\system32\Dphikllo.exe
        243⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Edmhai32.exe
        
        C:\Windows\system32\Edmhai32.exe
        244⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Epdigjaa.exe
        
        C:\Windows\system32\Epdigjaa.exe
        245⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Gjcmgmdg.exe
        
        C:\Windows\system32\Gjcmgmdg.exe
        246⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Hkohmnal.exe
        
        C:\Windows\system32\Hkohmnal.exe
        247⤵
        Drops file in System32 directory
        
        PID:2932
        
        C:\Windows\SysWOW64\Ikaebnoj.exe
        
        C:\Windows\system32\Ikaebnoj.exe
        248⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Iannkd32.exe
        
        C:\Windows\system32\Iannkd32.exe
        249⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Ijkloi32.exe
        
        C:\Windows\system32\Ijkloi32.exe
        250⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Jloacl32.exe
        
        C:\Windows\system32\Jloacl32.exe
        251⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Jaljlb32.exe
        
        C:\Windows\system32\Jaljlb32.exe
        252⤵
        Modifies registry class
        
        PID:6740
        
        C:\Windows\SysWOW64\Jdmcnnnb.exe
        
        C:\Windows\system32\Jdmcnnnb.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2992
        
        C:\Windows\SysWOW64\Jjgkjh32.exe
        
        C:\Windows\system32\Jjgkjh32.exe
        254⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Jacpma32.exe
        
        C:\Windows\system32\Jacpma32.exe
        255⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Khfkpjjk.exe
        
        C:\Windows\system32\Khfkpjjk.exe
        256⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Laalnpoi.exe
        
        C:\Windows\system32\Laalnpoi.exe
        257⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Lhkdkj32.exe
        
        C:\Windows\system32\Lhkdkj32.exe
        258⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Lcebcbaf.exe
        
        C:\Windows\system32\Lcebcbaf.exe
        259⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Mdkhficp.exe
        
        C:\Windows\system32\Mdkhficp.exe
        260⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5952
        
        C:\Windows\SysWOW64\Mdneki32.exe
        
        C:\Windows\system32\Mdneki32.exe
        261⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Moefna32.exe
        
        C:\Windows\system32\Moefna32.exe
        262⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Nddklhke.exe
        
        C:\Windows\system32\Nddklhke.exe
        263⤵
        Drops file in System32 directory
        
        PID:7084
        
        C:\Windows\SysWOW64\Ochafm32.exe
        
        C:\Windows\system32\Ochafm32.exe
        264⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Pmhkpacg.exe
        
        C:\Windows\system32\Pmhkpacg.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5300
        
        C:\Windows\SysWOW64\Aeoppbge.exe
        
        C:\Windows\system32\Aeoppbge.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5280
        
        C:\Windows\SysWOW64\Bmagmn32.exe
        
        C:\Windows\system32\Bmagmn32.exe
        267⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Dllfpg32.exe
        
        C:\Windows\system32\Dllfpg32.exe
        268⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Fckaoneo.exe
        
        C:\Windows\system32\Fckaoneo.exe
        269⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Fjeikh32.exe
        
        C:\Windows\system32\Fjeikh32.exe
        270⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Gcbgom32.exe
        
        C:\Windows\system32\Gcbgom32.exe
        271⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\Gfemfhje.exe
        
        C:\Windows\system32\Gfemfhje.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5616
        
        C:\Windows\SysWOW64\Hcdmlk32.exe
        
        C:\Windows\system32\Hcdmlk32.exe
        273⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\Iglhhhmm.exe
        
        C:\Windows\system32\Iglhhhmm.exe
        274⤵
        Drops file in System32 directory
        
        PID:5896
        
        C:\Windows\SysWOW64\Kagbmkch.exe
        
        C:\Windows\system32\Kagbmkch.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6592
        
        C:\Windows\SysWOW64\Ldckkdfl.exe
        
        C:\Windows\system32\Ldckkdfl.exe
        276⤵
        Modifies registry class
        
        PID:6572
        
        C:\Windows\SysWOW64\Mkbmbn32.exe
        
        C:\Windows\system32\Mkbmbn32.exe
        277⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Nknlnl32.exe
        
        C:\Windows\system32\Nknlnl32.exe
        278⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Nahdkffc.exe
        
        C:\Windows\system32\Nahdkffc.exe
        279⤵
        Drops file in System32 directory
        
        PID:2324
        
        C:\Windows\SysWOW64\Nonajj32.exe
        
        C:\Windows\system32\Nonajj32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6684
        
        C:\Windows\SysWOW64\Nehjfdkf.exe
        
        C:\Windows\system32\Nehjfdkf.exe
        281⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Ndmghqpo.exe
        
        C:\Windows\system32\Ndmghqpo.exe
        282⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Oemcac32.exe
        
        C:\Windows\system32\Oemcac32.exe
        283⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\Okiljj32.exe
        
        C:\Windows\system32\Okiljj32.exe
        284⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\Odbpcpli.exe
        
        C:\Windows\system32\Odbpcpli.exe
        285⤵
        Modifies registry class
        
        PID:1208
        
        C:\Windows\SysWOW64\Oklhpjcf.exe
        
        C:\Windows\system32\Oklhpjcf.exe
        286⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\Oafald32.exe
        
        C:\Windows\system32\Oafald32.exe
        287⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Pdkcinco.exe
        
        C:\Windows\system32\Pdkcinco.exe
        288⤵
        Drops file in System32 directory
        
        PID:3364
        
        C:\Windows\SysWOW64\Qgeoah32.exe
        
        C:\Windows\system32\Qgeoah32.exe
        289⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Adiojl32.exe
        
        C:\Windows\system32\Adiojl32.exe
        290⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Akchgfok.exe
        
        C:\Windows\system32\Akchgfok.exe
        291⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Andqia32.exe
        
        C:\Windows\system32\Andqia32.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3420
        
        C:\Windows\SysWOW64\Aocmbdco.exe
        
        C:\Windows\system32\Aocmbdco.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7060
        
        C:\Windows\SysWOW64\Akjnhehc.exe
        
        C:\Windows\system32\Akjnhehc.exe
        294⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Abdfdp32.exe
        
        C:\Windows\system32\Abdfdp32.exe
        295⤵
        
        PID:440
        
        C:\Windows\SysWOW64\Akmjmefq.exe
        
        C:\Windows\system32\Akmjmefq.exe
        296⤵
        Modifies registry class
        
        PID:7152
        
        C:\Windows\SysWOW64\Bfbojnff.exe
        
        C:\Windows\system32\Bfbojnff.exe
        297⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\Bkogce32.exe
        
        C:\Windows\system32\Bkogce32.exe
        298⤵
        
        PID:384
        
        C:\Windows\SysWOW64\Beglljko.exe
        
        C:\Windows\system32\Beglljko.exe
        299⤵
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Ceehmh32.exe
        
        C:\Windows\system32\Ceehmh32.exe
        300⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Cpklja32.exe
        
        C:\Windows\system32\Cpklja32.exe
        301⤵
        Modifies registry class
        
        PID:3064
        
        C:\Windows\SysWOW64\Chfaoc32.exe
        
        C:\Windows\system32\Chfaoc32.exe
        302⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Cblellle.exe
        
        C:\Windows\system32\Cblellle.exe
        303⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\Dnebfm32.exe
        
        C:\Windows\system32\Dnebfm32.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:884
        
        C:\Windows\SysWOW64\Dhmgob32.exe
        
        C:\Windows\system32\Dhmgob32.exe
        305⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\Elilgo32.exe
        
        C:\Windows\system32\Elilgo32.exe
        306⤵
        Drops file in System32 directory
        
        PID:4228
        
        C:\Windows\SysWOW64\Flekbm32.exe
        
        C:\Windows\system32\Flekbm32.exe
        307⤵
        Drops file in System32 directory
        
        PID:1500
        
        C:\Windows\SysWOW64\Glghhmdn.exe
        
        C:\Windows\system32\Glghhmdn.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Ggmlefcd.exe
        
        C:\Windows\system32\Ggmlefcd.exe
        309⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\Gohajhao.exe
        
        C:\Windows\system32\Gohajhao.exe
        310⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\Ginega32.exe
        
        C:\Windows\system32\Ginega32.exe
        311⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Gpgndkhb.exe
        
        C:\Windows\system32\Gpgndkhb.exe
        312⤵
        
        PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abmhbplf.exe

Filesize
109KB

MD5
502cd8ea606340f554100e30f2fc6b76

SHA1
0752824397718a196516d2fdb0457ec241ddd35d

SHA256
9020cd007ce9e9aff0ca9cf4a53e247667e263d6b755290a551456432d885e4e

SHA512
672ba109d92d0043c1bf7e630319acd48837d6ee769b474a50358613cfaebd5ed5ffc2a24bea9e34cb05bac83322cdc05113470c57e2cbba8291b6b64b5d349d

Download Submit
C:\Windows\SysWOW64\Aeoppbge.exe

Filesize
109KB

MD5
9e0477d2f97c105a20902e5ca2c0731f

SHA1
0b5ac7d888e4cb84ade800791e0612fff301800f

SHA256
b4f08765ea4ba06f9de7e7f581bbde8fba21a1da82919f7c44bd2747ac5386be

SHA512
dda1532844f506a07bcaeace7c5546a9b9b9565d112da6012969c603bf98b632b1d72aee1a0ecca87c4cfdb568867c2db8023434eb7593c8605054046596cb99

Download Submit
C:\Windows\SysWOW64\Aiclodaj.exe

Filesize
109KB

MD5
9bc56822838b97a03f4067c1a8f98508

SHA1
90ac491a8086cf04104c6394e71873d9b5fba21a

SHA256
d2afd6ca07ce95234bfba48c9d1c0327483de4507435def453731ffb09ec7060

SHA512
a1889278a893db4dcb9114c2c39af1a6f215a6b18d8b6b580eb3b31bb5f2593c45d2587facd743f9b4d8aa43af2bd10978b5ed57e6cfb4f221185f6d93c9940e

Download Submit
C:\Windows\SysWOW64\Akpojpic.exe

Filesize
109KB

MD5
e1f95bd8faadef3a1fefa6a7c44655c8

SHA1
a129c5372d5aa4d9c20273c05a97dc766f17d6ef

SHA256
7105dce72e339f70ba7e61f84332453511ea313bc139ea396e5d247ce3294bcb

SHA512
abced101d5e0aba6b0f5ec0607f4ed02f312f2f6759d07c28204265bb8112f05141643ded02935ae67e4e8063bb1fbaf1ee98664024670c315dc5b8b64841ae1

Download Submit
C:\Windows\SysWOW64\Algbfo32.exe

Filesize
109KB

MD5
a9edb60c404a5b1d3c412e7989b106ac

SHA1
9d9a2e44cc1107bfc366c5ff085a7366eb8ef5ec

SHA256
a2320807d14be5dbd3e6dad6c5271e8e1b2ba010dd9c96220e3d345cca307863

SHA512
0b5d114a613f6f4786268ba8a2bf15ab7651a8a93710c0332745a3ef63da986dd65d5d0f4a94ea3157156c588d7ded0f1ad12959699f213f59b6624e63e7a2c9

Download Submit
C:\Windows\SysWOW64\Alioloje.exe

Filesize
109KB

MD5
b33553cf05c3c6e34c4f03537f966ba2

SHA1
86982bda165c99fd472089cc4ecfe01241064367

SHA256
534d6f6d301cd19c311e917762f8beef412c09c3c10609852cc75e18108df29f

SHA512
285390e8496c027b779a0e4cab351ba789abb94984668b9d30effcb249a2517d93686d26d9376fc7def1c57067e52072fcffcea1584101b270872b967901a01c

Download Submit
C:\Windows\SysWOW64\Aocmbdco.exe

Filesize
109KB

MD5
c4680d2a2adea269013c5e5c2b18dc58

SHA1
912193792848f9b57b9e1a3181bcf0d20e683312

SHA256
9b38b3b2192f4989f491be599fe0f169a4c1287f86160b35fd2ab9c4d8da5dc7

SHA512
d0f104034d8c5fe33746c359fe4d27cc9d9f1a5721cac0ffd34e1fedb554ca5f324fffbf1dd1fc931e0bc8786d69382566868262fd0ad61505fa7cab55d27ab5

Download Submit
C:\Windows\SysWOW64\Aofemaog.exe

Filesize
109KB

MD5
74b0dbeb171456bbb201bbd80f748b5c

SHA1
dc6b5c7502e1c6a01d0428592e67a22046c3e42a

SHA256
4c28f8201acec954c67012649eee56d3d0095fe9dbde28e8ce79b24a1f205c22

SHA512
c9ef4b2c3325a7a74e29a2ff0d52797bbd9c5f5f3ff73068d03223c612a729d013a926e38f968f96d53198a41f8ba74f693c8fe47fbdb940e2c88108ac82d136

Download Submit
C:\Windows\SysWOW64\Balfko32.exe

Filesize
109KB

MD5
5e60eb8f14ae782c8174d3c4dfbf2070

SHA1
6b97d4523bb27c79cb0c3b282a66e3154be8fd3a

SHA256
9cf30e4279bff037e30bd913ebccdfe902ff4e543688ffa8e4b15553843af6c6

SHA512
85cc11264372666fe733244dbf49af1d4e7509ae611e8bbded8e14548b66c114e41e3cbaee06a05e45ff78408b86b09df357952fcad2d1a0a789515e73b3d961

Download Submit
C:\Windows\SysWOW64\Bckddn32.exe

Filesize
109KB

MD5
ec9c4e49500b249818e1a5019ade8ba9

SHA1
3231d6e8c5b5c026c135ef39f52490603f1a6d30

SHA256
14203e250c4f710e8af0e0b38e7915b45f55d6bf407b6167491460b69f901165

SHA512
6451289a28c5ebf7e640069cbbf15756250018f34dbb8ef257e44d2c18313e22931da775d4a2059909e3715b75d493cb399a22bebb9db620de0d4728f1d967fb

Download Submit
C:\Windows\SysWOW64\Bhibgo32.exe

Filesize
109KB

MD5
acba8aeca3e8f549eff28eb705b4afe1

SHA1
28f08f5998802da356dbfb7ec8a6b5a491f8bcd9

SHA256
435ea240e5c28b4b6c26ab2148c7af21c1353bd141d79d7e29322ab95b21aae6

SHA512
9e9265dfb53a4c159b549bbf3427297efbe1bfb2b763c2e74dcf3e7c4b5c234779edf1a496350b3b1fe86316019fb82f12203d235e7b789e5b2935195fbb2fdb

Download Submit
C:\Windows\SysWOW64\Cijpkmml.exe

Filesize
109KB

MD5
2223d7740749f1fc66e0f11aeb093c5b

SHA1
16505c8f3d7b342d2924dbe1e0c9b7e761265c40

SHA256
045ca2bcbf132b4c7215a4d05f6f0dd12067dbbd1e95aa80233d8ff41f2d1ad7

SHA512
60a3a3833906070a9d09cd45d840be5d77fac60f326333c755f91fb595f776a5ba2e69099cc2369a8d329eabfc21fd367839f1ad1dab0f586b796f56351309a0

Download Submit
C:\Windows\SysWOW64\Clldhljp.exe

Filesize
109KB

MD5
ddc2e48e1ed8a9fc6ddf93da52de717d

SHA1
30693dd714c7159dd831c8360c31b890afdd9235

SHA256
53a5364013eb20e8fbff84ba3999726af0493ede8546a6333c900af0712139ea

SHA512
bf7d82ace7536e09767403f9f3283b482f637e96e6d596aff888ea91f1c2c07b118767f802b66aa04fdebfb32266ccb8cdec8bbe2ae1c14bc0f4baac4647f0ed

Download Submit
C:\Windows\SysWOW64\Cphgca32.exe

Filesize
109KB

MD5
55e2cbc4698fea67b66d92f3b081d58e

SHA1
98d0e500af07936b1540c6186e5e83bfbaf8376c

SHA256
a72cac1b37579b19adaa7c6d11cf521e6de8a254b09aeacda83f2f55627be433

SHA512
fb44c9727535ff9c4a28984b7d4295ea6dec666c1899721d6ccdf144b78458de47cd3e571ba52c32c01cca390c34bc3740ac1520daf9bb514b225ad12b841f3e

Download Submit
C:\Windows\SysWOW64\Damflb32.exe

Filesize
109KB

MD5
c7788ac180ed214ea0995623c8a9be17

SHA1
2afc28f5d4740b466b606d33bdb674425135fab5

SHA256
faf96ed080b3bfa9b393ca9a051a29de14a6b39578b1f1d4de9be5a75912c8f9

SHA512
44b9ea79b43baeadfb6b30d70c8a23a7f115c9d819beecf3b8dbdc4bc394736765c9f181ae1f417981600be7631ac1a2925c1dee4b834de23adef7299fb2b463

Download Submit
C:\Windows\SysWOW64\Dhlhcl32.exe

Filesize
109KB

MD5
ec683eeacdb556c85a2f5e93b5b2e7d6

SHA1
44baec68c75432742fdb11f3e35e62045ca33076

SHA256
b029118fa2beacdb48dd4228042480b08ea5cbbf5538765303105572b41205f7

SHA512
20a8dadcb08b8ce14393ef547629d7030108c0bada58c5230392ec9ffb37eedd2f382d536a16e0d5e953b51281b5dee9801e5f1297069f7088c6e9f17349f683

Download Submit
C:\Windows\SysWOW64\Diclff32.exe

Filesize
109KB

MD5
c6c783d260479e178fb95e16593a078d

SHA1
835d35c26a537341968afecaced26e0ea2f67284

SHA256
06278dee467778ec9aee8a99f8670fd9d32616d29b66b5fe4d9d9777b44e469e

SHA512
8770186978d996f8e85cb4c1ff3c70092811edf8d35e192c52ca496e4007c9e6be2329b596231b8382892d0f44a21b2c41198eeca018c998e3c3a843d93238ec

Download Submit
C:\Windows\SysWOW64\Dlcaca32.exe

Filesize
109KB

MD5
ee873842d2edfda1089143ce5c2fc60a

SHA1
1262999f5510e1f40101cb1b460a3fa25f00d84e

SHA256
c7e0648f3b625541662fe3a5454d183b4399e50769120f867096f97437f1d271

SHA512
31c55d941390fc91222ef61187e687eeb4b49ee1a01ee0d75ce0863e641248f46e818c115533942d48e07dd85366a2439a3e934fd723fda5f084529c2d767f3b

Download Submit
C:\Windows\SysWOW64\Dnebfm32.exe

Filesize
109KB

MD5
a596cdfa60e7846034a08c3c84d138ae

SHA1
a27419fdea3c97969d237c670bfe6e2c5e0d7874

SHA256
563646b51f56d7053b57e1728208c94dc0cdb7fd6758ac62ed29820514a74682

SHA512
dcf85673815b97bb81299692903218240407425db85adcaa294575c58c72cb338e045349b35cb0df8eb2b12d3c520960569724c1fee61a4ff34dd0fcaf22a62a

Download Submit
C:\Windows\SysWOW64\Ejjgic32.exe

Filesize
109KB

MD5
935fbbca5afa94fcae946af0049f2a19

SHA1
c782f597198e1e8e39a60b10243301ca97797a31

SHA256
b2061e5d146ea5dd60eb2a1bf3972267c7d446d75bb58f9cd0968d0785b4aa18

SHA512
9655b9c4bfa4058d791d2d48273c2c0dbfb889c17968879dd1de3d303bea8d45c8b27c019a7afe0b7a70bb3301b329f1f9ad90a1c46dc3bf2dbce07b1ab637eb

Download Submit
C:\Windows\SysWOW64\Elkfed32.exe

Filesize
109KB

MD5
4014a93a930c537d65e368ac7865d524

SHA1
0404fbd3ec74ce989b7f9b00d7dd8fa7aff98b84

SHA256
1bc2db3045d779892c8ad4407db15a99e7606ce1aa9c89dea72ab72e15d80b2f

SHA512
5fd059e164cb96023d7d3cf4f9800f290588e918366e3b3d7929dfdec0396b181e16e4171f73ca5db6bce8cc7a84683c1c3606388bdaf634e53634a8561d8a0a

Download Submit
C:\Windows\SysWOW64\Eomfae32.exe

Filesize
109KB

MD5
3b3689790a888d49e2307a2e1fb8f4b0

SHA1
61f0203b9c4b9e6dfb2050b0e3b14728bf7c6b10

SHA256
2512d50327ffec5b364a26084b772a9bf254949463ef8ff1ac071581326425e9

SHA512
204b5be4d6e9fc29b8ec96a5d90037ca888deea6cc5b3afd903373caf08f6fb303d140618ec4e8538d2aa2978ad9da030d3d91e6610ea8d31f9c1f9d649a65d8

Download Submit
C:\Windows\SysWOW64\Epdigjaa.exe

Filesize
109KB

MD5
9fbd0104250b7ba80221f791d16d0c8c

SHA1
c02ea4335d3b592022efa8d33fc0e2d70ac10ad9

SHA256
aa304483465122f429f912fc651ccad95ee71386bd6b6ba7aba1738b76c40261

SHA512
f7eca492e9768548477aa740a28d220e6a6fd8f76cbe872d1a1dfe799a66699ec7e2676516eb3713c7d22f58dba46aa0ec2795b2352930060d6e631e1f434ae2

Download Submit
C:\Windows\SysWOW64\Fckhnaab.exe

Filesize
109KB

MD5
c59dda70facce1206f3907680666dd24

SHA1
b5594e567a26229dbaa9aa859dcfd241274f60ca

SHA256
97e64caf6887aaea29caa822931af0d06c60add6d2ead27aa9fd5f2c885efa86

SHA512
6def0eaecd29a7af217849ae7d2b5da7c5ee3175a1ea2021c5008933d517f469b92be56602f61fa8eac5258850654cc444b61e5f3d6af4df1135efc30cbb92f9

Download Submit
C:\Windows\SysWOW64\Ffekom32.exe

Filesize
109KB

MD5
768913d724fdfccea46d13e0958e1cba

SHA1
7b5532939b9bd4e63f079d5756553d1a1b4a15a9

SHA256
7b54a7500e7a63614fee008101016c6bf842eac5e199ca7de27771b7c7ece91a

SHA512
93fcbf7862781616276f7b110b1eedf1deaad62a391ee9288697388e0d7af8fb492b722731e4e71867d5b71a2e1c32435e940a50e78b74ec277d6c371a6b52ba

Download Submit
C:\Windows\SysWOW64\Fifdqhal.exe

Filesize
109KB

MD5
a7e08b39af44e7e57e6f4ba56d1fd36d

SHA1
0adab984851be96a257efbfc22776d6cb4143f4a

SHA256
93bdc282e31f13f2ccfb620023a511fa569d65468ca20a7f9e7c934f38263426

SHA512
ccf2d9422e743988bb59e320d74a46a337792c5dab150b54f2c91885ac0033712045664c8e4df91724797ebaf8aeecb83e9a1f79e8c0c5cc3d74969cf328b805

Download Submit
C:\Windows\SysWOW64\Fldnoo32.exe

Filesize
109KB

MD5
f849d8d5c612fe277e49ca036a526a36

SHA1
52d45ed0a0e4ac8a48e648838a6b7a3cb80d0e5a

SHA256
f1833db621464d941b4a5dfe8aae5e4d167bb3f5717f8ecf9f5c22292d2c453c

SHA512
b3e08b4acf29a0458d3e54cf505ce0a0d1f5dc435c17a5abd33e02dc775e71bb1adaff8826d1acaec13faa3d9da7e3bbe46aaf12a7e59a7d2c354f91ee282292

Download Submit
C:\Windows\SysWOW64\Fnacfp32.exe

Filesize
109KB

MD5
07290c3b00aa2eaabcf37b5bcd524f9f

SHA1
dcf9387942e1e53f7766813ec455d05804baf904

SHA256
7edd0e0d5ac348026e749692213ef6d08c77e3e9653c7882843c8313ec21d940

SHA512
98a47199603644f2904dde78df4f68287d3820f9c0f9e921da6ba6b23b2f3157a77769f30c6aecbaa4b02477a359556b5dccee613454b597e044ab378b4bf48c

Download Submit
C:\Windows\SysWOW64\Gagebknp.exe

Filesize
109KB

MD5
e7f0695aa3d7999ed8d59be8c3090734

SHA1
5696bafd8ed1085f0a5233bb2b109d8c5df175eb

SHA256
56c0a9184b5e35888fe9f0836883fd7fe8d07312c37c23c51f8ec4554bbbdca1

SHA512
077e943dc0d7cfbba1f612383f6bbdb8fd6fddabb3e775fbb2445587267750734c43a503d9009cec1b5cd845b9f55ea65510e4b51806bf3c0e52919f2473cece

Download Submit
C:\Windows\SysWOW64\Gfpcpefb.exe

Filesize
109KB

MD5
d787739bc272a31887e6efcd1721f091

SHA1
9499cab27558049d0b64ac68fae11075a283710b

SHA256
66eb8cbee649bea03f5bb28da343cfc112bebdba977d9dc716564cfc4e8c2bb3

SHA512
f58f9987c762bf0654a789508d2cf369ec2a598ebc2136f3ae83b10dc962725c7c7ae2fa7df1282b327a8f94ece56c29750d266fe31ef97d2aeba67958e1bd17

Download Submit
C:\Windows\SysWOW64\Gikkof32.exe

Filesize
109KB

MD5
c406b43796c5b3853a9cab7408da0b41

SHA1
b065b479f4f115a925ee5f69fff9be817bd2db20

SHA256
fa4600c44a47351a66f72422737f0285ab5d205adb06ed86b5af89dfa73e8e7e

SHA512
af2133d9730b0864afdfc7a9e0a01eafac5db14bcbc968e43e2ed7c986efcab6366cb0b8c8f2adc6ac57a538fd0d459ea8694605885519d014515cdc21d5d147

Download Submit
C:\Windows\SysWOW64\Glghhmdn.exe

Filesize
109KB

MD5
09784d67a27f29bee8f16914c2e9c19f

SHA1
af4b0a59b286da44c13bdc49ffaf2c8cfcf1ec6f

SHA256
7b7eb73c6b14bc99a9b7c12f040d8fa8a3d4fa629bfd8d0e431a528c5c7881dd

SHA512
8263b09494aee82faa5c480ac6fab0a8dea533e13cb3836ecabe105658ba5961411b1f107bf015dc5b5deddd1d4b0e05bdededc77185fa3837761ba3eaaee382

Download Submit
C:\Windows\SysWOW64\Gpkliaol.exe

Filesize
109KB

MD5
afb82ce7c23da9eb361bcca4d28bf43b

SHA1
236dd5a3c0039588331e453036320b0e832b196d

SHA256
4dc9ba8c70e5e3d677dd166e9eb636d26f721750f13719fd19f7eec912123cca

SHA512
2c70cee77dccb0dc1d8389206a8aa3bc9a8b2e5c5e5c635a744b43bf77c662f6daf7851e7e3d0ddde896aa54966bc49e4b873b47cafcc84d462cb83b626cea0e

Download Submit
C:\Windows\SysWOW64\Habeni32.exe

Filesize
109KB

MD5
4fd8dc86c065cd3ab22079afe17b65de

SHA1
e94d6a6ac788ca14b14405a39ebd221f2a5a44e7

SHA256
41463fc003057506ff99ff8ec6825730828668c46a0e7d0a9fa3283ae81c25df

SHA512
c6ae594867778241882ebe8f6ebcce1b7b48deb98bf192735bd252802ad4b92be9283bde655c0dea39d733d22d6a9c72ea69bbf0b69eac7013e8ed1302590689

Download Submit
C:\Windows\SysWOW64\Hcdmlk32.exe

Filesize
109KB

MD5
cfef72f36374e7135b3d4513130dde12

SHA1
ae121c3a93d095771c2bfc8ab5736ef0969a335e

SHA256
80ac4df5630c78cf3cc9a6e9bfc7d3327141003b67445d0b022b1fbfb0319a51

SHA512
35b08641e6168a5b5603d1a043b866510a487cd24a9d65deed406e83ff3cf836fd369bd7bc3e4139b77095f1df2f466df988c49893dde00d48a9d56b320201e1

Download Submit
C:\Windows\SysWOW64\Idhgkcln.exe

Filesize
109KB

MD5
1ef9a56c0e395f837bc4d115d38bce3a

SHA1
2bb44aefe3cc1548c58f4d42fb5f9d53578e816a

SHA256
9ffb1cc510af1f2d7f46cd8f9deabf7de28f2f742abbe20d7447ae9e29a80bac

SHA512
22d50f3b105a8891197e59bf4e7efea6cce420a882ef56639cc5e157ee9fe5fc6694cabaf2db7fd92e53a30a06915d83f9a90dec23580f073a4385b343368b5a

Download Submit
C:\Windows\SysWOW64\Ijcecgnl.exe

Filesize
109KB

MD5
21a650dfe6225d3bec34edc0beede40c

SHA1
9474575d5c9a2a1e2d5091b271262cc2462ff01a

SHA256
7f181d6e8ccf24c71dd67c924ab5017a5df7048256ee2daeff6025c35a2760b3

SHA512
b9da794301ff4aa7e9d7a8262562020c12c9ea60b7a3d57eab0c9bce36afa406ec1a8c0791d63893ca10493c8e0687f50504541c17d644da79bcfcef08ce634b

Download Submit
C:\Windows\SysWOW64\Iloimopp.exe

Filesize
109KB

MD5
bbdd8777d1f3d089ba85b669a18eb543

SHA1
822e42d1272b1fe6ceb9da4c64201f8a7cf58c2a

SHA256
945ec03cb46e5ad464d32edef8fa07e03a3d9f65d97521c944f8eba082509ae4

SHA512
125c366fe17e9fde31bc395e5b7f23fe4fab3e5140471e5a0927f71b282bf2b0f96f2ae39d735f48a0773d90fc116a734f54e920bb9808dd5b8886cafa2aa77b

Download Submit
C:\Windows\SysWOW64\Jaljaoii.exe

Filesize
109KB

MD5
7eb54dfced0cf8f1f2ee877bc45c2dc8

SHA1
1152601239096ad56ef4cbd9f836b6abb8199d1a

SHA256
d6dc4a8a5f9b510bf99515078854997b3d51176b5fba2eb447f47072c6de989d

SHA512
bc4cd7b22833dd3dde582572d4d79e62b4d2c38774c6413261ac2ed2a8e892650b492209ececaf034ef806633fce1221bf110be9f06675ab8efc567be1892be2

Download Submit
C:\Windows\SysWOW64\Jjgkjh32.exe

Filesize
109KB

MD5
84fcffa6a2a1ce312add77e960058240

SHA1
4a38fc14f6470b5d53533e209c4fb1484913c27d

SHA256
cbd1ea97509ac653a64f12c1ee9b15e5af26b5df8fe2b18269d43e10c934c51b

SHA512
71a9a51881bcdaa0d3d6bbf3d2a7dae99e6cc756c061e761f86370194a19245c009e9beaf56bf200861c35766e9e01b529a30234d2508de508f5353c2918074d

Download Submit
C:\Windows\SysWOW64\Jknocljn.exe

Filesize
109KB

MD5
19ee00c2f118344fbd72a1695a81143d

SHA1
900a02716e05ceaa8cb1c7ab77f147b535d416d0

SHA256
b009f686d02175b48354126f0660ea74aa66eb181ce056c60bb507b68bc967fb

SHA512
c127169b2c3223b2ebf1fabf50c24f9e95e59b8e47d8a6c993459f97da618dbe00bd3f42ed27b5069b2e90eb4cec3e62c9e31851d9134242ee5103135c115b64

Download Submit
C:\Windows\SysWOW64\Kidbnd32.exe

Filesize
109KB

MD5
f841895d550de274dde3e0ec48a50b12

SHA1
0c56f0a4fb5e781457133a52b401ed784b0c91d8

SHA256
9b8af2b712fb362820c9557e5f16d55d6614d251d8935b31544e6f35b287834e

SHA512
d692e837ad76df904f741130e46adc114860b6aeb77b584131d9aec656392f441396445351439c0011069c4dfb1aa9479889dceae5fe96e9724ae5b23cb5a9f3

Download Submit
C:\Windows\SysWOW64\Kjhccf32.exe

Filesize
109KB

MD5
8244a9805eed170f68e86bd95a92cbe7

SHA1
61fa020f4348ca870a414d490f16b8d1cccd7908

SHA256
0c6cd412fa922f6cc56ffc7f5a4971c38fcfbbf3b4cb7293381df809852be05c

SHA512
72c7e1167a4d78845df2a3b402ebffb27e59d3a82b46b68610aec44f229e5f6a0d1afb539e096ee04a8311904e0df7710ded05129a6070f9b570002b827250ac

Download Submit
C:\Windows\SysWOW64\Kkgbjkac.exe

Filesize
109KB

MD5
dfd69f40c5c75b69bc7f9523b394277e

SHA1
b4ec4700813fa53e7b521b8a5b8f75386f3727e2

SHA256
3ed2b7d1f64a4eea50c291d648393a7bbfa7feaf5780d49f7877b4e2e56962b9

SHA512
ff1b3775b8916dfc7e3b630f83ac5b26205627b3e5017e18bd8902c4bea41a0d5abadd263ab980d01fffcb651956a9770459d0d7f4bd5fd7db3ea5822ef5797c

Download Submit
C:\Windows\SysWOW64\Kklkej32.exe

Filesize
109KB

MD5
a2a2b054b4a654b74e0c9dce9c6ce9a0

SHA1
ddfb62d18f1bf71e9f082a211ad259d8572da934

SHA256
8c363988a725291a1744e750fb9341649fb5b88e3d5eeb8c57c1b09481c89a71

SHA512
9ef64de8ecc7493edfd1e3807a8669e1f54e9e814b6ddb27a3c1b38f11c7b86d02c4ab70d7a9e58450d3fca4713f48825f4e66db8a4c8c7ec2091b82c657b908

Download Submit
C:\Windows\SysWOW64\Kqpoja32.exe

Filesize
109KB

MD5
5f7ced0dc937d56e0e430cbfab1e400e

SHA1
eb3114f32fa2e5d6956629089965c6a0bf7b59d5

SHA256
94a91bbc97af13f3fe4c1685125d800fa44277118c18ab2474314f204280d184

SHA512
bb5c3c8e5ec482869bb77b4ff2048a0e2ef3610e4911f3e3209e3e844a5e7190e676e37eefced636ddb260a55f01304ee1232ddf30e9eab191d784f3389de73b

Download Submit
C:\Windows\SysWOW64\Lamjbc32.exe

Filesize
109KB

MD5
d6910fc49199217f685ba35260855237

SHA1
473063c022635d6205daaca133f50887b02f74e0

SHA256
3f981bd94f8dc6cdc44163ae54b89753b7fdba4646a6253fcad683826ed90058

SHA512
05fc109d603dbb16557a5e49ecf62b2b602d21affbe5f7777b9b4299d71782832a74d52d87fb6c34caa07ff167e50b00186a746d27c68dc5623ccc7f037f60b9

Download Submit
C:\Windows\SysWOW64\Lhkdkj32.exe

Filesize
109KB

MD5
320c439e7465370003ce674a1f1d3cb0

SHA1
be13a28ceb8c9389434a19995b146f897fb74c29

SHA256
16fb32003b5aa4d5d7d9f6266cfb19f65237c9af382a90115205d239f3cccdc8

SHA512
cc3621692006e373e2c26e8bd944f9867c3c2d88056116f0c974cd7655741bff0c5cadc32c6d034d4cfee9aa52ec2d16df881b821f2619da964ff2eb8e633743

Download Submit
C:\Windows\SysWOW64\Lqfpoope.exe

Filesize
109KB

MD5
2147a587d3fdc9e79587f7900470b5b2

SHA1
e1e0b5a7b061e340120c889b4c161a377ee46ee9

SHA256
e3d3f90cebd8e8a4e23a673df6323f1daa765a168abb016bca6ed999fce35519

SHA512
c317a8c2e67233a6a29084b54e631877efc5bbb8e871ec98c50b44d386b509a9c0f28ab755cdee8b7e3ed81983664b731d4b3b1fee7161e6c2b147a3648ca540

Download Submit
C:\Windows\SysWOW64\Mglhgg32.exe

Filesize
109KB

MD5
bad336c15c9b0b9874b0b998e2d9360e

SHA1
36e4c2c76740cb14d0904969db519f2bb4ea1790

SHA256
08b923998aabe1502ea48f76cafef2e7b2520263b0aa51fbfa8a2d5a592c9199

SHA512
791d00a508c2e8b1073354df71681a1891eeeb50655735adb6ae00c039bbbcc548f6a7106e70fcb2bb0f1a37e37f2ad97d7d44b86117ed6b2fd7817897143aa6

Download Submit
C:\Windows\SysWOW64\Mjcghm32.exe

Filesize
64KB

MD5
f3436ebd7f4d91792363baca3adf68b5

SHA1
2ff3333b37caf5b34cdf5976e6860d74d9fc5285

SHA256
02313f084d3337ef5c9dae1a9fe0cff1d362fed71b38b87250a0c066a27870c8

SHA512
db1a8bc2b28401f9f3d4afc3c0c418efb4bc72f01dee40cc5661a763f147f299ca183c3e9bea0877bed5e20f52c9c469b7cad873c17ee0c38d1295816f8a5551

Download Submit
C:\Windows\SysWOW64\Moefna32.exe

Filesize
109KB

MD5
8eae5ab0046e5c48374deec6ea3fb8be

SHA1
fa099538911953bf9600ceb51bee92c88d31e023

SHA256
20f03fad409e9384800125340586fe8c86be0fded03c6d9232a3902468cdf30a

SHA512
15eebbc5f3f89a6a0c97c78d11a524a5b48aa579689bfc54797670e3778fcf24a7e6347a9914738f50975a87af2bbb226af5e348430727cb32cf4f0e99dce119

Download Submit
C:\Windows\SysWOW64\Nblfee32.exe

Filesize
109KB

MD5
b8b015a73469b1c8d5ec38371bb2368f

SHA1
af1dc938a6ee563210399fd00988b910de80af41

SHA256
a678939417d7ed568073b33c8ae3b088d523a1b752d14e9ddd156b142170055a

SHA512
91c079329270d4d189e440a35d37c5612a8bd7c626a84a0b2bc4091b684994d7216b527fb84d8c558a4b8f8dca8399517ecd25715bacde873ca7e6469289d814

Download Submit
C:\Windows\SysWOW64\Ogmaneoa.exe

Filesize
109KB

MD5
cd871f86bf4abcc3d45ecd5fb195ceac

SHA1
63091300056b2746dd10e7b6981f77f005cc9bb2

SHA256
cf71cd52902982338b1a473dc2a1c680a473fc8b222e4f68c2774d433c6fa930

SHA512
57d20f0bbb6709b5314cddebd48a733c91ad8c47bd4c401bb1025ee10a5e3c1c5d0c07c010a58788199b26c93db83e731272c458d06fa4bb76009daa71808467

Download Submit
C:\Windows\SysWOW64\Ohmjcpmd.dll

Filesize
7KB

MD5
0b1135ecf06111f377a50baef4ba5d9f

SHA1
90d6f827dc757d644b87502b539f8f70cf5bf03b

SHA256
84e0473e7936fe8119338398e998d1b91c26524141274126800f887b273d110d

SHA512
23da08019789a741a4207250d7c37db814f5ea16521026bf0ab2cf4b13a1e99a589782e2cbcab6e698f905a033369c5893d8a26ca724cd5724ee8f10f84ff7a6

Download Submit
C:\Windows\SysWOW64\Okiljj32.exe

Filesize
109KB

MD5
872991c8ba49e5812669fcf056670c47

SHA1
903f01f7b5b0bf92c223c496385ab5258a829de4

SHA256
7ad0f9c639f5c01ef10f20c4d2de131e5be03c1f183665f68bd0d29c09d9e3de

SHA512
cae889f1bc9ae6b070b09ef50697df875a2dd8c3092928c146ec33b7cd6f491c772a73ddd381a07a14221afd70bc5516e469653722cbff855efcaa415a3c8ab3

Download Submit
C:\Windows\SysWOW64\Onnmmipj.exe

Filesize
109KB

MD5
b2ceea86e9d2fd33baf3258d7c6b1feb

SHA1
b509fa3cad131148121a8962ec590fea40f71b50

SHA256
e0fa58c5607abb7f1b27b56ac7475c95a08d68a94fd6162aff8b7a5975b15104

SHA512
4a665d51d5d3c73b4750df3b37a5e702191dd8c53f390af3a293a10fda1d21666cc2a2b74f02b800d739fd4f09aa78c008137bc8c71e03e67ed484199c981612

Download Submit
C:\Windows\SysWOW64\Qecgcfmf.exe

Filesize
109KB

MD5
2bc8849cd872ee54ccb9930af866b3ad

SHA1
4f183e31ecec8fe1d281dc6d0a4ed73fd37aec41

SHA256
3bea2e2247581767fa9b8d276ddbe109488edc2ac72bca742fb1641858e2bec1

SHA512
a93c809fa15225f6fd922923853bee282f7df49ac442ad2f1c869cc2c48d3e95b2217bb5b7f539f67dcd52776c48cba3e72ed4fcc47a5fc6c4a02d23fa50f4aa

Download Submit
memory/392-7-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/392-79-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/456-81-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/456-168-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1000-15-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1000-96-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1008-305-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1008-235-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1084-194-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1084-106-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1216-221-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1216-134-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1312-279-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1360-103-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1376-218-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1388-191-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1464-315-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1464-249-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1596-294-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1596-223-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2072-64-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2072-151-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2308-306-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2480-116-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2480-204-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2500-247-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2500-161-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2520-24-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2520-105-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2536-170-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2536-257-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2592-265-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2852-212-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2852-125-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2932-123-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2932-39-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2980-231-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2980-143-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3260-308-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3260-240-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3520-258-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3520-322-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3632-299-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3696-209-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3736-114-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3736-31-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4080-309-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4160-196-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4160-278-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4252-183-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4468-177-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4468-88-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4480-282-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4560-156-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4580-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4724-132-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4724-47-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4728-159-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4728-71-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4768-288-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4804-55-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4804-141-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4956-266-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5012-319-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads