3442a5a5ac219f874c3e29cc8f4711b4894feee607efd006222b37c3a6738838

Analysis

max time kernel
195s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3442a5a5ac219f874c3e29cc8f4711b4894feee607efd006222b37c3a6738838.exe
Size

276KB
MD5

de0f7608b27ca9a86ec361c83d2af685
SHA1

f63013c90184cff876ed592a16f668419422c852
SHA256

3442a5a5ac219f874c3e29cc8f4711b4894feee607efd006222b37c3a6738838
SHA512

6423c8c592f05b5eae597b97293291e4c15b40d20ac69ca31f2fcbf50bd014cf9d772df92fe28ce25ab483a684f680c13c9a3eafe47d5e73d8fc6a4b6c140f88
SSDEEP

6144:cEAnXKpsV+vQf+KadWZHEFJ7aWN1rtMsQBOSGaF+:cdksV+vem2HEGWN1RMs1S7

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjcmpepm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahkkhnpg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccbaoc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Meobeb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjielh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mefkdm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdbiphhi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgpobmca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ccbaoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afdkfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkilbni.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfiedfmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gcbgom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcbeqaia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bqkigp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcomonkq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Addhbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akjnhehc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Noihojgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajjjjghg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apkhfo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkiamp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcbeqaia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pndhhnda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeeomegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odcfdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oamgcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qffoejkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcomonkq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aefcif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckhelb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oeffnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ahkkhnpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Meobeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cgbfka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npfkqpjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjcmognb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkegbpca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgllad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbifol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkboeobh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opopdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnjbbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apndloif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijmajc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogjpld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ogjpld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpklql32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhfoocaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phiekaql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Adnilfnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ankgpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nhfoocaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bekmei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ahfmka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbmbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfidgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Opopdd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaofedkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agcdnjcl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbeggmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oamgcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Abflfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aldeap32.exe

Executes dropped EXE 64 IoCs

pid	Process
3612	Khdoqefq.exe
756	Kkegbpca.exe
4652	Lkiamp32.exe
2992	Bcbeqaia.exe
3676	Dpoiho32.exe
3568	Gnanioad.exe
3384	Kfidgk32.exe
3388	Oeffnl32.exe
3080	Oggbfdog.exe
3540	Oamgcm32.exe
4676	Ogjpld32.exe
2204	Pndhhnda.exe
2724	Pgllad32.exe
3272	Pdbiphhi.exe
5108	Pnknim32.exe
4976	Pbifol32.exe
2468	Pgeogb32.exe
3608	Qffoejkg.exe
2352	Adnilfnl.exe
488	Akhaipei.exe
4580	Anijjkbj.exe
4112	Ankgpk32.exe
4300	Aeeomegd.exe
3852	Afdkfh32.exe
3292	Bpaikm32.exe
4872	Bgmnooom.exe
4884	Bfnnmg32.exe
1124	Ciogobcm.exe
1620	Cpklql32.exe
4380	Cfedmfqd.exe
2036	Mhmmieil.exe
2920	Nhafcd32.exe
4972	Nkboeobh.exe
1652	Nhfoocaa.exe
3116	Niihlkdm.exe
492	Odcfdc32.exe
1420	Ohaokbfd.exe
1064	Onngci32.exe
4240	Opmcod32.exe
2108	Opopdd32.exe
4148	Pkedbmab.exe
2344	Phiekaql.exe
4536	Pkinmlnm.exe
4684	Pgpobmca.exe
1212	Pddokabk.exe
2236	Aaofedkl.exe
3252	Ajjjjghg.exe
5052	Ababkdij.exe
3444	Ahkkhnpg.exe
3588	Ajmgof32.exe
1580	Aqfolqna.exe
2960	Adbkmo32.exe
4900	Ajodef32.exe
1672	Abflfc32.exe
1560	Addhbo32.exe
3772	Agcdnjcl.exe
1684	Anmmkd32.exe
1872	Bqkigp32.exe
3200	Bjcmpepm.exe
4392	Bdiamnpc.exe
5020	Bkcjjhgp.exe
3452	Bqpbboeg.exe
2252	Cnkilbni.exe
960	Bmhibi32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dfkclp32.dll	Afdkfh32.exe
File created	C:\Windows\SysWOW64\Gcmodc32.dll	Bekmei32.exe
File opened for modification	C:\Windows\SysWOW64\Cfedmfqd.exe	Cpklql32.exe
File opened for modification	C:\Windows\SysWOW64\Apndloif.exe	Ahfmka32.exe
File created	C:\Windows\SysWOW64\Bfgcag32.dll	Pkedbmab.exe
File opened for modification	C:\Windows\SysWOW64\Ajodef32.exe	Adbkmo32.exe
File created	C:\Windows\SysWOW64\Gcbgom32.exe	Fnllqh32.exe
File opened for modification	C:\Windows\SysWOW64\Nhfoocaa.exe	Nkboeobh.exe
File created	C:\Windows\SysWOW64\Pagfomja.dll	Lngkjhmi.exe
File created	C:\Windows\SysWOW64\Lofllk32.dll	Adnilfnl.exe
File created	C:\Windows\SysWOW64\Bqpbboeg.exe	Bkcjjhgp.exe
File created	C:\Windows\SysWOW64\Ihqimfil.dll	Mgokflpj.exe
File created	C:\Windows\SysWOW64\Dgklqbim.dll	Jajdai32.exe
File created	C:\Windows\SysWOW64\Ngefkh32.dll	Noihojgo.exe
File opened for modification	C:\Windows\SysWOW64\Aogkhjii.exe	Ahnclp32.exe
File created	C:\Windows\SysWOW64\Hjegpf32.dll	Pbifol32.exe
File opened for modification	C:\Windows\SysWOW64\Opmcod32.exe	Onngci32.exe
File created	C:\Windows\SysWOW64\Npjlfcgj.dll	Mbpfig32.exe
File created	C:\Windows\SysWOW64\Bcomonkq.exe	Bnbeggmi.exe
File created	C:\Windows\SysWOW64\Gpqjaanf.exe	Djhifnho.exe
File created	C:\Windows\SysWOW64\Pohngfml.exe	Noihojgo.exe
File created	C:\Windows\SysWOW64\Cnglpdin.dll	Pddokabk.exe
File opened for modification	C:\Windows\SysWOW64\Mihbpalh.exe	Mfiedfmd.exe
File opened for modification	C:\Windows\SysWOW64\Ifihnoda.exe	Hgmelc32.exe
File created	C:\Windows\SysWOW64\Bgmnooom.exe	Bpaikm32.exe
File opened for modification	C:\Windows\SysWOW64\Opopdd32.exe	Opmcod32.exe
File opened for modification	C:\Windows\SysWOW64\Bmhibi32.exe	Cnkilbni.exe
File created	C:\Windows\SysWOW64\Qfkqcb32.exe	Lngkjhmi.exe
File created	C:\Windows\SysWOW64\Leahbp32.dll	Ogjpld32.exe
File created	C:\Windows\SysWOW64\Mbnjicfj.dll	Abflfc32.exe
File created	C:\Windows\SysWOW64\Kmadhp32.dll	Bjcmpepm.exe
File created	C:\Windows\SysWOW64\Aldeap32.exe	Aified32.exe
File opened for modification	C:\Windows\SysWOW64\Pnknim32.exe	Pdbiphhi.exe
File created	C:\Windows\SysWOW64\Dabeamma.dll	Ccigpbga.exe
File opened for modification	C:\Windows\SysWOW64\Ablahjhj.exe	Apndloif.exe
File opened for modification	C:\Windows\SysWOW64\Ahnclp32.exe	Apbngn32.exe
File opened for modification	C:\Windows\SysWOW64\Fnllqh32.exe	Cfjdma32.exe
File created	C:\Windows\SysWOW64\Akjnhehc.exe	Qfdbipbf.exe
File created	C:\Windows\SysWOW64\Kgiamm32.dll	Niihlkdm.exe
File created	C:\Windows\SysWOW64\Pljpbhin.dll	Opopdd32.exe
File created	C:\Windows\SysWOW64\Ajmgof32.exe	Ahkkhnpg.exe
File opened for modification	C:\Windows\SysWOW64\Ahfmka32.exe	Aehpof32.exe
File created	C:\Windows\SysWOW64\Bjnjjg32.dll	Ckhelb32.exe
File created	C:\Windows\SysWOW64\Dfdofh32.dll	Pdbiphhi.exe
File created	C:\Windows\SysWOW64\Kppdpo32.dll	Qffoejkg.exe
File created	C:\Windows\SysWOW64\Jlljmmja.dll	Moajmk32.exe
File opened for modification	C:\Windows\SysWOW64\Gpqjaanf.exe	Djhifnho.exe
File opened for modification	C:\Windows\SysWOW64\Ckhelb32.exe	Bddjijia.exe
File created	C:\Windows\SysWOW64\Hgmelc32.exe	Eimlpc32.exe
File created	C:\Windows\SysWOW64\Polnbakm.dll	Ahkkhnpg.exe
File created	C:\Windows\SysWOW64\Ahfmka32.exe	Aehpof32.exe
File opened for modification	C:\Windows\SysWOW64\Mgokflpj.exe	Aogkhjii.exe
File created	C:\Windows\SysWOW64\Lbehhfik.dll	Gnanioad.exe
File opened for modification	C:\Windows\SysWOW64\Oggbfdog.exe	Oeffnl32.exe
File created	C:\Windows\SysWOW64\Digcnb32.dll	Mmfjfp32.exe
File created	C:\Windows\SysWOW64\Nhppbq32.exe	Mkbmbn32.exe
File opened for modification	C:\Windows\SysWOW64\Pdbiphhi.exe	Pgllad32.exe
File created	C:\Windows\SysWOW64\Nhafcd32.exe	Mhmmieil.exe
File created	C:\Windows\SysWOW64\Ocligb32.dll	Apkhfo32.exe
File created	C:\Windows\SysWOW64\Hodphf32.dll	Japmmlip.exe
File opened for modification	C:\Windows\SysWOW64\Aihfjd32.exe	Aldeap32.exe
File created	C:\Windows\SysWOW64\Ohdgoi32.dll	Aldeap32.exe
File created	C:\Windows\SysWOW64\Iomood32.exe	Fngcfikb.exe
File created	C:\Windows\SysWOW64\Kkegbpca.exe	Khdoqefq.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckboalem.dll"	Ofeggo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leahbp32.dll"	Ogjpld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Opopdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajjjjghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnkilbni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmhibi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjnjjg32.dll"	Ckhelb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fngcfikb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qpioeell.dll"	Pgeogb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Opmcod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pkedbmab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pkinmlnm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bdiamnpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kppdpo32.dll"	Qffoejkg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mfiedfmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ofeggo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eoqalg32.dll"	Ijmajc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bkcjjhgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Meobeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjmgafni.dll"	Cjcmognb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nhppbq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hgmelc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Phiekaql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdiebk32.dll"	Dpoiho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edijfd32.dll"	Cgmfel32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ldpijknm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Endhhbcc.dll"	Akdoam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aehpof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ablahjhj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jajdai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkgeph32.dll"	Nkboeobh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mmcnap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Labdefjj.dll"	Npfkqpjk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	3442a5a5ac219f874c3e29cc8f4711b4894feee607efd006222b37c3a6738838.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dpoiho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pemqkk32.dll"	Akhaipei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ababkdij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcdnlc32.dll"	Gcbgom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kfidgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjegpf32.dll"	Pbifol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aehpof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pgpobmca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bqpbboeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oamgcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aeeomegd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odcfdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akfhnjnb.dll"	Cnjbbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ccigpbga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pgllad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdpmkhmc.dll"	Ddmaia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kglmbd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjcmpepm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gpqjaanf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Adbkmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Agcdnjcl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnknim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfedmfqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igalei32.dll"	Anmmkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Meobeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgglmb32.dll"	Aehpof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ogjpld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ahfmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgmjad32.dll"	Phiekaql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhgkmjog.dll"	Adbkmo32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 3612	4272	3442a5a5ac219f874c3e29cc8f4711b4894feee607efd006222b37c3a6738838.exe	84
PID 4272 wrote to memory of 3612	4272	3442a5a5ac219f874c3e29cc8f4711b4894feee607efd006222b37c3a6738838.exe	84
PID 4272 wrote to memory of 3612	4272	3442a5a5ac219f874c3e29cc8f4711b4894feee607efd006222b37c3a6738838.exe	84
PID 3612 wrote to memory of 756	3612	Khdoqefq.exe	85
PID 3612 wrote to memory of 756	3612	Khdoqefq.exe	85
PID 3612 wrote to memory of 756	3612	Khdoqefq.exe	85
PID 756 wrote to memory of 4652	756	Kkegbpca.exe	86
PID 756 wrote to memory of 4652	756	Kkegbpca.exe	86
PID 756 wrote to memory of 4652	756	Kkegbpca.exe	86
PID 4652 wrote to memory of 2992	4652	Lkiamp32.exe	87
PID 4652 wrote to memory of 2992	4652	Lkiamp32.exe	87
PID 4652 wrote to memory of 2992	4652	Lkiamp32.exe	87
PID 2992 wrote to memory of 3676	2992	Bcbeqaia.exe	88
PID 2992 wrote to memory of 3676	2992	Bcbeqaia.exe	88
PID 2992 wrote to memory of 3676	2992	Bcbeqaia.exe	88
PID 3676 wrote to memory of 3568	3676	Dpoiho32.exe	89
PID 3676 wrote to memory of 3568	3676	Dpoiho32.exe	89
PID 3676 wrote to memory of 3568	3676	Dpoiho32.exe	89
PID 3568 wrote to memory of 3384	3568	Gnanioad.exe	90
PID 3568 wrote to memory of 3384	3568	Gnanioad.exe	90
PID 3568 wrote to memory of 3384	3568	Gnanioad.exe	90
PID 3384 wrote to memory of 3388	3384	Kfidgk32.exe	91
PID 3384 wrote to memory of 3388	3384	Kfidgk32.exe	91
PID 3384 wrote to memory of 3388	3384	Kfidgk32.exe	91
PID 3388 wrote to memory of 3080	3388	Oeffnl32.exe	92
PID 3388 wrote to memory of 3080	3388	Oeffnl32.exe	92
PID 3388 wrote to memory of 3080	3388	Oeffnl32.exe	92
PID 3080 wrote to memory of 3540	3080	Oggbfdog.exe	93
PID 3080 wrote to memory of 3540	3080	Oggbfdog.exe	93
PID 3080 wrote to memory of 3540	3080	Oggbfdog.exe	93
PID 3540 wrote to memory of 4676	3540	Oamgcm32.exe	94
PID 3540 wrote to memory of 4676	3540	Oamgcm32.exe	94
PID 3540 wrote to memory of 4676	3540	Oamgcm32.exe	94
PID 4676 wrote to memory of 2204	4676	Ogjpld32.exe	95
PID 4676 wrote to memory of 2204	4676	Ogjpld32.exe	95
PID 4676 wrote to memory of 2204	4676	Ogjpld32.exe	95
PID 2204 wrote to memory of 2724	2204	Pndhhnda.exe	96
PID 2204 wrote to memory of 2724	2204	Pndhhnda.exe	96
PID 2204 wrote to memory of 2724	2204	Pndhhnda.exe	96
PID 2724 wrote to memory of 3272	2724	Pgllad32.exe	97
PID 2724 wrote to memory of 3272	2724	Pgllad32.exe	97
PID 2724 wrote to memory of 3272	2724	Pgllad32.exe	97
PID 3272 wrote to memory of 5108	3272	Pdbiphhi.exe	98
PID 3272 wrote to memory of 5108	3272	Pdbiphhi.exe	98
PID 3272 wrote to memory of 5108	3272	Pdbiphhi.exe	98
PID 5108 wrote to memory of 4976	5108	Pnknim32.exe	99
PID 5108 wrote to memory of 4976	5108	Pnknim32.exe	99
PID 5108 wrote to memory of 4976	5108	Pnknim32.exe	99
PID 4976 wrote to memory of 2468	4976	Pbifol32.exe	100
PID 4976 wrote to memory of 2468	4976	Pbifol32.exe	100
PID 4976 wrote to memory of 2468	4976	Pbifol32.exe	100
PID 2468 wrote to memory of 3608	2468	Pgeogb32.exe	101
PID 2468 wrote to memory of 3608	2468	Pgeogb32.exe	101
PID 2468 wrote to memory of 3608	2468	Pgeogb32.exe	101
PID 3608 wrote to memory of 2352	3608	Qffoejkg.exe	102
PID 3608 wrote to memory of 2352	3608	Qffoejkg.exe	102
PID 3608 wrote to memory of 2352	3608	Qffoejkg.exe	102
PID 2352 wrote to memory of 488	2352	Adnilfnl.exe	103
PID 2352 wrote to memory of 488	2352	Adnilfnl.exe	103
PID 2352 wrote to memory of 488	2352	Adnilfnl.exe	103
PID 488 wrote to memory of 4580	488	Akhaipei.exe	104
PID 488 wrote to memory of 4580	488	Akhaipei.exe	104
PID 488 wrote to memory of 4580	488	Akhaipei.exe	104
PID 4580 wrote to memory of 4112	4580	Anijjkbj.exe	105

C:\Users\Admin\AppData\Local\Temp\3442a5a5ac219f874c3e29cc8f4711b4894feee607efd006222b37c3a6738838.exe
"C:\Users\Admin\AppData\Local\Temp\3442a5a5ac219f874c3e29cc8f4711b4894feee607efd006222b37c3a6738838.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\Khdoqefq.exe
  C:\Windows\system32\Khdoqefq.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\SysWOW64\Kkegbpca.exe
    C:\Windows\system32\Kkegbpca.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\Windows\SysWOW64\Lkiamp32.exe
      C:\Windows\system32\Lkiamp32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4652
    - - C:\Windows\SysWOW64\Bcbeqaia.exe
        
        C:\Windows\system32\Bcbeqaia.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2992
      - C:\Windows\SysWOW64\Dpoiho32.exe
        
        C:\Windows\system32\Dpoiho32.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Windows\SysWOW64\Gnanioad.exe
        
        C:\Windows\system32\Gnanioad.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Windows\SysWOW64\Kfidgk32.exe
        
        C:\Windows\system32\Kfidgk32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\SysWOW64\Oeffnl32.exe
        
        C:\Windows\system32\Oeffnl32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Windows\SysWOW64\Oggbfdog.exe
        
        C:\Windows\system32\Oggbfdog.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\SysWOW64\Oamgcm32.exe
        
        C:\Windows\system32\Oamgcm32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3540
        
        C:\Windows\SysWOW64\Ogjpld32.exe
        
        C:\Windows\system32\Ogjpld32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\SysWOW64\Pndhhnda.exe
        
        C:\Windows\system32\Pndhhnda.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\SysWOW64\Pgllad32.exe
        
        C:\Windows\system32\Pgllad32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\SysWOW64\Pdbiphhi.exe
        
        C:\Windows\system32\Pdbiphhi.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3272
        
        C:\Windows\SysWOW64\Pnknim32.exe
        
        C:\Windows\system32\Pnknim32.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\Pbifol32.exe
        
        C:\Windows\system32\Pbifol32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Windows\SysWOW64\Pgeogb32.exe
        
        C:\Windows\system32\Pgeogb32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Windows\SysWOW64\Qffoejkg.exe
        
        C:\Windows\system32\Qffoejkg.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3608
        
        C:\Windows\SysWOW64\Adnilfnl.exe
        
        C:\Windows\system32\Adnilfnl.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Windows\SysWOW64\Akhaipei.exe
        
        C:\Windows\system32\Akhaipei.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:488
        
        C:\Windows\SysWOW64\Anijjkbj.exe
        
        C:\Windows\system32\Anijjkbj.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Ankgpk32.exe
        
        C:\Windows\system32\Ankgpk32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4112
        
        C:\Windows\SysWOW64\Aeeomegd.exe
        
        C:\Windows\system32\Aeeomegd.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4300
        
        C:\Windows\SysWOW64\Afdkfh32.exe
        
        C:\Windows\system32\Afdkfh32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3852
        
        C:\Windows\SysWOW64\Bpaikm32.exe
        
        C:\Windows\system32\Bpaikm32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3292
        
        C:\Windows\SysWOW64\Bgmnooom.exe
        
        C:\Windows\system32\Bgmnooom.exe
        27⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SysWOW64\Bfnnmg32.exe
        
        C:\Windows\system32\Bfnnmg32.exe
        28⤵
        Executes dropped EXE
        
        PID:4884
        
        C:\Windows\SysWOW64\Ciogobcm.exe
        
        C:\Windows\system32\Ciogobcm.exe
        29⤵
        Executes dropped EXE
        
        PID:1124
        
        C:\Windows\SysWOW64\Cpklql32.exe
        
        C:\Windows\system32\Cpklql32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1620
        
        C:\Windows\SysWOW64\Cfedmfqd.exe
        
        C:\Windows\system32\Cfedmfqd.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4380
        
        C:\Windows\SysWOW64\Mhmmieil.exe
        
        C:\Windows\system32\Mhmmieil.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2036
        
        C:\Windows\SysWOW64\Nhafcd32.exe
        
        C:\Windows\system32\Nhafcd32.exe
        33⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\Nkboeobh.exe
        
        C:\Windows\system32\Nkboeobh.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4972
        
        C:\Windows\SysWOW64\Nhfoocaa.exe
        
        C:\Windows\system32\Nhfoocaa.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1652
        
        C:\Windows\SysWOW64\Niihlkdm.exe
        
        C:\Windows\system32\Niihlkdm.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3116
        
        C:\Windows\SysWOW64\Odcfdc32.exe
        
        C:\Windows\system32\Odcfdc32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:492
        
        C:\Windows\SysWOW64\Ohaokbfd.exe
        
        C:\Windows\system32\Ohaokbfd.exe
        38⤵
        Executes dropped EXE
        
        PID:1420
        
        C:\Windows\SysWOW64\Onngci32.exe
        
        C:\Windows\system32\Onngci32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1064
        
        C:\Windows\SysWOW64\Opmcod32.exe
        
        C:\Windows\system32\Opmcod32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4240
        
        C:\Windows\SysWOW64\Opopdd32.exe
        
        C:\Windows\system32\Opopdd32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2108
        
        C:\Windows\SysWOW64\Pkedbmab.exe
        
        C:\Windows\system32\Pkedbmab.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4148
        
        C:\Windows\SysWOW64\Phiekaql.exe
        
        C:\Windows\system32\Phiekaql.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2344
        
        C:\Windows\SysWOW64\Pkinmlnm.exe
        
        C:\Windows\system32\Pkinmlnm.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4536
        
        C:\Windows\SysWOW64\Pgpobmca.exe
        
        C:\Windows\system32\Pgpobmca.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4684
        
        C:\Windows\SysWOW64\Pddokabk.exe
        
        C:\Windows\system32\Pddokabk.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1212
        
        C:\Windows\SysWOW64\Aaofedkl.exe
        
        C:\Windows\system32\Aaofedkl.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2236
        
        C:\Windows\SysWOW64\Ajjjjghg.exe
        
        C:\Windows\system32\Ajjjjghg.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3252
        
        C:\Windows\SysWOW64\Ababkdij.exe
        
        C:\Windows\system32\Ababkdij.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5052
        
        C:\Windows\SysWOW64\Ahkkhnpg.exe
        
        C:\Windows\system32\Ahkkhnpg.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3444
        
        C:\Windows\SysWOW64\Ajmgof32.exe
        
        C:\Windows\system32\Ajmgof32.exe
        51⤵
        Executes dropped EXE
        
        PID:3588
        
        C:\Windows\SysWOW64\Aqfolqna.exe
        
        C:\Windows\system32\Aqfolqna.exe
        52⤵
        Executes dropped EXE
        
        PID:1580
        
        C:\Windows\SysWOW64\Adbkmo32.exe
        
        C:\Windows\system32\Adbkmo32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2960
        
        C:\Windows\SysWOW64\Ajodef32.exe
        
        C:\Windows\system32\Ajodef32.exe
        54⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Windows\SysWOW64\Abflfc32.exe
        
        C:\Windows\system32\Abflfc32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1672
        
        C:\Windows\SysWOW64\Addhbo32.exe
        
        C:\Windows\system32\Addhbo32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1560
        
        C:\Windows\SysWOW64\Agcdnjcl.exe
        
        C:\Windows\system32\Agcdnjcl.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3772
        
        C:\Windows\SysWOW64\Anmmkd32.exe
        
        C:\Windows\system32\Anmmkd32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1684
        
        C:\Windows\SysWOW64\Bqkigp32.exe
        
        C:\Windows\system32\Bqkigp32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1872
        
        C:\Windows\SysWOW64\Bjcmpepm.exe
        
        C:\Windows\system32\Bjcmpepm.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3200
        
        C:\Windows\SysWOW64\Bdiamnpc.exe
        
        C:\Windows\system32\Bdiamnpc.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4392
        
        C:\Windows\SysWOW64\Bkcjjhgp.exe
        
        C:\Windows\system32\Bkcjjhgp.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5020
        
        C:\Windows\SysWOW64\Bqpbboeg.exe
        
        C:\Windows\system32\Bqpbboeg.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3452
        
        C:\Windows\SysWOW64\Cnkilbni.exe
        
        C:\Windows\system32\Cnkilbni.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2252
        
        C:\Windows\SysWOW64\Bmhibi32.exe
        
        C:\Windows\system32\Bmhibi32.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:960
        
        C:\Windows\SysWOW64\Bdpqcg32.exe
        
        C:\Windows\system32\Bdpqcg32.exe
        66⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\Ccbaoc32.exe
        
        C:\Windows\system32\Ccbaoc32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3996
        
        C:\Windows\SysWOW64\Cnjbbl32.exe
        
        C:\Windows\system32\Cnjbbl32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4664
        
        C:\Windows\SysWOW64\Cgbfka32.exe
        
        C:\Windows\system32\Cgbfka32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2908
        
        C:\Windows\SysWOW64\Ccigpbga.exe
        
        C:\Windows\system32\Ccigpbga.exe
        70⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1564
        
        C:\Windows\SysWOW64\Cnokmkfh.exe
        
        C:\Windows\system32\Cnokmkfh.exe
        71⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Mfiedfmd.exe
        
        C:\Windows\system32\Mfiedfmd.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2580
        
        C:\Windows\SysWOW64\Mihbpalh.exe
        
        C:\Windows\system32\Mihbpalh.exe
        73⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\Mmcnap32.exe
        
        C:\Windows\system32\Mmcnap32.exe
        74⤵
        Modifies registry class
        
        PID:4776
        
        C:\Windows\SysWOW64\Moajmk32.exe
        
        C:\Windows\system32\Moajmk32.exe
        75⤵
        Drops file in System32 directory
        
        PID:4280
        
        C:\Windows\SysWOW64\Mbpfig32.exe
        
        C:\Windows\system32\Mbpfig32.exe
        76⤵
        Drops file in System32 directory
        
        PID:3612
        
        C:\Windows\SysWOW64\Meobeb32.exe
        
        C:\Windows\system32\Meobeb32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:440
        
        C:\Windows\SysWOW64\Mmfjfp32.exe
        
        C:\Windows\system32\Mmfjfp32.exe
        78⤵
        Drops file in System32 directory
        
        PID:756
        
        C:\Windows\SysWOW64\Bekmei32.exe
        
        C:\Windows\system32\Bekmei32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1148
        
        C:\Windows\SysWOW64\Bnbeggmi.exe
        
        C:\Windows\system32\Bnbeggmi.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1268
        
        C:\Windows\SysWOW64\Bcomonkq.exe
        
        C:\Windows\system32\Bcomonkq.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4476
        
        C:\Windows\SysWOW64\Bjielh32.exe
        
        C:\Windows\system32\Bjielh32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4628
        
        C:\Windows\SysWOW64\Clhbhc32.exe
        
        C:\Windows\system32\Clhbhc32.exe
        83⤵
        
        PID:392
        
        C:\Windows\SysWOW64\Cgmfel32.exe
        
        C:\Windows\system32\Cgmfel32.exe
        84⤵
        Modifies registry class
        
        PID:4184
        
        C:\Windows\SysWOW64\Aefcif32.exe
        
        C:\Windows\system32\Aefcif32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1244
        
        C:\Windows\SysWOW64\Ahdpea32.exe
        
        C:\Windows\system32\Ahdpea32.exe
        86⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\Apkhfo32.exe
        
        C:\Windows\system32\Apkhfo32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4264
        
        C:\Windows\SysWOW64\Abjdbj32.exe
        
        C:\Windows\system32\Abjdbj32.exe
        88⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\Aehpof32.exe
        
        C:\Windows\system32\Aehpof32.exe
        89⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4976
        
        C:\Windows\SysWOW64\Ahfmka32.exe
        
        C:\Windows\system32\Ahfmka32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1464
        
        C:\Windows\SysWOW64\Apndloif.exe
        
        C:\Windows\system32\Apndloif.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4936
        
        C:\Windows\SysWOW64\Ablahjhj.exe
        
        C:\Windows\system32\Ablahjhj.exe
        92⤵
        Modifies registry class
        
        PID:500
        
        C:\Windows\SysWOW64\Aified32.exe
        
        C:\Windows\system32\Aified32.exe
        93⤵
        Drops file in System32 directory
        
        PID:2276
        
        C:\Windows\SysWOW64\Aldeap32.exe
        
        C:\Windows\system32\Aldeap32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:564
        
        C:\Windows\SysWOW64\Aihfjd32.exe
        
        C:\Windows\system32\Aihfjd32.exe
        95⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\Apbngn32.exe
        
        C:\Windows\system32\Apbngn32.exe
        96⤵
        Drops file in System32 directory
        
        PID:316
        
        C:\Windows\SysWOW64\Ahnclp32.exe
        
        C:\Windows\system32\Ahnclp32.exe
        97⤵
        Drops file in System32 directory
        
        PID:4688
        
        C:\Windows\SysWOW64\Aogkhjii.exe
        
        C:\Windows\system32\Aogkhjii.exe
        98⤵
        Drops file in System32 directory
        
        PID:4524
        
        C:\Windows\SysWOW64\Mgokflpj.exe
        
        C:\Windows\system32\Mgokflpj.exe
        99⤵
        Drops file in System32 directory
        
        PID:2976
        
        C:\Windows\SysWOW64\Npfkqpjk.exe
        
        C:\Windows\system32\Npfkqpjk.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3660
        
        C:\Windows\SysWOW64\Ddmaia32.exe
        
        C:\Windows\system32\Ddmaia32.exe
        101⤵
        Modifies registry class
        
        PID:956
        
        C:\Windows\SysWOW64\Cjcmognb.exe
        
        C:\Windows\system32\Cjcmognb.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3108
        
        C:\Windows\SysWOW64\Inejlibi.exe
        
        C:\Windows\system32\Inejlibi.exe
        103⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\Djhifnho.exe
        
        C:\Windows\system32\Djhifnho.exe
        104⤵
        Drops file in System32 directory
        
        PID:4860
        
        C:\Windows\SysWOW64\Gpqjaanf.exe
        
        C:\Windows\system32\Gpqjaanf.exe
        105⤵
        Modifies registry class
        
        PID:1264
        
        C:\Windows\SysWOW64\Kglmbd32.exe
        
        C:\Windows\system32\Kglmbd32.exe
        106⤵
        Modifies registry class
        
        PID:1260
        
        C:\Windows\SysWOW64\Mjkbemll.exe
        
        C:\Windows\system32\Mjkbemll.exe
        107⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Bddjijia.exe
        
        C:\Windows\system32\Bddjijia.exe
        108⤵
        Drops file in System32 directory
        
        PID:728
        
        C:\Windows\SysWOW64\Ckhelb32.exe
        
        C:\Windows\system32\Ckhelb32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3588
        
        C:\Windows\SysWOW64\Fngcfikb.exe
        
        C:\Windows\system32\Fngcfikb.exe
        110⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1672
        
        C:\Windows\SysWOW64\Iomood32.exe
        
        C:\Windows\system32\Iomood32.exe
        111⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Lngkjhmi.exe
        
        C:\Windows\system32\Lngkjhmi.exe
        112⤵
        Drops file in System32 directory
        
        PID:3664
        
        C:\Windows\SysWOW64\Qfkqcb32.exe
        
        C:\Windows\system32\Qfkqcb32.exe
        113⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Jajdai32.exe
        
        C:\Windows\system32\Jajdai32.exe
        114⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4664
        
        C:\Windows\SysWOW64\Ofeggo32.exe
        
        C:\Windows\system32\Ofeggo32.exe
        115⤵
        Modifies registry class
        
        PID:2928
        
        C:\Windows\SysWOW64\Bpedoold.exe
        
        C:\Windows\system32\Bpedoold.exe
        116⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Ciihcbhg.exe
        
        C:\Windows\system32\Ciihcbhg.exe
        117⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\Jloacl32.exe
        
        C:\Windows\system32\Jloacl32.exe
        118⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\Ldpijknm.exe
        
        C:\Windows\system32\Ldpijknm.exe
        119⤵
        Modifies registry class
        
        PID:1952
        
        C:\Windows\SysWOW64\Mefkdm32.exe
        
        C:\Windows\system32\Mefkdm32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4476
        
        C:\Windows\SysWOW64\Akdoam32.exe
        
        C:\Windows\system32\Akdoam32.exe
        121⤵
        Modifies registry class
        
        PID:2648
        
        C:\Windows\SysWOW64\Aioelpki.exe
        
        C:\Windows\system32\Aioelpki.exe
        122⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\Cfjdma32.exe
        
        C:\Windows\system32\Cfjdma32.exe
        123⤵
        Drops file in System32 directory
        
        PID:1984
        
        C:\Windows\SysWOW64\Fnllqh32.exe
        
        C:\Windows\system32\Fnllqh32.exe
        124⤵
        Drops file in System32 directory
        
        PID:1688
        
        C:\Windows\SysWOW64\Gcbgom32.exe
        
        C:\Windows\system32\Gcbgom32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2668
        
        C:\Windows\SysWOW64\Ggppel32.exe
        
        C:\Windows\system32\Ggppel32.exe
        126⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Hcgjajmo.exe
        
        C:\Windows\system32\Hcgjajmo.exe
        127⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\Ijmajc32.exe
        
        C:\Windows\system32\Ijmajc32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4372
        
        C:\Windows\SysWOW64\Jnmgea32.exe
        
        C:\Windows\system32\Jnmgea32.exe
        129⤵
        
        PID:184
        
        C:\Windows\SysWOW64\Japmmlip.exe
        
        C:\Windows\system32\Japmmlip.exe
        130⤵
        Drops file in System32 directory
        
        PID:1648
        
        C:\Windows\SysWOW64\Mkbmbn32.exe
        
        C:\Windows\system32\Mkbmbn32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2656
        
        C:\Windows\SysWOW64\Nhppbq32.exe
        
        C:\Windows\system32\Nhppbq32.exe
        132⤵
        Modifies registry class
        
        PID:3372
        
        C:\Windows\SysWOW64\Noihojgo.exe
        
        C:\Windows\system32\Noihojgo.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2260
        
        C:\Windows\SysWOW64\Pohngfml.exe
        
        C:\Windows\system32\Pohngfml.exe
        134⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Qfdbipbf.exe
        
        C:\Windows\system32\Qfdbipbf.exe
        135⤵
        Drops file in System32 directory
        
        PID:4252
        
        C:\Windows\SysWOW64\Akjnhehc.exe
        
        C:\Windows\system32\Akjnhehc.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4328
        
        C:\Windows\SysWOW64\Bbpepn32.exe
        
        C:\Windows\system32\Bbpepn32.exe
        137⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\Eimlpc32.exe
        
        C:\Windows\system32\Eimlpc32.exe
        138⤵
        Drops file in System32 directory
        
        PID:4052
        
        C:\Windows\SysWOW64\Hgmelc32.exe
        
        C:\Windows\system32\Hgmelc32.exe
        139⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adnilfnl.exe

Filesize
276KB

MD5
3f716bf8dc9dc559d6b9d09b97e70b89

SHA1
8b65cb5b2c7e3d771e1854480efb6fa8c2a04a85

SHA256
52f94ceeeb2930cd091381aaed36c68f8df6674ddcc446302bacee037214c025

SHA512
c65de8a442c9edce7612ff0a38b507d856908dd0679dcae80c7ca849e33f723ddfb6bc3d6635fb0a5ce50994b7a9b4c7e963ad20bb919b90edbeb9294b035317

Download Submit
C:\Windows\SysWOW64\Aeeomegd.exe

Filesize
276KB

MD5
a51ee8b3c375033dc9207e243a497b97

SHA1
468ef2e3ca356dbc6f778ab1df9d287d7fbd8a46

SHA256
d4a006eebf620bab8ab44ee16512e643c229574b4320ea095d389ebaa65a74b1

SHA512
980a852a303c7066b104eeacfdd21b7dc900f84ee784b04553efa12988f95ef0e6ede44abd6100f12724d422c8e6b02023f375dd324a04907dcadc1853e31dd6

Download Submit
C:\Windows\SysWOW64\Afdkfh32.exe

Filesize
276KB

MD5
ca3ec35cb1080ad169c252d6a1a21e68

SHA1
457e497d97d35a355b83e8332ebc5f3282781db8

SHA256
ba6ff2c6949590985842993b8cadd9df39b236a71196a1204e6fbab26afc2911

SHA512
bfaf6531a27e74b985df4c56c0347fa43858c786b64d7a367558ca5acef2598c1f0ebcb0845fc5e76ba7710dfe970678aa2c46e9e974f3decaa51e5da99e70b3

Download Submit
C:\Windows\SysWOW64\Akhaipei.exe

Filesize
276KB

MD5
49294016574a1a514bfab610f963416a

SHA1
c0640701dce413bf9bf9a7d836052eb8e8262de3

SHA256
e75e0cb2760bbe41e567f351f3b8d56738c565bc7634031288f816df5b11e45e

SHA512
f389b75b63591fc969dcd8c90ea298875e7a90586373ac887f44d2a31f852a2b53392f2d4dce12304c2bc319af7fb0b3e184da9282d2b59fbaabbd22ac06ac17

Download Submit
C:\Windows\SysWOW64\Anijjkbj.exe

Filesize
276KB

MD5
ccd14a08d2f94c70578d527449e34a96

SHA1
cbb2624966cac06d6228b9ec3a90c882a7a93b14

SHA256
d6015f6d16da5c32c5566de928e378bdabcc414e50ad41c1ac207df57b02689a

SHA512
8c7f6ce090dbd1658d6196f68dd41d2bc335372dc1c4390a63720587b7b629a798236cf2edd737f4f19b053ab3abf137c34ad88e6349eb150299ddbaa27b169a

Download Submit
C:\Windows\SysWOW64\Ankgpk32.exe

Filesize
276KB

MD5
690d8f4128e80edbc2937f6b809d03d5

SHA1
ac3dc19de25c964fce9d83698fcc28d8a4f991aa

SHA256
8ab674e5b6e5773d31cb0bc6f5608ed23fcf6962808a2474563caa07aa2baac9

SHA512
640deafcd4825aff3eaa8434945beb0f15da42d8a6b2448203589ef959955225c2b1ce0d0436c58cc2f03e9fc735bc2193ffcb62fa2532db502e74efe7f23c6c

Download Submit
C:\Windows\SysWOW64\Bcbeqaia.exe

Filesize
276KB

MD5
e345da10e4b241a1f86d57b8af04234a

SHA1
fd3dc00fe6d03e446287e83baafd48b64a9f7b69

SHA256
da3ffa7d3ed807c2f93f5ad88d9ff44efb76776d6e81047ea5791e12bdb47c38

SHA512
91151b7f58e190a8495dcbb1b5ed6b615628614dba2c5714000044ba7bce41f10e3f815892433b56f842518c131c98aec1d1d3e9499f5b947e9b5ae8f9994068

Download Submit
C:\Windows\SysWOW64\Bfnnmg32.exe

Filesize
276KB

MD5
8e78ac9fe3b323baecc14b5c7bc9f7f3

SHA1
9e9d0887bf3fa4cc3fd06396ff177f68c803df55

SHA256
35de07687237bfa0716b42d347964333463d287a512fef67752cacfae8d4dac0

SHA512
c4f436584415a8463ea94df52d9c51f0af037f6159725e8e06f859b195c0d2e82e8abe794ea842b24b50d855c93b1cc4f4190386d85105231434682cd7179a7c

Download Submit
C:\Windows\SysWOW64\Bgmnooom.exe

Filesize
276KB

MD5
5dcee71131f1f74797e432dbebedcb00

SHA1
f9a8bdf43d3a1116fece70431c742fe6570a83de

SHA256
b9b60280fd6df01bc483caa03f03df54c89040eb01d393a47518c92221e1cb5c

SHA512
1b416237d548bf465d977c41540816a032b1a911f11ee8eab55de4e5aeb8e1794de826e04a6d24b4075b3b940c960454737786bae96ba1e6279ae86decaf880e

Download Submit
C:\Windows\SysWOW64\Bpaikm32.exe

Filesize
276KB

MD5
fc8157b09ac80bc32c402f0f30414343

SHA1
5d034755ef806451904641c9d8d4a5d54abb7e4e

SHA256
e0d202670697c782c718530cb33bd97fb2967e5277a783ee31360d88601296ae

SHA512
a23baaa43b72f3a00f73d5f3a52c10a632190d681ac4f32c13109d728ad3e150805c5fb1e39c3547c276588c45e3eef5af0ea12a1b218e1473d8a8a350601976

Download Submit
C:\Windows\SysWOW64\Ccigpbga.exe

Filesize
276KB

MD5
79a99121d3daee5498c753f8b1a8da25

SHA1
f6114d9fd52bf847f3280165c2f799f263f984a3

SHA256
1a0ee6745cf7b65cf73174ac95c0f3c2056c728b8224c2f32ca30bdeb1f89802

SHA512
039646c05750d62f62d6e26d6c70c26038e71de58d537ac670c832e031c897b67225b366e1e1d80e0e12b696cd1299d68ef4d636d27e5ae34cd537c7fb87896b

Download Submit
C:\Windows\SysWOW64\Cfedmfqd.exe

Filesize
276KB

MD5
629799541bc220f639438ee5cfb80351

SHA1
c798f7a3c8f74db3771b07f53483d7fdd726e6f5

SHA256
ca05bbef6c25dec1cce7a668ffb4895952b0ce6f69522e4d6251865376ff5d2b

SHA512
3b0e51126ee1969696455d1be5f9953e022eba74f0bbca32299689cabbefd143865a104f288fd1ff3221525c341b49cc82248893395541fa6cfbfebfa7157cb1

Download Submit
C:\Windows\SysWOW64\Ciihcbhg.exe

Filesize
276KB

MD5
a3f054ff70ffd57f8e4bfc3c4745291e

SHA1
1a788bdbb9f51c266a8afd14d2dac0d7289742d0

SHA256
e0a72341b1991ea9f66d89b3b48d87c43f92dca4038b3c8b576df9dc09283001

SHA512
f1773d9d220d9692596cf3b6776165c4a20819b07279ca51070317323140e864f9a3bfed4c3813aef751ccae7851df1a552c69dd8d25dee0bb2c85947b6168eb

Download Submit
C:\Windows\SysWOW64\Ciogobcm.exe

Filesize
276KB

MD5
33f4b6ed7985f395c04edfbfb920a5f5

SHA1
f659f072c2a0abcc6cc9ca32054af39a94e56f9c

SHA256
8ff80a8453aabf4690a8bcd7b56b972a3b064ceb9cd80a2c15db1c20644ab3a5

SHA512
71e8c5f10fea27cf14176c304fd96bd0db097509b1985c150a1c7afccb64d45a2cca38cdcc5bb0e74cda02146c37093f93afe30bc627943969c28571fe264669

Download Submit
C:\Windows\SysWOW64\Cnjbbl32.exe

Filesize
276KB

MD5
663caf8304cc8b4887d000d66e948242

SHA1
f49ff0178868e417cdedda3842d8bab88644f247

SHA256
0719ee10a863f6cee17ef20cfe5d7ebb8fabdedfaf2249800ba033168a2f9d63

SHA512
34b74518b70644205591a8a1f7bfe01f091e464c0fd68a4d6deedb0d227daf5dafd3ac768fbb87c4ea8bec76974d4406c476b541d200d50891e7c358380f76f8

Download Submit
C:\Windows\SysWOW64\Cnkilbni.exe

Filesize
276KB

MD5
2b6745edf003aa7e3b6f65de6bc3c58d

SHA1
57f34326c839401657d22ce0ca79b1c595be7361

SHA256
5c83efeab836caa9d6950a069b56939b53e379bb45cca48e98889da19d2cb991

SHA512
b6facca8d91db18acaa012cc2e1af5b9e5fd9ce448e61ad7df00d3b389237e88f018e76163de1703727f34253d49ca294773d60c50bafb9a3b15610b3bdb0db1

Download Submit
C:\Windows\SysWOW64\Cpklql32.exe

Filesize
276KB

MD5
303cf4981645a158ff39edbc1b96a914

SHA1
f944e6d41e5c9db17d647a3e25deaf0181ddd86c

SHA256
61bac94919b5ac7d6a4e4f67735ab328174db0590310ccf4699cf1282cf7be8f

SHA512
d5bd5800db33bb9003d5300698251aa67849bba5d28578c4910a50cab6cd8f48aa0ee8dd7bb36356468a554c0622b7a094fbc2b4e2badd6f8f76828f3bca9ed9

Download Submit
C:\Windows\SysWOW64\Dpoiho32.exe

Filesize
276KB

MD5
cdbd4519af298e0712c8d3bf6da9f832

SHA1
52a5d535bddd4330c0fcdbfd8abf5b82a98ed12a

SHA256
73b0621582f1a576c5947ed451ec4acef2fb1db18441f9a8a735e07a8870541b

SHA512
74dd1a0b66587c26e6a9a318dae817952b4b099e2a07ca0c080d7a540571ace506ab50ae5e23ba563b5a3dcaa13ade2df8e3cbffccd36e5121045d146f11924f

Download Submit
C:\Windows\SysWOW64\Fngcfikb.exe

Filesize
256KB

MD5
3659c2b1c4a77c0bd337b9d07cde5752

SHA1
6574d9fbfedbc38681687bcece69c65cfaafff71

SHA256
7155bbd9e5e3eafa4663ea30ab8c262aa4aeaa375c17a2b8c4787ed33baf755e

SHA512
c932b6f554c812005e8c3cc8d806a2fabf9566a8bf47ad060e6f7545ce21658e85bea95839d9cd4878d384ecb74fd68495f642eaf4c6f80749edf8eec7e06236

Download Submit
C:\Windows\SysWOW64\Gnanioad.exe

Filesize
276KB

MD5
204bef4ad80bc747bd02b994f9aca215

SHA1
f5d7941b03b05d3b4c082054d510edc62aaafdeb

SHA256
f2d4686e038b392269c1206d4cf50cbff0947b046f63ff50b214232b505d23d6

SHA512
3338cf721bedddcb7e496bd6f3bb4f42d3d96ce21b2a9c6c3e166ebd9ed9981b8793ff837335791070cbc49813c72b09c89fd307f4e59d9b9c2221d0d9bf1ed4

Download Submit
C:\Windows\SysWOW64\Japmmlip.exe

Filesize
276KB

MD5
a4433e9cc0947bf8edd7b31f07a4f057

SHA1
7474f97cd9b8da380904756ffc02f29e0db627e9

SHA256
babf2f06c93b23365b0007ffb1cd796af65ddc59ce9b718b3f32b88d2433cd04

SHA512
c1467ab0ef2330b0acf3db48a5490fbe6ff1dec861076ad66bd0b91a829b500dfc55bda02ac92a6a063b1927bafa404f19813edbaab9643867cb2f3c5d5d22be

Download Submit
C:\Windows\SysWOW64\Jnmgea32.exe

Filesize
276KB

MD5
5a8761eb69ee721e3adc37413d1e9e67

SHA1
1275194d18ecbb54c059b3d8db6d1416c92ed5e9

SHA256
a446af1cca6ed13efcda6cce628a486d3b2eaf357108793a16858c27c6c46455

SHA512
9b1855e0600d264d76d273bbed6f0dd2a0f3fd98df5c7c8af6bcd01475c7b1a67e3fbb11d46965a01aadb8a221f5dd5876f344fb1a0a00f497d6bb97011a55ed

Download Submit
C:\Windows\SysWOW64\Kfidgk32.exe

Filesize
276KB

MD5
f61dfa5e233087b8ee2c9bc4eb15742e

SHA1
efd64176e995ce979e243d8ce4c0cc7c94d59005

SHA256
b36f81a747b8006de658c4990480acd19bf889a26d7db45aded879724e5f701a

SHA512
fdcb8cdd10f2247399853cd7ba31ad521181335c1780ddaa40edd6ba8c30604d013e54287c3a51e6ca4f1c1cce14e714e2662bd2d35a4bcfdceccba96a862e17

Download Submit
C:\Windows\SysWOW64\Kglmbd32.exe

Filesize
276KB

MD5
93c5655ef9e5a274281f52d9190ac6eb

SHA1
d2485b540062106923aa8316d984f9111a97cdea

SHA256
5479fd31d398cfc8b60f03b98e38e7bbb75f8fc888f3d70249788a29838e33e0

SHA512
0a3325a1eda0171a1f8e32d4e0ab0b103c76948d760043389d29a351d366882e5b9e09afeaa83e31d4a9daa15b7f1ac2452bdfc07d36660f3f4e458a5086cfee

Download Submit
C:\Windows\SysWOW64\Khdoqefq.exe

Filesize
276KB

MD5
0288e62be2e1220af771aa82a161c772

SHA1
ddf487c08af45426246cf7ad28b69813f89ca812

SHA256
0eefee430731259b85db67176dadcf6b7f26e3a8be2ac49ef020e90fbfe878f3

SHA512
432f5c7f42adbd7cd7808e8cda2850ec2d0c4f39455bec5323fa634676e2c84fd3f7b7bd66ece998fd4db6eb7212b2af62d39f59e2b77fbeab360192b3497cc9

Download Submit
C:\Windows\SysWOW64\Kkegbpca.exe

Filesize
276KB

MD5
eb787077d15314906ebb07f0f9832f5d

SHA1
6e4fcd719c72f3c5f51d2150dae51bd0052f2ecb

SHA256
5678ab59a4c35bead7104d2fa656560066b438b2c584d84bccde6bdbdb96185d

SHA512
e42fcc82afbe214a1c0256a31094be24a41a2dd881cd95af84510511ad4db0e5d0ec32ee485a4b9fe0251d031e9b0a04e186d670bdc4627cedac5386eb34f286

Download Submit
C:\Windows\SysWOW64\Kmnlmdhd.dll

Filesize
7KB

MD5
10017aaa0382695f9c34b4991af3e6ad

SHA1
ad93fc97cb6eb6c9d030b3abf76d44b7f9f36e5e

SHA256
68a0d6bc4ace3b9fae98c6ab8cfd210048405023c3add43dbf343c8d4a265dca

SHA512
4fda1adbaeb7392f4ff833511a6c09d4f023b7309b42458b305e5281044625873882baf04bd6405065a46a0d384ca9b3f63fa970c30ac1dca68bacac467caafd

Download Submit
C:\Windows\SysWOW64\Lkiamp32.exe

Filesize
276KB

MD5
2dc61cbd9d7ae24af9f7f71dd595ff5c

SHA1
8b239253faaa5c7cc3d23adb0a9d7e5291527ae9

SHA256
0fc52368917e02d997e24de4b88e74e2f86ffd5ca794640bdcc00bb802c7a62f

SHA512
a7606bd32fbda51357e85d43cb981b6d2966e0c6dcc8796c73f6bc65f92569509c851e8fdb5ecf1dbd81955ea85c18226856775395629ca52c6d9aab5808c1ea

Download Submit
C:\Windows\SysWOW64\Mefkdm32.exe

Filesize
276KB

MD5
7d8143dc8251ca354488cd5e1f821126

SHA1
afeff3e3270c56aa3146108fe2c35b69dd83d708

SHA256
c6ce70cdc76909135f1fad1d332d609bba26328f274af66718351d7ba596bca3

SHA512
63a57d22677f0b0f71744d895319990d433a4275b4c3b0dcf84e4d58297ab8173f5fe842360631160ff6daf65fc47be78cc279233e30fd5793c6f250818e9511

Download Submit
C:\Windows\SysWOW64\Mhmmieil.exe

Filesize
276KB

MD5
5307a7c8a9a2cbfba141c4a939911811

SHA1
e06b0f25e63be1f5a64490f157edfcede61ff49c

SHA256
2ed84e41711ad7fb99a60cf8c18a08080ffd126ded982a72dfa23b8056b6a6a3

SHA512
57f08a75ff4768840a6b281fe225c681ece0e128864d976db10ce91947b6f6bdc03e34a1cee58e38a673fd7c008d76d9d8271288a972fdca796f111d28653236

Download Submit
C:\Windows\SysWOW64\Nhafcd32.exe

Filesize
276KB

MD5
11988fe2c0d9bf8da99b5b74e7694205

SHA1
3d93239c12b7513c6f164cc9ad1b10c2396d0da3

SHA256
8c925f5d8ffe33bcc766e4f2e425e1bf4a7e9b6de030a9f434699993651f5357

SHA512
bde762317c10a40c88b5cfb359fa0d13fd363fae28c745d7683afc2717063bfcd2df9ef5cee590d23d4a6d3fc4dc295658a0aa6604df98a8b368eeba6333f6a6

Download Submit
C:\Windows\SysWOW64\Nhfoocaa.exe

Filesize
276KB

MD5
b6a27d14a92f657f79178cc6a91a6575

SHA1
02adc211f6a43ac019a16241f5b6088930416f95

SHA256
1b142514cc69b156a608b4d95f9c223346e5a4a8492055eceefe029d16fa8aa5

SHA512
e1fb3fca6151556ff6b28bdff667db408d829ba585b28bd84a221ffd8a9ff40fc15a86e696ca4c09f3295bd137eeca0de91571d98125b7bf873e1350f8303d3d

Download Submit
C:\Windows\SysWOW64\Oamgcm32.exe

Filesize
276KB

MD5
22eb7688594cd3cc3894610cc1412eca

SHA1
7cdf846d517fa7f5dc3fff1ea2a1e6b7252a58d5

SHA256
cf8a3fb21ed8024557c7c4b4168bd12ce478ca374eb268ac52a5878208bc0edd

SHA512
9be6e2e8c19829223bd53c329f8499abf93f6bfa904186d8fcf7b2c91220f19b92fa3471be12d1415ca64d4b514cbe8ec3979dd39475fee9c9abda2922265bf6

Download Submit
C:\Windows\SysWOW64\Oeffnl32.exe

Filesize
276KB

MD5
0ba6e108ca2e0b421e71a34ef79cc0ed

SHA1
4569055a9af5558a33c1c46dda495824a624e20b

SHA256
7afe331496d77f9ab1401850a7cb7e4536376190130591a61ef8304ea078d1a7

SHA512
4ce780e5a999b54f68b960f338781844ac8f9c291ded88823a6ed16b23440b29e45d242a47c659a82c0c79adc09e4c187e9540e95892e36fb5e2df5e80df6a38

Download Submit
C:\Windows\SysWOW64\Oggbfdog.exe

Filesize
276KB

MD5
859cfe575c7f208ea60a8fa409032c60

SHA1
09da50f71e8233d9026412899b44694026d0ce27

SHA256
d975585a883320f1e2ff1ac0a9b2999b32b5a5384ad343a0a59492e120d5d5e9

SHA512
3cec8c46a1bf49261b4b15c5b0582c7989fe3d7f50896c5bf74afdcad57fd38b1956d22d7ea415f48b752d087436407f641d047bee6155848e94dd22abfd80e8

Download Submit
C:\Windows\SysWOW64\Ogjpld32.exe

Filesize
276KB

MD5
b50123b2bb58c8ba87c79d5ab9ad113e

SHA1
8827f633d44850370d563e239f9c5b18cede486a

SHA256
d6e2f72901945ef72f0ec959c2a2e6e44ba0203fcf95622513bac8f575a1612d

SHA512
62d132b306953418849ee0ab1b496893d40107d11f09d4ee1fbcb509efd7969db580a62df6054fba0d1ab7fba14e2220b8e72852751b5f27945cbe19861bde37

Download Submit
C:\Windows\SysWOW64\Pbifol32.exe

Filesize
276KB

MD5
d50f623e0712b441addf47faaa765a43

SHA1
60dbff05ca1072441af55323ba352db332ae0d49

SHA256
cc600966affdf39b7c8ee0ad494f81a4d513d682fc67023b29c62f9d816691b4

SHA512
f457df8c2db6eb6c4354dfc738e9c0451df1299b1f6682f1434c7341b66bb83ebb3f7981a8cbdebb21c92be66397227fc48933a6f21ac58c99a9d55386b0e24d

Download Submit
C:\Windows\SysWOW64\Pdbiphhi.exe

Filesize
276KB

MD5
00d3abad983f2b55873fc049b2b9a6e0

SHA1
401d2c10663862f5da4fe5c8e1f874b523b697be

SHA256
2a093f6916f1c9c5dd73b679ddabe65e277bd68d0f46dc9172c4450085d7e86b

SHA512
6b04280d81f9c8c60a7eb5140b65a31e69242d1b3069b9b072fedfaae299b17a3ec979e460676245ac692c4fe6867727f3da86251d30e65e82bebcf50fa743a0

Download Submit
C:\Windows\SysWOW64\Pgeogb32.exe

Filesize
276KB

MD5
2ea71ad124fe1c337227c3a7feeb65a9

SHA1
cdb0be9d8a2ee32957d2c68e39c4417c980ecda8

SHA256
79e4f1a1ed7fff271869baaa0af6725f154fce7ad5571980db4f81f275e759ca

SHA512
b7540448b26458099490dd320f477da581b7c2f7dcc8ed9637d23598fed531c34e6c2673313dc0bde7eb01369be633ea2fca5fc46b3161a56230764d88290bfa

Download Submit
C:\Windows\SysWOW64\Pgllad32.exe

Filesize
276KB

MD5
7a2e60c04106fd611cfb006034d5fc44

SHA1
10f36f6cc4798d94e2868b5580810a0f6d022517

SHA256
3dda21c66b94471a9f20e24ff68c46ce7a669df4453f8803ba201f38254de67b

SHA512
0a34156c5c6a2fd1090f7149fdc867dc77b11e8bc727d20795333be86d8d928c793839e87955a12c9e79e83057936ecbe3dc9e9527737bbc339dea4fa87901d2

Download Submit
C:\Windows\SysWOW64\Pkinmlnm.exe

Filesize
276KB

MD5
5440ae232d4fd7c7312b601c2983ce61

SHA1
bd54b744394245588a6a9cb862520fb42367569c

SHA256
5de4eb3cad6de5ba81edd7a59e62f2a9b5cdc3679758447c35898cde9c58bb1c

SHA512
16d7b02e1d122c070d20f068d1fbb12449e5ad84ed63cb752691a061a7bc89aa3176479b4c07d9a41b7ab9985ec183b4bfa10acc3e1f370c7b848d53bba4110a

Download Submit
C:\Windows\SysWOW64\Pndhhnda.exe

Filesize
276KB

MD5
b9c876c3a73b9cb4b76d7db8449111bb

SHA1
86a74a19a9394d4912e2154890f79b700198fbd1

SHA256
20f913ceb623c54d5731d104b882f36d53eb24e420bce6b8d355b29fd211253d

SHA512
03530ea40e521470cbe9a1ba0afa8f641f54fbd84915c95306fe0417e713f91ad0c03ddba00a220bed9de10f080a402ff8ed6490c0ed858835072edc76bfdb20

Download Submit
C:\Windows\SysWOW64\Pnknim32.exe

Filesize
276KB

MD5
112f52a5b54a80e2324aec0824ce7124

SHA1
bf8f9c69a3b81cc3be9c16ca2bc16c8b5430c9cf

SHA256
8021c1157d86afd928f53577ba144e611ae526eefba073da44d1db0b50924056

SHA512
bfb977a4d02b0fdc447e32d77eb6b97324913d2ab55376c8270000e38db73aae0401db543619d70419248f1748cd8bf1e4ee6bed6ae6e76dff070c5101edbb17

Download Submit
C:\Windows\SysWOW64\Qffoejkg.exe

Filesize
276KB

MD5
b57b43341272f79a51e35c86d0ee8ae3

SHA1
f40db9fe8123c30687f4f8fea6c1671de154ac83

SHA256
b007097145b17e0f96ccc6f69f1261f0629ae8cf11598e303b804f3a5c256002

SHA512
ec5ec288564c54a2a9a14e01ff1c1962efb2e726c32ae7ee0a261ed8a05586297a193139a366732177b32af0e4b9b62190c8c8d81bf6ceb907d00db3b4b9c20f

Download Submit
memory/488-166-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/488-245-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/492-293-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/756-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/756-98-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1064-310-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1124-231-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1124-292-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1420-305-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1620-303-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1620-240-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1652-279-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1652-346-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2036-325-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2036-256-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2108-323-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2204-99-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2204-219-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2344-333-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2352-162-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2468-160-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2724-120-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2920-266-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2920-326-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2992-128-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2992-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3080-88-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3116-286-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3272-122-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3292-206-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3292-272-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3384-64-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3388-72-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3540-93-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3568-48-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3568-174-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3608-164-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3612-80-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3612-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3676-43-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3676-152-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3852-199-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3852-264-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4112-190-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4148-327-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4240-312-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4272-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4272-56-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4300-195-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4380-249-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4380-318-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4536-344-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4580-181-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4652-111-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4652-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4676-97-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4684-347-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4872-221-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4884-285-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4884-223-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4972-273-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4972-339-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4976-144-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5108-136-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads