c9280e9164396c32b00bf690f5aced78db7fe7b6e162984e8766dae0d20d346d

Analysis

max time kernel
130s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 04:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9280e9164396c32b00bf690f5aced78db7fe7b6e162984e8766dae0d20d346d.exe
Size

78KB
MD5

21232de3e082559c77d93c14e8338ab7
SHA1

4bb6a302b75906bbd8fbb07aff7a5da8e7190074
SHA256

c9280e9164396c32b00bf690f5aced78db7fe7b6e162984e8766dae0d20d346d
SHA512

c570bfb72c981fb91489fa9236f8716a8971a1e17098d9bcff5673689b9abbdc41ca6b85d9078c5aec51571c7f8748493a4736cc4e54da3b012a0fccc14ba5a5
SSDEEP

1536:BK3RZYWM/bYHcUCkWroJbnjn13tNMliVQqN+zL20gJi1ie:4Xf8UCkWr2jdQliVZgzL20WKt

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpacfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eckonn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iiibkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfffjqdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbapjafe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgphpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chnlihnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Denlnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fifdgblo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfffjqdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpccnefa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpedjf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbmfoa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kckbqpnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfqjafdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eqalmafo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjolnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jagqlj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laefdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcgblncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ejegjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jidbflcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kacphh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbjhlfhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iapjlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kphmie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnhmng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hclakimb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfofbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfjmgdlf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebeejijj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jiikak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmlnbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njcpee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbgkfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijhodq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfaloa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jiikak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmgdgjek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laopdgcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibojncfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ejbkehcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hadkpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iakaql32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpgqpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hippdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hippdo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkiqbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpnhekgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpgdbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jibeql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bockjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icjmmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgfoan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djnaji32.exe

Executes dropped EXE 64 IoCs

pid	Process
2532	Bekfan32.exe
1044	Bpqjofcd.exe
2444	Bockjc32.exe
4504	Bemcgmak.exe
4436	Blgkdg32.exe
1768	Bpcgdfaa.exe
2064	Badcln32.exe
1916	Chnlihnl.exe
5004	Cpedjf32.exe
3000	Cafpanem.exe
2984	Cimhckeo.exe
1356	Cpgqpe32.exe
4300	Cojqkbdf.exe
4032	Cipehkcl.exe
824	Commqb32.exe
3148	Cefemliq.exe
1488	Clqnjf32.exe
4100	Ccjfgphj.exe
540	Camfbm32.exe
4588	Clckpf32.exe
3964	Capchmmb.exe
2412	Dpacfd32.exe
868	Dcopbp32.exe
5020	Denlnk32.exe
1260	Dlgdkeje.exe
2212	Dcalgo32.exe
1964	Dhnepfpj.exe
1064	Dljqpd32.exe
4948	Dcdimopp.exe
4732	Dagiil32.exe
1648	Djnaji32.exe
2540	Dphifcoi.exe
4996	Dcfebonm.exe
2044	Djpnohej.exe
3144	Dchbhn32.exe
2172	Efgodj32.exe
3388	Ejbkehcg.exe
2092	Epmcab32.exe
1820	Eckonn32.exe
2692	Ejegjh32.exe
4956	Elccfc32.exe
1732	Epopgbia.exe
532	Ebploj32.exe
3588	Ehjdldfl.exe
3448	Eqalmafo.exe
4720	Ecphimfb.exe
3640	Ejjqeg32.exe
3836	Ehlaaddj.exe
4440	Ebeejijj.exe
1120	Efpajh32.exe
4988	Ehonfc32.exe
1032	Emjjgbjp.exe
4880	Ecdbdl32.exe
4848	Fjnjqfij.exe
4360	Fmmfmbhn.exe
388	Fcgoilpj.exe
2372	Fbioei32.exe
2264	Fmocba32.exe
432	Fqkocpod.exe
2120	Fomonm32.exe
4688	Fbllkh32.exe
2080	Ffggkgmk.exe
2156	Fifdgblo.exe
4580	Fmapha32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ggpfjejo.dll	Jfhbppbc.exe
File created	C:\Windows\SysWOW64\Fneiph32.dll	Maohkd32.exe
File opened for modification	C:\Windows\SysWOW64\Nafokcol.exe	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Habnjm32.exe	Hmfbjnbp.exe
File created	C:\Windows\SysWOW64\Mlilmlna.dll	Iannfk32.exe
File opened for modification	C:\Windows\SysWOW64\Jigollag.exe	Jfhbppbc.exe
File created	C:\Windows\SysWOW64\Milgab32.dll	Kbfiep32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Jfifijhb.dll	Clckpf32.exe
File created	C:\Windows\SysWOW64\Mdmiambh.dll	Capchmmb.exe
File created	C:\Windows\SysWOW64\Gjapmdid.exe	Gbjhlfhb.exe
File opened for modification	C:\Windows\SysWOW64\Ijdeiaio.exe	Ifhiib32.exe
File created	C:\Windows\SysWOW64\Iikopmkd.exe	Ijhodq32.exe
File created	C:\Windows\SysWOW64\Mdemcacc.dll	Ldmlpbbj.exe
File opened for modification	C:\Windows\SysWOW64\Laefdf32.exe	Lnjjdgee.exe
File opened for modification	C:\Windows\SysWOW64\Mpkbebbf.exe	Mahbje32.exe
File created	C:\Windows\SysWOW64\Gdibmd32.dll	Blgkdg32.exe
File opened for modification	C:\Windows\SysWOW64\Fcgoilpj.exe	Fmmfmbhn.exe
File opened for modification	C:\Windows\SysWOW64\Hpbaqj32.exe	Hapaemll.exe
File opened for modification	C:\Windows\SysWOW64\Hbhdmd32.exe	Hcedaheh.exe
File created	C:\Windows\SysWOW64\Nafokcol.exe	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Dpacfd32.exe	Capchmmb.exe
File opened for modification	C:\Windows\SysWOW64\Gmkbnp32.exe	Gjlfbd32.exe
File created	C:\Windows\SysWOW64\Lmbocjjm.dll	Gmmocpjk.exe
File opened for modification	C:\Windows\SysWOW64\Mjjmog32.exe	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Ebkdha32.dll	Ibagcc32.exe
File created	C:\Windows\SysWOW64\Bclhoo32.dll	Jfdida32.exe
File created	C:\Windows\SysWOW64\Jaimbj32.exe	Jmnaakne.exe
File opened for modification	C:\Windows\SysWOW64\Jplmmfmi.exe	Jaimbj32.exe
File created	C:\Windows\SysWOW64\Fphbondi.dll	Ejegjh32.exe
File created	C:\Windows\SysWOW64\Fopldmcl.exe	Fmapha32.exe
File opened for modification	C:\Windows\SysWOW64\Kphmie32.exe	Kaemnhla.exe
File opened for modification	C:\Windows\SysWOW64\Mgidml32.exe	Mcnhmm32.exe
File created	C:\Windows\SysWOW64\Hmklen32.exe	Hippdo32.exe
File opened for modification	C:\Windows\SysWOW64\Kmegbjgn.exe	Jiikak32.exe
File created	C:\Windows\SysWOW64\Dchbhn32.exe	Djpnohej.exe
File created	C:\Windows\SysWOW64\Gfqjafdq.exe	Gqdbiofi.exe
File created	C:\Windows\SysWOW64\Lpacnb32.dll	Gmoliohh.exe
File opened for modification	C:\Windows\SysWOW64\Kbfiep32.exe	Kdcijcke.exe
File opened for modification	C:\Windows\SysWOW64\Gjjjle32.exe	Gfnnlffc.exe
File created	C:\Windows\SysWOW64\Mnnkcb32.dll	Jaedgjjd.exe
File opened for modification	C:\Windows\SysWOW64\Mcpebmkb.exe	Mdmegp32.exe
File created	C:\Windows\SysWOW64\Emjjgbjp.exe	Ehonfc32.exe
File opened for modification	C:\Windows\SysWOW64\Fifdgblo.exe	Ffggkgmk.exe
File opened for modification	C:\Windows\SysWOW64\Jdemhe32.exe	Jpjqhgol.exe
File created	C:\Windows\SysWOW64\Jaljgidl.exe	Jmpngk32.exe
File opened for modification	C:\Windows\SysWOW64\Jaljgidl.exe	Jmpngk32.exe
File created	C:\Windows\SysWOW64\Baefid32.dll	Laalifad.exe
File opened for modification	C:\Windows\SysWOW64\Clckpf32.exe	Camfbm32.exe
File created	C:\Windows\SysWOW64\Oddfqf32.dll	Gmkbnp32.exe
File created	C:\Windows\SysWOW64\Hcqjfh32.exe	Habnjm32.exe
File opened for modification	C:\Windows\SysWOW64\Imgkql32.exe	Iikopmkd.exe
File created	C:\Windows\SysWOW64\Ldobbkdk.dll	Kacphh32.exe
File created	C:\Windows\SysWOW64\Nqjfoc32.dll	Kbdmpqcb.exe
File created	C:\Windows\SysWOW64\Mfpoqooh.dll	Jbocea32.exe
File created	C:\Windows\SysWOW64\Hlmobp32.dll	Njljefql.exe
File created	C:\Windows\SysWOW64\Lifoip32.dll	Cafpanem.exe
File opened for modification	C:\Windows\SysWOW64\Gppekj32.exe	Gmaioo32.exe
File created	C:\Windows\SysWOW64\Jeiooj32.dll	Jdjfcecp.exe
File created	C:\Windows\SysWOW64\Mgidml32.exe	Mcnhmm32.exe
File created	C:\Windows\SysWOW64\Hdgohg32.dll	Fbqefhpm.exe
File created	C:\Windows\SysWOW64\Honckk32.dll	Hmfbjnbp.exe
File created	C:\Windows\SysWOW64\Jdcpcf32.exe	Jpgdbg32.exe
File created	C:\Windows\SysWOW64\Cichoi32.dll	Elccfc32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8268	9156	WerFault.exe	372

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djpnohej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbocea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmocba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffjdqg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dchbhn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbqefhpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljnnch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffjdqg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbqefhpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gefncbmc.dll"	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogedoeae.dll"	Emjjgbjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmmcfa32.dll"	Kpccnefa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipqnahgf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnjjdgee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icpdfeeb.dll"	Bekfan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emjjgbjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npckna32.dll"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnplgc32.dll"	Hbckbepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebkdha32.dll"	Ibagcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imgkql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jdemhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgbnmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dcalgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epmjjbbj.dll"	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njacpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ejbkehcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmjdia32.dll"	Hpbaqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjkiobic.dll"	Haidklda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddpfgd32.dll"	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppmeid32.dll"	Hippdo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imgkql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppaaagol.dll"	Kdcijcke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jingckla.dll"	Clqnjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnnkcb32.dll"	Jaedgjjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akanejnd.dll"	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Idofhfmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijhodq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dcdimopp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmaioo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkageheh.dll"	Hadkpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlmpolji.dll"	Hbhdmd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhnepfpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eckonn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jiikak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lelgbkio.dll"	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	c9280e9164396c32b00bf690f5aced78db7fe7b6e162984e8766dae0d20d346d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqncfneo.dll"	Kilhgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbaohn32.dll"	Laciofpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldaeka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ejjqeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkihknfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmfbjnbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbmfdgkm.dll"	Kgbefoji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdemcacc.dll"	Ldmlpbbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	c9280e9164396c32b00bf690f5aced78db7fe7b6e162984e8766dae0d20d346d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcedaheh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jagqlj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbdmpqcb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehjdldfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmlnbi32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 2532	4036	c9280e9164396c32b00bf690f5aced78db7fe7b6e162984e8766dae0d20d346d.exe	85
PID 4036 wrote to memory of 2532	4036	c9280e9164396c32b00bf690f5aced78db7fe7b6e162984e8766dae0d20d346d.exe	85
PID 4036 wrote to memory of 2532	4036	c9280e9164396c32b00bf690f5aced78db7fe7b6e162984e8766dae0d20d346d.exe	85
PID 2532 wrote to memory of 1044	2532	Bekfan32.exe	86
PID 2532 wrote to memory of 1044	2532	Bekfan32.exe	86
PID 2532 wrote to memory of 1044	2532	Bekfan32.exe	86
PID 1044 wrote to memory of 2444	1044	Bpqjofcd.exe	87
PID 1044 wrote to memory of 2444	1044	Bpqjofcd.exe	87
PID 1044 wrote to memory of 2444	1044	Bpqjofcd.exe	87
PID 2444 wrote to memory of 4504	2444	Bockjc32.exe	88
PID 2444 wrote to memory of 4504	2444	Bockjc32.exe	88
PID 2444 wrote to memory of 4504	2444	Bockjc32.exe	88
PID 4504 wrote to memory of 4436	4504	Bemcgmak.exe	89
PID 4504 wrote to memory of 4436	4504	Bemcgmak.exe	89
PID 4504 wrote to memory of 4436	4504	Bemcgmak.exe	89
PID 4436 wrote to memory of 1768	4436	Blgkdg32.exe	90
PID 4436 wrote to memory of 1768	4436	Blgkdg32.exe	90
PID 4436 wrote to memory of 1768	4436	Blgkdg32.exe	90
PID 1768 wrote to memory of 2064	1768	Bpcgdfaa.exe	91
PID 1768 wrote to memory of 2064	1768	Bpcgdfaa.exe	91
PID 1768 wrote to memory of 2064	1768	Bpcgdfaa.exe	91
PID 2064 wrote to memory of 1916	2064	Badcln32.exe	92
PID 2064 wrote to memory of 1916	2064	Badcln32.exe	92
PID 2064 wrote to memory of 1916	2064	Badcln32.exe	92
PID 1916 wrote to memory of 5004	1916	Chnlihnl.exe	93
PID 1916 wrote to memory of 5004	1916	Chnlihnl.exe	93
PID 1916 wrote to memory of 5004	1916	Chnlihnl.exe	93
PID 5004 wrote to memory of 3000	5004	Cpedjf32.exe	94
PID 5004 wrote to memory of 3000	5004	Cpedjf32.exe	94
PID 5004 wrote to memory of 3000	5004	Cpedjf32.exe	94
PID 3000 wrote to memory of 2984	3000	Cafpanem.exe	95
PID 3000 wrote to memory of 2984	3000	Cafpanem.exe	95
PID 3000 wrote to memory of 2984	3000	Cafpanem.exe	95
PID 2984 wrote to memory of 1356	2984	Cimhckeo.exe	97
PID 2984 wrote to memory of 1356	2984	Cimhckeo.exe	97
PID 2984 wrote to memory of 1356	2984	Cimhckeo.exe	97
PID 1356 wrote to memory of 4300	1356	Cpgqpe32.exe	98
PID 1356 wrote to memory of 4300	1356	Cpgqpe32.exe	98
PID 1356 wrote to memory of 4300	1356	Cpgqpe32.exe	98
PID 4300 wrote to memory of 4032	4300	Cojqkbdf.exe	99
PID 4300 wrote to memory of 4032	4300	Cojqkbdf.exe	99
PID 4300 wrote to memory of 4032	4300	Cojqkbdf.exe	99
PID 4032 wrote to memory of 824	4032	Cipehkcl.exe	100
PID 4032 wrote to memory of 824	4032	Cipehkcl.exe	100
PID 4032 wrote to memory of 824	4032	Cipehkcl.exe	100
PID 824 wrote to memory of 3148	824	Commqb32.exe	101
PID 824 wrote to memory of 3148	824	Commqb32.exe	101
PID 824 wrote to memory of 3148	824	Commqb32.exe	101
PID 3148 wrote to memory of 1488	3148	Cefemliq.exe	103
PID 3148 wrote to memory of 1488	3148	Cefemliq.exe	103
PID 3148 wrote to memory of 1488	3148	Cefemliq.exe	103
PID 1488 wrote to memory of 4100	1488	Clqnjf32.exe	104
PID 1488 wrote to memory of 4100	1488	Clqnjf32.exe	104
PID 1488 wrote to memory of 4100	1488	Clqnjf32.exe	104
PID 4100 wrote to memory of 540	4100	Ccjfgphj.exe	105
PID 4100 wrote to memory of 540	4100	Ccjfgphj.exe	105
PID 4100 wrote to memory of 540	4100	Ccjfgphj.exe	105
PID 540 wrote to memory of 4588	540	Camfbm32.exe	106
PID 540 wrote to memory of 4588	540	Camfbm32.exe	106
PID 540 wrote to memory of 4588	540	Camfbm32.exe	106
PID 4588 wrote to memory of 3964	4588	Clckpf32.exe	107
PID 4588 wrote to memory of 3964	4588	Clckpf32.exe	107
PID 4588 wrote to memory of 3964	4588	Clckpf32.exe	107
PID 3964 wrote to memory of 2412	3964	Capchmmb.exe	108

C:\Users\Admin\AppData\Local\Temp\c9280e9164396c32b00bf690f5aced78db7fe7b6e162984e8766dae0d20d346d.exe
"C:\Users\Admin\AppData\Local\Temp\c9280e9164396c32b00bf690f5aced78db7fe7b6e162984e8766dae0d20d346d.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\SysWOW64\Bekfan32.exe
  C:\Windows\system32\Bekfan32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\SysWOW64\Bpqjofcd.exe
    C:\Windows\system32\Bpqjofcd.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Windows\SysWOW64\Bockjc32.exe
      C:\Windows\system32\Bockjc32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2444
    - - C:\Windows\SysWOW64\Bemcgmak.exe
        
        C:\Windows\system32\Bemcgmak.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4504
      - C:\Windows\SysWOW64\Blgkdg32.exe
        
        C:\Windows\system32\Blgkdg32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\SysWOW64\Bpcgdfaa.exe
        
        C:\Windows\system32\Bpcgdfaa.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\SysWOW64\Badcln32.exe
        
        C:\Windows\system32\Badcln32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2064
        
        C:\Windows\SysWOW64\Chnlihnl.exe
        
        C:\Windows\system32\Chnlihnl.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Windows\SysWOW64\Cpedjf32.exe
        
        C:\Windows\system32\Cpedjf32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SysWOW64\Cafpanem.exe
        
        C:\Windows\system32\Cafpanem.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Windows\SysWOW64\Cimhckeo.exe
        
        C:\Windows\system32\Cimhckeo.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\SysWOW64\Cpgqpe32.exe
        
        C:\Windows\system32\Cpgqpe32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\SysWOW64\Cojqkbdf.exe
        
        C:\Windows\system32\Cojqkbdf.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4300
        
        C:\Windows\SysWOW64\Cipehkcl.exe
        
        C:\Windows\system32\Cipehkcl.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4032
        
        C:\Windows\SysWOW64\Commqb32.exe
        
        C:\Windows\system32\Commqb32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:824
        
        C:\Windows\SysWOW64\Cefemliq.exe
        
        C:\Windows\system32\Cefemliq.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\SysWOW64\Clqnjf32.exe
        
        C:\Windows\system32\Clqnjf32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Windows\SysWOW64\Ccjfgphj.exe
        
        C:\Windows\system32\Ccjfgphj.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Windows\SysWOW64\Camfbm32.exe
        
        C:\Windows\system32\Camfbm32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\SysWOW64\Clckpf32.exe
        
        C:\Windows\system32\Clckpf32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4588
        
        C:\Windows\SysWOW64\Capchmmb.exe
        
        C:\Windows\system32\Capchmmb.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\SysWOW64\Dpacfd32.exe
        
        C:\Windows\system32\Dpacfd32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2412
        
        C:\Windows\SysWOW64\Dcopbp32.exe
        
        C:\Windows\system32\Dcopbp32.exe
        24⤵
        Executes dropped EXE
        
        PID:868
        
        C:\Windows\SysWOW64\Denlnk32.exe
        
        C:\Windows\system32\Denlnk32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5020
        
        C:\Windows\SysWOW64\Dlgdkeje.exe
        
        C:\Windows\system32\Dlgdkeje.exe
        26⤵
        Executes dropped EXE
        
        PID:1260
        
        C:\Windows\SysWOW64\Dcalgo32.exe
        
        C:\Windows\system32\Dcalgo32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2212
        
        C:\Windows\SysWOW64\Dhnepfpj.exe
        
        C:\Windows\system32\Dhnepfpj.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1964
        
        C:\Windows\SysWOW64\Dljqpd32.exe
        
        C:\Windows\system32\Dljqpd32.exe
        29⤵
        Executes dropped EXE
        
        PID:1064
        
        C:\Windows\SysWOW64\Dcdimopp.exe
        
        C:\Windows\system32\Dcdimopp.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4948
        
        C:\Windows\SysWOW64\Dagiil32.exe
        
        C:\Windows\system32\Dagiil32.exe
        31⤵
        Executes dropped EXE
        
        PID:4732
        
        C:\Windows\SysWOW64\Djnaji32.exe
        
        C:\Windows\system32\Djnaji32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1648
        
        C:\Windows\SysWOW64\Dphifcoi.exe
        
        C:\Windows\system32\Dphifcoi.exe
        33⤵
        Executes dropped EXE
        
        PID:2540
        
        C:\Windows\SysWOW64\Dcfebonm.exe
        
        C:\Windows\system32\Dcfebonm.exe
        34⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Djpnohej.exe
        
        C:\Windows\system32\Djpnohej.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2044
        
        C:\Windows\SysWOW64\Dchbhn32.exe
        
        C:\Windows\system32\Dchbhn32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3144
        
        C:\Windows\SysWOW64\Efgodj32.exe
        
        C:\Windows\system32\Efgodj32.exe
        37⤵
        Executes dropped EXE
        
        PID:2172
        
        C:\Windows\SysWOW64\Ejbkehcg.exe
        
        C:\Windows\system32\Ejbkehcg.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3388
        
        C:\Windows\SysWOW64\Epmcab32.exe
        
        C:\Windows\system32\Epmcab32.exe
        39⤵
        Executes dropped EXE
        
        PID:2092
        
        C:\Windows\SysWOW64\Eckonn32.exe
        
        C:\Windows\system32\Eckonn32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1820
        
        C:\Windows\SysWOW64\Ejegjh32.exe
        
        C:\Windows\system32\Ejegjh32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2692
        
        C:\Windows\SysWOW64\Elccfc32.exe
        
        C:\Windows\system32\Elccfc32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4956
        
        C:\Windows\SysWOW64\Epopgbia.exe
        
        C:\Windows\system32\Epopgbia.exe
        43⤵
        Executes dropped EXE
        
        PID:1732
        
        C:\Windows\SysWOW64\Ebploj32.exe
        
        C:\Windows\system32\Ebploj32.exe
        44⤵
        Executes dropped EXE
        
        PID:532
        
        C:\Windows\SysWOW64\Ehjdldfl.exe
        
        C:\Windows\system32\Ehjdldfl.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3588
        
        C:\Windows\SysWOW64\Eqalmafo.exe
        
        C:\Windows\system32\Eqalmafo.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3448
        
        C:\Windows\SysWOW64\Ecphimfb.exe
        
        C:\Windows\system32\Ecphimfb.exe
        47⤵
        Executes dropped EXE
        
        PID:4720
        
        C:\Windows\SysWOW64\Ejjqeg32.exe
        
        C:\Windows\system32\Ejjqeg32.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3640
        
        C:\Windows\SysWOW64\Ehlaaddj.exe
        
        C:\Windows\system32\Ehlaaddj.exe
        49⤵
        Executes dropped EXE
        
        PID:3836
        
        C:\Windows\SysWOW64\Ebeejijj.exe
        
        C:\Windows\system32\Ebeejijj.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4440
        
        C:\Windows\SysWOW64\Efpajh32.exe
        
        C:\Windows\system32\Efpajh32.exe
        51⤵
        Executes dropped EXE
        
        PID:1120
        
        C:\Windows\SysWOW64\Ehonfc32.exe
        
        C:\Windows\system32\Ehonfc32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4988
        
        C:\Windows\SysWOW64\Emjjgbjp.exe
        
        C:\Windows\system32\Emjjgbjp.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1032
        
        C:\Windows\SysWOW64\Ecdbdl32.exe
        
        C:\Windows\system32\Ecdbdl32.exe
        54⤵
        Executes dropped EXE
        
        PID:4880
        
        C:\Windows\SysWOW64\Fjnjqfij.exe
        
        C:\Windows\system32\Fjnjqfij.exe
        55⤵
        Executes dropped EXE
        
        PID:4848
        
        C:\Windows\SysWOW64\Fmmfmbhn.exe
        
        C:\Windows\system32\Fmmfmbhn.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4360
        
        C:\Windows\SysWOW64\Fcgoilpj.exe
        
        C:\Windows\system32\Fcgoilpj.exe
        57⤵
        Executes dropped EXE
        
        PID:388
        
        C:\Windows\SysWOW64\Fbioei32.exe
        
        C:\Windows\system32\Fbioei32.exe
        58⤵
        Executes dropped EXE
        
        PID:2372
        
        C:\Windows\SysWOW64\Fmocba32.exe
        
        C:\Windows\system32\Fmocba32.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2264
        
        C:\Windows\SysWOW64\Fqkocpod.exe
        
        C:\Windows\system32\Fqkocpod.exe
        60⤵
        Executes dropped EXE
        
        PID:432
        
        C:\Windows\SysWOW64\Fomonm32.exe
        
        C:\Windows\system32\Fomonm32.exe
        61⤵
        Executes dropped EXE
        
        PID:2120
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        62⤵
        Executes dropped EXE
        
        PID:4688
        
        C:\Windows\SysWOW64\Ffggkgmk.exe
        
        C:\Windows\system32\Ffggkgmk.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2080
        
        C:\Windows\SysWOW64\Fifdgblo.exe
        
        C:\Windows\system32\Fifdgblo.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2156
        
        C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4580
        
        C:\Windows\SysWOW64\Fopldmcl.exe
        
        C:\Windows\system32\Fopldmcl.exe
        66⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\Fckhdk32.exe
        
        C:\Windows\system32\Fckhdk32.exe
        67⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        68⤵
        Modifies registry class
        
        PID:3052
        
        C:\Windows\SysWOW64\Fmclmabe.exe
        
        C:\Windows\system32\Fmclmabe.exe
        69⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        70⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        71⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1036
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        72⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\Fqaeco32.exe
        
        C:\Windows\system32\Fqaeco32.exe
        73⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\Gcpapkgp.exe
        
        C:\Windows\system32\Gcpapkgp.exe
        74⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        75⤵
        Drops file in System32 directory
        
        PID:3696
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        76⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\Gqdbiofi.exe
        
        C:\Windows\system32\Gqdbiofi.exe
        77⤵
        Drops file in System32 directory
        
        PID:2280
        
        C:\Windows\SysWOW64\Gfqjafdq.exe
        
        C:\Windows\system32\Gfqjafdq.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2468
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        79⤵
        Drops file in System32 directory
        
        PID:2036
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        80⤵
        Drops file in System32 directory
        
        PID:4812
        
        C:\Windows\SysWOW64\Gqfooodg.exe
        
        C:\Windows\system32\Gqfooodg.exe
        81⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Gbgkfg32.exe
        
        C:\Windows\system32\Gbgkfg32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5140
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        83⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        84⤵
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\Gqikdn32.exe
        
        C:\Windows\system32\Gqikdn32.exe
        85⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Gcggpj32.exe
        
        C:\Windows\system32\Gcggpj32.exe
        86⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5396
        
        C:\Windows\SysWOW64\Gjapmdid.exe
        
        C:\Windows\system32\Gjapmdid.exe
        88⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        89⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Gmoliohh.exe
        
        C:\Windows\system32\Gmoliohh.exe
        90⤵
        Drops file in System32 directory
        
        PID:5528
        
        C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5572
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        92⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        93⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        94⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        95⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        96⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5844
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6080
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        99⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Hapaemll.exe
        
        C:\Windows\system32\Hapaemll.exe
        100⤵
        Drops file in System32 directory
        
        PID:5160
        
        C:\Windows\SysWOW64\Hpbaqj32.exe
        
        C:\Windows\system32\Hpbaqj32.exe
        101⤵
        Modifies registry class
        
        PID:5232
        
        C:\Windows\SysWOW64\Hfljmdjc.exe
        
        C:\Windows\system32\Hfljmdjc.exe
        102⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        103⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        104⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Habnjm32.exe
        
        C:\Windows\system32\Habnjm32.exe
        105⤵
        Drops file in System32 directory
        
        PID:5516
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        106⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        107⤵
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5740
        
        C:\Windows\SysWOW64\Himcoo32.exe
        
        C:\Windows\system32\Himcoo32.exe
        109⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        110⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        112⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        113⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6076
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        115⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        116⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        117⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        118⤵
        Modifies registry class
        
        PID:5452
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        119⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5636
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        121⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        122⤵
        Modifies registry class
        
        PID:5872
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        123⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        124⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        125⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        126⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5480
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5692
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        129⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        130⤵
        Drops file in System32 directory
        
        PID:6060
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        131⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        132⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        133⤵
        Drops file in System32 directory
        
        PID:5992
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        134⤵
        Modifies registry class
        
        PID:5924
        
        C:\Windows\SysWOW64\Ibojncfj.exe
        
        C:\Windows\system32\Ibojncfj.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5752
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        136⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6260
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        138⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6336
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        140⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        141⤵
        Modifies registry class
        
        PID:6432
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        142⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6476
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        144⤵
        Drops file in System32 directory
        
        PID:6576
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        145⤵
        Modifies registry class
        
        PID:6628
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        146⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        147⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        148⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Ijkljp32.exe
        
        C:\Windows\system32\Ijkljp32.exe
        149⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        150⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        151⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6884
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6932
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        153⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7020
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        155⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        156⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6156
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        158⤵
        Drops file in System32 directory
        
        PID:6296
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        159⤵
        Modifies registry class
        
        PID:6368
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        160⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        161⤵
        Drops file in System32 directory
        
        PID:6472
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6592
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        163⤵
        Drops file in System32 directory
        
        PID:6660
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        164⤵
        Drops file in System32 directory
        
        PID:6756
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        165⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        166⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6960
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7028
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        169⤵
        Drops file in System32 directory
        
        PID:7112
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        170⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        171⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        172⤵
        Drops file in System32 directory
        
        PID:6424
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6568
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        174⤵
        Drops file in System32 directory
        
        PID:6680
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        175⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        176⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        177⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        178⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        179⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6288
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        180⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6656
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        182⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        183⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6324
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6624
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        186⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        187⤵
        Modifies registry class
        
        PID:6248
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        188⤵
        Modifies registry class
        
        PID:6704
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7104
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6736
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        191⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        192⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7180
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7224
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        194⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        195⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        196⤵
        Drops file in System32 directory
        
        PID:7364
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7416
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        198⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7464
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        199⤵
        Drops file in System32 directory
        
        PID:7508
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        200⤵
        Modifies registry class
        
        PID:7564
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        201⤵
        Modifies registry class
        
        PID:7608
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7652
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        203⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        204⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        205⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7828
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7872
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        208⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        209⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        210⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        211⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        212⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8136
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        214⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8180
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7208
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        216⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        217⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        218⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7504
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7588
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        221⤵
        Modifies registry class
        
        PID:7644
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        222⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        223⤵
        Modifies registry class
        
        PID:7776
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        224⤵
        Modifies registry class
        
        PID:7856
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7948
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        226⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8016
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8080
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        228⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7188
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        230⤵
        Modifies registry class
        
        PID:7320
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        231⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        232⤵
        Drops file in System32 directory
        
        PID:7548
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        233⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        234⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        235⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        236⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8120
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        238⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        239⤵
        Modifies registry class
        
        PID:7444
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        240⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        241⤵
        Modifies registry class
        
        PID:7772
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        242⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        243⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        244⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        245⤵
        Drops file in System32 directory
        
        PID:7348
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        246⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        247⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6892
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        249⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7336
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        250⤵
        Drops file in System32 directory
        
        PID:7820
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        251⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8036
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        252⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7524
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        254⤵
        Modifies registry class
        
        PID:8100
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        255⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        256⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        257⤵
        Drops file in System32 directory
        
        PID:7556
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        258⤵
        Modifies registry class
        
        PID:8216
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        259⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        260⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8348
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        262⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8468
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8516
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        265⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        266⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        267⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        268⤵
        Modifies registry class
        
        PID:8688
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        269⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        270⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        271⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        272⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        273⤵
        Modifies registry class
        
        PID:8896
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8940
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        275⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        276⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9068
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        278⤵
        Drops file in System32 directory
        
        PID:9112
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        279⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9156 -s 400
        280⤵
        Program crash
        
        PID:8268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9156 -ip 9156
1⤵
PID:8200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Badcln32.exe

Filesize
78KB

MD5
1e72224d8ead2f89fe228c8e8e64401a

SHA1
11b7499fd301c99cec5a53a6fd8f82fc07a62160

SHA256
a904ab61982d599bed97bf01e04d64f708533b64547c4b5f9c22b8531ae054a6

SHA512
f42d157ec7c87952572cc7bcf83757126ae51ce3002a64147a78f532b5067ebcb4e257512325dbb47f2c230500929bd98c667ebec67c4cda34b5e87b6451895c

Download Submit
C:\Windows\SysWOW64\Bekfan32.exe

Filesize
78KB

MD5
ac5cc796dd48ed176a5d6120355f63c6

SHA1
ab1f9dd8339bfa7512950131087e5800d97f6898

SHA256
ef741656385b3524ac4c3b6428b39974f03aa695dbb14b6f3328a9c2637e1b2b

SHA512
d3469cfc9744269953570b860028e4a4004ccd57c6ea719f80bd3f95caf26e7b77fbf535d718becbd8be0143e9147f28fbbdc3b267a6664bfa43097ec3cac343

Download Submit
C:\Windows\SysWOW64\Bemcgmak.exe

Filesize
78KB

MD5
2269845abb4faff16b7f265938d33547

SHA1
bc8fe4a3b409507063a6eac3e7ab312390d39f3e

SHA256
eee998c9d05d061740da8901de34a7fc327090fcce51d0bdc42912779294c108

SHA512
a9ee5b117bd808eec4e982e3f594650879448b32f7b5f5a8c41f2f2a06d3711ddfcce01e924b4bcc4a9264a88e687ff61e231f216010bd64bd3fa00512d225ae

Download Submit
C:\Windows\SysWOW64\Blgkdg32.exe

Filesize
78KB

MD5
8e1375146b4739d54d8caab0fa3c2140

SHA1
666571bc09a00e13c49b92cd2eaa8490b9db6719

SHA256
d505ff585ed88c49c6cf9f4cf42fdbb60b0432dfa50181659c38b96216c4b61a

SHA512
0c3b2731ae594b75d281a488726bfa67be203743ff06d6971aeebb76698f087f729de80fa3e9d75f0f7bce032bae200c7310133fbb6d9c8f50cd0e59e991f053

Download Submit
C:\Windows\SysWOW64\Bockjc32.exe

Filesize
78KB

MD5
34c583da5908ad0c5e35ca7813073353

SHA1
1a8bf1a2436abefdaed449849c37b0281dfdf206

SHA256
2b7fa67922c56c41553f41315a81b88e11d117d126b7b35f3a56b539e40ff387

SHA512
9a31883f6ebef635f99bf5529364940c434b8e37f7e667918a64ca7e9fb38e1bd2c7cf8a920b36ad638bd44b7f3ae90b0d14f6dafcf2bcfe3e871fece422dd9b

Download Submit
C:\Windows\SysWOW64\Bpcgdfaa.exe

Filesize
78KB

MD5
c36a30b3dffaba7a791377f952c5968b

SHA1
0866e440f8223db50f0279a641b02ca9f9de3af5

SHA256
48e5a4821060cf72c8fae57fc5c14a3ba4ef7bf11eb3de6b432ad548d88a84b6

SHA512
74211e1f993c4ac7ef5b7ceafd14718c81341d42dcae7023a29378264677d57cce53b213b312c61e5489177fec316f642785b78e89bbf64b5d7515e5cd74d575

Download Submit
C:\Windows\SysWOW64\Bpqjofcd.exe

Filesize
78KB

MD5
82ae87e7a40105fe53e24993ac5e56f2

SHA1
c8d0af591263463f35893e1508e93fc1627b1ffa

SHA256
ac760bf1e658a76a0e2887db3edc0c562859fb25952f86401000da8a8ec6f4c0

SHA512
0def9551f71108e31bbb4dc36ad82959d26d2f14b9d24f5e99d21db83d7b29ec172ab656d5712245e0da2082f883596a077781881685837ffa43fd056bf34852

Download Submit
C:\Windows\SysWOW64\Cafpanem.exe

Filesize
78KB

MD5
b9995879c80db5f9892b34d5d965fdb7

SHA1
3204751add83ebd08ae6ac2d2ed8c1cc7708838a

SHA256
022a2826cdfdc89b2ab2d460c2be09013f26d0bd37c5eae7036889530e749579

SHA512
69eab5730037509a2b051a489bb4db39632c5de006c94ba35ca4b5ce4d07062217c8a3b6d85bd6707cb3a1f2471ebb0f28a855b6954a3020d69dd36d525d867c

Download Submit
C:\Windows\SysWOW64\Camfbm32.exe

Filesize
78KB

MD5
4c314491c5a30a87d1d948d00031c71c

SHA1
072f9c8bbb9b9cb555700e85e9c3b9156cc37a7a

SHA256
1763da2e3797d12ebd420e03fe01fd38acc468ba1e0f513e9eab193623bfb038

SHA512
c2a8db41e1f1b093b9b786528b962733204ee57627a2876e38e8fbcbc1d4d2c9118a3c098dcfa25f02e1d1ff7be3dc2ead2378d5552ab8ffb8eb2d21919f6210

Download Submit
C:\Windows\SysWOW64\Capchmmb.exe

Filesize
78KB

MD5
fd48eeabaae1834431179b5be70b046e

SHA1
b76f2715aeedbe01ee9112e050a5582254098043

SHA256
ce71735ee6dd0e9a23aa750a4c7b290e3500db4e96361f09ce8131efc23a22af

SHA512
7dd3e32501eab2b9f3419e82543973b6238c93778bfba52bf41dfd14d23adb098d5955e0caf04b2477c82f00013302ff326f08c9621a08894c9a75adf451f660

Download Submit
C:\Windows\SysWOW64\Ccjfgphj.exe

Filesize
78KB

MD5
0e62d66afe13a90e6d1d34111d2be257

SHA1
f637d5a9b5d71bcf6aa994255c20ed29579ec11c

SHA256
319e023b8f1ba1eed654a7f327f0fce5f72ac81404850b8c790667adadbe6384

SHA512
90ef40b8a78030199465df899fba37ba53f1b5431ea2ebc0415b1f870f24b91861aa4276324c4655c1163febe9972ebc415c74a38e2de45207222a8b9b450bef

Download Submit
C:\Windows\SysWOW64\Cefemliq.exe

Filesize
78KB

MD5
b02c4151f13733440dd387c6c331055d

SHA1
3577f5f0fb6966d6f2eaa4ee824df31e07394ce9

SHA256
b82d0e3ac4f2ef1346ee9f35d304d3e625cd320009ab6ad9c933e50c89e733d2

SHA512
5c4117c4bc43cf02352e29fdc405d9e0ab28ab154be5e677bc0263afb198757b2fc8cf022bf0af445be3b24cedd7b7345130f11eb81ecf649cbbf1e1e44b439f

Download Submit
C:\Windows\SysWOW64\Chnlihnl.exe

Filesize
78KB

MD5
d7bdec3881863a7a5e89802213d55d29

SHA1
55ca4a5bab90d86b0eab259f40f157fb0e23d374

SHA256
6d793e2f41d75d9bd2449875cace422958ac5c03b3c4b2c51e2e141927b4de9f

SHA512
1eb4d3ce80c3e724d3bacf094a872aa99382a5818609f1a83b2a186703f9b92896d6cf81ae589434c7abf51e0101baba4d95601f25bb7f091eb00da1c7300c15

Download Submit
C:\Windows\SysWOW64\Cimhckeo.exe

Filesize
78KB

MD5
e62b0dfba859e295015adc64e2e6911d

SHA1
daa851f21868553a7ad2af881610973db9e9bbc2

SHA256
0b0a4d505358faab9f567ae269d521b6183b91cb317d0d042bf2135886c755df

SHA512
f35f63f0f31afdabd49491c1aa1e899343469f6101c0793e92a4517ed7179e4bdb4eea79ef2e6d65ef70d7374bce0697a0cd587ec7c15ff241f7a205df03014b

Download Submit
C:\Windows\SysWOW64\Cipehkcl.exe

Filesize
78KB

MD5
2eeeeffe3cdc04086a0fd371c8717499

SHA1
15627ba487ba0b835f15df46a0e8d60eb00ec89b

SHA256
c124387028f4b4e2fbd5a057cc14acdc1de6469a6a33983b750539f417070d12

SHA512
f60fc16b236cb9df813f1e227795f1e3d60656faadf95e88c56f50fd8ccd28e426e01ad110a05a5084a1a33ebd81b7849df6408fd79c806a3042acd3062d9d05

Download Submit
C:\Windows\SysWOW64\Clckpf32.exe

Filesize
78KB

MD5
554d0c20d6cf582a90d77535b6e0bd18

SHA1
ec9c6823f6b8da5ae8ed868699c4338f5991df96

SHA256
c94a994556bced21d65b092727771481954902cac715d67b418be46a2aa71bf9

SHA512
55a15bad8e2fe1d96d8eec0e190d0e76b60a6f525f9c6318616f1f6b221784781d58e54a07227227854dace6b548b57aa0f46302431681fb1e6a3e236c7b087b

Download Submit
C:\Windows\SysWOW64\Clqnjf32.exe

Filesize
78KB

MD5
91fe4c242239a3325c966139f519b1f3

SHA1
630c4624b3b2463229d6a7dba7a1d8b1bc230717

SHA256
4558850e53df6056d9c7e5e493779576d9abf6abe7bdead8d6f5002c4aff37b3

SHA512
1303657b141bab6edd3d6b634396c5956fc08130b91ba5204f695c8cf3fcdbd610d27d8aa179aba8bd561fbebe7670a9fc13a3d71794d73a8830d459f4dfb6a9

Download Submit
C:\Windows\SysWOW64\Cojqkbdf.exe

Filesize
78KB

MD5
c6abbf7830fa68d9f6e8cf8b466c4c7a

SHA1
e40ab66e8cb521fdffd1a1b7b2502702923cfd19

SHA256
fd3934aa5a6303b4a3ecdfe21725c0f292804e0163e9aaaa787487922b40f83b

SHA512
1dc71ebfdfd470a5172838c7f7a166c8dfcb60e5bad2a5cbb8d67dc38f388b8a658db4f6688c0fb7a33c858802dbe8fac43d5fb7de1618d18c1947f333b8700d

Download Submit
C:\Windows\SysWOW64\Commqb32.exe

Filesize
78KB

MD5
4bfaa64bd1633fa0aa5a105081f4dd74

SHA1
40c9d28ac23dad76e64b2d01c37d710f0b724cf5

SHA256
1e93a1bd4d47d6ed95fa553366698ca5084388ec03db91090b31e9a6d10aaf8a

SHA512
8a1a0d54f0a2b95e9f29eff4976b8b15c967da6024d5358b7a36496ab3396724fce01bccaa3bee6f228452d5d78b894b388581c15d12f4a0a57853df05ddf9e9

Download Submit
C:\Windows\SysWOW64\Cpedjf32.exe

Filesize
78KB

MD5
a6023043558265d1db6a6b1268c8dac1

SHA1
66a2245fb330b61a4bf44379591a7127d87f2878

SHA256
dd4cfe8e021469b7b4a619ab3435b0b0731ab31e22bb34cd54decbfb931a9b8a

SHA512
563bf447919082e8923f0152e3a8788282460ca9ea0995205da1e5b10a5acdb0e0334e856d44eb451d2830cd3443a8f16d1d5915cfc47bea76551eec7a9de2cc

Download Submit
C:\Windows\SysWOW64\Cpgqpe32.exe

Filesize
78KB

MD5
a8500fd640b8daaaf523cbf5d23fd804

SHA1
d8cd00f542fbd6cc86888509a7bdf8805f6de425

SHA256
9d73e48d1a3ac78ff02c09183f9e897f8031f5532b2a910ab534061ccd7b4d40

SHA512
1c2ea006c4dfe8b9813bd5294f5e30a4bc117e1d925e1f55bdd5795007f2a75683a09c08ca77f1931ba36f1eee45e431a52f5b5746c4d12c10f2108be4b992a3

Download Submit
C:\Windows\SysWOW64\Dagiil32.exe

Filesize
78KB

MD5
03d9a80ecf093cc5ca4cb0870ebc64e6

SHA1
ab9f0fc2f67cc6ac798aa879996844b9801dfbcc

SHA256
b912fb749dfc996c638f379d3133a62e490cfea5fbca4ea090e51a02454a7f77

SHA512
ec95994b7bda08ed0c6f8776c109420b22c9a21eea470acf9f732d39f0128372796b4178efb2908958cc3d44d3684b5584d26d4cabe6fdaf5977ad2ef6370b6b

Download Submit
C:\Windows\SysWOW64\Dcalgo32.exe

Filesize
78KB

MD5
f1b9ef27329b8184b056f41e4eb91e0f

SHA1
e4f98728ee873e30f518f197e4d5d72ae40ec709

SHA256
894c94d5a9e3f20b51e81781a7f2bac8837dbcae780eeaf4c6379da6af2d38d6

SHA512
916a974024d7f556fa32618a3d5705dd6c1689e563ee0cb8e5e8b64450804a577aaab8af1eb464c5e01d43f914fb18127c98f3f1c7cd506c1491e590949bf047

Download Submit
C:\Windows\SysWOW64\Dcdimopp.exe

Filesize
78KB

MD5
6b9c76b3a387f3adbb254ed19f0c8012

SHA1
0c62234bd14868942bc305c69c2c67d3acaec769

SHA256
82fa016146b78d72da27be70be346a03383cc9c7b2ab80514ffc22a7300a518e

SHA512
298225ec2311df4cd106513b67917ce9e734e63b0bb1925a57a91e22e004012dd0dcc790bc9f567bbcca8d00c3f4bbf16d10a7fc67450ba0dc773666761668aa

Download Submit
C:\Windows\SysWOW64\Dchbhn32.exe

Filesize
78KB

MD5
e9d1eb3f21cd7d979eefe59eee86e864

SHA1
c91e525d4202006d610f084bc5cdf8efafcf6d33

SHA256
018d66cb5d1d81a463e7f63582da0ba88202beb19bd49605304ef187e4a2e1ec

SHA512
129f117c9001451a4f5cd9814080f3a2a35a6468be6b7bb63a880156a8eb66a2aa0a4308dad179622e707a93709f1b9c8d67d9afde3b6694753b359643951773

Download Submit
C:\Windows\SysWOW64\Dcopbp32.exe

Filesize
78KB

MD5
0dd32cf2ea925cee185021bccc109836

SHA1
d5b9ddac184ba9ab694e676abc63ec49435e4d92

SHA256
d604d04a7d7fd4ff3074b739142232c9cc3f6846f1d4df093485fc6eca21dfae

SHA512
ea904e0dfd3fb2d7c205ae3604af7d7d5402317c0560d1898ff6d08c502f41fe9a4e21fb1bfdcfec118fdaca4ecda8725c96e44b89aed4475936c600bcde1aff

Download Submit
C:\Windows\SysWOW64\Denlnk32.exe

Filesize
78KB

MD5
d1e0d7b42de902158f830251c4f5ba84

SHA1
5d9874948212e40db23cb68e6fd846db25d0b589

SHA256
1dd6e980bb0fc08aee5a4802504c1794f2f55c12173a60347e7f8c074e4d2faa

SHA512
121cd2946c0fe3eba8509e3f3a9bb5d3a295a11bef7cea4035890f8a4603e61753def5555776c0b23f33b995a90531c26395886e380258e84027312a598fd149

Download Submit
C:\Windows\SysWOW64\Dhnepfpj.exe

Filesize
78KB

MD5
0972a5a2dc39e1e8c4bfbcef5d127aa8

SHA1
b2fad47b9f66655776aedb0339127c3ec06b0341

SHA256
f95938bd59297430c5fafbc2696ab967b18e48343c647c98f611ed6641e9a081

SHA512
48e1b4ebd73e75e2d10a63c2654ab6da51e6dd4f8c6ed397424ee5cbb54a3acff8b77211ece3a4eb305e4e77538d9929b566397e035656aeb911636e727a96d8

Download Submit
C:\Windows\SysWOW64\Djnaji32.exe

Filesize
78KB

MD5
261f57f82016df40ef4b75a703236fb9

SHA1
b908576e505e91427d39a64c92f5a48402bf06ae

SHA256
13dfa44a4900d8f6b9f8fb20d7cf73b37fbe4d797dae9bf75c05ce89038778be

SHA512
0f4abd37b7389f19cb2d1b3ed5ae327187bd32714563f31de5793258e512eab5bb74c3597ce1e07bf3ac73a6f432f044f357b700ef903b67d738ab40598aa1db

Download Submit
C:\Windows\SysWOW64\Dlgdkeje.exe

Filesize
78KB

MD5
74c5aa11abb6d5ce3ed218511b7799fa

SHA1
5bb026bf6176714c6bf902979e152d61d396fcfe

SHA256
26087119c1bfe11678e08c46e85c6fd0d5e5f81a5987279bdd6ea7794cd3e02e

SHA512
b5025bf61e4eb48e78a8a765e6035c2bc93854b85f22169809b9c5e6d1fbefa0cdecc01f32dc87f5e34ef03df2dcc814c400c99b4064ba01a5f26591901ac680

Download Submit
C:\Windows\SysWOW64\Dljqpd32.exe

Filesize
78KB

MD5
bdd91d769f23127bac78ca369043a77f

SHA1
ee3359a45b6df9c1ccdba2dcc01205703b1446f5

SHA256
093a0d7d6e0ee529ac8f057081e0ecdfc023abfcc1c2c23c829a6c1a6eec2cdc

SHA512
d42e0abca9a7aa7623cb2d0b412bf6d2d0da32a83e40b8f718b09ae7508b0eb2e7ec85fd8626b4b421352056f9967c2ab5f6e9f1add65e3d2a056cdf51426167

Download Submit
C:\Windows\SysWOW64\Dpacfd32.exe

Filesize
78KB

MD5
f76d2d863548dbb686ecdda8307665dd

SHA1
66bb2338d1e0d68c61d07403118f381dbf040596

SHA256
c086cdbfa26e5c72c79a09472c0ec1125516c957c24a84db45a6ed29642cb6d1

SHA512
bf7187e85f632dbe4bfa5b62b062be5f6c3b9f76f6f6c4031f3bb22a5f759da213673c4c2334fb403a576832c5472a3eee01c2227560d1675ccdaa92d9542f5a

Download Submit
C:\Windows\SysWOW64\Dphifcoi.exe

Filesize
78KB

MD5
d16db70eed16da33c6369fe4ed0d1461

SHA1
42b11ec67f9a591f27ba8e8852323e05053a5a68

SHA256
9d79bedc6c2420945f42793c3bed71c83227d0f2ea4855f2e6d9bbe84ede7846

SHA512
f2560da48877a60505a974fa4769346241896603118dc4cdbf356e8bbbd301fd8a50e20d450c0cab9a6a63f86ab7df7b016f3d1113489c30519880691c2088ba

Download Submit
C:\Windows\SysWOW64\Ebploj32.exe

Filesize
78KB

MD5
19de0c0b6450b7992801e9acab22f81f

SHA1
2da14c1e1470cb9e0c3704ae84e23c8a37ef34fd

SHA256
5036ef830e805c656464b3bce08892da43df58e8eabbf0d078d3cf35d1816cbb

SHA512
df0579a2af1987d4ecc4a6699d90ff0fa7f02b0cefea6778efdf3147ff8e3d2148deb0d65082bbe72e53f7608e09ee1c7765cf70c1057430851da60e156a148a

Download Submit
C:\Windows\SysWOW64\Ecphimfb.exe

Filesize
78KB

MD5
3962bbc659461cb4ec932e03520072bf

SHA1
adf0148fdea77af58c629001383a812c70b62961

SHA256
abcc8019074639696f8e52a48016be54871df702ba13d75e49a3db4c45775b3b

SHA512
7bac0852d124781d835673fec5e3d2373356706ac2cd1d7dc7dbd132f1b3cbe0abd343c24ac29eecff690918d836d23ea31eb61ccc3b36e478ed95ac243aa9bd

Download Submit
C:\Windows\SysWOW64\Fobiilai.exe

Filesize
78KB

MD5
182ac8810c95300ca77c975aa8994627

SHA1
5349f9931ba7ef9958172f501a9fcb186fefa837

SHA256
2c057216f8203d60beb44358ef1c9d72a22b65dd3ba83efa09254adf415f5085

SHA512
9d0c2508609080705db02a4dd5dd92de1787f05b73d12f8cd45aa3074ddeaef44d49532cbbb88e65356cfe7b86632e95c1f0177ab536cd6c1cf2d9e5e6ef8a35

Download Submit
C:\Windows\SysWOW64\Gjocgdkg.exe

Filesize
78KB

MD5
d267aa9c4067f287df59062f1ce8f5b0

SHA1
87d22d76d8eda1fa053aff0730de86d777664a29

SHA256
f80703de8a2b7be0725e8ab3a5f8fd695bf6d16025c019af001cc6f8cbe4a5f5

SHA512
be0878426e89ff40bb0ff2b4722480a6a6fa3bfd0973a1959fb65bf1c4c8cb103e45a1d090fd46d89ed2fb566c6e14b45d3ad02a1e19ae8ed81e5926a90aaf30

Download Submit
C:\Windows\SysWOW64\Hcqjfh32.exe

Filesize
78KB

MD5
14066303082f712aa437cc1c2695677c

SHA1
7591b9b80907c7b21ea7a7f96e8355ba22fa4a57

SHA256
4f042ad173d40b9add065a83b13c2b1b2735bd655a8a2ed124352362eea81460

SHA512
38e6a793e888c157f0f8f78122b6c2d25d1b70cdf609cd5d1cada0f26f185bd728e681e2c68725ddad437969c9f94f2537501d25589a6f06c54a41301a253297

Download Submit
C:\Windows\SysWOW64\Hpbaqj32.exe

Filesize
78KB

MD5
c52e08f49530bb247f373bd50c320b89

SHA1
21134fd515e20e1fcb2bc3dff141ccf39e64be3e

SHA256
82a71193912ba71ada804e8e1351bb7b14806427545be27dee1d80741eb9c6d2

SHA512
6527ab82ffe846741501460e2eb36041f1a006126487c21fd93cd400c1a20e9acc2faec4e353ea3fae612f0dcd3fec6ead8f1ad7e7b0ae43b273246b5eeaf7ef

Download Submit
C:\Windows\SysWOW64\Ibjqcd32.exe

Filesize
64KB

MD5
3152ccffdd5fb1a03ba799e86d7f8fcd

SHA1
84300aef7269f40575af59c3eefe6511e8aa7985

SHA256
ae9cb3f366dcbc4ecec3b35e31d4682aec64fcf7c4d0caf20d88d9c043c43732

SHA512
12b6a71b53d134766f7461ccaa37e9c74da50aec040c2cc891e516ecf4732024114e108d5ae36ce7c6a589851af96af4f61e2144bb5048d70fd6edb789823017

Download Submit
C:\Windows\SysWOW64\Icgqggce.exe

Filesize
78KB

MD5
6d80039ff6236dc197364d8ca2472a6d

SHA1
a116779e114b7119a41868bdfe2d2f50e60de4ea

SHA256
2216d973b801c39fc98e54cc7aeb18ca02006625c815156a13a7d635e4edb43b

SHA512
982dc3e6903e13629aea27f918c976ad2276c74bdea7a49ca91f3980de388146550222ff9e2135c367de0b4d8ae8982a13aca507fa2da91ba3553bc680b690bb

Download Submit
C:\Windows\SysWOW64\Impepm32.exe

Filesize
78KB

MD5
bcc1eb419dda85a06ff64bdb17c6fe49

SHA1
66a721230a934d07b89e49594a95abfc1d886574

SHA256
addde98790df593ac9b88992cfc674135adfd8cf42bd4a207eec0ba787d94e37

SHA512
dbbd717d8c6800831e1eb8a04c7c9ae1e9a76f42522d586e6858328ddfa24e781c19e1827eb8010f8acac701ceb77001934b0b9e900f3faefc053fb17fc07c7e

Download Submit
C:\Windows\SysWOW64\Ipegmg32.exe

Filesize
78KB

MD5
49b10f1e316be703c21560cae72e3a04

SHA1
5de0503ce3fce5cf14de0c716b90354279cb4646

SHA256
654e6cd8c76e31e9642f5b15016eaa8fe318f9b2fa252352108aefa1635d6899

SHA512
8da7822311b8689d29126560565e4e066d578ac6e34761e7277ba7bfe37fdb8c10f534142f2aa978cf45df73d1366ef30745390bee03979d51a28ce977f6ebf7

Download Submit
C:\Windows\SysWOW64\Jfaloa32.exe

Filesize
78KB

MD5
dd8f119a208926f0e3cc0b2a183cfaab

SHA1
d0d27a09e6fa666a1c70ef2ee810b7e814314744

SHA256
8cc186fe82298027dc5494fc3ba0962bef3694c01d791ec5bba59f1c10de4566

SHA512
b5d405f204a50253c8e0ed37801b7eda539a0d4db1728f6f3d350157791f6c782c5d344a4cc1f99444644614490a376730ce2876b655e8dc8bcc6d7ef539aedc

Download Submit
C:\Windows\SysWOW64\Jpojcf32.exe

Filesize
78KB

MD5
338fa35f744b279a647957826ef06426

SHA1
569acdfbed4c3b4081f3de8c2b2e32a9cfc205d5

SHA256
7c96b6c1dcfafe22fa0fcfec53fb2880c19b7084a49883a89a0410755b55195d

SHA512
78ce496346decefd3bf3663f8290a5596bc81773e6d70675b9e4d343051e13f5d37ded540a4423058e2e04a856d4a9ec9bf6f744d8bfc948a67b3f5b3d2ccaa9

Download Submit
C:\Windows\SysWOW64\Kckbqpnj.exe

Filesize
78KB

MD5
359105f8e7d6ca43e69e96f11c05506d

SHA1
59bbaa1002e1d4fa55e2e3809d0fdf7e378a19e5

SHA256
5b7f444b3fe10581fc60e3697ab6b19bc39104fc69363c930399bf23a1946516

SHA512
5c7023084c7025d365d484ce673317277968febc8e83c9b96672d2a3a92422261269daf106e55a0f5a9d498a752a778de150244df8d56f329ef5eb70c9ed8927

Download Submit
C:\Windows\SysWOW64\Kgdbkohf.exe

Filesize
78KB

MD5
d9b95ced6561d1294e5e2a9608de7be6

SHA1
7ce10bebe377275608edbfc7fdd0e585d74edbb6

SHA256
e1a810aa53d9d350a46fe2694d88624ef1246afb789847888d7fbdd2578910d8

SHA512
96cb9651eff2b67880d6755fa0d16feaad576dd7ce6677d88c22a9f6c7aa652ffb7dce6e5a2c2502901535af701ff398fca4d1a1f13055dd684aa63153834f55

Download Submit
C:\Windows\SysWOW64\Laopdgcg.exe

Filesize
78KB

MD5
99f220287d04eae6ecc283b5d6c666e4

SHA1
684995c12842406cb86784364ce87bb1e164c070

SHA256
0019e8b334772bd4ad9445bc57888b53b62cb3ac8a4e3b967be20e69f2e96153

SHA512
3cb131b489ad0cc865bb4bf5af0b15bbe3d820d79668c277f572cc78e402f9377f7f9055223c81adf748b06ab3e084bc7d949c045ad46caab653b1137a2bcde7

Download Submit
C:\Windows\SysWOW64\Liekmj32.exe

Filesize
78KB

MD5
862ca3f912dbc71a5c1ea15f08009736

SHA1
de5a4006f157883407f22357f6360581e72912c1

SHA256
aa14a605d696f1368670dfe2ca97f6f855bb375da11677afe3c88c46751c76c1

SHA512
eb5141c339ada2a07e618e5e2dd8a185074897e4962bb11ff6bc0ad860b39ec3417fc0f0043ac6460233eb92d7bcab960a8989d575f89c9f704026fd25e1b7fc

Download Submit
C:\Windows\SysWOW64\Njacpf32.exe

Filesize
78KB

MD5
f3f2dd14566b06248ee12c6936add24c

SHA1
1dde07d436538c1f620c0300c42a7ce5c4324224

SHA256
62850fe36cbbcc9ac88e4597d3df90a986b2e0f7b023caccfa14230f4e2fb7a2

SHA512
6d46fa706264eca3f71b6736b0472faf02cb0884e8013f8cd763b38a44b81f6d2688423a3df2b2944e53c476b9b714c78b1f5f431576c9420c444380a73cf1e6

Download Submit
memory/388-440-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/532-354-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/540-162-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/540-254-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/824-125-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/824-213-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/868-283-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/868-201-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1032-415-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1044-21-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1064-241-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1064-317-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1120-397-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1260-214-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1260-297-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1356-103-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1488-236-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1488-144-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1648-336-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1648-268-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1732-343-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1732-408-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1768-134-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1768-49-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1820-329-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1916-65-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1916-156-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1964-237-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2044-356-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2044-291-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2064-57-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2064-143-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2092-383-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2092-318-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2172-305-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2172-374-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2212-224-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2212-304-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2372-443-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2412-281-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2412-192-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2444-106-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2444-25-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2532-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2532-9-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2540-282-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2692-330-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2692-396-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2984-178-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2984-90-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3000-82-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3000-170-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3144-298-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3144-367-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3148-135-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3148-222-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3388-316-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3448-368-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3588-357-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3588-423-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3640-442-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3640-377-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3836-449-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3836-384-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3964-266-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3964-179-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4032-116-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4032-205-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4036-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4036-5-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/4036-73-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4100-158-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4300-200-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4300-108-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4360-430-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4436-124-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4436-41-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4440-394-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4504-115-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4504-33-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4588-171-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4588-263-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4720-376-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4732-264-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4848-427-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4880-417-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4948-255-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4956-407-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4956-337-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4988-409-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4996-353-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4996-284-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5004-74-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5004-161-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5020-290-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5020-209-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads