af4b9ed2848ef43503c30249c56dbf55da8a800c22ee759f975a346590260f19

Analysis

max time kernel
142s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 01:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

af4b9ed2848ef43503c30249c56dbf55da8a800c22ee759f975a346590260f19.exe
Size

117KB
MD5

d6d44281ab66ed3ce22d21323c8e5131
SHA1

78f50a475bd3c42a93a586b3398954e654fdc8e6
SHA256

af4b9ed2848ef43503c30249c56dbf55da8a800c22ee759f975a346590260f19
SHA512

3fefbff92c3a67d446f5a7b9faa81337db293e84992d6fbbda2c19984c137b29a4a3bbe60149b2b85eac807cea3d4746853065ebf6bd3d7779412e8e5ef32a98
SSDEEP

3072:WbDrGcQDdQeSBJqoMHWipPE8VFFfUrQlM:WbDrGcQtwcoMHWifVTfMQ

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baaplhef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kbceejpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Llcpoo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehljfnpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ieolehop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmlpoqpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Echknh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcpclbfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jmmjgejj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Imfdff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpablkhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ofnckp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gdjjckag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jmhale32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcioiood.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdkcde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aaepqjpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Camphf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Elppfmoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hopnqdan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ifjodl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpablkhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dlijfneg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhemmlhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hoiafcic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njnpppkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ambgef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anadoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daolnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhidjpqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dedkdcie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dlncan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lllcen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibjjhn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdhdajea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeopki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckcgkldl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dlgmpogj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmhale32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icplcpgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbhfjljd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klimip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Miemjaci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdbiedpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnfdcjkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dllfkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmjdjgjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ogpmjb32.exe

Executes dropped EXE 64 IoCs

pid	Process
4548	Aeopki32.exe
3120	Angddopp.exe
4636	Aaepqjpd.exe
1372	Adcmmeog.exe
2976	Alkdnboj.exe
1176	Abemjmgg.exe
3128	Bhaebcen.exe
1312	Bbgipldd.exe
1956	Bhdbhcck.exe
1036	Bnnjen32.exe
1264	Behbag32.exe
4968	Blbknaib.exe
2908	Bejogg32.exe
1764	Bldgdago.exe
1016	Baaplhef.exe
3328	Bdolhc32.exe
568	Boepel32.exe
464	Cbqlfkmi.exe
1860	Ceoibflm.exe
3180	Cklaknjd.exe
2660	Cafigg32.exe
636	Cddecc32.exe
4980	Cbefaj32.exe
2320	Chbnia32.exe
3460	Colffknh.exe
808	Cdiooblp.exe
1976	Ckcgkldl.exe
3576	Camphf32.exe
2716	Ckedalaj.exe
3916	Daolnf32.exe
4000	Dhidjpqc.exe
1856	Docmgjhp.exe
444	Dlgmpogj.exe
4764	Dbaemi32.exe
2464	Deoaid32.exe
1208	Dlijfneg.exe
2920	Dccbbhld.exe
2172	Dddojq32.exe
3572	Dllfkn32.exe
3868	Dceohhja.exe
3168	Dedkdcie.exe
544	Dlncan32.exe
2140	Echknh32.exe
2236	Eaklidoi.exe
4900	Elppfmoo.exe
2468	Eoolbinc.exe
4368	Eamhodmf.exe
2600	Elbmlmml.exe
1384	Eekaebcm.exe
4116	Eleiam32.exe
3080	Eocenh32.exe
3564	Ehljfnpn.exe
5060	Eepjpb32.exe
3736	Ehnglm32.exe
2056	Febgea32.exe
4424	Fllpbldb.exe
3996	Faihkbci.exe
668	Flnlhk32.exe
1356	Fakdpb32.exe
3068	Fhemmlhc.exe
4528	Fooeif32.exe
3464	Ffimfqgm.exe
2476	Fkffog32.exe
3812	Fcmnpe32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ngbpidjh.exe	Ndcdmikd.exe
File created	C:\Windows\SysWOW64\Kgngca32.dll	Qjoankoi.exe
File created	C:\Windows\SysWOW64\Bmkjkd32.exe	Bnhjohkb.exe
File opened for modification	C:\Windows\SysWOW64\Ngmgne32.exe	Ndokbi32.exe
File created	C:\Windows\SysWOW64\Dqfhilhd.dll	Aepefb32.exe
File created	C:\Windows\SysWOW64\Nbgngp32.dll	Dejacond.exe
File created	C:\Windows\SysWOW64\Nekfmb32.dll	Hflcbngh.exe
File opened for modification	C:\Windows\SysWOW64\Iemppiab.exe	Ifjodl32.exe
File opened for modification	C:\Windows\SysWOW64\Mcmabg32.exe	Miemjaci.exe
File created	C:\Windows\SysWOW64\Pcppfaka.exe	Pqbdjfln.exe
File created	C:\Windows\SysWOW64\Jedeph32.exe	Jbeidl32.exe
File created	C:\Windows\SysWOW64\Gfpggnan.dll	Echknh32.exe
File created	C:\Windows\SysWOW64\Coffpf32.dll	Ndcdmikd.exe
File created	C:\Windows\SysWOW64\Eeijge32.dll	Angddopp.exe
File created	C:\Windows\SysWOW64\Kjqkei32.dll	Ipnjab32.exe
File opened for modification	C:\Windows\SysWOW64\Ndcdmikd.exe	Nphhmj32.exe
File created	C:\Windows\SysWOW64\Kmcjho32.dll	Ndhmhh32.exe
File opened for modification	C:\Windows\SysWOW64\Aqppkd32.exe	Anadoi32.exe
File opened for modification	C:\Windows\SysWOW64\Baaplhef.exe	Bldgdago.exe
File created	C:\Windows\SysWOW64\Kbfbkj32.exe	Kpgfooop.exe
File opened for modification	C:\Windows\SysWOW64\Lfkaag32.exe	Lpqiemge.exe
File created	C:\Windows\SysWOW64\Chmhoe32.dll	Oneklm32.exe
File created	C:\Windows\SysWOW64\Lmbmibhb.exe	Lekehdgp.exe
File created	C:\Windows\SysWOW64\Ndcdmikd.exe	Nphhmj32.exe
File opened for modification	C:\Windows\SysWOW64\Olfobjbg.exe	Oflgep32.exe
File created	C:\Windows\SysWOW64\Kboeke32.dll	Adgbpc32.exe
File opened for modification	C:\Windows\SysWOW64\Menjdbgj.exe	Mcpnhfhf.exe
File created	C:\Windows\SysWOW64\Oqhacgdh.exe	Ojoign32.exe
File created	C:\Windows\SysWOW64\Acnlgp32.exe	Aqppkd32.exe
File opened for modification	C:\Windows\SysWOW64\Aeopki32.exe	af4b9ed2848ef43503c30249c56dbf55da8a800c22ee759f975a346590260f19.exe
File created	C:\Windows\SysWOW64\Gfngap32.exe	Gcojed32.exe
File created	C:\Windows\SysWOW64\Feibedlp.dll	Ambgef32.exe
File created	C:\Windows\SysWOW64\Deoaid32.exe	Dbaemi32.exe
File opened for modification	C:\Windows\SysWOW64\Miifeq32.exe	Menjdbgj.exe
File created	C:\Windows\SysWOW64\Qddfkd32.exe	Qmmnjfnl.exe
File created	C:\Windows\SysWOW64\Klgqcqkl.exe	Kemhff32.exe
File created	C:\Windows\SysWOW64\Flfelggh.dll	Mdhdajea.exe
File created	C:\Windows\SysWOW64\Qcgffqei.exe	Qddfkd32.exe
File created	C:\Windows\SysWOW64\Ohmoom32.dll	Daconoae.exe
File created	C:\Windows\SysWOW64\Ifjodl32.exe	Ickchq32.exe
File opened for modification	C:\Windows\SysWOW64\Jmhale32.exe	Jfoiokfb.exe
File created	C:\Windows\SysWOW64\Cfmajipb.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Cajolcjk.dll	Ehljfnpn.exe
File created	C:\Windows\SysWOW64\Pacghh32.dll	Ilghlc32.exe
File created	C:\Windows\SysWOW64\Deimfpda.dll	Lpebpm32.exe
File created	C:\Windows\SysWOW64\Ladjgikj.dll	Ofnckp32.exe
File created	C:\Windows\SysWOW64\Pnonbk32.exe	Pfhfan32.exe
File created	C:\Windows\SysWOW64\Ghngib32.dll	Pmdkch32.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Bnbmefbg.exe
File opened for modification	C:\Windows\SysWOW64\Cnicfe32.exe	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Ihoofe32.dll	Iemppiab.exe
File opened for modification	C:\Windows\SysWOW64\Lgmngglp.exe	Llgjjnlj.exe
File created	C:\Windows\SysWOW64\Fpkknm32.dll	Ndfqbhia.exe
File created	C:\Windows\SysWOW64\Himldi32.exe	Hcpclbfa.exe
File opened for modification	C:\Windows\SysWOW64\Imfdff32.exe	Ieolehop.exe
File opened for modification	C:\Windows\SysWOW64\Mpjlklok.exe	Mmlpoqpg.exe
File created	C:\Windows\SysWOW64\Njqmepik.exe	Ngbpidjh.exe
File created	C:\Windows\SysWOW64\Bneljh32.dll	Bnkgeg32.exe
File opened for modification	C:\Windows\SysWOW64\Bdolhc32.exe	Baaplhef.exe
File created	C:\Windows\SysWOW64\Dqlbaq32.dll	Gcojed32.exe
File opened for modification	C:\Windows\SysWOW64\Odapnf32.exe	Onhhamgg.exe
File created	C:\Windows\SysWOW64\Ibaabn32.dll	Ajckij32.exe
File created	C:\Windows\SysWOW64\Oepgml32.dll	Abemjmgg.exe
File created	C:\Windows\SysWOW64\Hhkephlb.dll	Faihkbci.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9104	9024	WerFault.exe	385

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhicommo.dll"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckmllpik.dll"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gcojed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbnamnpl.dll"	Pfjcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pcbmka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Olfobjbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daolnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gbdgfa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mgfqmfde.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pqknig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pcppfaka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmjfkopm.dll"	Ffimfqgm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngdmod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdeflhhf.dll"	Nggjdc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pmdkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmmblqfc.dll"	Pcppfaka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblnkg32.dll"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chdfonda.dll"	Gdjjckag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Helfik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Allebf32.dll"	Lekehdgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cbqlfkmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cklaknjd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jpppnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhaomhld.dll"	Klgqcqkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ocbddc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cbqlfkmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Febgea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpnaemnl.dll"	Hoiafcic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bneljh32.dll"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbpbca32.dll"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgmngglp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nilcjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndcdmikd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmpmkplp.dll"	Jpijnqkp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kbceejpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pjeoglgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkgldj32.dll"	Behbag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ehnglm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ibjjhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lbdolh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dedkdcie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iemppiab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lekehdgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldjicq32.dll"	Gkmlofol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iefioj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pemfincl.dll"	Njnpppkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiglalpk.dll"	Aaepqjpd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Alkdnboj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnepdqjg.dll"	Elppfmoo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Helfik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hecmijim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hbgmcnhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdeoemeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lpebpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aeopki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjihje32.dll"	Dedkdcie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gkoiefmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdkcde32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 4548	212	af4b9ed2848ef43503c30249c56dbf55da8a800c22ee759f975a346590260f19.exe	84
PID 212 wrote to memory of 4548	212	af4b9ed2848ef43503c30249c56dbf55da8a800c22ee759f975a346590260f19.exe	84
PID 212 wrote to memory of 4548	212	af4b9ed2848ef43503c30249c56dbf55da8a800c22ee759f975a346590260f19.exe	84
PID 4548 wrote to memory of 3120	4548	Aeopki32.exe	85
PID 4548 wrote to memory of 3120	4548	Aeopki32.exe	85
PID 4548 wrote to memory of 3120	4548	Aeopki32.exe	85
PID 3120 wrote to memory of 4636	3120	Angddopp.exe	86
PID 3120 wrote to memory of 4636	3120	Angddopp.exe	86
PID 3120 wrote to memory of 4636	3120	Angddopp.exe	86
PID 4636 wrote to memory of 1372	4636	Aaepqjpd.exe	87
PID 4636 wrote to memory of 1372	4636	Aaepqjpd.exe	87
PID 4636 wrote to memory of 1372	4636	Aaepqjpd.exe	87
PID 1372 wrote to memory of 2976	1372	Adcmmeog.exe	88
PID 1372 wrote to memory of 2976	1372	Adcmmeog.exe	88
PID 1372 wrote to memory of 2976	1372	Adcmmeog.exe	88
PID 2976 wrote to memory of 1176	2976	Alkdnboj.exe	89
PID 2976 wrote to memory of 1176	2976	Alkdnboj.exe	89
PID 2976 wrote to memory of 1176	2976	Alkdnboj.exe	89
PID 1176 wrote to memory of 3128	1176	Abemjmgg.exe	90
PID 1176 wrote to memory of 3128	1176	Abemjmgg.exe	90
PID 1176 wrote to memory of 3128	1176	Abemjmgg.exe	90
PID 3128 wrote to memory of 1312	3128	Bhaebcen.exe	91
PID 3128 wrote to memory of 1312	3128	Bhaebcen.exe	91
PID 3128 wrote to memory of 1312	3128	Bhaebcen.exe	91
PID 1312 wrote to memory of 1956	1312	Bbgipldd.exe	92
PID 1312 wrote to memory of 1956	1312	Bbgipldd.exe	92
PID 1312 wrote to memory of 1956	1312	Bbgipldd.exe	92
PID 1956 wrote to memory of 1036	1956	Bhdbhcck.exe	93
PID 1956 wrote to memory of 1036	1956	Bhdbhcck.exe	93
PID 1956 wrote to memory of 1036	1956	Bhdbhcck.exe	93
PID 1036 wrote to memory of 1264	1036	Bnnjen32.exe	94
PID 1036 wrote to memory of 1264	1036	Bnnjen32.exe	94
PID 1036 wrote to memory of 1264	1036	Bnnjen32.exe	94
PID 1264 wrote to memory of 4968	1264	Behbag32.exe	96
PID 1264 wrote to memory of 4968	1264	Behbag32.exe	96
PID 1264 wrote to memory of 4968	1264	Behbag32.exe	96
PID 4968 wrote to memory of 2908	4968	Blbknaib.exe	97
PID 4968 wrote to memory of 2908	4968	Blbknaib.exe	97
PID 4968 wrote to memory of 2908	4968	Blbknaib.exe	97
PID 2908 wrote to memory of 1764	2908	Bejogg32.exe	98
PID 2908 wrote to memory of 1764	2908	Bejogg32.exe	98
PID 2908 wrote to memory of 1764	2908	Bejogg32.exe	98
PID 1764 wrote to memory of 1016	1764	Bldgdago.exe	99
PID 1764 wrote to memory of 1016	1764	Bldgdago.exe	99
PID 1764 wrote to memory of 1016	1764	Bldgdago.exe	99
PID 1016 wrote to memory of 3328	1016	Baaplhef.exe	100
PID 1016 wrote to memory of 3328	1016	Baaplhef.exe	100
PID 1016 wrote to memory of 3328	1016	Baaplhef.exe	100
PID 3328 wrote to memory of 568	3328	Bdolhc32.exe	102
PID 3328 wrote to memory of 568	3328	Bdolhc32.exe	102
PID 3328 wrote to memory of 568	3328	Bdolhc32.exe	102
PID 568 wrote to memory of 464	568	Boepel32.exe	103
PID 568 wrote to memory of 464	568	Boepel32.exe	103
PID 568 wrote to memory of 464	568	Boepel32.exe	103
PID 464 wrote to memory of 1860	464	Cbqlfkmi.exe	104
PID 464 wrote to memory of 1860	464	Cbqlfkmi.exe	104
PID 464 wrote to memory of 1860	464	Cbqlfkmi.exe	104
PID 1860 wrote to memory of 3180	1860	Ceoibflm.exe	105
PID 1860 wrote to memory of 3180	1860	Ceoibflm.exe	105
PID 1860 wrote to memory of 3180	1860	Ceoibflm.exe	105
PID 3180 wrote to memory of 2660	3180	Cklaknjd.exe	106
PID 3180 wrote to memory of 2660	3180	Cklaknjd.exe	106
PID 3180 wrote to memory of 2660	3180	Cklaknjd.exe	106
PID 2660 wrote to memory of 636	2660	Cafigg32.exe	107

C:\Users\Admin\AppData\Local\Temp\af4b9ed2848ef43503c30249c56dbf55da8a800c22ee759f975a346590260f19.exe
"C:\Users\Admin\AppData\Local\Temp\af4b9ed2848ef43503c30249c56dbf55da8a800c22ee759f975a346590260f19.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\SysWOW64\Aeopki32.exe
  C:\Windows\system32\Aeopki32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\SysWOW64\Angddopp.exe
    C:\Windows\system32\Angddopp.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3120
  - - C:\Windows\SysWOW64\Aaepqjpd.exe
      C:\Windows\system32\Aaepqjpd.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4636
    - - C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1372
      - C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1176
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1036
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1764
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1016
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:568
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        23⤵
        Executes dropped EXE
        
        PID:636
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        24⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        25⤵
        Executes dropped EXE
        
        PID:2320
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        26⤵
        Executes dropped EXE
        
        PID:3460
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        27⤵
        Executes dropped EXE
        
        PID:808
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1976
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3576
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        30⤵
        Executes dropped EXE
        
        PID:2716
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3916
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4000
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        33⤵
        Executes dropped EXE
        
        PID:1856
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:444
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4764
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        36⤵
        Executes dropped EXE
        
        PID:2464
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1208
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        38⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        39⤵
        Executes dropped EXE
        
        PID:2172
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3572
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        41⤵
        Executes dropped EXE
        
        PID:3868
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3168
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:544
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2140
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        45⤵
        Executes dropped EXE
        
        PID:2236
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        47⤵
        Executes dropped EXE
        
        PID:2468
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        48⤵
        Executes dropped EXE
        
        PID:4368
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        49⤵
        Executes dropped EXE
        
        PID:2600
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        50⤵
        Executes dropped EXE
        
        PID:1384
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        51⤵
        Executes dropped EXE
        
        PID:4116
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        52⤵
        Executes dropped EXE
        
        PID:3080
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3564
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        54⤵
        Executes dropped EXE
        
        PID:5060
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3736
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2056
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        57⤵
        Executes dropped EXE
        
        PID:4424
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3996
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        59⤵
        Executes dropped EXE
        
        PID:668
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        60⤵
        Executes dropped EXE
        
        PID:1356
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3068
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        62⤵
        Executes dropped EXE
        
        PID:4528
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3464
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        64⤵
        Executes dropped EXE
        
        PID:2476
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        65⤵
        Executes dropped EXE
        
        PID:3812
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        66⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        67⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        68⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1800
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        69⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        70⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        71⤵
        
        PID:428
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        72⤵
        Modifies registry class
        
        PID:624
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        73⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        74⤵
        Modifies registry class
        
        PID:4452
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        75⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        76⤵
        Modifies registry class
        
        PID:4132
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        77⤵
        
        PID:436
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        78⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        79⤵
        
        PID:408
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2360
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        81⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1584
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        83⤵
        Modifies registry class
        
        PID:3376
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        84⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        85⤵
        Drops file in System32 directory
        
        PID:776
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        86⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2016
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        88⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        89⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        90⤵
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5180
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        93⤵
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        94⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        95⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        96⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        98⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        99⤵
        Drops file in System32 directory
        
        PID:5532
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        100⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        101⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        102⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        103⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5756
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        105⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5816
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        106⤵
        Drops file in System32 directory
        
        PID:5864
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        107⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        108⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6020
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6056
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6116
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        112⤵
        Drops file in System32 directory
        
        PID:5160
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5228
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        114⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        115⤵
        Drops file in System32 directory
        
        PID:5408
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        116⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        117⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        118⤵
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5768
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        120⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5932
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        122⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        123⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        124⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        125⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5464
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        127⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        128⤵
        Modifies registry class
        
        PID:5888
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        129⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        130⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        131⤵
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        132⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        133⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6000
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        136⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        137⤵
        Drops file in System32 directory
        
        PID:6048
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        138⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        139⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        140⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        141⤵
        Modifies registry class
        
        PID:6172
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        142⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        143⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        144⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        145⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6392
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        147⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        148⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6476
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        149⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        150⤵
        Drops file in System32 directory
        
        PID:6564
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        151⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        152⤵
        Drops file in System32 directory
        
        PID:6648
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        153⤵
        Modifies registry class
        
        PID:6688
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        154⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        155⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6776
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        156⤵
        Modifies registry class
        
        PID:6812
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        157⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6900
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        159⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6988
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        161⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        162⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        163⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7156
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        165⤵
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6256
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        167⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        168⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        169⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6540
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        171⤵
        Drops file in System32 directory
        
        PID:6596
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        172⤵
        Drops file in System32 directory
        
        PID:6676
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        173⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        174⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        175⤵
        Drops file in System32 directory
        
        PID:6876
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        176⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        177⤵
        Modifies registry class
        
        PID:7016
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        178⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6184
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        180⤵
        Drops file in System32 directory
        
        PID:6252
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        181⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6352
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        182⤵
        Drops file in System32 directory
        
        PID:6460
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        183⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        184⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        185⤵
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        186⤵
        Modifies registry class
        
        PID:6928
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        187⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6984
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        189⤵
        Drops file in System32 directory
        
        PID:4596
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        190⤵
        Modifies registry class
        
        PID:7148
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        191⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        192⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        193⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        194⤵
        Drops file in System32 directory
        
        PID:4456
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        195⤵
        Modifies registry class
        
        PID:4820
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        196⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6656
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        198⤵
        Drops file in System32 directory
        
        PID:3452
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        199⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        200⤵
        Modifies registry class
        
        PID:3952
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        201⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1460
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        203⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5736
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        205⤵
        Drops file in System32 directory
        
        PID:6420
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        206⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7268
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        208⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        209⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        210⤵
        Modifies registry class
        
        PID:7404
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        211⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        212⤵
        Drops file in System32 directory
        
        PID:7496
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        213⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        214⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        215⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        216⤵
        Modifies registry class
        
        PID:7676
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        217⤵
        Modifies registry class
        
        PID:7720
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        218⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7764
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7804
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7848
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        221⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        222⤵
        Drops file in System32 directory
        
        PID:7944
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        223⤵
        Modifies registry class
        
        PID:7988
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        224⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8072
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        226⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        227⤵
        Modifies registry class
        
        PID:8160
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        228⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        229⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        230⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7392
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        232⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        233⤵
        Drops file in System32 directory
        
        PID:7524
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        234⤵
        Drops file in System32 directory
        
        PID:7596
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        235⤵
        Drops file in System32 directory
        
        PID:7620
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        236⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7748
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        238⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        239⤵
        Drops file in System32 directory
        
        PID:7896
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        240⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        241⤵
        Drops file in System32 directory
        
        PID:8036
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8084
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        243⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7232
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7336
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        246⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        247⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7636
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        249⤵
        Modifies registry class
        
        PID:7760
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        250⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        251⤵
        Modifies registry class
        
        PID:7956
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8012
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        253⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        254⤵
        Drops file in System32 directory
        
        PID:7204
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        255⤵
        Modifies registry class
        
        PID:7428
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7580
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        257⤵
        Drops file in System32 directory
        
        PID:7740
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        258⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        259⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        260⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        261⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        262⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6152
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        263⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        264⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        265⤵
        Modifies registry class
        
        PID:7612
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        266⤵
        Modifies registry class
        
        PID:7308
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        267⤵
        Modifies registry class
        
        PID:7672
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6520
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        269⤵
        Drops file in System32 directory
        
        PID:7880
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6552
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        271⤵
        Modifies registry class
        
        PID:7888
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        272⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        273⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        274⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        275⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        276⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8360
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        277⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8472
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        279⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        280⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8592
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8644
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        283⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        284⤵
        Drops file in System32 directory
        
        PID:8724
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        285⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        286⤵
        Modifies registry class
        
        PID:8812
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        287⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8900
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        289⤵
        Drops file in System32 directory
        
        PID:8932
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8980
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        291⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9024 -s 408
        292⤵
        Program crash
        
        PID:9104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 9024 -ip 9024
1⤵
PID:9080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaepqjpd.exe

Filesize
117KB

MD5
eafd3b4377581fffe1fc9c9df3e6adc7

SHA1
a8703f664c7de8c293e9ea2783a1d8e4f9069e01

SHA256
892ba9f72fbbf922736469ed7fc5c21b288c18734ef723f5b779a2684e623ded

SHA512
4917ea5154eefbf99dacce118eadacbaec2c918514fc108727f76ae0dff3645cd85834efcb10b2bb1cac8016f4ce3653852cb439631ccd09d9345ce968538a86

Download Submit
C:\Windows\SysWOW64\Abemjmgg.exe

Filesize
117KB

MD5
50278c24d0be9f63e6392677c8a62ef3

SHA1
7616af51e2f60509c32fe7e1c6874c4d0c7f6cbc

SHA256
7908fc7eb49dc06bcb9afd43b456bb5969163e04c900c058b5a734cdb8a2c0c0

SHA512
d3f066caebb2d5e40c03282206ddd5ea0f2cb331f6bf365ffb63ef626d8425b64aefa70964e0e7cdbeae952880e77ff0489592053468c5f918b15c946892b9d9

Download Submit
C:\Windows\SysWOW64\Adcmmeog.exe

Filesize
117KB

MD5
d2708b6db02dee1b17daff684a1d15d4

SHA1
51fa98dbc86af6d975d68f3b99ea927bdbc7058e

SHA256
ffc3cd6207a9c7a58a5b6def2a3367c8e52038317631275bd6c9386adc2e039a

SHA512
c334ba9601dd7dde03eb0ddb1be06aadb225a9123d12fee2a17607da609716db3383114b74a2cbff6fb847ee916011b659804f6ac7ebcb5e3b948e59902c422d

Download Submit
C:\Windows\SysWOW64\Aeopki32.exe

Filesize
117KB

MD5
3375aca1e1a0d4b5335b3712c08e3fba

SHA1
05ceb3ee3a8042a23b05d7408119be814ad9c0bc

SHA256
412bc76a7fd276f44553f5eb67d773bda7a49e478e32718075ac7df2479682d6

SHA512
d2780bfa430e0a68a2ac9ecfb0ba68760af296805faea21405654eac67b64223ddffcc8bec4dafcd80a8a534b426a598ed91eb5e69a76118d5bfa5bc45bf99af

Download Submit
C:\Windows\SysWOW64\Alkdnboj.exe

Filesize
117KB

MD5
e261856195b680ef1fd325f7c914eeee

SHA1
a84f31c3f0901f0e06bcf2f21d2b3b2e825f514e

SHA256
56682c4e94b5da20797fdc0d00e67ad06a20d49519c4623172bafb2b7818fd46

SHA512
fe1cb61c6c7dc4b6a83737e609be593959a6c7ada0035e11d1434f9fcfa71346319107a1f4ced8fc569c7bde1668b96afbe5da9ce4f2da5c0e61d20272c13440

Download Submit
C:\Windows\SysWOW64\Angddopp.exe

Filesize
117KB

MD5
0ae8559c4af7221604ce693242147609

SHA1
675dd9a046cf60a4e27ff178437e0e14cb79aaf1

SHA256
30b3f6459917080a24fed8d65313fad9d7034627f98fecfc809c765293251d39

SHA512
14c5e844b41652f88b9ff1975cf7945be6eb7d56711610c35eaaedcc05aacc8ee87b0773f3fe9a6c2b70d0d970656bf2287ccfbc77693ffa39cd40bd8522ad02

Download Submit
C:\Windows\SysWOW64\Baaplhef.exe

Filesize
117KB

MD5
701fda473e5ee509b6c48ddbaecd6fcc

SHA1
f237d25be57ac1ed5cf14b7da2a58b3033622c49

SHA256
5b9f0cd5fdb35a04e4735451005e6eee3632956be8b2666fd2730d87e4ba5ad4

SHA512
a3f2c66be7c9c2b8324efafb9bbf8e72b9f6c186371f73bd124e5f1da4c6a30fbaed153722ca7ea1d3d1c8cb4b5dd3dcee47350fd38e67706d59af907697d9c7

Download Submit
C:\Windows\SysWOW64\Bbgipldd.exe

Filesize
117KB

MD5
71fb73a7c12e40564d7191e88725a3f4

SHA1
9cebf50c04cab48c9c8c0db6b8afbf3d2e6a7922

SHA256
e79273b93c1b15781a27c4d319086267db1069d7410ee071558245122c95b5e9

SHA512
739b01a5919b86d9f999d896b3183cc90f9cad3b12dde00567258f8d34ffae6692600a2066c3b208e65d278892b11a34ca824543244831f2122fadcefb3d296f

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
117KB

MD5
a5838624873c826ecc9d48dd4e8735d9

SHA1
eb0e796d66225822b4a3322329d22336585ffb44

SHA256
98c808567f53e524c35695c57b2c09651aa6a46d48fcf4b051a38565b59953e1

SHA512
dd677ba92615b79b34a35b04aa96245f490068efe5ef7c442925a6a93d5f53260b9827a9c2e72bfb263c30702d2ea0fced4b8a0af099d5398f3f595f41334654

Download Submit
C:\Windows\SysWOW64\Bdolhc32.exe

Filesize
117KB

MD5
1ae76b24cbc396464eb87ebfe2c4846c

SHA1
1d7a304ee47ab5efb66d3fcc44c203334f92406b

SHA256
7b04b83a89e816cd522943611c05d223bf93f07ef30c454b4cdde9921cc1db58

SHA512
c23051bee86b9b099abc843a0998fab23811babd5550126ce7dd7c2fb30e03a98589cb60ab8f39e27424ff87c90048419bd84c07275ae3171580e55317250f28

Download Submit
C:\Windows\SysWOW64\Behbag32.exe

Filesize
117KB

MD5
7194a14fe1feb900af14463ea22cc010

SHA1
39062467e811978a4488e7213f90cb0470b0a03c

SHA256
c9ce8fac65765aa96575ac9e48f0edefe3fc2bf4cbccf95183516cb9200d35fe

SHA512
4a6f3abd0f59eef578b34b9b0f52815ae57f04394be84fff6527753a23da7ce38758c821cd26a5a72510ad1d80f1ea247238658473a1f4ebc6ede3bfdfd07d50

Download Submit
C:\Windows\SysWOW64\Beihma32.exe

Filesize
117KB

MD5
06c7726414fd354b3db2e1d5552dc09f

SHA1
82d0e43313edfea0927fef35dbfe287838d24b13

SHA256
b57cb9d543c753baf874316b35d07eefd0478be1b3b841b1e086ead0d33e146e

SHA512
6782cc90ef50d779320cd7c0ee328ee9c587cf07bd47a8dc674b4a969719d4c5c5ce777db798c5b5a9d2a521036778504e9761a5fc85c2466575e78929d30ee3

Download Submit
C:\Windows\SysWOW64\Bejogg32.exe

Filesize
117KB

MD5
b620d6ce1a0d00cbe6ea30fa66d5ea24

SHA1
e26100d2ceb03d06d3889be0e6fd228f8bdda6f1

SHA256
742391e23e2ce28e3986798686346422a677eb3918b0f7079a13259e886f920e

SHA512
2e083fd8edeaa507fc2893fad226606ead2f689d83137e72aac3de891d49eda680fe615ddbe5fc8e744ca35df2f8ee13576a149d80e44cf25303fdd6f8f261d5

Download Submit
C:\Windows\SysWOW64\Bhaebcen.exe

Filesize
117KB

MD5
d6894c6d8a8c5722d75d2a30d850cba0

SHA1
46e3e7e70b20b0a8e31b16dcfa64f7282e88e41a

SHA256
592ef3729145878b21bdb7ec34870281b156e0e13d90ea121383650d617c140e

SHA512
0974792b39e96f95459457eae6d7b63ad44b38f00bb1fea785424c319fce2980e10e9161f9de79568680ad90e1ad0ddc2319285628203cad39b1e92dbe392fb5

Download Submit
C:\Windows\SysWOW64\Bhdbhcck.exe

Filesize
117KB

MD5
3bf6216bd3e96c7edd56e6a685474033

SHA1
99d9be5cf669bee178989ac9e3f4200897312969

SHA256
4711304cca94e280a3445eba561ee7d85d2c042333cc9301f343c285a646882d

SHA512
4f1a0fee98de00936b98a0d1f2aa5d86f842223c3934849bb25090ab202e9dc974099d606f04227c553c24787d422e2f86f17b17dfd1d1e490ce5173ccee9559

Download Submit
C:\Windows\SysWOW64\Blbknaib.exe

Filesize
117KB

MD5
3c4fbe4c0a9be5527def703a08b3e580

SHA1
2649c3c66968d0e5915da8cc85e5b6b1a6efcd4f

SHA256
97600defbfb6f6361e6ae1e6a45ea083a9d15785d3218d8f052d330fe9949bce

SHA512
e33422a6fce8522766f4ee46beb4c33359c08c87355e2b6b7b4900774c406642dcf8d25dca8b1f00ba21fd8055733b503779b68ca4b4774e8aa998d7b0df416e

Download Submit
C:\Windows\SysWOW64\Bldgdago.exe

Filesize
117KB

MD5
da1be6a0b7da23a9fd29d0898cc36c20

SHA1
38977e8555e01d15f31ca6215978a734cf3faa94

SHA256
630a576ab7b671cba6e29ff11db751f8df7959aeb8a3966f321ef98aef7950c0

SHA512
d38711862a67881f88eb6b271946373c48b4a350cd81cef31882317ecdcdc030d489916422d37e54c0d208d9d7b1f227e8e4953241b9d130a25fe70a29da15a5

Download Submit
C:\Windows\SysWOW64\Bnnjen32.exe

Filesize
117KB

MD5
1799765d19f11e9cb66013c6877fd887

SHA1
ea3256545883be1ffcfe8220e4e9d34d75fc3cd6

SHA256
3d865c2a51b317a130b73c3ee4e8310caa60673b9b92b0d0e61ae643d9194423

SHA512
4749496b3899ae613b33d4000f4f413714969b2844107462ae41fdf0ded433c0c0d472b46cc83627bc41b796512b483eddd91506f0d19f15594a75ba968dd847

Download Submit
C:\Windows\SysWOW64\Boepel32.exe

Filesize
117KB

MD5
6514e608652397bab2c0c426c6c6b71f

SHA1
dcde4e14b476cc8628ec813ee4afcff091658f76

SHA256
bab012550afb4835558b8c8f56cce8c6f64b9d9b8a83a91f4d3a5d83cdd10216

SHA512
1c2e835a5ee8c8e2f0d5ac970800efe213fbfa9be2957836536afce6d7c05f39dbdf70627ce299aac903893ff60aa06278c29a11b91076db2c02357911edb374

Download Submit
C:\Windows\SysWOW64\Cafigg32.exe

Filesize
117KB

MD5
a246a1b1da69fed871f9c0866c72712a

SHA1
c1a037c6ce741c2a15fd0f1b2e26fd5b99526c1e

SHA256
5695ef018d183d05b3b9f462803511502e41825c8d44a6ceb41c984aa55f5053

SHA512
f27568fc98b6b18de0c59ce20f05ba9227ed9a69a651efc7e5170f3fa47e015d6510552207d515130deb5c6539e6b7eca04a9d59620ce0ca60177511569a09a7

Download Submit
C:\Windows\SysWOW64\Camphf32.exe

Filesize
117KB

MD5
1bc8d58424060ee1a9807930303531a2

SHA1
ea478b4876dc80a7054090b027389617ac0fffd0

SHA256
5e64dedb6c0c270eba51ce65a12e7719736f5f02b8aed8a955ae309ce7b2c721

SHA512
9f7d5b2685475efe0e9ca91b1295b4286cc0c0aea0e7ec088f28fa58ccdea07774893c574083828a469ba06f74c2de75d3bf06bb6e73a3d85a50338972475b30

Download Submit
C:\Windows\SysWOW64\Cbefaj32.exe

Filesize
117KB

MD5
ba4c642480e1b024816d704dea934761

SHA1
2e031fb2fef77d7929147d6537dde7e72e4dc9ec

SHA256
8be8eb973303672f6d350271225f49ee39d4619c55b5cc92c109fe6f6ef8dfbc

SHA512
27e1fe07bb22b775400962aec39309038808fa9417401a8dae7f260abc7db1d1a55e339d554833dcc2d375c590dea69c7582a899e64144f0313f7ab1570eb1b6

Download Submit
C:\Windows\SysWOW64\Cbqlfkmi.exe

Filesize
117KB

MD5
d13298f3558ad8335509c88a248214b2

SHA1
37afb24790b7ea111af75988c2bde6e3e5058174

SHA256
2ac84e1cfa976f8398c153bc1203895cab38a6ade032988a6aade3069c4d7741

SHA512
3fc486940826d67637c022ad4349678c413323cb0ee9a16f4dbfaf3c4dcdaa8e6233628a6470c760ac0f0d6d564ee678553882286516a5ff01bd0c005aa9b35e

Download Submit
C:\Windows\SysWOW64\Cdabcm32.exe

Filesize
117KB

MD5
1a73c05553e0cf8fd09fb62b0586302b

SHA1
27a855b8329e89b869249df4372724808cb9fba7

SHA256
6353242d6e965d0c6f9e661a4d820089a42903a05c39425b88d145298300c71b

SHA512
9f68a4eca5781565a7f58fd82f25e2ec10bc5b68ae9550a85484b01e86a686e9c9a3939bed8d7dcc919795fe836ad7ee9293751bfde5879bf43eb6412658cb86

Download Submit
C:\Windows\SysWOW64\Cddecc32.exe

Filesize
117KB

MD5
c5c0aa1ad59bb72cc79ae0bf4277e6f1

SHA1
c2703ea20de7c756779e3eb4fc21d71080f32698

SHA256
caf407901895cccd554b01c3992d8d6cb8bd98e56c835ab09d50e144a1c7f357

SHA512
ccfd71eb3d72fc7abd12b028f8e96b7040dc1f941482b414f79b077f7bed3c7f6255bb3fe7b8aafa240ee78a8c4deaa1b35959595f0079bcfeffe664c7913b5f

Download Submit
C:\Windows\SysWOW64\Cdiooblp.exe

Filesize
117KB

MD5
f6b9f97b29a9499e1058ce207cf7dda4

SHA1
c9d1a1976815fef81ee1557750ebfb7bdc1d4e3d

SHA256
82a898352fb6a1a729f4e9589bff9d636e0f09edcfa06d45fb225d7c9f7e2ab4

SHA512
32c12f02d319ac77941de299f0fc4e21a9c19d880adda5cab2550e4e73a7d10236e5ab85028ce4827b337b99de05997ad2969c1766effe08d21f7b0111bb3077

Download Submit
C:\Windows\SysWOW64\Ceoibflm.exe

Filesize
117KB

MD5
367f6ef5e47a610b7fa740fe4b10b970

SHA1
d37b152e08ba75a5d92f7b4e2f993f21c49364f7

SHA256
37792b45c59e42bfeeb135a0b00fa23ac4cc27ab1ca53621707fef009ce5adea

SHA512
c3f38ce3f9a0a2430a3940ab0e71837bdfd5f6f533165c343cd37a88158b844f28963b602b5a32390be78adbd706aa99affdf33bdf9e309c23981d8662515fc6

Download Submit
C:\Windows\SysWOW64\Chbnia32.exe

Filesize
117KB

MD5
08e8bcb40aef96cc37829dcc921674e4

SHA1
64437a648bf90080a8fae4ba4dfd03bc852128e2

SHA256
32ae1e1d54e96f2cea2931cfd651f71b573ead3774750e3af7d97c692a06b690

SHA512
31560ea48921213fb9329af5deb414586ce713b857ef34900a12047d0b178ba87b7c7e7e41c3029d6416ada7197fdbb8419009fd0227102f0843c93a1879b3f8

Download Submit
C:\Windows\SysWOW64\Ckcgkldl.exe

Filesize
117KB

MD5
6ba13b45862cb842e6dcf27ab9bbe78d

SHA1
4419cbc6ef3bd66b8ee8e0c7cfae5adb79e6fa56

SHA256
1b2ff070e3f5d57822d87b371962dabeba5779f596cb6d50c25d6b49b93c9da5

SHA512
e0ffb3bff3e29e12fc493314517f8ddf602e507d4419d3b895c5576cb90540ac28996b14420f9c0fea5567c9e13e300d20065cf80d615dd52645520b44324a2e

Download Submit
C:\Windows\SysWOW64\Ckedalaj.exe

Filesize
117KB

MD5
6a4079219b0b9ab8973f38463f412ecb

SHA1
aed366ddfdd4e7fbe3a685e18a74c984f1426173

SHA256
6037679f49c26648e91505299e2d622182995fda6eded3e94309a09cfa3ad733

SHA512
e503e955aea2505e6c231ccc4b85e22acb7d3950ee2e5ca266f04a7df494aaff343fe615ed7cc1c5cd5cb669467c48ccac6039185810446189723d5ef6739727

Download Submit
C:\Windows\SysWOW64\Cklaknjd.exe

Filesize
117KB

MD5
d22792374fd61488f72ee53e3b8aede6

SHA1
4be3852e318448053ca420bf1962c58103b4d42e

SHA256
ba4d2e25c7e2eb8201c2978cb0e4427b4db4b08b9b2ac2b43c85eee734339a3e

SHA512
a767babf02dc40e9a8fdd3160e01ff5f213d5da1b240046f60ea853941b4376c3fa28c7efecca6e54c5647883a1191a9b962e645220381200afc798a3dc7f4a5

Download Submit
C:\Windows\SysWOW64\Colffknh.exe

Filesize
117KB

MD5
f25d68476131daf5dd9ff0dd04032c02

SHA1
b142544fbfaa136ba09e0101ddd06b3f3a7bfcc3

SHA256
85284c440944f8509c59e64be1cd1efe1e2eb0d83dba088d42ed5e0dda98e126

SHA512
fe8e70058e7e4b5c52e3ad8fbd347a407c3a16ea74d936b11eb313efa46f3cc77c5d8807ab1be02ea3d77907d73ca4fd26726f54d0ad941c5da611ccc2d88634

Download Submit
C:\Windows\SysWOW64\Daekdooc.exe

Filesize
117KB

MD5
0e7a7cfd73fc515b42214f0585c819b6

SHA1
09b361fd467c782e45a0b9c9c8bd7bd13963625f

SHA256
073be4b52f854d14a511f1ba783f6e272f38682a0ef350cd40f001ea36ee9d15

SHA512
b8705bc3519c583aa414f3a56d30cf56070085d1b6a777d04d46efac2bd2fec7fc3dd7917c8841b3edb8974398fbff16fcf77c5a29c958dc30dc95abc0a954b0

Download Submit
C:\Windows\SysWOW64\Daolnf32.exe

Filesize
117KB

MD5
dddcf18ccb7db472da77536547de1ea5

SHA1
f0d9982dee4d86f29efb68f9cc27376e0dce17b4

SHA256
ca252c458a51c70463ba48606467ed56c70224d3ed2ef5f7962d361b41bcdf98

SHA512
64d3215f231dbcd852177e530c1610cbcc295e7ef718bb2bde02ed4dc167df313c68158800685a635fd01e1b7e364a69d4bc80d95b566d74b576107804fd35c2

Download Submit
C:\Windows\SysWOW64\Dhidjpqc.exe

Filesize
117KB

MD5
87555406221d871aa09e245d0e202b47

SHA1
d3a950aa704780dca568effbd90c30ef878ab33f

SHA256
b3be39edc760e379ee0d01b51e63c9132b6aa62c20e787e49f37ca171e83fdbe

SHA512
c7ae0600b69ede02592102038590de2a1fc2dd43614e152126b9e1f4f1f6466dc435e8a3aeb5aff21c7594c9b57af6eac6110cc45264b9e46d956478b6f6ed36

Download Submit
C:\Windows\SysWOW64\Djdmffnn.exe

Filesize
117KB

MD5
79873835b3bccf9ae8d6c4d8543f43d7

SHA1
4be8db4839078504d1e5c8e3f9a0752fc6ce813f

SHA256
923170f1465694da8d7adc9f038e9304613881f798086bb59118a4199bde3680

SHA512
c34afe51c1678ef3c985d4bc3ead54eca87988e55a5abdd75f1871d9756f47396dd1a015801ca34868186a261114f26c6246bbecbf34042d98df400a4bd99665

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
117KB

MD5
41a369eac628dae0502294d6cdd471ff

SHA1
c006b89d5f4b6d351124ca606c081bf9d7c719b4

SHA256
71346ca6672db7b2d6c44fb1f518a6caf3103dbd3fdec7ce222f03f32711a680

SHA512
73ed5ea0a5330c52dc1d3ab2e329304e208aac100c0dd4a4c043e0a5212ca5f6e782c2df0fb9fb064b020d58ba30cb67978cda0df89d4f7d209d9dc1dde19b61

Download Submit
C:\Windows\SysWOW64\Docmgjhp.exe

Filesize
117KB

MD5
03b2e309b6ebc1ecabfcbeae53433145

SHA1
de357298b4580f9ba886cd6664883074d5ad0f33

SHA256
3dba037aa848cdd5640c5077e71275ea21c3df10c3675d5031fc960b2ec78e38

SHA512
33c072b485d70d941cae2ef0eb8773dcd4906d4b39cc97d28cbba1ca3b0e9fbaf2da92e021f81b3c0369fac19fa1074f2cda47dce2e2783e1b6d4f2a73cfc721

Download Submit
C:\Windows\SysWOW64\Elfana32.dll

Filesize
7KB

MD5
4e5c22f95d2761e993ca6f9178d2fbe8

SHA1
ca59d467db9308d4e777a85e42604ad9d7165a3a

SHA256
5fb34f3e369599d46273d9197f7b2c7eddd89807c62ac60d8812b531e49fce7d

SHA512
93b3e4d41d9027f4284b9c1f817aeba664adcb463fe044bf01b3e5392a4ffd244f2b0ed942a260ac4b084ef768a9f31bdbaf0711354f76c8ad62c0f4d83ea86c

Download Submit
C:\Windows\SysWOW64\Eocenh32.exe

Filesize
117KB

MD5
728bd3d4d91f5f9521dba4fc7c61e5ff

SHA1
361ec451a06222a992e4666ff185f9cc2ab44675

SHA256
4f46d949e715c9758ccdf22a4a55e03f1b0ceaf7548218de50ec666547ba83de

SHA512
64d2cd59f01db3107195e66f4f6a67c90c187384cfd3afffcac9269b6c7bcf83ff887f20a24065f3d9670a393e07f6954a1f227e3be7ec0f63223e90733577f5

Download Submit
C:\Windows\SysWOW64\Ffimfqgm.exe

Filesize
117KB

MD5
6e61c407047c0f1e003b065f96098f56

SHA1
342510d108cf2bbb0a96059e54b3b7f8882297b3

SHA256
fe4d1ff045c3710d7c5e0de705eaab90d682442c1bbb2cb8580c040144a1e684

SHA512
7069a4b414b72b5754e27301b3f3e7130f25bc2b3ca2dcbd74c57c2e978ce5cd7ef5facc8031409b265c8bbb53e8aad33a1086f207ca78c4de516241e3f10f71

Download Submit
C:\Windows\SysWOW64\Flnlhk32.exe

Filesize
117KB

MD5
474f19631e77a45e4d3249ca3ac8e9a1

SHA1
eec70524770fa758031f7b485b41c5c8f7d0f53c

SHA256
8afad897be4bdb11eb1e1a3f2e5d5fbaa10f0af26af1b589c345e561e2908434

SHA512
cc75be4dabfdaaf4d4a8d992ee4ee1a066888a208019fcc7a5d2996625676749791259fb76ad0023b469d4f036e65986abaeac2ab9c9994ba04151ee0a9bfd4f

Download Submit
C:\Windows\SysWOW64\Gfembo32.exe

Filesize
117KB

MD5
638a879cb52ab12bb069ad1036aa9670

SHA1
ccad8fb69568ca9a0483425339b87aa7152cb73c

SHA256
6940ae8d5e5a59a568e8a50e96e099088cd799539d4563d9ca1d0fb74d88610e

SHA512
7a6ea3eb582d5bd00f3ff0ae0612ba67e74d64e7951ae74aaf22bf58b37c4d7fa14153aa9826b8e0d7227a8aaf8ed7cb6bff5eac5d8a04635b246ef87476168d

Download Submit
C:\Windows\SysWOW64\Iicbehnq.exe

Filesize
117KB

MD5
6cc8efd5b5e04c42b4bcd80b88b9f5a6

SHA1
546dba086fcd3f021b17b20a74541c99fa2e183c

SHA256
2a3818d73f93b30081d85c9f173f16b3d0d664612abf751ecf54942f2dab7cd5

SHA512
3d98eb9d341e3b47dbc0c1bc92bdc35d99e7120278c9d4cfaf1b4bcf47bffe61a4b9768503ec45aa7e6982e65d3b64c79e88a6850ce153374ba3832c129ca91b

Download Submit
C:\Windows\SysWOW64\Klgqcqkl.exe

Filesize
117KB

MD5
074531e93772e829426c50217e1d53e1

SHA1
8bec06c425eaf1461cc9b3d9f794978cbdcd433b

SHA256
c352d744950abe059d97ba0ce581d19747fc6198d5994ef0cd65a68322f93c8c

SHA512
c27d9708ef25d405b617ff6744bad088ca2870cd9865c917c5220bb1507ead19f2aeef906a23f20111c5a9253fd7c4255db85cf3af3be2c8839abc1d61d8670c

Download Submit
C:\Windows\SysWOW64\Lekehdgp.exe

Filesize
117KB

MD5
0ebbb0a5c34cd9f63619a0349e955da0

SHA1
5ba2e7163bda5df3b2524cd79f26719bf670beb7

SHA256
b51ebc0898f774be7975d36f2de32d7fbbd627dbae4b6aceef5d6931f8426ad2

SHA512
b13d54ac748b00af45403318eaeb405eaa0f531fd69b87862627471d5bc4cee3011d235eb8998a06538fc83ce871c32f7474f754dea0d69ddcdd1c32ddabcf5f

Download Submit
C:\Windows\SysWOW64\Mgagbf32.exe

Filesize
64KB

MD5
da5c5c8f3907b9c040eea295a5387b31

SHA1
a204f3f026fe89b2762d7f7bede23759d722198b

SHA256
19f93d1060d0f5684b796bbf8f442296101959b21ec93516dc32465fdc07fad1

SHA512
eaad37e1f4c99ab42567a4d91ec0abfbe147870e80fc01c3830c8e2877c2073f098fc378e86bdd00321abfcedfe0190dabeea2e8d3db57221283d930af8e0a17

Download Submit
C:\Windows\SysWOW64\Ngmgne32.exe

Filesize
117KB

MD5
855db1f0ebe1f8d3036021c0f686cf55

SHA1
592e23a5faa83f3893d3b6122090fb7697ebddfd

SHA256
a2c44fc8d11b13fb42b7149ee108bbaaff69b18c02b8c526712172a2c7d88f80

SHA512
4682aaa624dca01e632b731db8c5a4fdf2bb76e23fd6c5088155d6e3fc6c30ef95f136550488428ea9cb379897e8e5dc7ced9d0e3b26a3569710fdb89e4bd090

Download Submit
C:\Windows\SysWOW64\Njnpppkn.exe

Filesize
117KB

MD5
2a864e27dbb85afd4fa16e2c833d74b4

SHA1
0180e3efd88141c05dfc3d22cf2f1c3a1b451832

SHA256
219221f4a75b6e688ec37061153171ea6dc0199a1a52df744d156f4fbd41f039

SHA512
231a2b1398c5872d2139ec52b86f0b614c316f74c9edebe7873a267cb5fb80f79d71995aac18f8ed283f89ad528989e0761a801664b9eed0fe3ad1116dc345bd

Download Submit
C:\Windows\SysWOW64\Olcbmj32.exe

Filesize
117KB

MD5
596edb78c5892fe49333b616b3c73946

SHA1
f37e7f70f6eb278f4457fbae77063e94869b9a78

SHA256
cb0384ba331cf373a7cd121858b17e97b5b2d671f49e8bf768b55b40580bb9d2

SHA512
12302e33479e833c6a598724694b2828e18a8ae829bc10525f3142c27eda8f7d5b0f7093ab7780aa4a4ddc2936245db6cfb4169a9597c9d445eae9092b6287f2

Download Submit
C:\Windows\SysWOW64\Olfobjbg.exe

Filesize
64KB

MD5
d6164d5c18f6dca02fff11ae1ca16ed1

SHA1
bac47cca1f1d3912489b2f361c78b33540b8b083

SHA256
d825a21444406310a7fbe431a06f124e9f2599d28e464dd646c5f2a308a8d5bd

SHA512
cd5c3b1da0d406e858c7e653cbc2d391d00f0b52375441ba7a0bb864abdabbd214b5c94efaca4bfaba6026f811ce4dbaad503dcc5097692044756af26b3e91f5

Download Submit
C:\Windows\SysWOW64\Onhhamgg.exe

Filesize
117KB

MD5
c094fc6440ac98596b675cb757160cd5

SHA1
216b72cbaab8a4c63dcb61f93ab19663f92e91b5

SHA256
a60abf09595583cf6f9d8a8f224f11beae9272a65a5c64cb625fe30609f540b3

SHA512
eca85c65534b0f9c7e62e1084ddaa5eb9f7220d8070321c9b4e0a8ae5ce7c6019d39fdceab12225144ed3356eccc28f3942759c8a4be6dfcc37b6f15ee2cad17

Download Submit
C:\Windows\SysWOW64\Pjhlml32.exe

Filesize
117KB

MD5
6a2ca3b39e11b587402006ab2423b284

SHA1
96e98bf94ae9eec0dac5c2a11a8c883076a5cf1b

SHA256
3bfb3b8d96ee496f95ae36bc68bc46871be13442b15c2182482e6dbd47caed2a

SHA512
2369ced98574c18683d8aab97a4934790cdfadad38505d7a957582c7aae1fdb80d72b885365c410a6689089d73d58884c38e6e61b29411b5bad6cc6c2b6e30f5

Download Submit
memory/212-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/212-544-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/408-532-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/428-489-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/436-520-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/444-262-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/464-144-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/544-316-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/568-139-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/624-495-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/636-175-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/668-412-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/776-578-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/808-208-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1016-120-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1036-85-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1176-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1176-586-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1208-280-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1256-454-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1264-92-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1268-545-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1312-64-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1356-418-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1372-36-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1372-572-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1380-570-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1384-358-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1584-552-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1672-580-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1764-112-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1800-466-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1856-255-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1860-152-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1956-72-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1976-215-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2016-587-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2056-394-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2140-326-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2172-292-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2236-328-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2320-192-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2360-543-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2464-274-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2468-341-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2476-442-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2600-352-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2660-172-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2716-236-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2908-104-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2920-286-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2976-579-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2976-39-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3068-424-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3080-370-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3120-558-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3120-15-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3128-55-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3128-593-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3168-310-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3180-159-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3328-128-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3376-563-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3460-199-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3464-440-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3564-376-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3572-298-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3576-223-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3652-472-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3736-388-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3812-448-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3868-309-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3916-240-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3996-406-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4000-248-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4116-364-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4132-519-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4160-526-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4240-496-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4300-465-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4368-346-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4424-400-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4444-513-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4452-502-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4464-479-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4528-430-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4548-551-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4548-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4636-565-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4636-26-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4764-273-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4900-334-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4968-96-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4980-183-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4988-594-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5060-382-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads