6a2e53b732a540f664c9042bf569fea2fb41a54f8a02cf0608a316ae899de26b

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Backdoor.Win32.Padodor.exe
Size

93KB
MD5

0bf24b0748e3707f77f5c554edb4c3a8
SHA1

56747ad4bf53ff62556a419e12ad304ef9b718fc
SHA256

6a2e53b732a540f664c9042bf569fea2fb41a54f8a02cf0608a316ae899de26b
SHA512

be3773bcb26a0d76568f6c019928044119ebee1a286611ae3e8b65e02838a654e82ed457ba9e00f493caacf21baae0519e13c767310cc1a893a6e48cc8654fdc
SSDEEP

1536:+gTLNhjustxN8RWGPVAlOCfN04m6fng1HQHC45ha37nhPuSTXjiwg58:NTLNhjptxN8RWGCkwDfng1HQHC45Yhfx

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmijbcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Doqpak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hijooifk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aadifclh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddpeoafg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcijeb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpgfooop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikpaldog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jianff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gfbploob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Icifbang.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iifokh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kpbmco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmpijp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anpncp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceoibflm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ofcmfodb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojaelm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Deokon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hijooifk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoiafcic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfjhkjle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eeidoc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jplfcpin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hkkhqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Megdccmb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ojaelm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cefoce32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fakdpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fchddejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kedoge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liddbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpnlpnih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qceiaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dedkdcie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fchddejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dddojq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glhonj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbmhlihl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfkaag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Llgjjnlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdmnlj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alabgd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckcgkldl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edbklofb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ifllil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlampmdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mckemg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onfbfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjffbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdhhdlid.exe

Executes dropped EXE 64 IoCs

pid	Process
3548	Ncnadk32.exe
3984	Okeieh32.exe
4676	Oboaabga.exe
1304	Ocqnij32.exe
2532	Onfbfc32.exe
4156	Oqdoboli.exe
4764	Okjbpglo.exe
2628	Onholckc.exe
3532	Odbgim32.exe
3700	Ojopad32.exe
4340	Oqihnn32.exe
5012	Ogcpjhoq.exe
3868	Obidhaog.exe
4784	Odgqdlnj.exe
2936	Pgemphmn.exe
464	Pjdilcla.exe
1064	Pnpemb32.exe
4984	Pbkamqmd.exe
3988	Peimil32.exe
2860	Pghieg32.exe
4220	Pjffbc32.exe
2564	Peljol32.exe
4896	Pgjfkg32.exe
4332	Pcagphom.exe
1384	Pnfkma32.exe
1720	Peqcjkfp.exe
3872	Pkjlge32.exe
4412	Pbddcoei.exe
1344	Qcepkg32.exe
1148	Qbgqio32.exe
652	Qeemej32.exe
2536	Qgciaf32.exe
2276	Qjbena32.exe
4488	Acjjfggb.exe
1988	Alabgd32.exe
2352	Anpncp32.exe
4836	Aejfpjne.exe
1572	Acmflf32.exe
4944	Aldomc32.exe
3720	Anbkio32.exe
2000	Aelcfilb.exe
4916	Ahkobekf.exe
2264	Ajiknpjj.exe
2816	Aeopki32.exe
2040	Alhhhcal.exe
672	Angddopp.exe
4536	Aaepqjpd.exe
2104	Alkdnboj.exe
2580	Abemjmgg.exe
380	Bhaebcen.exe
756	Bnlnon32.exe
1336	Bajjli32.exe
1996	Bdhfhe32.exe
3004	Blpnib32.exe
872	Bnnjen32.exe
2836	Balfaiil.exe
2724	Bdkcmdhp.exe
3524	Blbknaib.exe
2304	Bopgjmhe.exe
3664	Bejogg32.exe
4084	Bhikcb32.exe
4540	Bbnpqk32.exe
4900	Baaplhef.exe
1392	Blfdia32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jbglkbhg.dll	Flnlhk32.exe
File created	C:\Windows\SysWOW64\Pmdkch32.exe	Pjeoglgc.exe
File created	C:\Windows\SysWOW64\Bclhhnca.exe	Beihma32.exe
File created	C:\Windows\SysWOW64\Panfqmhb.dll	Pcijeb32.exe
File created	C:\Windows\SysWOW64\Hjjgia32.dll	Acjjfggb.exe
File created	C:\Windows\SysWOW64\Angddopp.exe	Alhhhcal.exe
File opened for modification	C:\Windows\SysWOW64\Iehfdi32.exe	Ibjjhn32.exe
File opened for modification	C:\Windows\SysWOW64\Hckjacjg.exe	Hkdbpe32.exe
File created	C:\Windows\SysWOW64\Bmemac32.exe	Bclhhnca.exe
File created	C:\Windows\SysWOW64\Nggdeh32.dll	Acmflf32.exe
File created	C:\Windows\SysWOW64\Cahfmgoo.exe	Cojjqlpk.exe
File opened for modification	C:\Windows\SysWOW64\Lmgfda32.exe	Lgmngglp.exe
File opened for modification	C:\Windows\SysWOW64\Mdckfk32.exe	Lmiciaaj.exe
File opened for modification	C:\Windows\SysWOW64\Gbiaapdf.exe	Gcfqfc32.exe
File created	C:\Windows\SysWOW64\Iccbgbmg.dll	Ifgbnlmj.exe
File opened for modification	C:\Windows\SysWOW64\Ifjodl32.exe	Ildkgc32.exe
File created	C:\Windows\SysWOW64\Ogifjcdp.exe	Odkjng32.exe
File opened for modification	C:\Windows\SysWOW64\Bnhjohkb.exe	Bfabnjjp.exe
File opened for modification	C:\Windows\SysWOW64\Bhikcb32.exe	Bejogg32.exe
File created	C:\Windows\SysWOW64\Gohibf32.dll	Cklaknjd.exe
File created	C:\Windows\SysWOW64\Iifokh32.exe	Ifgbnlmj.exe
File created	C:\Windows\SysWOW64\Ghaliknf.exe	Gfbploob.exe
File created	C:\Windows\SysWOW64\Ingapb32.dll	Jlbgha32.exe
File created	C:\Windows\SysWOW64\Dalchnkg.dll	Ojopad32.exe
File created	C:\Windows\SysWOW64\Filmeaek.dll	Qjbena32.exe
File created	C:\Windows\SysWOW64\Bkjpmk32.dll	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Echmafdm.dll	Oqdoboli.exe
File created	C:\Windows\SysWOW64\Pclgkb32.exe	Pqmjog32.exe
File opened for modification	C:\Windows\SysWOW64\Pclgkb32.exe	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Doqpak32.exe	Cehkhecb.exe
File created	C:\Windows\SysWOW64\Fhglla32.dll	Ecjhcg32.exe
File created	C:\Windows\SysWOW64\Bbjiol32.dll	Mlampmdo.exe
File created	C:\Windows\SysWOW64\Ihjahg32.dll	Ghopckpi.exe
File created	C:\Windows\SysWOW64\Keblci32.dll	Ikpaldog.exe
File opened for modification	C:\Windows\SysWOW64\Klqcioba.exe	Kibgmdcn.exe
File created	C:\Windows\SysWOW64\Jgefkimp.dll	Mgimcebb.exe
File opened for modification	C:\Windows\SysWOW64\Pnfkma32.exe	Pcagphom.exe
File opened for modification	C:\Windows\SysWOW64\Cefoce32.exe	Cbgbgj32.exe
File created	C:\Windows\SysWOW64\Fdnjgmle.exe	Ffkjlp32.exe
File created	C:\Windows\SysWOW64\Mlcifmbl.exe	Mmpijp32.exe
File created	C:\Windows\SysWOW64\Cfpnph32.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Dhcbhjlp.dll	Ddmhja32.exe
File opened for modification	C:\Windows\SysWOW64\Jlnnmb32.exe	Jioaqfcc.exe
File created	C:\Windows\SysWOW64\Kdgljmcd.exe	Klqcioba.exe
File created	C:\Windows\SysWOW64\Cbeedbdm.dll	Lmppcbjd.exe
File opened for modification	C:\Windows\SysWOW64\Ndaggimg.exe	Nljofl32.exe
File created	C:\Windows\SysWOW64\Nenqea32.dll	Nljofl32.exe
File opened for modification	C:\Windows\SysWOW64\Dmcibama.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Hipnbb32.dll	Backdoor.Win32.Padodor.exe
File opened for modification	C:\Windows\SysWOW64\Dhnnep32.exe	Deoaid32.exe
File opened for modification	C:\Windows\SysWOW64\Gdqgmmjb.exe	Gbbkaako.exe
File created	C:\Windows\SysWOW64\Jcfhgi32.dll	Pgjfkg32.exe
File created	C:\Windows\SysWOW64\Dcjfkm32.dll	Ecoangbg.exe
File created	C:\Windows\SysWOW64\Cajolcjk.dll	Ekjfcipa.exe
File created	C:\Windows\SysWOW64\Nniadn32.dll	Mdckfk32.exe
File created	C:\Windows\SysWOW64\Cabfga32.exe	Cndikf32.exe
File opened for modification	C:\Windows\SysWOW64\Ocqnij32.exe	Oboaabga.exe
File created	C:\Windows\SysWOW64\Oncmnnje.dll	Pnonbk32.exe
File created	C:\Windows\SysWOW64\Amgapeea.exe	Aqppkd32.exe
File created	C:\Windows\SysWOW64\Ocbddc32.exe	Ojjolnaq.exe
File created	C:\Windows\SysWOW64\Qhbepcmd.dll	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Alkdnboj.exe	Aaepqjpd.exe
File created	C:\Windows\SysWOW64\Bnnjen32.exe	Blpnib32.exe
File created	C:\Windows\SysWOW64\Mgimcebb.exe	Mlcifmbl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9708	9668	WerFault.exe	459

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klohppck.dll"	Chmeobkq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fllpbldb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dchfiejc.dll"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjlena32.dll"	Amgapeea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpjphglm.dll"	Bdhfhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eocqqdjh.dll"	Daaicfgd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eekaebcm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ocdqjceo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Febgea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbeedbdm.dll"	Lmppcbjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akichh32.dll"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnjpej32.dll"	Okeieh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpiaib32.dll"	Glhonj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifmafkkf.dll"	Gicinj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fllifblf.dll"	Jfaedkdp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pjeoglgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Okeieh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Alhhhcal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hkkhqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbnkjc32.dll"	Kbaipkbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jfaedkdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Halpnqlq.dll"	Pqknig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ahkobekf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Angddopp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ckcgkldl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Faihkbci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iphkfg32.dll"	Bhaebcen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogqnnn32.dll"	Ddpeoafg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ffkjlp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jlnnmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pghieg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ehljfnpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fchddejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfjhbihm.dll"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Clnjjpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ipbdmaah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfnbea32.dll"	Kpgfooop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cabfga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bbnpqk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdiooblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gkmlofol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhqeiena.dll"	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdmpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnlnon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ceoibflm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdgljmcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbnamnpl.dll"	Pggbkagp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjjgia32.dll"	Acjjfggb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhbgqohi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpdkcl32.dll"	Kpjcdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mckemg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gfbploob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnhjmp32.dll"	Jcllonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kfjhkjle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfnphnen.dll"	Afhohlbj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 3548	4584	Backdoor.Win32.Padodor.exe	87
PID 4584 wrote to memory of 3548	4584	Backdoor.Win32.Padodor.exe	87
PID 4584 wrote to memory of 3548	4584	Backdoor.Win32.Padodor.exe	87
PID 3548 wrote to memory of 3984	3548	Ncnadk32.exe	88
PID 3548 wrote to memory of 3984	3548	Ncnadk32.exe	88
PID 3548 wrote to memory of 3984	3548	Ncnadk32.exe	88
PID 3984 wrote to memory of 4676	3984	Okeieh32.exe	89
PID 3984 wrote to memory of 4676	3984	Okeieh32.exe	89
PID 3984 wrote to memory of 4676	3984	Okeieh32.exe	89
PID 4676 wrote to memory of 1304	4676	Oboaabga.exe	90
PID 4676 wrote to memory of 1304	4676	Oboaabga.exe	90
PID 4676 wrote to memory of 1304	4676	Oboaabga.exe	90
PID 1304 wrote to memory of 2532	1304	Ocqnij32.exe	91
PID 1304 wrote to memory of 2532	1304	Ocqnij32.exe	91
PID 1304 wrote to memory of 2532	1304	Ocqnij32.exe	91
PID 2532 wrote to memory of 4156	2532	Onfbfc32.exe	92
PID 2532 wrote to memory of 4156	2532	Onfbfc32.exe	92
PID 2532 wrote to memory of 4156	2532	Onfbfc32.exe	92
PID 4156 wrote to memory of 4764	4156	Oqdoboli.exe	93
PID 4156 wrote to memory of 4764	4156	Oqdoboli.exe	93
PID 4156 wrote to memory of 4764	4156	Oqdoboli.exe	93
PID 4764 wrote to memory of 2628	4764	Okjbpglo.exe	95
PID 4764 wrote to memory of 2628	4764	Okjbpglo.exe	95
PID 4764 wrote to memory of 2628	4764	Okjbpglo.exe	95
PID 2628 wrote to memory of 3532	2628	Onholckc.exe	96
PID 2628 wrote to memory of 3532	2628	Onholckc.exe	96
PID 2628 wrote to memory of 3532	2628	Onholckc.exe	96
PID 3532 wrote to memory of 3700	3532	Odbgim32.exe	97
PID 3532 wrote to memory of 3700	3532	Odbgim32.exe	97
PID 3532 wrote to memory of 3700	3532	Odbgim32.exe	97
PID 3700 wrote to memory of 4340	3700	Ojopad32.exe	98
PID 3700 wrote to memory of 4340	3700	Ojopad32.exe	98
PID 3700 wrote to memory of 4340	3700	Ojopad32.exe	98
PID 4340 wrote to memory of 5012	4340	Oqihnn32.exe	99
PID 4340 wrote to memory of 5012	4340	Oqihnn32.exe	99
PID 4340 wrote to memory of 5012	4340	Oqihnn32.exe	99
PID 5012 wrote to memory of 3868	5012	Ogcpjhoq.exe	101
PID 5012 wrote to memory of 3868	5012	Ogcpjhoq.exe	101
PID 5012 wrote to memory of 3868	5012	Ogcpjhoq.exe	101
PID 3868 wrote to memory of 4784	3868	Obidhaog.exe	102
PID 3868 wrote to memory of 4784	3868	Obidhaog.exe	102
PID 3868 wrote to memory of 4784	3868	Obidhaog.exe	102
PID 4784 wrote to memory of 2936	4784	Odgqdlnj.exe	103
PID 4784 wrote to memory of 2936	4784	Odgqdlnj.exe	103
PID 4784 wrote to memory of 2936	4784	Odgqdlnj.exe	103
PID 2936 wrote to memory of 464	2936	Pgemphmn.exe	111
PID 2936 wrote to memory of 464	2936	Pgemphmn.exe	111
PID 2936 wrote to memory of 464	2936	Pgemphmn.exe	111
PID 464 wrote to memory of 1064	464	Pjdilcla.exe	104
PID 464 wrote to memory of 1064	464	Pjdilcla.exe	104
PID 464 wrote to memory of 1064	464	Pjdilcla.exe	104
PID 1064 wrote to memory of 4984	1064	Pnpemb32.exe	105
PID 1064 wrote to memory of 4984	1064	Pnpemb32.exe	105
PID 1064 wrote to memory of 4984	1064	Pnpemb32.exe	105
PID 4984 wrote to memory of 3988	4984	Pbkamqmd.exe	107
PID 4984 wrote to memory of 3988	4984	Pbkamqmd.exe	107
PID 4984 wrote to memory of 3988	4984	Pbkamqmd.exe	107
PID 3988 wrote to memory of 2860	3988	Peimil32.exe	106
PID 3988 wrote to memory of 2860	3988	Peimil32.exe	106
PID 3988 wrote to memory of 2860	3988	Peimil32.exe	106
PID 2860 wrote to memory of 4220	2860	Pghieg32.exe	110
PID 2860 wrote to memory of 4220	2860	Pghieg32.exe	110
PID 2860 wrote to memory of 4220	2860	Pghieg32.exe	110
PID 4220 wrote to memory of 2564	4220	Pjffbc32.exe	108

C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Padodor.exe
"C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Padodor.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\Ncnadk32.exe
  C:\Windows\system32\Ncnadk32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\SysWOW64\Okeieh32.exe
    C:\Windows\system32\Okeieh32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - C:\Windows\SysWOW64\Oboaabga.exe
      C:\Windows\system32\Oboaabga.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4676
    - - C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1304
      - C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4156
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4764
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3532
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3868
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:464

C:\Windows\SysWOW64\Pnpemb32.exe
C:\Windows\system32\Pnpemb32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\Pbkamqmd.exe
  C:\Windows\system32\Pbkamqmd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\SysWOW64\Peimil32.exe
    C:\Windows\system32\Peimil32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3988

C:\Windows\SysWOW64\Pghieg32.exe
C:\Windows\system32\Pghieg32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\Pjffbc32.exe
  C:\Windows\system32\Pjffbc32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4220

C:\Windows\SysWOW64\Peljol32.exe
C:\Windows\system32\Peljol32.exe
1⤵
- Executes dropped EXE
PID:2564
- C:\Windows\SysWOW64\Pgjfkg32.exe
  C:\Windows\system32\Pgjfkg32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:4896
- - C:\Windows\SysWOW64\Pcagphom.exe
    C:\Windows\system32\Pcagphom.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4332
  - - C:\Windows\SysWOW64\Pnfkma32.exe
      C:\Windows\system32\Pnfkma32.exe
      4⤵
      Executes dropped EXE
      PID:1384
    - - C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        5⤵
        Executes dropped EXE
        
        PID:1720
      - C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        6⤵
        Executes dropped EXE
        
        PID:3872
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        7⤵
        Executes dropped EXE
        
        PID:4412
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        8⤵
        Executes dropped EXE
        
        PID:1344
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        9⤵
        Executes dropped EXE
        
        PID:1148
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        10⤵
        Executes dropped EXE
        
        PID:652
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        11⤵
        Executes dropped EXE
        
        PID:2536
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2276
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4488
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1988
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2352
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        16⤵
        Executes dropped EXE
        
        PID:4836
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1572
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        18⤵
        Executes dropped EXE
        
        PID:4944
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        19⤵
        Executes dropped EXE
        
        PID:3720
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        20⤵
        Executes dropped EXE
        
        PID:2000
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4916
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        22⤵
        Executes dropped EXE
        
        PID:2264
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        23⤵
        Executes dropped EXE
        
        PID:2816
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2040
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:672
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4536
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        27⤵
        Executes dropped EXE
        
        PID:2104
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        28⤵
        Executes dropped EXE
        
        PID:2580
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:380
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:756
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        31⤵
        Executes dropped EXE
        
        PID:1336
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1996
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3004
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        34⤵
        Executes dropped EXE
        
        PID:872
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        35⤵
        Executes dropped EXE
        
        PID:2836
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        36⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        37⤵
        Executes dropped EXE
        
        PID:3524
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        38⤵
        Executes dropped EXE
        
        PID:2304
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3664
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        40⤵
        Executes dropped EXE
        
        PID:4084
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4540
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        42⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        43⤵
        Executes dropped EXE
        
        PID:1392
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        44⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5052
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        46⤵
        Modifies registry class
        
        PID:5112
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        47⤵
        Drops file in System32 directory
        
        PID:4444
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        48⤵
        
        PID:3124
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        49⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        50⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        51⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        52⤵
        Drops file in System32 directory
        
        PID:4020
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        53⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        54⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        55⤵
        Modifies registry class
        
        PID:1004
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        56⤵
        Drops file in System32 directory
        
        PID:2760
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:432
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        58⤵
        Modifies registry class
        
        PID:2720
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4392
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        60⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        61⤵
        Drops file in System32 directory
        
        PID:5156
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5204
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        63⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        64⤵
        Drops file in System32 directory
        
        PID:5304
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        65⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        66⤵
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        68⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        69⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        70⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        71⤵
        Drops file in System32 directory
        
        PID:5608
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        72⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        73⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        74⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        76⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5868
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        78⤵
        Modifies registry class
        
        PID:5908
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        79⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        80⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        81⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        82⤵
        Drops file in System32 directory
        
        PID:6088
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1412
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        84⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        85⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        86⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        87⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        88⤵
        Drops file in System32 directory
        
        PID:5496
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        89⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        90⤵
        Modifies registry class
        
        PID:5640
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        91⤵
        Drops file in System32 directory
        
        PID:5692
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        92⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5844
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        94⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        95⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        96⤵
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        97⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        98⤵
        Modifies registry class
        
        PID:5248
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        99⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        100⤵
        Modifies registry class
        
        PID:5476
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        101⤵
        Drops file in System32 directory
        
        PID:5572
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        102⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5888
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        105⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        106⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        107⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        108⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        109⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        110⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        111⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        112⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        113⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        114⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        115⤵
        Drops file in System32 directory
        
        PID:6112
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        116⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        118⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        119⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        120⤵
        Drops file in System32 directory
        
        PID:6148
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        121⤵
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        122⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        124⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        125⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        126⤵
        Drops file in System32 directory
        
        PID:6396
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        127⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        128⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        129⤵
        Modifies registry class
        
        PID:6520
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        130⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        131⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        132⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        133⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        134⤵
        Drops file in System32 directory
        
        PID:6736
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        135⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        136⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        137⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        138⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        139⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7004
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        141⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        142⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        143⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7164
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        145⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        146⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6324
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        148⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        149⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        150⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6600
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        152⤵
        Drops file in System32 directory
        
        PID:6676
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        153⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        154⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6884
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        156⤵
        Drops file in System32 directory
        
        PID:6928
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7040
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        158⤵
        Drops file in System32 directory
        
        PID:7096
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        159⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        160⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        161⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        162⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        163⤵
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6688
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        165⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        166⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        167⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        168⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        169⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        170⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        171⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        172⤵
        Modifies registry class
        
        PID:6780
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        173⤵
        Drops file in System32 directory
        
        PID:6956
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        174⤵
        Modifies registry class
        
        PID:6160
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        175⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        176⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7112
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        178⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6892
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        180⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        181⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        182⤵
        Drops file in System32 directory
        
        PID:7176
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        183⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        184⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        185⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        186⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        187⤵
        Modifies registry class
        
        PID:7392
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7432
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        189⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        190⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7552
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        192⤵
        Modifies registry class
        
        PID:7588
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        193⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        194⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        195⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7760
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7796
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        198⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7880
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        200⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        201⤵
        Modifies registry class
        
        PID:7960
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        202⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8052
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        204⤵
        Drops file in System32 directory
        
        PID:8088
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        205⤵
        Modifies registry class
        
        PID:8140
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        206⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7204
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        208⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7284
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7340
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7416
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        211⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        212⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7620
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7668
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        215⤵
        Drops file in System32 directory
        
        PID:7740
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        216⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        217⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        218⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        219⤵
        Drops file in System32 directory
        
        PID:8016
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        220⤵
        Drops file in System32 directory
        
        PID:8080
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        221⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        222⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7316
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7460
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        225⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7612
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        227⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7784
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        229⤵
        Drops file in System32 directory
        
        PID:7928
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        230⤵
        Drops file in System32 directory
        
        PID:7984
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8136
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        232⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        233⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        234⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        235⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        236⤵
        Drops file in System32 directory
        
        PID:7864
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        237⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        238⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        239⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        240⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        241⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        242⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        243⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7280
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        245⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        246⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7992
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        248⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        249⤵
        Drops file in System32 directory
        
        PID:4876
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        250⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        251⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        252⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        253⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        254⤵
        Drops file in System32 directory
        
        PID:8268
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        255⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        256⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        257⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        258⤵
        Modifies registry class
        
        PID:8428
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        259⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8516
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        261⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        262⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        263⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8684
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        265⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8768
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        267⤵
        Modifies registry class
        
        PID:8812
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8848
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        269⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        270⤵
        Drops file in System32 directory
        
        PID:8932
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        271⤵
        Drops file in System32 directory
        
        PID:8976
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        272⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        273⤵
        Modifies registry class
        
        PID:9052
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        274⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9104
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        275⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        276⤵
        Modifies registry class
        
        PID:9188
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        277⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        278⤵
        Modifies registry class
        
        PID:8256
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        279⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        280⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        281⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        282⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        283⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8664
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        285⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        286⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        287⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8928
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        289⤵
        Modifies registry class
        
        PID:9020
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        290⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        291⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        292⤵
        Drops file in System32 directory
        
        PID:9204
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        293⤵
        Modifies registry class
        
        PID:8264
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        294⤵
        Drops file in System32 directory
        
        PID:8372
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        295⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8600
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        297⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        298⤵
        Drops file in System32 directory
        
        PID:8776
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        299⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        300⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        301⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        302⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8420
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        304⤵
        Modifies registry class
        
        PID:8652
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8832
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        306⤵
        Modifies registry class
        
        PID:8988
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        307⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        308⤵
        Modifies registry class
        
        PID:8336
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        309⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8876
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        311⤵
        Drops file in System32 directory
        
        PID:7596
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        312⤵
        Drops file in System32 directory
        
        PID:8568
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        313⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        314⤵
        Modifies registry class
        
        PID:8524
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        315⤵
        Modifies registry class
        
        PID:8668
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        316⤵
        Drops file in System32 directory
        
        PID:8924
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        317⤵
        Modifies registry class
        
        PID:9264
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        318⤵
        Modifies registry class
        
        PID:9312
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        319⤵
        Drops file in System32 directory
        
        PID:9348
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        320⤵
        Modifies registry class
        
        PID:9396
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        321⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        322⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        323⤵
        Modifies registry class
        
        PID:9520
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        324⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        325⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9640
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        327⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9732
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        329⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        330⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        331⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        332⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        333⤵
        Drops file in System32 directory
        
        PID:9944
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        334⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        335⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        336⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        337⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10148
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        339⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        340⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9240
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9324
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9380
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        344⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        345⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        346⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        347⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9668 -s 408
        348⤵
        Program crash
        
        PID:9708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 9668 -ip 9668
1⤵
PID:9700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aqkgpedc.exe

Filesize
93KB

MD5
3aa85175b8b41c0d1b6ab7ed5c30391b

SHA1
9282699b36436c786c2810c10b5d3b5744e67a26

SHA256
af23a8786722681edb64d46b46d5d3ee4e5c9fdf42f30c13ede1f9cd5f65e5b0

SHA512
8a462c129e9fc13b2f605f9daf5ecebff9893f059370990dd4f5457bb22b6b8ffc9cd42b7368f3896e0be7866a9cf4f98b31a56251f8c67efcf01da145a47909

Download Submit
C:\Windows\SysWOW64\Bmemac32.exe

Filesize
93KB

MD5
e5c464d3459667ccd95ca32728be1f50

SHA1
37abd719a50fe335ac5f0a5831764521bcee09cb

SHA256
f85a5367df0d80105c21e996812b42b7488b8b88b9d7bccf5553b90642c60695

SHA512
976c4399a8144f212ce24b1dd388d502e704a64a0506aee48365dbe5497d2d7f8e9e77872cec193b2c19598ae275f012b8e8db2a60d85c8aa87f93d42eb2af0c

Download Submit
C:\Windows\SysWOW64\Gpamgn32.dll

Filesize
7KB

MD5
5ff6b7c4b9c0df022500b5bde663a031

SHA1
5ba6062ef7574525b6a8d1dc37ba5a2b5cf89dd8

SHA256
a4116216a9678dc8ef300586951641e351e724ba44183b7c51a78625b5e696b8

SHA512
5f73c4551d68c3464f49b03341786c898880243bc324867280a6cca1bdfe85280b1511abfffb8a81c6f6b19e9238855767f7048492bf4d584d25dde94d987f1e

Download Submit
C:\Windows\SysWOW64\Ldanqkki.exe

Filesize
93KB

MD5
141c897c3c708d8adca04dd9d002a3c7

SHA1
5efb1525d3483e3ee490ade98c98a2f006f499b1

SHA256
9eab6360e8a81fb97c9ec7139e651a5216990a100ec2d51d2752ebd05f309243

SHA512
a9f67e500c2bb9a3331b302a7c80b5c24ca3624c85b92ef1180b48cd0e1a01af0c8bf64267f96d4161394dd818e9092ebd9d7cffb09108f968ffdf455c92d0bf

Download Submit
C:\Windows\SysWOW64\Lfkaag32.exe

Filesize
64KB

MD5
f958e0c84c635cb5a53cdcd4df01e3ea

SHA1
9ab6543c9c28ac97d1b7ada449db585be6d39f81

SHA256
8c8bbaebc9f41bfe744b50524fa95fda6140c18cb19cac4980054b51ae73193c

SHA512
8f752dfef878d5adeefbd4b9234ffe5f027b4aa27eec6b23ea321776e58737573d9016da52cbb88f9e123c8fe1f42c1c019a0fd62a0f2a37229f20937f7e96e0

Download Submit
C:\Windows\SysWOW64\Miifeq32.exe

Filesize
93KB

MD5
999423096082d1cfb54d201608e76ac3

SHA1
a3b910e4ba21eacd94dec20cf7478422ef5cb2fc

SHA256
152e3ceefdf12888c7bf7e943a1249e4df772a34385613cd6977da15fa92f163

SHA512
8edff27a7c66ef31d05ebfb1ae5f5a6f733d0a4b874cb9614795c453a3d9b8cbb683e0c9501734960d00d80a97eb952cb01627098d8b945b0d262bdf5b2fb143

Download Submit
C:\Windows\SysWOW64\Mmlpoqpg.exe

Filesize
93KB

MD5
30a818323f2131e32af6c2f23cab71b9

SHA1
c71f11337fae979dd001f89922671a932ddd75de

SHA256
1814f53539262936b530531191b56f7e9dc77d715fd40ba68e88e5e16b9b8923

SHA512
121b8251d697cf9997054d4596b6b2e8b22cdda206ec099fa2784ae08e5ce0ee4af81268d4abb79ce1e61b09adcc56c53ab2a3c63fd9f12b7a9dc57609e21b84

Download Submit
C:\Windows\SysWOW64\Ncnadk32.exe

Filesize
93KB

MD5
6439ff20eb21c675f07f034f3dc983a1

SHA1
7597e9048ae2efb454fbc78bda84500c9cbb3cf5

SHA256
714c11572a7458e8e1ee260f02b3c3e5614f14959b49026978c1aad90b4c37f6

SHA512
4a27cf80cef34f9636d4d132abec6931c5328edd477026a8655985777582d0f5318f9b4a78f6327337bae0c7f114803237b6e1c14f99ec9bfaee8f5e087b349d

Download Submit
C:\Windows\SysWOW64\Ndhmhh32.exe

Filesize
93KB

MD5
97b173e00bffeba2c079edd59a753b9e

SHA1
becb1d0240dd7681f5bb30aa5136c4d46b5b08d7

SHA256
0ed7f570d9a7e945dfef009b25453e5efc2a29def89a0b486e748f0f02ac5610

SHA512
9da0ffd0fc33aea8ea4a3da6be101922d2fb21af6bf0deba7a15f0863c8aff350c37804e3f336ef8de5be85d0f7500ac0a014d7feb4f0d93a2ad3cbe11dca44f

Download Submit
C:\Windows\SysWOW64\Neeqea32.exe

Filesize
93KB

MD5
55a994e3aee5f520e0100c085cba0935

SHA1
dd18f8699009191c6c8f3acb935161c3440d141f

SHA256
5d2cf7c2019b96a2c472b7fe91090b6256a53f0ea01ab305254bf8e5e2f9b15d

SHA512
b2d609a2ac2aae78974d0b8437133d7cfdc83b9593c960c606809fc3c2cadfc3c32a35c3f391afa2584ce9e85ef9e3739e52fc8f4e1c9b780fa34ca655656b2a

Download Submit
C:\Windows\SysWOW64\Obidhaog.exe

Filesize
93KB

MD5
92875d7961a7999a7ece127588a768a9

SHA1
bafb438e084fc4d9311b21e3df97c450b04bbc59

SHA256
adb26f942a1d3c7d70313959c4f5e8cab1daaf224d3674ee55d35c6cfef29e6f

SHA512
f3ec6a5e49f1c80618d42d25ae2061157f9ad7466a858ad9ad6af783226cdbcfc5506460734a6507959f731b83932949cfcafb103c9cc6f50f9b5468dd81c563

Download Submit
C:\Windows\SysWOW64\Oboaabga.exe

Filesize
93KB

MD5
b658b856dda5e720826f4df0ee8b0b6f

SHA1
ae7bcabb9b795b3ede4d7607a7b178b876bc6bd2

SHA256
2ddb09ff6d8a92dd91adb2f037ef60c31a5f6c293d78af2cfe93010166629d28

SHA512
6c982258e9ca9f15f04c2fa86c88cdbcfaa53cfb51c65fc3ff8fbb2bfd5fc18fbb4cadb5e8d9635d04800284a299baa636b5e708cfadafe9a9433233b55c3c37

Download Submit
C:\Windows\SysWOW64\Ocqnij32.exe

Filesize
93KB

MD5
02ce3f8813c956d90f3f74e847f16370

SHA1
34db359e6bb75441cf61b914030ebbe62ee18e23

SHA256
8069b201b751d9c416b9f47ad059f7b20888e22f0742a56b906017ef5f4d683c

SHA512
b2d077c3cfdceb47f590fc2bf511795b9e6211cc85d4f3c39db752727be9d923b88f3631345013571e18116a72b766cc698b5db6fdf22c7df936a79034dc9e33

Download Submit
C:\Windows\SysWOW64\Odbgim32.exe

Filesize
93KB

MD5
9392f47d2c98e49483d25af4a2c47cc3

SHA1
052c977c9ff33626a0429232c9d0d27b15906a75

SHA256
72fdaa9c4a850ebc0c0a7f45b646b42fab39b99640e23b726850d3d36c2ca550

SHA512
3ef8da362781595bc8cfefd9715154ce38e145895115e9a0fc0177d07919bfd251f35417d485361bd1407ac836d22e06de860d2e56ad2510f2e13e9f0b14031f

Download Submit
C:\Windows\SysWOW64\Odgqdlnj.exe

Filesize
93KB

MD5
ab8490781b0af206f41fafd9f06e0ee6

SHA1
11b2266ba2242e5e5d455dac90988b98fe78489a

SHA256
1d5f65433f0315b45c8cbfcbf9ff98d6508224f0eda4b9ccc73390480f5e16b2

SHA512
2f79a200c9782cba0a30c9a611f71e5dcb7199ab1dced95dce98de6d34499d96d1003263c026954edc496a5549e1eb9aaa6aef094a181f7e7abd537f5165d0ae

Download Submit
C:\Windows\SysWOW64\Ogcpjhoq.exe

Filesize
93KB

MD5
4470e9287740009554b7ac2d850e53bd

SHA1
9d3ade4957ab536f4d6773ac66ffa90c8400cba4

SHA256
d015cef2d4ceebdbbd6e85c78bef82f2ee0c40ffcf4fa277b88544244ee95e4c

SHA512
97034af1b52b3101017b727a15ac681f14f6f607c176d051d46f8632b357caf1f7207dfd5e5c2b9d6b0cc90934e1bebcdd3429ef4cb9dfd492a843c94338dd32

Download Submit
C:\Windows\SysWOW64\Ojopad32.exe

Filesize
93KB

MD5
353d4f52a6b74780e6bdf17b6ac002e1

SHA1
5124cca723b79147ba539f018e362addb164f0ae

SHA256
8267ce9878371a8fdd9d91ed8e75ab995f0bfbf712c74a096399818069e04c98

SHA512
9475011cc9d1dc1dc8e0df1ed9eaaef571c1d550675945d46d159048706494f0e3bf4a607b7f7bcf99295d02112da00a320d547cef2f6de02f8187dfb0bfacdd

Download Submit
C:\Windows\SysWOW64\Okeieh32.exe

Filesize
93KB

MD5
67422535d4b212ee6492dcea788577b0

SHA1
a32d851c7c6280146828a67de8cb699b17aed582

SHA256
8ff067502da7daee06cf1822bd01f7e889dfd45b38020a44fc0daf9a9f494134

SHA512
52a586ac900461ddbeac8ba180338ef84479d82b0de2d2d876b4e15fd99f5c315590f7a4d77e03b93deed4b82256a5e2bd5ff093629df1e7718f09458bb9e442

Download Submit
C:\Windows\SysWOW64\Okjbpglo.exe

Filesize
93KB

MD5
3084cbd135f66951ff8b7282f131741f

SHA1
6113d7a35c4994578ffd92c3bf208c7588db6a38

SHA256
6f615a277460e554878a762c62817822a7326852013b026aee63ec528fa80a96

SHA512
907979818e2b782debde0226dcf42cefc7a50d8cb2718634dddee7c42ed83ad4186be248b8e6c6b99f7b1bea3bc24adf460a1021780f341d37eacda870838ad6

Download Submit
C:\Windows\SysWOW64\Onfbfc32.exe

Filesize
93KB

MD5
352b632b83d123a01c1f711fbbc34e2d

SHA1
daef2dabcd36478e68c245f6de662c0642f08f6a

SHA256
c3cc6347c3ca962a4964d1f9fc39692cca680501c7f66d3de6e3a729aa727bcb

SHA512
c86d59b7c8c6a8c015cccaa12f040e887b146a4a55a9a26339b15c40dbd5a65ed29ecf05eee7754d4fde2f7d95030b91e1e963b4c6ab0427928161a8091ecbed

Download Submit
C:\Windows\SysWOW64\Onholckc.exe

Filesize
93KB

MD5
1f351ba0078f6099c4973a16c306ca03

SHA1
4be46cb2b198be7dc43af16c714764b785bb7ced

SHA256
7cdce8516f20f824cbff58f70e17f4730f2a339270f64274122ba5495a24524d

SHA512
5443d6fff184e41f51adf6176df49c78e39b2e7cbc002250d966595bb10d5b19744f5d537c9c20237485943a840f8f060cc350625b7b5de3f32118179ee3dd86

Download Submit
C:\Windows\SysWOW64\Oqdoboli.exe

Filesize
93KB

MD5
dd28ed54e7237b700121ce23a9b4c591

SHA1
6a25c2b127d6d3a1830adf8414577bdb5f99c2d3

SHA256
4f8c5b0d7f559abf98c6a2c9315c48aaf0e8e703b1be26d30620a3fde2c6eb18

SHA512
6e7edb6263d77f3db70ec62f77b060a4495da3ce84143762f38647073eb345d4a8cbb419b6ddce08f0f831111f51b5aced39b48e4806e2463fe1d6e4a571f9d9

Download Submit
C:\Windows\SysWOW64\Oqihnn32.exe

Filesize
93KB

MD5
a00f0c66e909da90c73aa8d87c0991f7

SHA1
645991e2e22a24f241ac872a541c5e0cbd870fc7

SHA256
c366a2f60bf48112c4358779297b13335f87a0450a0f6d1f519ccd745e7f33b0

SHA512
47f0b1f09e4e317e22355b138c4ced78f6c69c411e6954f5411534751fbe5fc05678077475cebdb95a6aee7273b955d9b0e9fe9419def1ccf02faf503ec9fe4f

Download Submit
C:\Windows\SysWOW64\Pbddcoei.exe

Filesize
93KB

MD5
0d3a2b8ec558ce4d36cde3ebf892b58d

SHA1
3caa7604241e104a0669f789313cf6bc012d6f27

SHA256
d40c4beb5e63f7d7437699d51ab50a9d2f885b93c1b53cb080f989b3748accd7

SHA512
037f5bb0004a8a5803c5e856ddd391e41b7d68d0c0a88019ba70515e4e7a03da54f9eb9671fec5143701ec893fbbe15dcf9aa0c225a70f41b8da1767ffe4feac

Download Submit
C:\Windows\SysWOW64\Pbkamqmd.exe

Filesize
93KB

MD5
c5ebe7f078326fb4f37eaeb761a81fac

SHA1
05f05db57f735ab9b1cc4efdd55e66f852363939

SHA256
562d47dbd268877aaac0a47666bb4d3b339dfefbeb560ce9b877e398b5b2d0ec

SHA512
871d953ea88e0865ecd8009a47de99849bcd41f14abb2d9e4aa41f5bd344fbe2659ad84b9d08a46c2f4e9dd2d5866c08e2ecf2002d834567b07624f5610bd608

Download Submit
C:\Windows\SysWOW64\Pcagphom.exe

Filesize
93KB

MD5
d66e4a059f0342b3b04ee0f3f5f0bbea

SHA1
c6d0fcf5e0946893b5b971d66ea41e56a6aba02f

SHA256
2657e15c4d908292837a33642de5c45a7410a5127b24a179f1d3a2534dbfc7d3

SHA512
5f8e636454c5001ef4b4b6588191a7c2b1e1f347d784c67b46f366b4937487b0c0dbd6a00e764b53cd0d67c14d6d7cf2c40d7f8c4c2e2f12564e14b8f9328647

Download Submit
C:\Windows\SysWOW64\Peimil32.exe

Filesize
93KB

MD5
02a333ada376e778b376ae28c1a05153

SHA1
94b2b6683f9a495bbd06069e3700287221706db1

SHA256
965bd78e01eb2ec28b68b591b632c98b155c7b1518592aff0e9545ae7e97ff65

SHA512
13d5f3c69a61042040e0e17b9b5812bd716fb051bd0f52a62afbc672029f1f920d292020c20f0e03856c9d16adfe51f4013aaa66e5e097bae26afae64d829baa

Download Submit
C:\Windows\SysWOW64\Peljol32.exe

Filesize
93KB

MD5
ac85ae068158791de6cfd7a36a3d3e50

SHA1
f6c2549c3ecabac3094342f13e9787b82aa33339

SHA256
fb968deae384d57e9f0648399388d8e6d6d265b852606846c1dada54e6b4f84a

SHA512
7be0483d5c09085e2961bb5a117d546a3f376fca7b399f17b7e7ebb9caa64d2a6c43c3173c671552df9755cb9025f29de7b453c8fa7258cab7fb25c682aafe21

Download Submit
C:\Windows\SysWOW64\Peqcjkfp.exe

Filesize
93KB

MD5
5151691031f479eae8adcc389c24c1b0

SHA1
ba3842dcbbc1b256a61b221aae87168f2858295a

SHA256
a15844ae8262ebc9adab2a0cdd3746547fa396dafa796c2477fa051e4b991156

SHA512
bd94641943d1897ae725066a709947e39476635fdc32bb54587f56001396c987516638f9e3e6ff1120078cc7a11bcb28a79456a463457853ef720b08c2287c68

Download Submit
C:\Windows\SysWOW64\Pgemphmn.exe

Filesize
93KB

MD5
c7ef366016e6050c72fe868a2d0cb5b9

SHA1
42f58eaff51d013ceffaabb748841e87f37e2919

SHA256
ef0cfa462d0edcb7a0515446ae98fb459d64aebd67f73624ecbbf6818c0091cb

SHA512
03901259be26f46ae4a951483723bb4bb0a5c483e1cadf0586694c4d4d75a19dc405aa611a4edb6ea23eaba056b541aba1e0b80f90bd6cad0123d57449bb6a33

Download Submit
C:\Windows\SysWOW64\Pghieg32.exe

Filesize
93KB

MD5
40783660422715e88eb968fc73ac5ca2

SHA1
ed7d99db78a4bba58074474b708f99542e14fde6

SHA256
24082564ab5b23f23c6b05b2a74427c7e7ca1fbb23dc56fb5409aaad2582a994

SHA512
c5e1e98c29736924759db1614762c56741945df9edfbb9450387a88cdfab5fa8dec1659d17d07a03335ff780902e490559b4265ac988095d11b3fb7ec951673e

Download Submit
C:\Windows\SysWOW64\Pgjfkg32.exe

Filesize
93KB

MD5
a3012195e0290ec157c2591d35f8d64b

SHA1
d4072dff4b5bf28cad0ef65821991ee898db570d

SHA256
4666479a7e52edabd6b83a455b6664adf0d54b42f0a21112eb0e495703e464d7

SHA512
a0050295c2676b4c08361d330168534524ae6e00c5b15eccb5eb76c80a7dcdef3a391435295fde6677e4a1449d12713630dc9417f7ca9edde72e277eb199fd5d

Download Submit
C:\Windows\SysWOW64\Pjdilcla.exe

Filesize
93KB

MD5
c4461a03547f4f19f74d63a752f19ec6

SHA1
91327bb519ab6fa540e8908e8308dcbaa5e2d4f3

SHA256
2df5f5422313ca2814136e98a7097075e0542d7bd3d758fde949892501264e4a

SHA512
4ea57bf7288d3a8b40f486bbfd6b4ed1f9f87fd95838bba2a78b3a61a85f84abe84ac7938ae195d291c02842defcc5649a149d3773d4e523c7d99e8a82570a86

Download Submit
C:\Windows\SysWOW64\Pjffbc32.exe

Filesize
93KB

MD5
2651a936e84d7fa7a2568e20dfbe5b86

SHA1
ac09b4794ba2b93e7ea39c91c44a1b9a56e2f856

SHA256
2bfeef2c0c44004bec177ad130ac08d9ac498519fe589d2285bf11efebe1b7e2

SHA512
2889431d8a56e23048362eb1b86e911cf125bf448033bcef52adbfc813be97a399b45befd86834f9ccb9c784ddbd3a86986ddcd890d1ec8bf0fb8aceb6c94dfe

Download Submit
C:\Windows\SysWOW64\Pkjlge32.exe

Filesize
93KB

MD5
0718aef61aa5198df68bd7be1ba71bad

SHA1
14a0a446002605aa3d6a0a98d4704695d3cec365

SHA256
b29b810c4fc891f7f43dd8efc98b36151aa236f28294ce5d238c9e138c86814a

SHA512
82ca00b06aeeef31e458c26e3500414b367611c259e8937356ca3d1fad192cc34291eae69941dd2857ff09aab14af18b2e7606acd6a69f5c6b930007d13a3ef7

Download Submit
C:\Windows\SysWOW64\Pnfkma32.exe

Filesize
93KB

MD5
d2d43579710e4647e4d446a2d2c3b10a

SHA1
db007f4415a35a9deffab17e7a0165dafaca5fed

SHA256
8ac8019c37a18332f213be118e01ecbd584f1a05eb24e36d018aced750f1533e

SHA512
f1fc39a775bba10d7d9e7117865cd996dc635b48e2b7b3aefd360de8e78ac3d14ae3ac229c35e704516d59babe724302b79de5ad2b29efcc2d8db30dd4349501

Download Submit
C:\Windows\SysWOW64\Pnpemb32.exe

Filesize
93KB

MD5
003b64b30041bf5323f6e2b2a14fc408

SHA1
1f796a4e8c1aa59fd60231661f72716c94c8e765

SHA256
683c71fc8e0d09b70201e8c786893db0402fa2469e043189c509759d9d0a438b

SHA512
53014e892361dfc79832994f7763ed8aeac15a7a9f29721242cf80bbecd47a9860197eaee29fefa0cee7602981af309e3cef85a2c9ea3963b8a6e41956fa8fc4

Download Submit
C:\Windows\SysWOW64\Qbgqio32.exe

Filesize
93KB

MD5
62614ddb6935e99f5cea57062f842011

SHA1
55f46787f54419c2ad4fcaa75a0752c4c79c93bc

SHA256
9d6fa8868f03216a891cc6b692fb3a08959873398605b1e74c3b61eae7df0016

SHA512
846c8c69d8ae5b2a26efb728ff808af44fab4768aa4c351eed0b5efe3de246e0ce5df9ad2235e857c6464476eb6a61e9bfbb475a455d4bd2438d54e1baa7a265

Download Submit
C:\Windows\SysWOW64\Qcepkg32.exe

Filesize
93KB

MD5
b79705856c1e93de13939cf2e7bdb6f7

SHA1
0164b267bf353046183388dce792c0d3814aa95a

SHA256
e2ddd8e4c44fd3def253332bd5bb215a2d0e3b5a70df6a19b82eab372a1daef9

SHA512
789e1ed46d4b26bd3ee9ac3d23cbfc0dff10f46cd9d2a56548793fbbc4e4bf0a5da35dafde56cc1c61057cfbc70e5b5e0f02ef5edf1161c2e15e1ef9e0985147

Download Submit
C:\Windows\SysWOW64\Qeemej32.exe

Filesize
93KB

MD5
bfce219842ef3524bbf862bd602ed2a8

SHA1
a29954994410d584acc0544bbd03f7bcbde7225a

SHA256
f52f40207fbfd14a8e9cfeab3ba902928085da704bc74db3642b11d814d89fce

SHA512
603f9d0a90291502f082675d505ea06be133971b56daa5cd78dec18ae8cde81b29f1c804027cce197e744a5bec6833cdf7e49a4a828f5754fc8a9bb8e9a91f35

Download Submit
C:\Windows\SysWOW64\Qgciaf32.exe

Filesize
93KB

MD5
45686ffebb9074e9ccace9b129f4cf88

SHA1
0594d95e52bdaa220a36e5816672d3d74b39e12e

SHA256
d7aed624b32596755a08d273956497d928978904e9634a5b91e519ef83b4413f

SHA512
c01c1ec22652c01d08e9245594efb08f03e564b9a37f5ca4d1067d05559ec43a3ae88cdbac84ed2be5f035a7e69c87c514a80d3c0a39876b2ab4860768f76fc5

Download Submit
memory/380-364-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/464-148-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/652-253-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/672-340-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/756-372-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/872-394-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1064-153-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1148-244-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1304-31-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1336-380-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1344-231-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1384-205-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1572-292-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1720-208-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1988-274-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1996-382-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2000-310-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2040-338-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2104-356-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2264-322-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2276-262-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2304-418-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2352-280-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2532-40-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2536-256-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2564-183-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2580-362-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2628-68-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2724-410-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2816-328-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2836-404-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2860-178-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2936-173-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3004-391-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3524-416-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3532-72-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3548-13-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3664-428-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3700-80-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3720-304-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3868-104-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3872-215-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3984-16-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3988-165-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4084-430-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4156-48-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4220-181-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4332-191-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4340-88-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4412-224-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4488-268-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4536-346-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4540-440-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4584-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4676-24-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4764-56-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4784-112-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4836-290-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4896-188-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4900-446-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4916-320-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4944-298-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4984-157-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5012-96-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads