bdc75545b6bc5dd48e053e64aee6f6adc1c1120f10b0e1751a9cf10ba0dbc9bc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 06:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Backdoor.Win32.Padodor.exe
Size

89KB
MD5

deb1ef2a5ba79cb49d1a07adb9e94ffb
SHA1

d6a010cbcd62c3bda825d728eb246012788cef82
SHA256

bdc75545b6bc5dd48e053e64aee6f6adc1c1120f10b0e1751a9cf10ba0dbc9bc
SHA512

e53aa33a3b94958d31f4d63ac1d8408a81269b9b446e4baf5e82a0587ee352c95d666a7fabdf5662ff73588b7a24a803822e7fb8897192b28374ee3c642000e8
SSDEEP

1536:UmwtjU4YQkUsiiXnXoRh3lwMpyUF3MaxRhRQyD68a+VMKKTRVGFtUhQfR1WRaROu:DwtA4YQXsFXo/3lwGyUF3MOhejr4MKym

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lbmhlihl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjhlml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pnbbbabh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hoiafcic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kbfbkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lpebpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mlopkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gcfqfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gblngpbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jidklf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nlmllkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pcijeb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hcbpab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kboljk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cbjoljdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpnhfhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Peimil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ecmeig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kebbafoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjmehkqk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jianff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Neeqea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojmcld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gfngap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ldjhpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ocpgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pclneicb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eaklidoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ghopckpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ghaliknf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gkaejf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eocenh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qeemej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gfgjgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ndhmhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Backdoor.Win32.Padodor.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fohoigfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqgkhnjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kiidgeki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnjlpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qeemej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jlednamo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qjoankoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Heapdjlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pgioqq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqpnombl.exe

Executes dropped EXE 64 IoCs

pid	Process
4444	Ndidbn32.exe
2184	Nggqoj32.exe
1152	Njfmke32.exe
4796	Ndkahnhh.exe
4440	Ogjmdigk.exe
2564	Okeieh32.exe
372	Oboaabga.exe
3700	Ocqnij32.exe
1668	Okhfjh32.exe
2852	Ojjffddl.exe
4628	Oqdoboli.exe
1964	Occkojkm.exe
4900	Okjbpglo.exe
1020	Ojmcld32.exe
1940	Obdkma32.exe
1788	Oqgkhnjf.exe
3460	Odbgim32.exe
2712	Ocegdjij.exe
4016	Ogaceh32.exe
3036	Okloegjl.exe
4492	Ojopad32.exe
2008	Onklabip.exe
5052	Obfhba32.exe
804	Oqihnn32.exe
4020	Ogcpjhoq.exe
4360	Onmhgb32.exe
3100	Pcjapi32.exe
5028	Pkaiqf32.exe
1776	Pbkamqmd.exe
1424	Peimil32.exe
972	Pclneicb.exe
4460	Pnbbbabh.exe
2416	Pqpnombl.exe
4840	Pkfblfab.exe
2908	Pbpjhp32.exe
1392	Pgmcqggf.exe
3108	Pjkombfj.exe
60	Paegjl32.exe
3476	Pjmlbbdg.exe
2108	Pnihcq32.exe
4520	Pagdol32.exe
2804	Qcepkg32.exe
2604	Qkmhlekj.exe
4808	Qbgqio32.exe
3204	Qeemej32.exe
1684	Qgciaf32.exe
884	Qnnanphk.exe
900	Acjjfggb.exe
1384	Alabgd32.exe
4736	Aanjpk32.exe
1800	Acmflf32.exe
1208	Ajfoiqll.exe
4884	Anbkio32.exe
4376	Abngjnmo.exe
1880	Aaqgek32.exe
464	Acocaf32.exe
1804	Alfkbc32.exe
876	Abpcon32.exe
3688	Alhhhcal.exe
1212	Ajkhdp32.exe
2400	Angddopp.exe
1752	Aaepqjpd.exe
2724	Ahoimd32.exe
2376	Aniajnnn.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Mipcob32.exe	Mbfkbhpa.exe
File created	C:\Windows\SysWOW64\Echdno32.dll	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Pcpopjlq.dll	Bbnpqk32.exe
File opened for modification	C:\Windows\SysWOW64\Acocaf32.exe	Aaqgek32.exe
File created	C:\Windows\SysWOW64\Alfkbc32.exe	Acocaf32.exe
File opened for modification	C:\Windows\SysWOW64\Pdpmpdbd.exe	Pmidog32.exe
File opened for modification	C:\Windows\SysWOW64\Ddonekbl.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Oqihnn32.exe	Obfhba32.exe
File created	C:\Windows\SysWOW64\Lejfpelg.dll	Gdjjckag.exe
File created	C:\Windows\SysWOW64\Oncofm32.exe	Oflgep32.exe
File created	C:\Windows\SysWOW64\Ifjodl32.exe	Ickchq32.exe
File opened for modification	C:\Windows\SysWOW64\Nlmllkja.exe	Nnjlpo32.exe
File created	C:\Windows\SysWOW64\Kmfiloih.dll	Ajkaii32.exe
File created	C:\Windows\SysWOW64\Oammoc32.dll	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Ekiapn32.dll	Onmhgb32.exe
File opened for modification	C:\Windows\SysWOW64\Ddgkpp32.exe	Dceohhja.exe
File opened for modification	C:\Windows\SysWOW64\Kdcbom32.exe	Kpgfooop.exe
File created	C:\Windows\SysWOW64\Okjbpglo.exe	Occkojkm.exe
File created	C:\Windows\SysWOW64\Eadopc32.exe	Eofbch32.exe
File created	C:\Windows\SysWOW64\Oqdoboli.exe	Ojjffddl.exe
File opened for modification	C:\Windows\SysWOW64\Ffgqqaip.exe	Fchddejl.exe
File created	C:\Windows\SysWOW64\Fbnafb32.exe	Fkciihgg.exe
File opened for modification	C:\Windows\SysWOW64\Gcddpdpo.exe	Gohhpe32.exe
File created	C:\Windows\SysWOW64\Hcpclbfa.exe	Hodgkc32.exe
File created	C:\Windows\SysWOW64\Hoiafcic.exe	Hioiji32.exe
File created	C:\Windows\SysWOW64\Lllcen32.exe	Lebkhc32.exe
File created	C:\Windows\SysWOW64\Blleba32.dll	Mlopkm32.exe
File created	C:\Windows\SysWOW64\Klqmnp32.dll	Paegjl32.exe
File created	C:\Windows\SysWOW64\Eocqqdjh.dll	Docmgjhp.exe
File opened for modification	C:\Windows\SysWOW64\Deagdn32.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Kgldjcmk.dll	Qnhahj32.exe
File created	C:\Windows\SysWOW64\Amgapeea.exe	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Fcckif32.exe	Fohoigfh.exe
File created	C:\Windows\SysWOW64\Nnneknob.exe	Nfgmjqop.exe
File created	C:\Windows\SysWOW64\Alabgd32.exe	Acjjfggb.exe
File created	C:\Windows\SysWOW64\Aainof32.dll	Ekhjmiad.exe
File opened for modification	C:\Windows\SysWOW64\Fhqcam32.exe	Fafkecel.exe
File created	C:\Windows\SysWOW64\Ibqpimpl.exe	Ilghlc32.exe
File opened for modification	C:\Windows\SysWOW64\Lmdina32.exe	Lenamdem.exe
File created	C:\Windows\SysWOW64\Mckemg32.exe	Mplhql32.exe
File opened for modification	C:\Windows\SysWOW64\Ogbipa32.exe	Oddmdf32.exe
File created	C:\Windows\SysWOW64\Aglemn32.exe	Amgapeea.exe
File opened for modification	C:\Windows\SysWOW64\Ickchq32.exe	Ildkgc32.exe
File created	C:\Windows\SysWOW64\Kiidgeki.exe	Kboljk32.exe
File opened for modification	C:\Windows\SysWOW64\Ofcmfodb.exe	Odapnf32.exe
File opened for modification	C:\Windows\SysWOW64\Ocegdjij.exe	Odbgim32.exe
File created	C:\Windows\SysWOW64\Kebbafoj.exe	Kbceejpf.exe
File opened for modification	C:\Windows\SysWOW64\Ghaliknf.exe	Gbgdlq32.exe
File created	C:\Windows\SysWOW64\Ilghlc32.exe	Iihkpg32.exe
File created	C:\Windows\SysWOW64\Fjegoh32.dll	Nlaegk32.exe
File created	C:\Windows\SysWOW64\Cnicfe32.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Ajkhdp32.exe	Alhhhcal.exe
File created	C:\Windows\SysWOW64\Nnenbk32.dll	Cbjoljdo.exe
File created	C:\Windows\SysWOW64\Jhondp32.dll	Gohhpe32.exe
File opened for modification	C:\Windows\SysWOW64\Nebdoa32.exe	Ncdgcf32.exe
File created	C:\Windows\SysWOW64\Hdoemjgn.dll	Pfhfan32.exe
File created	C:\Windows\SysWOW64\Oehldcbk.dll	Bblckl32.exe
File created	C:\Windows\SysWOW64\Dqlbaq32.dll	Gcojed32.exe
File opened for modification	C:\Windows\SysWOW64\Ceoibflm.exe	Cbqlfkmi.exe
File created	C:\Windows\SysWOW64\Ooajidfn.dll	Ibcmom32.exe
File created	C:\Windows\SysWOW64\Danecp32.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Jbllbm32.dll	Pnbbbabh.exe
File opened for modification	C:\Windows\SysWOW64\Qcepkg32.exe	Pagdol32.exe
File created	C:\Windows\SysWOW64\Ghkebndc.dll	Hcpclbfa.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10340	10292	WerFault.exe	500

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdoemjgn.dll"	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lbdolh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nloiakho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fkciihgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hoiafcic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jcllonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidlk32.dll"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpdaoioe.dll"	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Onmhgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hodgkc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hmfkoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lenamdem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Llgjjnlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Opdghh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pclneicb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ajfoiqll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eoolbinc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Odapnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echdno32.dll"	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pcjapi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cddecc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ghaliknf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hcpclbfa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Icgjmapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jpijnqkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mdehlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eonefj32.dll"	Megdccmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ehljfnpn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fdlnbm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ampkof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nljofl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ngdmod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jekpanpa.dll"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Backdoor.Win32.Padodor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ddmhja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bejogg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ghopckpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Heocnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bqbodd32.dll"	Qjoankoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qeemej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Acmflf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ibcmom32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ncfdie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qdbiedpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dobfld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fcckif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hcbpab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imhkcaln.dll"	Hfifmnij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkblkg32.dll"	Ibqpimpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mlefklpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pdpmpdbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hioiji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Icplcpgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gcagkdba.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 4444	688	Backdoor.Win32.Padodor.exe	86
PID 688 wrote to memory of 4444	688	Backdoor.Win32.Padodor.exe	86
PID 688 wrote to memory of 4444	688	Backdoor.Win32.Padodor.exe	86
PID 4444 wrote to memory of 2184	4444	Ndidbn32.exe	87
PID 4444 wrote to memory of 2184	4444	Ndidbn32.exe	87
PID 4444 wrote to memory of 2184	4444	Ndidbn32.exe	87
PID 2184 wrote to memory of 1152	2184	Nggqoj32.exe	88
PID 2184 wrote to memory of 1152	2184	Nggqoj32.exe	88
PID 2184 wrote to memory of 1152	2184	Nggqoj32.exe	88
PID 1152 wrote to memory of 4796	1152	Njfmke32.exe	89
PID 1152 wrote to memory of 4796	1152	Njfmke32.exe	89
PID 1152 wrote to memory of 4796	1152	Njfmke32.exe	89
PID 4796 wrote to memory of 4440	4796	Ndkahnhh.exe	90
PID 4796 wrote to memory of 4440	4796	Ndkahnhh.exe	90
PID 4796 wrote to memory of 4440	4796	Ndkahnhh.exe	90
PID 4440 wrote to memory of 2564	4440	Ogjmdigk.exe	91
PID 4440 wrote to memory of 2564	4440	Ogjmdigk.exe	91
PID 4440 wrote to memory of 2564	4440	Ogjmdigk.exe	91
PID 2564 wrote to memory of 372	2564	Okeieh32.exe	92
PID 2564 wrote to memory of 372	2564	Okeieh32.exe	92
PID 2564 wrote to memory of 372	2564	Okeieh32.exe	92
PID 372 wrote to memory of 3700	372	Oboaabga.exe	93
PID 372 wrote to memory of 3700	372	Oboaabga.exe	93
PID 372 wrote to memory of 3700	372	Oboaabga.exe	93
PID 3700 wrote to memory of 1668	3700	Ocqnij32.exe	94
PID 3700 wrote to memory of 1668	3700	Ocqnij32.exe	94
PID 3700 wrote to memory of 1668	3700	Ocqnij32.exe	94
PID 1668 wrote to memory of 2852	1668	Okhfjh32.exe	95
PID 1668 wrote to memory of 2852	1668	Okhfjh32.exe	95
PID 1668 wrote to memory of 2852	1668	Okhfjh32.exe	95
PID 2852 wrote to memory of 4628	2852	Ojjffddl.exe	96
PID 2852 wrote to memory of 4628	2852	Ojjffddl.exe	96
PID 2852 wrote to memory of 4628	2852	Ojjffddl.exe	96
PID 4628 wrote to memory of 1964	4628	Oqdoboli.exe	97
PID 4628 wrote to memory of 1964	4628	Oqdoboli.exe	97
PID 4628 wrote to memory of 1964	4628	Oqdoboli.exe	97
PID 1964 wrote to memory of 4900	1964	Occkojkm.exe	100
PID 1964 wrote to memory of 4900	1964	Occkojkm.exe	100
PID 1964 wrote to memory of 4900	1964	Occkojkm.exe	100
PID 4900 wrote to memory of 1020	4900	Okjbpglo.exe	99
PID 4900 wrote to memory of 1020	4900	Okjbpglo.exe	99
PID 4900 wrote to memory of 1020	4900	Okjbpglo.exe	99
PID 1020 wrote to memory of 1940	1020	Ojmcld32.exe	101
PID 1020 wrote to memory of 1940	1020	Ojmcld32.exe	101
PID 1020 wrote to memory of 1940	1020	Ojmcld32.exe	101
PID 1940 wrote to memory of 1788	1940	Obdkma32.exe	110
PID 1940 wrote to memory of 1788	1940	Obdkma32.exe	110
PID 1940 wrote to memory of 1788	1940	Obdkma32.exe	110
PID 1788 wrote to memory of 3460	1788	Oqgkhnjf.exe	102
PID 1788 wrote to memory of 3460	1788	Oqgkhnjf.exe	102
PID 1788 wrote to memory of 3460	1788	Oqgkhnjf.exe	102
PID 3460 wrote to memory of 2712	3460	Odbgim32.exe	103
PID 3460 wrote to memory of 2712	3460	Odbgim32.exe	103
PID 3460 wrote to memory of 2712	3460	Odbgim32.exe	103
PID 2712 wrote to memory of 4016	2712	Ocegdjij.exe	109
PID 2712 wrote to memory of 4016	2712	Ocegdjij.exe	109
PID 2712 wrote to memory of 4016	2712	Ocegdjij.exe	109
PID 4016 wrote to memory of 3036	4016	Ogaceh32.exe	104
PID 4016 wrote to memory of 3036	4016	Ogaceh32.exe	104
PID 4016 wrote to memory of 3036	4016	Ogaceh32.exe	104
PID 3036 wrote to memory of 4492	3036	Okloegjl.exe	108
PID 3036 wrote to memory of 4492	3036	Okloegjl.exe	108
PID 3036 wrote to memory of 4492	3036	Okloegjl.exe	108
PID 4492 wrote to memory of 2008	4492	Ojopad32.exe	105

C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Padodor.exe
"C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Padodor.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:688
- C:\Windows\SysWOW64\Ndidbn32.exe
  C:\Windows\system32\Ndidbn32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\SysWOW64\Nggqoj32.exe
    C:\Windows\system32\Nggqoj32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Windows\SysWOW64\Njfmke32.exe
      C:\Windows\system32\Njfmke32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1152
    - - C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4796
      - C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:372
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1668
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4900

C:\Windows\SysWOW64\Ojmcld32.exe
C:\Windows\system32\Ojmcld32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\Obdkma32.exe
  C:\Windows\system32\Obdkma32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\Oqgkhnjf.exe
    C:\Windows\system32\Oqgkhnjf.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1788

C:\Windows\SysWOW64\Odbgim32.exe
C:\Windows\system32\Odbgim32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\SysWOW64\Ocegdjij.exe
  C:\Windows\system32\Ocegdjij.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\Ogaceh32.exe
    C:\Windows\system32\Ogaceh32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4016

C:\Windows\SysWOW64\Okloegjl.exe
C:\Windows\system32\Okloegjl.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\Ojopad32.exe
  C:\Windows\system32\Ojopad32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4492

C:\Windows\SysWOW64\Onklabip.exe
C:\Windows\system32\Onklabip.exe
1⤵
- Executes dropped EXE
PID:2008
- C:\Windows\SysWOW64\Obfhba32.exe
  C:\Windows\system32\Obfhba32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:5052
- - C:\Windows\SysWOW64\Oqihnn32.exe
    C:\Windows\system32\Oqihnn32.exe
    3⤵
    - Executes dropped EXE
    PID:804
  - - C:\Windows\SysWOW64\Ogcpjhoq.exe
      C:\Windows\system32\Ogcpjhoq.exe
      4⤵
      Executes dropped EXE
      PID:4020
    - - C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4360
      - C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3100
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        7⤵
        Executes dropped EXE
        
        PID:5028
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        8⤵
        Executes dropped EXE
        
        PID:1776
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1424
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:972
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4460
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2416
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        13⤵
        Executes dropped EXE
        
        PID:4840
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        14⤵
        Executes dropped EXE
        
        PID:2908
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        15⤵
        Executes dropped EXE
        
        PID:1392
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        16⤵
        Executes dropped EXE
        
        PID:3108
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:60
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        18⤵
        Executes dropped EXE
        
        PID:3476
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        19⤵
        Executes dropped EXE
        
        PID:2108
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4520
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        21⤵
        Executes dropped EXE
        
        PID:2804
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        22⤵
        Executes dropped EXE
        
        PID:2604
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        23⤵
        Executes dropped EXE
        
        PID:4808
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3204
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        25⤵
        Executes dropped EXE
        
        PID:1684
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        26⤵
        Executes dropped EXE
        
        PID:884
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:900
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        28⤵
        Executes dropped EXE
        
        PID:1384
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        29⤵
        Executes dropped EXE
        
        PID:4736
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1800
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1208
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        32⤵
        Executes dropped EXE
        
        PID:4884
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        33⤵
        Executes dropped EXE
        
        PID:4376
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1880
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:464
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        36⤵
        Executes dropped EXE
        
        PID:1804
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        37⤵
        Executes dropped EXE
        
        PID:876
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3688
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        39⤵
        Executes dropped EXE
        
        PID:1212
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        40⤵
        Executes dropped EXE
        
        PID:2400
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        41⤵
        Executes dropped EXE
        
        PID:1752
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        42⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        43⤵
        Executes dropped EXE
        
        PID:2376
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        44⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        45⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        46⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        47⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        48⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        49⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        50⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        51⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        52⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        53⤵
        Drops file in System32 directory
        
        PID:4112
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        54⤵
        Modifies registry class
        
        PID:2816
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        55⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        56⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        57⤵
        Drops file in System32 directory
        
        PID:5088
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        58⤵
        Drops file in System32 directory
        
        PID:944
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        59⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        60⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        61⤵
        Modifies registry class
        
        PID:1280
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        62⤵
        
        PID:1000
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        63⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        64⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        65⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        66⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        67⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        68⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        69⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5168
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        71⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        72⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        73⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        74⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        75⤵
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        76⤵
        Drops file in System32 directory
        
        PID:5440
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        77⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        78⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        79⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        80⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        81⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        82⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        83⤵
        Drops file in System32 directory
        
        PID:5776
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        84⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        85⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        86⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5964
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        88⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        89⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        90⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        91⤵
        Modifies registry class
        
        PID:6128
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        92⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        93⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5188
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        95⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        96⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        97⤵
        Drops file in System32 directory
        
        PID:5488
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5564
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        99⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        100⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        101⤵
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        102⤵
        Drops file in System32 directory
        
        PID:5900
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        103⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        104⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5124
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        106⤵
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        107⤵
        Drops file in System32 directory
        
        PID:5296
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        108⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        109⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        110⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        111⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        112⤵
        Drops file in System32 directory
        
        PID:5988
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        113⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        114⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        115⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        116⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        117⤵
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        118⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        119⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        120⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        121⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        122⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        123⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        124⤵
        Drops file in System32 directory
        
        PID:6044
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5940
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        126⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        127⤵
        Modifies registry class
        
        PID:6404
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        128⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6488
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        130⤵
        Drops file in System32 directory
        
        PID:6528
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        131⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        132⤵
        Drops file in System32 directory
        
        PID:6612
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6656
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        134⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        135⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6776
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        137⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6872
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6912
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6948
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        141⤵
        Drops file in System32 directory
        
        PID:6988
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        142⤵
        Modifies registry class
        
        PID:7044
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        143⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        144⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        145⤵
        Modifies registry class
        
        PID:7164
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        146⤵
        Modifies registry class
        
        PID:6180
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        147⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6220
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        148⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6292
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6324
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        150⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        151⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6432
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        153⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        154⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6592
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6672
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        156⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        157⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        158⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        159⤵
        Modifies registry class
        
        PID:6932
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        160⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        161⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        162⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        163⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        164⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        165⤵
        Drops file in System32 directory
        
        PID:6320
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        166⤵
        Drops file in System32 directory
        
        PID:6400
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        167⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        168⤵
        Drops file in System32 directory
        
        PID:6636
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        169⤵
        Drops file in System32 directory
        
        PID:6724
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        170⤵
        Modifies registry class
        
        PID:6856
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        171⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        172⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        173⤵
        Modifies registry class
        
        PID:6152
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        174⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6244
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        175⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        176⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        177⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        178⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        179⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        180⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        181⤵
        Modifies registry class
        
        PID:6384
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        182⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7016
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        184⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        185⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        186⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6548
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        188⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        189⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        190⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        191⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        192⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7384
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        194⤵
        Modifies registry class
        
        PID:7424
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7460
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7504
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        197⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        198⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        199⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        200⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        201⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        202⤵
        Drops file in System32 directory
        
        PID:7752
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7788
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        204⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        205⤵
        Drops file in System32 directory
        
        PID:7880
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        206⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7968
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        208⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        209⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        210⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        211⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        212⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        213⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        214⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        215⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7364
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7436
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        218⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        219⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        220⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        221⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        222⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7772
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        223⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        224⤵
        Modifies registry class
        
        PID:7928
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        225⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        226⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8120
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        228⤵
        Modifies registry class
        
        PID:7052
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        229⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        230⤵
        Drops file in System32 directory
        
        PID:7360
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        231⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        232⤵
        Drops file in System32 directory
        
        PID:7576
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        233⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7744
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        235⤵
        Modifies registry class
        
        PID:7908
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        236⤵
        Modifies registry class
        
        PID:8004
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        237⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        238⤵
        Drops file in System32 directory
        
        PID:8152
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        239⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        240⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        241⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        242⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        243⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        244⤵
        Modifies registry class
        
        PID:7996
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        245⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7408
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        247⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        248⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        249⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        250⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8168
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        252⤵
        Modifies registry class
        
        PID:5704
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        253⤵
        Drops file in System32 directory
        
        PID:6480
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        254⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8232
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8276
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        257⤵
        Modifies registry class
        
        PID:8316
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8352
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        259⤵
        Modifies registry class
        
        PID:8396
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        260⤵
        Modifies registry class
        
        PID:8436
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        261⤵
        Drops file in System32 directory
        
        PID:8472
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        262⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        263⤵
        Drops file in System32 directory
        
        PID:8564
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8604
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        265⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8680
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        267⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        268⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        269⤵
        Drops file in System32 directory
        
        PID:8820
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        270⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        271⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8940
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        273⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        274⤵
        Modifies registry class
        
        PID:9028
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        275⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        276⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        277⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        278⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        279⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7552
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        280⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        281⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        282⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        283⤵
        Drops file in System32 directory
        
        PID:8480
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        284⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        285⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        286⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        287⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8832
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        289⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8888
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        290⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        291⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        292⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        293⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        294⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        295⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        296⤵
        Modifies registry class
        
        PID:2420
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3956
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8416
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        299⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        300⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        301⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        302⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        303⤵
        Modifies registry class
        
        PID:8936
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        304⤵
        Drops file in System32 directory
        
        PID:9060
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        305⤵
        Modifies registry class
        
        PID:9144
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8228
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        307⤵
        Drops file in System32 directory
        
        PID:32
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        308⤵
        Modifies registry class
        
        PID:8392
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        309⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8740
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        311⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        312⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        313⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        314⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        315⤵
        Modifies registry class
        
        PID:8448
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        316⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        317⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        318⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        319⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        320⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        321⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        322⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        323⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        324⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        325⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        326⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9348
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        328⤵
        Drops file in System32 directory
        
        PID:9384
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        329⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9472
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        331⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        332⤵
        Modifies registry class
        
        PID:9552
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9592
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        334⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        335⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        336⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        337⤵
        Modifies registry class
        
        PID:9768
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        338⤵
        Modifies registry class
        
        PID:9812
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        339⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        340⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        341⤵
        Modifies registry class
        
        PID:9936
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        342⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        343⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        344⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        345⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10152
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        347⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        348⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9272
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        350⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        351⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        352⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        353⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9584
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        355⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        356⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        357⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        358⤵
        Modifies registry class
        
        PID:9864
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9944
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        360⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9996
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        361⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        362⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        363⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9248
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        365⤵
        Modifies registry class
        
        PID:9376
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        366⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        367⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        368⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        369⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9776
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9896
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        371⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        372⤵
        Drops file in System32 directory
        
        PID:10132
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10228
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        374⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        375⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        376⤵
        Modifies registry class
        
        PID:9664
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9876
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        378⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        379⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        380⤵
        Drops file in System32 directory
        
        PID:9560
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9788
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        382⤵
        Modifies registry class
        
        PID:9984
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        383⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        384⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        385⤵
        Drops file in System32 directory
        
        PID:9296
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9284
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        387⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        388⤵
        Modifies registry class
        
        PID:10252
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        389⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10292 -s 408
        390⤵
        Program crash
        
        PID:10340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 10292 -ip 10292
1⤵
PID:10316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aepefb32.exe

Filesize
89KB

MD5
c52896ba8188cd976da71cfd1e3be96a

SHA1
75908813a9319aa69ccb725e198387e1c3a41c49

SHA256
4b42a45db0ace62c1e3f35e8a85d23d56a2fce8c48de3a9670da17419485bf67

SHA512
6f3586da915109633d9a6e47ead0ebae64e72ec395847446a040e76091e56323987d5e1202d21767e0fb879b8ae1a833124e226ce5a8f6a7fec6cfd8ee18473b

Download Submit
C:\Windows\SysWOW64\Aglemn32.exe

Filesize
89KB

MD5
53a376af18e68658acd35d6fd564d4d9

SHA1
8b410427aec2763fc623b3a1b9463cf6bbe199bc

SHA256
5e218674365fadc956f386de1371a168540d8d7a83f446696777c1f11775b773

SHA512
c121001c761a6bd2a241b9c97b726de344353b3c2c5aeeaa2f208fe45aa698d99db534ddfdd439e8a72ebf8165fd3902102a017436736c6a1c8090ed502ff8f9

Download Submit
C:\Windows\SysWOW64\Bejogg32.exe

Filesize
89KB

MD5
703a28993f2ee502088dd85d12ab2df6

SHA1
b04951542fa373273277004b8231e22e22c55907

SHA256
0f7f7a3231ed04eb05f423a2bf0c28cf185c3463dd04d5f76c0cc46763db8b39

SHA512
d9d8f09fd3916b25a04967c15054a6901e67a1faec68704ef3e27aace9f5a3841c14807f881f2fafd9788a5b53a378b0e9b9d813f00a9b32bb42fe8ff40fc804

Download Submit
C:\Windows\SysWOW64\Cajcbgml.exe

Filesize
89KB

MD5
b5b5c6915ba05b58fb2ed1cc22ebdc3d

SHA1
766fbb4838ea32eb0f6f7bd091fb6605cdbe46c7

SHA256
67136f3e693753396e2ea9ebc0700145bb5275de89564268191a2322a14b2e87

SHA512
20f9357f0f987a17c995644a72dde619bf754bb47a2e26ad3c598f717392b9f432d97ec8f7c90256d345ec5209d29421dede74506b4e8f3b1126ef26155b4f52

Download Submit
C:\Windows\SysWOW64\Cbqlfkmi.exe

Filesize
89KB

MD5
1293b946e7f2f38625a0be94390d252d

SHA1
27cae150bb9a92609419ba3a76d020388c7642ff

SHA256
6bacf73053e3f3ee9d7f8f922a4cc4b7e3d96ca0aacb0868de20b6f2d517a881

SHA512
0915163d7d035a86ecc2c7db2469bfbe6ea2aba5b9bbaf94620c24e5560e752ba32ab48dc1edfb2245c16f3e7b41242d0a81c63e2aa5d3da82e83f41924a818a

Download Submit
C:\Windows\SysWOW64\Doeiljfn.exe

Filesize
89KB

MD5
7efb89e2f95ea13b044d89697375b42e

SHA1
76e2341b9a422adb2496651441c60180516408ad

SHA256
df0fec030c33095b71ada409d5fc2274f83cdae9237ddc099a53b5b0da2cfa09

SHA512
b11c1246a05b25fb42861cba8b0e9fc4c249df4e8b6c855d368f6cea69ad51f0602988a3aa5e73d24bef81987da664c7eb426bd75a6fa1197e44970a72358c01

Download Submit
C:\Windows\SysWOW64\Hoiafcic.exe

Filesize
89KB

MD5
c40fe5f47b13ac24d8fb0beb888229d5

SHA1
d3a329676b4de1fec1d002883f6d2165c081b658

SHA256
d171fdd698bf2440790921dd12bd734c4a01c8af503c431f3e91c08144721579

SHA512
50424f7d1bc64c7ff7e831aeb36e0ed1af3ccc39fea137d4de53879f7a764ba948d7b8a190fa73f515c08fe04b14d8939c1f4e8f6ce2aa177fcf16d538f2b374

Download Submit
C:\Windows\SysWOW64\Honhef32.dll

Filesize
7KB

MD5
b6cc939ef322cb1399f1c9306623621b

SHA1
00a0f5bd978775d3be67e39fd43217b645510210

SHA256
72b36963ecc542237be99600925d9056bd93a1f8593c5f58ee50cf2192dd802a

SHA512
22a0f739ce0c6a3b72de984ef700518525c090939e500d13dd46093b3debaf4ddf5180146d921fd319b596ed7684b6cab7a33ee3b5678260bc79b7fb98a8966e

Download Submit
C:\Windows\SysWOW64\Ndidbn32.exe

Filesize
89KB

MD5
eff7563c0f5597e35daf851b72297263

SHA1
452ddd75c40ce0c53fceb985bdaf5034d972491d

SHA256
5aded04ca4672d13ac63ad9c625ea3c869c61e0c4586a1c79a5c978682ac31eb

SHA512
0dc44b453c7282b2a9ebe9745bffd1d46aa9c22b896ec438f3ffd6094623a4f0bee970ece32f9434fde6e9492fa54589e7bea48f2a61ac3efd5fd1c4291a2291

Download Submit
C:\Windows\SysWOW64\Ndkahnhh.exe

Filesize
89KB

MD5
d50ac01c2a186503b55f690ebb31fe87

SHA1
96eaf022a35eb1f7667dc4b973228619c375243b

SHA256
76b56633fe677f1518ab30db99f0e3a9455b168464041891e3078f4d96bcd1de

SHA512
72c6655184b0203812787476ec791cc4162dee4f3ff2ce016838c90a4e686b01448081018c04cbbc4119d597d56e8799e0df419ca84985c0aaa4f7b69a369da9

Download Submit
C:\Windows\SysWOW64\Nggqoj32.exe

Filesize
89KB

MD5
06167ad4a29eb58fa6e751f7415f3ce0

SHA1
00028039d91103dc896e6942b5d6cbe8854e98da

SHA256
77d18a84c965d43c6da45aba8aeae3f6179bcadf30ded1422c3f85eff3c208a9

SHA512
05392fc4fd7b00b7322b23071cfc4f91bf35a3627f05547aa217cdf4dc1d9961b192acbc245c17d31867e0dbdeb8ee7b8096ade50b29f983b34c9cbfaed57864

Download Submit
C:\Windows\SysWOW64\Njfmke32.exe

Filesize
89KB

MD5
ded03f29488c675d9ec80cfbd417ae6b

SHA1
b9bfe7281e5262c0cc65ff4f1d4f9f94214af19c

SHA256
b4ea3a4e85c27a111c721ea0829d665b6cf444613d5ee26c5b7e1e9f90218ea3

SHA512
d81fc6ab535d59f13a9a217adef56ffc59904e1e2ed5b7c8c6b7d30dae13e89f9b7e6f9bb0fe50b139bc642fde38893f7a0d74d754a1482e7566e62d88de8ccd

Download Submit
C:\Windows\SysWOW64\Obdkma32.exe

Filesize
89KB

MD5
e61ffbae0e464b5fc9f0ab002236fddc

SHA1
e49a2960585baa7714b74b19732daf2b005c7b83

SHA256
d02eb8d31ef18825e1205e230c3bb1050f2eb8f272bbda18cd5d221ac3224d3a

SHA512
ceab32ba371af063237ce243b28095683ea2187f4361b9720f745e8b09346016537305cc220a9a9b78c0e4f8fc6dc46ab0788730139017a32ed37941d5978453

Download Submit
C:\Windows\SysWOW64\Obfhba32.exe

Filesize
89KB

MD5
039bed87eea51af61adfaa308521183d

SHA1
9d1fd5839ee885005ad2d0cdfecf3fb3276bac63

SHA256
38aee365e3ca6c44fcb0b8ca126844a42fa96c55dc7148885033427fb07f80e6

SHA512
5614136ad0141863443cfabdcbb9132d51320a5647335ce4b8bb4ceca805551ad2563a55019c0163e9ef1cd0f58371af99406c30c66dd6bbee86e73e65ebdaf5

Download Submit
C:\Windows\SysWOW64\Oboaabga.exe

Filesize
89KB

MD5
d386dd349aa08e8f0c87cf7a2e9fc919

SHA1
b674cd7a2901c245702d2699ff3fbe5bd0818f00

SHA256
44a8a306e4393be84cfb48e00b07a11b202ec89c0121261f95c149404b3f2f94

SHA512
5c94a45b3e3bdd8234df183f3588fb37e385cb235a07b9b2d4295bb4cdfae74c736cdd5ae50a55ede4d779eaaa448bab3c10f8538929b6a3d274b6adaf0ddfbd

Download Submit
C:\Windows\SysWOW64\Occkojkm.exe

Filesize
89KB

MD5
0142d50ae426db3be77903c0acefccc4

SHA1
0695c779e630789d56e2c7a2d3aa61b46e911eb9

SHA256
d756c5180e03a60e36f75232a7518cfa7b2851ee06b392610d930448080d134b

SHA512
9e01ee751e961f443343c6d937c4aa3713c5cd1bfd170062ab3726e1baeceb50f1e0f520f3727afa570c8debc0999b86b7111b7b7be494c28512ecf0b9d2ae33

Download Submit
C:\Windows\SysWOW64\Ocegdjij.exe

Filesize
89KB

MD5
412353d424c5229c8067b03bed2d0a1f

SHA1
c04247643e0eb7baf17642af650a0e13e471fd92

SHA256
ed7a7aa86f22951f7ae98949d7ca8cc9a7c15ad0729c72b5118a2a407ee47ae8

SHA512
7ba3ff1a4e36da0bf7cef9878eea75e85fb24478c0feb63955c05e1819f8f6a87c7aba3d94b5f2feeb140ab82eebc9d0c19e5f212a6bbb0f52f76f98d482c717

Download Submit
C:\Windows\SysWOW64\Ocqnij32.exe

Filesize
89KB

MD5
0c3a321c18bb00528c3c57e6f485da3a

SHA1
513fae024e9aeec70749246b70030d4f2fc1b575

SHA256
e56521384e54e7fc9370ad8c0134ef67b1931d53a899f330fca5c085a0251ee6

SHA512
6385b2764006cc2b6b7cf7eeb6a6c86dea104aec25b29545349920d41c8457b307c1e058ddd7b743ba2e9df2639777680cf162d772b1a197c3b5504a796532ba

Download Submit
C:\Windows\SysWOW64\Odbgim32.exe

Filesize
89KB

MD5
38f308ac0d538cbf1b1c48ed5a375361

SHA1
b2786770b1141487b3eaab71bdd61875f6815b25

SHA256
329327c07ed4889da051bdd0e149a47bb6f75ac7d4d92cb6cd251744f45875d9

SHA512
fc8de66a476b330ec6ef9f128f9c1e52f7a9e160c90e476999e6c30adabe3e1f62636da7fb8d3ed333d853a90fed90973e85586e3d60a517296165f47c270a72

Download Submit
C:\Windows\SysWOW64\Ogaceh32.exe

Filesize
89KB

MD5
f3cb546b734e870e7d461c9226c0e332

SHA1
1e410c21ba983acfa715fce36f77835be66fa971

SHA256
05c99f1ff309d88f7a5ff54fe8dba8a6c7da323f8541d7bfde124576e6798193

SHA512
0bbdb45c1e0ada0bdbdb84423d4a4fc08d5f3a752264606809b60591fe627413e1d38fbb511f69bc9c915aed290463cb101864cd5fd3b1924cc0037ce746f27a

Download Submit
C:\Windows\SysWOW64\Ogcpjhoq.exe

Filesize
89KB

MD5
b64381a6a1a478ec7e5453d10cd943f2

SHA1
8553b0ba9c9a44ece83961a635e0e13f74207797

SHA256
5fb58c2ce07db194087b2f61be0e6307be719c630b9246ecbc17f9ca3cc87a44

SHA512
81cf334141aeb931a76800fc43797479bfd0521ed1feffe68948cf1280b992746fca6123b7a96940d74bd7fecb872edc0da5cb0092283b2def9e0b9b7e4aa376

Download Submit
C:\Windows\SysWOW64\Ogjmdigk.exe

Filesize
89KB

MD5
013229b8a6075d8fcdc0b9f1a3bf3cec

SHA1
eba5a1bb5aafc6ac206e9c5615fee9595c6321b6

SHA256
39703b829e03441227130ae273c1d102adc6fcb99d18db9fb72d0dd6e3aef6af

SHA512
6fd97107fcf1fdd31cb5e6f7bf165f8e441f5edccc7df3976e04d9abb6808c643f306e8a27212601515fabe8039f3b4a7523e70f138b8037cf0d4342e0cbfcc0

Download Submit
C:\Windows\SysWOW64\Ojjffddl.exe

Filesize
89KB

MD5
2f857510189048e151913a3d3d37cf43

SHA1
9d3dbe11e153c393854054d669570a4839d89ad1

SHA256
4c37e3006871b029e21931e0d357a216910c2ab037930064e993ec597d8a783d

SHA512
91a147425e594eece9bf56420663ac38e9d5ded78509553213aee0835d75927458b21caa7c3b9dd726ff4e25c9ab7fd0c07b8d64ccb534e5c536248340d7e6f3

Download Submit
C:\Windows\SysWOW64\Ojmcld32.exe

Filesize
89KB

MD5
03ff9354998c6fef8c8278283c66c012

SHA1
82e1237cedbed4e3b1663aaf72c52752e3f8f688

SHA256
dd7cdd623b3d65d4d70ced35bd27d7986732e6bea7bde15afcecc7a80e650001

SHA512
64cf8eacbe0ec8f8ae4978eb3e145155ae6549b915a290d77b18f3cf964a1d7d2f36e9a85e654cb221af0760c29afb95fb917f518e66a49fa468f0eb5d5544f3

Download Submit
C:\Windows\SysWOW64\Ojopad32.exe

Filesize
89KB

MD5
e7c932ee3c0a2d05db756dd48d87ae57

SHA1
abe8e6aad91aed1696f121ab0ab8ad83abf74023

SHA256
9676a7977fad7fa1a95c52d9698a8d10a7f9d07f9680f297f200d76ef3eeeb74

SHA512
2b6a54f4ce4917fb7fc64d86fa81aaff8322250991f6cf5ec6d1af789bbe5e5e0eca87b5b668810bbef9eb0b491cc8538ae77f43d761a464d97b548df773f102

Download Submit
C:\Windows\SysWOW64\Okeieh32.exe

Filesize
89KB

MD5
0c8090c088106307def7333aebfda035

SHA1
8d4456bcc941688db7a16b68f8765e8eb2a6ffc7

SHA256
54237c511aa82fbe69695c96a69a93799ebc8463d8b08a5ee4b14c62194faef5

SHA512
7345b34f0efc6324eea29c05bc1c9f98fce417c70d117aadb1a723c6c3acc394b9038628c59b3af77daa8c845cf7dc7bed07fd9dc755571ab724cb06c50f30f4

Download Submit
C:\Windows\SysWOW64\Okhfjh32.exe

Filesize
89KB

MD5
6e0d63683012a4a3bcb74ffe52cd9d0e

SHA1
f74502911b17ac2357f8225b5a32c819e8abfe7b

SHA256
cab60161a5fb8d5e2e7677e9cbc1edeeaf9d472a7aedbe370b0c9caffdd934ef

SHA512
5db7bf2bcc96b50d9e8b37e22e6083a64546f1f2da54a3d18b1162fecf86eee620a4e8e10ee2404f306ded63993995514d4f17ccdd3f6175679d01d6c9d094b3

Download Submit
C:\Windows\SysWOW64\Okjbpglo.exe

Filesize
89KB

MD5
72c1f98fb032b9336e55788dbd9564b3

SHA1
2f9bbd0e4732a957df518816667793678a80ac79

SHA256
5a7c0857216f06e5bd676579066937739698da7ca2d29f491f54b1a1d23a5c64

SHA512
88d9f596211dcb46eb626583ed0d302f6aa6cc702156e5b0e8d1a72029f0246967b8ed10e4b3113739843ab9007059a86e1231ddc5a665f19081f1f622cfc3d6

Download Submit
C:\Windows\SysWOW64\Okloegjl.exe

Filesize
89KB

MD5
53a5e0fefb8f516e14562b2fb970aa8d

SHA1
618842ada34f1db324a3671003cd6bd0dfebfb9b

SHA256
c0f02a8524866317b58c48a2353e47ffbbfff636e3fa6e08d57cf5f16c1ab95b

SHA512
dce49ee4b197a6b19c4f6d99df2f9833200cf4955fd90172886f7de459ad320e38c8f3d7e3fb708425f07f1761a338ee4885e13f4f52fc242118205a78ac815b

Download Submit
C:\Windows\SysWOW64\Oncofm32.exe

Filesize
89KB

MD5
6189ee366e318556f6e546e31062bcb9

SHA1
0108fc58ab01df4401707597de8a30073987e676

SHA256
75508fe6163903b899709e9a4abda54bf6e71511509e65fbf4ef6ab79e4c54d2

SHA512
be092050c712dbe22f5809cf5628a7d629e4c67c9e65ce521c2b32032ac1390922bf66bb2125653316eb449acf45d524cb084cd74f4f8ea144fb0882eed8506b

Download Submit
C:\Windows\SysWOW64\Onklabip.exe

Filesize
89KB

MD5
92c001401686a8ae0a95a0f7eb3d0b8c

SHA1
882ca2518798f0f076396787af859a118b731238

SHA256
97a6c3194c6c78e83d6e3d648ce894f21dd70bc58289efdd5c8bf68e721900e9

SHA512
fad515b4e2ce2b44265fd98a47a55b0366cb954b5570ed88d10e730feb701a7599e8a0d012e270ff9e81e9dada7ff6edcae136df6ed5789c346007f984e38623

Download Submit
C:\Windows\SysWOW64\Onmhgb32.exe

Filesize
89KB

MD5
3012b82cb71acffc9510fb3b865776bb

SHA1
96c03771ec7ec3188b80804c26299c7a3e558534

SHA256
7ed1ccc3a5429a0a28c0d4b5f1d62d022b1bc255eac9bef72df2373f75de27ff

SHA512
b2f19c1102be6c26a9a9f708edfe0ac38958ff4d108e0ba29e42b853b9c888dc5dd89954304c52d6a00eb8401a75995b6d4e4045839c3150c3d55c1946ca9684

Download Submit
C:\Windows\SysWOW64\Oqdoboli.exe

Filesize
89KB

MD5
b72ed703cea9d365f1b438bf19fff276

SHA1
f71f0e966a7d81c295c5ee608d5f2fc65ccf14cd

SHA256
9eddb323a24befdd27cceb219aed20ea99bea11da3b8d5b5f3acee531d9e5d53

SHA512
67fb87bcb5bf7ce386338cd994bb460ed606c508693e520b52855745b057c3ab207fc371067387b7120cccb3e95c95839c49032653bf14dee7c5c04b4c6cb1ce

Download Submit
C:\Windows\SysWOW64\Oqgkhnjf.exe

Filesize
89KB

MD5
a5527a6b32dabc9eff8f5e12210eb4c1

SHA1
fcbb2598a9651502ffdfcce65aea62298e70df6b

SHA256
344641b9c7e238ae8f24fb3b9ff8ea875cc39d7d64e76e5ab498114f1120ff0f

SHA512
ef38303f7939302ca270675b6924aa338daa1b091b458c35240e989bc91a60b5db42415d5d9a075c599ce5afc63674239b6af993936635a09ed6bb773aeea8ff

Download Submit
C:\Windows\SysWOW64\Oqihnn32.exe

Filesize
89KB

MD5
e84d964e6cbfa24fd2ce64f281482c16

SHA1
8647dc7b11df2dacfec13a81355970dfec9dede6

SHA256
b1c894adff5d7550cf12f1b49f46f2f2bd4ad735fd671948151413d2b26df0a5

SHA512
c1267d84e3947ce4b68831a0db9f79fd579dfeabbcb7b7149d5591bcd1cde6caa2ad93996f71102e0edae1d53e80808d5e1e6042bf93630e4b06a701e31ac1ff

Download Submit
C:\Windows\SysWOW64\Pbkamqmd.exe

Filesize
89KB

MD5
fa5c5d40e162f238cf982a4eccf9c2ee

SHA1
4f5fd4f639cb016658616a80c962782a7c3191d9

SHA256
31f2254892d2b4b4c6463550f0f2d1dab0febabdc57ac178d0307b24638a6f22

SHA512
c20734f282fca12ce17678931d68fdb6c29f4a03936172fea2915dbc919c6b244ef1074845b33331eb9a793c317bdd93998fb0674efbc04c8989e49b22c3c178

Download Submit
C:\Windows\SysWOW64\Pcjapi32.exe

Filesize
89KB

MD5
5017f0a9a0181264f8e026db2dc19f0a

SHA1
fc3830a72032a9ab6ac4f4621ae3754a6528880e

SHA256
881832d76ef6a38f63bd2cecb4bf1013a80282483ac445157965f67aac120910

SHA512
a7f20a651ff6d852eb582776a99d20db5dc37549e070f09bbe4eb5f614405e632b6565c9adb929f484f26ecd6b5cf1f774dcf90719661082e7692a6541c3b2b3

Download Submit
C:\Windows\SysWOW64\Pclneicb.exe

Filesize
89KB

MD5
ed4a9e1b545f66f2dba2540e686404b2

SHA1
68a325a900c717e2e8f42fec5f7bceec4108fa7b

SHA256
60d946abcae1d56914e58b37832ea34e70542c75d734dab9b6ba2077961f61cf

SHA512
55093273b7f50c261ffad803aeadd98fe16574bf39cd15cf8ee657eb99d470db95dc5b38cdac7268c82e2a3216cc3f0fe03a58075515b7ee755452ac16ad5ded

Download Submit
C:\Windows\SysWOW64\Peimil32.exe

Filesize
89KB

MD5
4f193e86a977f87a64d93716c3e4deff

SHA1
2076b05f509ee02b19f395d964c58ed576567358

SHA256
17ed454037e249369950cacbfad0ca3082e9aecff35843a8e1d32e8e40325d39

SHA512
036a4984e2f5f674df48f3fee46987d4d181ae209354a286ca8c94d02acd7d19cd91d55aab9580ae7c8deadd7fe07d08390e44fd60d26c69470f1e5a2b36c911

Download Submit
C:\Windows\SysWOW64\Pkaiqf32.exe

Filesize
89KB

MD5
1f6834323ee77e70fd757f27b10eb58a

SHA1
042eedbe11a54e6be5ea0b0e2064b36beb96088a

SHA256
6dfe0e356fa9fba042eb7f63fdd90af738f6e543f0d9c20bfbe0fdc1be90521b

SHA512
c9b09bf20f8b5214239b601f0adfc24a24879faa039f530b945407c8138ddbb45dca9e6af03bf5581d67d7b11ac1aa56ca6e6da3b8b053ed3b25bc3c4fe10d9f

Download Submit
C:\Windows\SysWOW64\Pnbbbabh.exe

Filesize
89KB

MD5
992acb22066a6acf96d699ab8154d9aa

SHA1
f14b5bdcabff091ba40ca93b6253f5606823ee21

SHA256
ddcd7e29779a620be23ad6543466e01f7373e57bf5189fb3d018ff191345d778

SHA512
fb7e771c5eaa7288ed668bef5717bf15fd65d10b995eef5ac1367967e5673a3754c3b5d61c1514556d2e0ede0f489e3548bcb748c51ee8da49e15f3dd5820849

Download Submit
memory/60-362-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/60-301-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/372-275-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/372-55-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/688-85-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/688-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/804-221-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/884-356-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/900-368-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/972-265-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1020-178-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1152-213-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1152-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1384-369-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1392-293-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1392-349-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1424-257-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1668-72-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1668-282-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1684-350-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1776-251-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1788-183-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1940-205-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1964-116-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2008-203-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2108-313-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2108-375-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2184-139-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2184-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2416-274-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2564-268-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2564-48-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2604-331-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2712-207-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2804-329-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2852-93-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2908-288-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3036-193-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3100-247-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3108-299-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3204-343-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3460-185-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3476-311-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3700-68-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4016-187-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4020-225-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4360-233-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4440-260-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4440-40-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4444-100-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4444-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4460-267-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4492-197-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4520-386-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4520-319-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4628-104-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4736-380-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4796-32-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4796-241-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4808-337-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4840-281-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4900-117-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5028-250-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5052-215-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads