4b696c33939313131e291a6e079336c2251825cd8e3788a9af6bf39e38b6c1c4

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b696c33939313131e291a6e079336c2251825cd8e3788a9af6bf39e38b6c1c4.exe
Size

74KB
MD5

092e33b7d47da88fb38c7a58e1d86e90
SHA1

f6ae1615d7ea52b569a9ce1daa1fd82f0400e6b2
SHA256

4b696c33939313131e291a6e079336c2251825cd8e3788a9af6bf39e38b6c1c4
SHA512

fbb55283ce3c1f7ee6ba6d973684aa0d66439190fe2d00daa9d97e3552acf887a04d602d40772563fe0cc23ced61105414fd545b5663c5873c04f54f5e54220f
SSDEEP

1536:uG8HZEgApwIV4mDvhlNBtyYY8YYYYYYYYYYYYYYqYYYYYYYWYYYYY7hr:uGxHpwSLvhlTQYY8YYYYYYYYYYYYYYqm

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmiciaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mbfkbhpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mckemg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onfbfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbeidl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pghieg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aldomc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffgqqaip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiefcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Olfobjbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Behbag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clnjjpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eefhjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Flqimk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Helfik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eamhodmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkopnh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kebbafoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdjagjco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocnjidkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icgjmapi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pkjlge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cklaknjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dbaemi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdgdgnbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jefbfgig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olkhmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	4b696c33939313131e291a6e079336c2251825cd8e3788a9af6bf39e38b6c1c4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njfmke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcojed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmijbcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lboeaifi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qbimoo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdeoemeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Opdghh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qecppkdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cbcilkjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpjcdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbdolh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Medgncoe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opdghh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnihcq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifefimom.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbjcolha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlkagbej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bdfibe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cklaknjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eepjpb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fooeif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghaliknf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Icifbang.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bejogg32.exe

Executes dropped EXE 64 IoCs

pid	Process
956	Ngpjnkpf.exe
2940	Nnjbke32.exe
3696	Nddkgonp.exe
64	Nkncdifl.exe
940	Nnmopdep.exe
1732	Nbhkac32.exe
1124	Ncihikcg.exe
3780	Nkqpjidj.exe
4956	Njcpee32.exe
1580	Nqmhbpba.exe
4052	Ndidbn32.exe
3508	Nggqoj32.exe
4888	Njfmke32.exe
4792	Ogjmdigk.exe
3532	Oboaabga.exe
3204	Okhfjh32.exe
2244	Onfbfc32.exe
4520	Odpjcm32.exe
1684	Ojmcld32.exe
2960	Obdkma32.exe
3380	Ocegdjij.exe
2964	Okloegjl.exe
664	Obfhba32.exe
1192	Odednmpm.exe
4032	Ogcpjhoq.exe
1512	Oqkdcn32.exe
2376	Pcjapi32.exe
4868	Pjdilcla.exe
3200	Pqnaim32.exe
4356	Pghieg32.exe
3108	Pnbbbabh.exe
3596	Pcojkhap.exe
1372	Pkfblfab.exe
828	Pndohaqe.exe
4432	Pcagphom.exe
4308	Pkhoae32.exe
1976	Pnfkma32.exe
4932	Paegjl32.exe
4372	Pcccfh32.exe
1392	Pkjlge32.exe
2248	Pnihcq32.exe
4380	Qecppkdm.exe
1716	Qgallfcq.exe
4456	Qjpiha32.exe
452	Qnkdhpjn.exe
2748	Qajadlja.exe
392	Qchmagie.exe
3196	Qloebdig.exe
3004	Qbimoo32.exe
568	Aegikj32.exe
4544	Agffge32.exe
1356	Abkjdnoa.exe
2532	Aejfpjne.exe
4260	Aldomc32.exe
4576	Aaqgek32.exe
1416	Ajiknpjj.exe
3872	Aacckjaf.exe
3764	Adapgfqj.exe
1216	Ajkhdp32.exe
3276	Abbpem32.exe
4752	Ahoimd32.exe
1140	Aniajnnn.exe
2924	Bdfibe32.exe
3576	Blmacb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Abbpem32.exe	Ajkhdp32.exe
File created	C:\Windows\SysWOW64\Dlncan32.exe	Ddgkpp32.exe
File opened for modification	C:\Windows\SysWOW64\Bapiabak.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Danecp32.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Mpbbmhgf.dll	Behbag32.exe
File opened for modification	C:\Windows\SysWOW64\Eefhjc32.exe	Eolpmi32.exe
File opened for modification	C:\Windows\SysWOW64\Fkopnh32.exe	Fhqcam32.exe
File created	C:\Windows\SysWOW64\Nlaegk32.exe	Njciko32.exe
File created	C:\Windows\SysWOW64\Ajckij32.exe	Ageolo32.exe
File opened for modification	C:\Windows\SysWOW64\Pnfdcjkg.exe	Pgllfp32.exe
File created	C:\Windows\SysWOW64\Ambgef32.exe	Anogiicl.exe
File created	C:\Windows\SysWOW64\Pkjlge32.exe	Pcccfh32.exe
File created	C:\Windows\SysWOW64\Eoolbinc.exe	Elppfmoo.exe
File opened for modification	C:\Windows\SysWOW64\Gfembo32.exe	Gbiaapdf.exe
File created	C:\Windows\SysWOW64\Pohkbc32.dll	Gmoeoidl.exe
File opened for modification	C:\Windows\SysWOW64\Jblpek32.exe	Jpnchp32.exe
File created	C:\Windows\SysWOW64\Jplfcpin.exe	Jmmjgejj.exe
File created	C:\Windows\SysWOW64\Kpeiioac.exe	Kmfmmcbo.exe
File created	C:\Windows\SysWOW64\Nenqea32.dll	Nljofl32.exe
File created	C:\Windows\SysWOW64\Pnbbbabh.exe	Pghieg32.exe
File created	C:\Windows\SysWOW64\Npfhbbpk.dll	Ddmhja32.exe
File created	C:\Windows\SysWOW64\Pniggbmk.dll	Dlncan32.exe
File opened for modification	C:\Windows\SysWOW64\Ehnglm32.exe	Eepjpb32.exe
File created	C:\Windows\SysWOW64\Dmamoe32.dll	Jefbfgig.exe
File created	C:\Windows\SysWOW64\Dpmdoo32.dll	Aeiofcji.exe
File opened for modification	C:\Windows\SysWOW64\Cklaknjd.exe	Cliaoq32.exe
File opened for modification	C:\Windows\SysWOW64\Fhgjblfq.exe	Fdlnbm32.exe
File opened for modification	C:\Windows\SysWOW64\Ippggbck.exe	Imakkfdg.exe
File created	C:\Windows\SysWOW64\Lepncd32.exe	Lgmngglp.exe
File created	C:\Windows\SysWOW64\Gbmgladp.dll	Nebdoa32.exe
File created	C:\Windows\SysWOW64\Pnjpej32.dll	Ogjmdigk.exe
File created	C:\Windows\SysWOW64\Deanodkh.exe	Dohfbj32.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Acnlgp32.exe
File opened for modification	C:\Windows\SysWOW64\Bdolhc32.exe	Bemlmgnp.exe
File opened for modification	C:\Windows\SysWOW64\Ghaliknf.exe	Gdeqhl32.exe
File opened for modification	C:\Windows\SysWOW64\Jidklf32.exe	Jfeopj32.exe
File created	C:\Windows\SysWOW64\Kepelfam.exe	Kdnidn32.exe
File opened for modification	C:\Windows\SysWOW64\Daaicfgd.exe	Dkgqfl32.exe
File created	C:\Windows\SysWOW64\Dfdjmlhn.dll	Ognpebpj.exe
File created	C:\Windows\SysWOW64\Qcgffqei.exe	Qddfkd32.exe
File created	C:\Windows\SysWOW64\Dhmgki32.exe	Ddakjkqi.exe
File opened for modification	C:\Windows\SysWOW64\Ecandfpd.exe	Ekjfcipa.exe
File created	C:\Windows\SysWOW64\Beapme32.dll	Ocbddc32.exe
File created	C:\Windows\SysWOW64\Pfaigm32.exe	Pgnilpah.exe
File opened for modification	C:\Windows\SysWOW64\Acnlgp32.exe	Aeklkchg.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Pcpopjlq.dll	Bdolhc32.exe
File opened for modification	C:\Windows\SysWOW64\Hmjdjgjo.exe	Hecmijim.exe
File created	C:\Windows\SysWOW64\Kdqejn32.exe	Kpeiioac.exe
File opened for modification	C:\Windows\SysWOW64\Kdeoemeg.exe	Kpjcdn32.exe
File created	C:\Windows\SysWOW64\Pqbdjfln.exe	Pmfhig32.exe
File opened for modification	C:\Windows\SysWOW64\Bnlnon32.exe	Blmacb32.exe
File created	C:\Windows\SysWOW64\Jeaikh32.exe	Ipdqba32.exe
File created	C:\Windows\SysWOW64\Popodg32.dll	Pdifoehl.exe
File created	C:\Windows\SysWOW64\Pdpmpdbd.exe	Pmidog32.exe
File created	C:\Windows\SysWOW64\Ndokbi32.exe	Mlhbal32.exe
File opened for modification	C:\Windows\SysWOW64\Fkffog32.exe	Fhgjblfq.exe
File created	C:\Windows\SysWOW64\Fkgoikdb.dll	Ipbdmaah.exe
File created	C:\Windows\SysWOW64\Jfeopj32.exe	Jbjcolha.exe
File created	C:\Windows\SysWOW64\Ejnjpohk.dll	Klljnp32.exe
File created	C:\Windows\SysWOW64\Mlopkm32.exe	Mmlpoqpg.exe
File created	C:\Windows\SysWOW64\Cdcoim32.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Nnmopdep.exe	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Ajiknpjj.exe	Aaqgek32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11336	12244	WerFault.exe	561

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hkkhqd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fkmchi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Foabofnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qloebdig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Imfdff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mmlpoqpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oddmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oicmfmok.dll"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gohhpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lbjlfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehaaclak.dll"	Pcncpbmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pghieg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnmljl32.dll"	Adapgfqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cefoce32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Doqpak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gokdeeec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kpbmco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deimfpda.dll"	Ldanqkki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mbfkbhpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ogcpjhoq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjoheljj.dll"	Pkhoae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akmfnc32.dll"	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klohnjkj.dll"	Qloebdig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hfnphn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fckajehi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjjplc32.dll"	Kboljk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhbffb32.dll"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Okhfjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qdchadai.dll"	Bjdkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ilghlc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfmbha32.dll"	Ipdqba32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jbjcolha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjmjdbam.dll"	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblnkg32.dll"	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ocegdjij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdihjfbe.dll"	Fohoigfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhkapp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jpnchp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leqcid32.dll"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Honhef32.dll"	Njfmke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bemlmgnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jioaqfcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogibpb32.dll"	Lmgfda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eoolbinc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fhgjblfq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mlefklpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnqbanmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccdlci32.dll"	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbpbca32.dll"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oqkdcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpiaib32.dll"	Glhonj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbfmkjoa.dll"	Gdjjckag.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 956	1352	4b696c33939313131e291a6e079336c2251825cd8e3788a9af6bf39e38b6c1c4.exe	89
PID 1352 wrote to memory of 956	1352	4b696c33939313131e291a6e079336c2251825cd8e3788a9af6bf39e38b6c1c4.exe	89
PID 1352 wrote to memory of 956	1352	4b696c33939313131e291a6e079336c2251825cd8e3788a9af6bf39e38b6c1c4.exe	89
PID 956 wrote to memory of 2940	956	Ngpjnkpf.exe	90
PID 956 wrote to memory of 2940	956	Ngpjnkpf.exe	90
PID 956 wrote to memory of 2940	956	Ngpjnkpf.exe	90
PID 2940 wrote to memory of 3696	2940	Nnjbke32.exe	91
PID 2940 wrote to memory of 3696	2940	Nnjbke32.exe	91
PID 2940 wrote to memory of 3696	2940	Nnjbke32.exe	91
PID 3696 wrote to memory of 64	3696	Nddkgonp.exe	92
PID 3696 wrote to memory of 64	3696	Nddkgonp.exe	92
PID 3696 wrote to memory of 64	3696	Nddkgonp.exe	92
PID 64 wrote to memory of 940	64	Nkncdifl.exe	93
PID 64 wrote to memory of 940	64	Nkncdifl.exe	93
PID 64 wrote to memory of 940	64	Nkncdifl.exe	93
PID 940 wrote to memory of 1732	940	Nnmopdep.exe	94
PID 940 wrote to memory of 1732	940	Nnmopdep.exe	94
PID 940 wrote to memory of 1732	940	Nnmopdep.exe	94
PID 1732 wrote to memory of 1124	1732	Nbhkac32.exe	95
PID 1732 wrote to memory of 1124	1732	Nbhkac32.exe	95
PID 1732 wrote to memory of 1124	1732	Nbhkac32.exe	95
PID 1124 wrote to memory of 3780	1124	Ncihikcg.exe	96
PID 1124 wrote to memory of 3780	1124	Ncihikcg.exe	96
PID 1124 wrote to memory of 3780	1124	Ncihikcg.exe	96
PID 3780 wrote to memory of 4956	3780	Nkqpjidj.exe	97
PID 3780 wrote to memory of 4956	3780	Nkqpjidj.exe	97
PID 3780 wrote to memory of 4956	3780	Nkqpjidj.exe	97
PID 4956 wrote to memory of 1580	4956	Njcpee32.exe	98
PID 4956 wrote to memory of 1580	4956	Njcpee32.exe	98
PID 4956 wrote to memory of 1580	4956	Njcpee32.exe	98
PID 1580 wrote to memory of 4052	1580	Nqmhbpba.exe	99
PID 1580 wrote to memory of 4052	1580	Nqmhbpba.exe	99
PID 1580 wrote to memory of 4052	1580	Nqmhbpba.exe	99
PID 4052 wrote to memory of 3508	4052	Ndidbn32.exe	100
PID 4052 wrote to memory of 3508	4052	Ndidbn32.exe	100
PID 4052 wrote to memory of 3508	4052	Ndidbn32.exe	100
PID 3508 wrote to memory of 4888	3508	Nggqoj32.exe	101
PID 3508 wrote to memory of 4888	3508	Nggqoj32.exe	101
PID 3508 wrote to memory of 4888	3508	Nggqoj32.exe	101
PID 4888 wrote to memory of 4792	4888	Njfmke32.exe	102
PID 4888 wrote to memory of 4792	4888	Njfmke32.exe	102
PID 4888 wrote to memory of 4792	4888	Njfmke32.exe	102
PID 4792 wrote to memory of 3532	4792	Ogjmdigk.exe	103
PID 4792 wrote to memory of 3532	4792	Ogjmdigk.exe	103
PID 4792 wrote to memory of 3532	4792	Ogjmdigk.exe	103
PID 3532 wrote to memory of 3204	3532	Oboaabga.exe	104
PID 3532 wrote to memory of 3204	3532	Oboaabga.exe	104
PID 3532 wrote to memory of 3204	3532	Oboaabga.exe	104
PID 3204 wrote to memory of 2244	3204	Okhfjh32.exe	105
PID 3204 wrote to memory of 2244	3204	Okhfjh32.exe	105
PID 3204 wrote to memory of 2244	3204	Okhfjh32.exe	105
PID 2244 wrote to memory of 4520	2244	Onfbfc32.exe	106
PID 2244 wrote to memory of 4520	2244	Onfbfc32.exe	106
PID 2244 wrote to memory of 4520	2244	Onfbfc32.exe	106
PID 4520 wrote to memory of 1684	4520	Odpjcm32.exe	107
PID 4520 wrote to memory of 1684	4520	Odpjcm32.exe	107
PID 4520 wrote to memory of 1684	4520	Odpjcm32.exe	107
PID 1684 wrote to memory of 2960	1684	Ojmcld32.exe	108
PID 1684 wrote to memory of 2960	1684	Ojmcld32.exe	108
PID 1684 wrote to memory of 2960	1684	Ojmcld32.exe	108
PID 2960 wrote to memory of 3380	2960	Obdkma32.exe	109
PID 2960 wrote to memory of 3380	2960	Obdkma32.exe	109
PID 2960 wrote to memory of 3380	2960	Obdkma32.exe	109
PID 3380 wrote to memory of 2964	3380	Ocegdjij.exe	110

C:\Users\Admin\AppData\Local\Temp\4b696c33939313131e291a6e079336c2251825cd8e3788a9af6bf39e38b6c1c4.exe
"C:\Users\Admin\AppData\Local\Temp\4b696c33939313131e291a6e079336c2251825cd8e3788a9af6bf39e38b6c1c4.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\Ngpjnkpf.exe
  C:\Windows\system32\Ngpjnkpf.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\SysWOW64\Nnjbke32.exe
    C:\Windows\system32\Nnjbke32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Windows\SysWOW64\Nddkgonp.exe
      C:\Windows\system32\Nddkgonp.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3696
    - - C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:64
      - C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:940
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3780
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4052
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3532
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3204
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        23⤵
        Executes dropped EXE
        
        PID:2964
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        24⤵
        Executes dropped EXE
        
        PID:664
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        25⤵
        Executes dropped EXE
        
        PID:1192
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4032
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1512
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        28⤵
        Executes dropped EXE
        
        PID:2376
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        29⤵
        Executes dropped EXE
        
        PID:4868
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        30⤵
        Executes dropped EXE
        
        PID:3200
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4356
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        32⤵
        Executes dropped EXE
        
        PID:3108
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        33⤵
        Executes dropped EXE
        
        PID:3596
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        34⤵
        Executes dropped EXE
        
        PID:1372
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        35⤵
        Executes dropped EXE
        
        PID:828
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        36⤵
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4308
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        38⤵
        Executes dropped EXE
        
        PID:1976
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        39⤵
        Executes dropped EXE
        
        PID:4932
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4372
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1392
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2248
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4380
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        44⤵
        Executes dropped EXE
        
        PID:1716
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        45⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        46⤵
        Executes dropped EXE
        
        PID:452
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        47⤵
        Executes dropped EXE
        
        PID:2748
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        48⤵
        Executes dropped EXE
        
        PID:392
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3196
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3004
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        51⤵
        Executes dropped EXE
        
        PID:568
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        52⤵
        Executes dropped EXE
        
        PID:4544
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        53⤵
        Executes dropped EXE
        
        PID:1356
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        54⤵
        Executes dropped EXE
        
        PID:2532
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4260
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4576
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        57⤵
        Executes dropped EXE
        
        PID:1416
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        58⤵
        Executes dropped EXE
        
        PID:3872
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3764
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1216
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        61⤵
        Executes dropped EXE
        
        PID:3276
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        62⤵
        Executes dropped EXE
        
        PID:4752
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        63⤵
        Executes dropped EXE
        
        PID:1140
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2924
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3576
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        66⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        67⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        68⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        69⤵
        
        PID:856
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        70⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2028
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        72⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        73⤵
        Modifies registry class
        
        PID:2900
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        74⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3624
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        76⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        77⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        78⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        79⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2628
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        80⤵
        Drops file in System32 directory
        
        PID:4428
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        81⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        82⤵
        Drops file in System32 directory
        
        PID:2228
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2272
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4492
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        85⤵
        
        PID:208
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        86⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        87⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        88⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3612
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        90⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        91⤵
        Modifies registry class
        
        PID:5180
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        92⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        93⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        94⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        95⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        96⤵
        Modifies registry class
        
        PID:5384
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        97⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        98⤵
        Drops file in System32 directory
        
        PID:5468
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        99⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        100⤵
        Drops file in System32 directory
        
        PID:5552
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        101⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        102⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        103⤵
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        104⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        106⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        107⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        108⤵
        Drops file in System32 directory
        
        PID:5912
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        109⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        110⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        111⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        112⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        113⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        114⤵
        Drops file in System32 directory
        
        PID:5172
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        115⤵
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        116⤵
        Drops file in System32 directory
        
        PID:5284
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5364
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        118⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        119⤵
        Drops file in System32 directory
        
        PID:5504
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        120⤵
        Modifies registry class
        
        PID:5576
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5640
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        122⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        123⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        124⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        125⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        126⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        127⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        128⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        129⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        130⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        131⤵
        Drops file in System32 directory
        
        PID:5416
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        132⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5724
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        134⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        135⤵
        Modifies registry class
        
        PID:5900
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        136⤵
        Modifies registry class
        
        PID:6028
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        137⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        138⤵
        Drops file in System32 directory
        
        PID:5312
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5424
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        140⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        141⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        142⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6120
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        144⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        145⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        146⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        147⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5672
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        149⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5844
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5968
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        152⤵
        Modifies registry class
        
        PID:6176
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        153⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        154⤵
        Drops file in System32 directory
        
        PID:6272
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        155⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        156⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        157⤵
        Modifies registry class
        
        PID:6400
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        158⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        159⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        160⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        161⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        162⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        163⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6700
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        165⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        166⤵
        Modifies registry class
        
        PID:6780
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        167⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        168⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        169⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        170⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        171⤵
        Modifies registry class
        
        PID:6996
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        172⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        173⤵
        Drops file in System32 directory
        
        PID:7080
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7128
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        175⤵
        Modifies registry class
        
        PID:6148
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        176⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        177⤵
        Drops file in System32 directory
        
        PID:6236
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        178⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        179⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        180⤵
        Drops file in System32 directory
        
        PID:6416
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        181⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        182⤵
        Modifies registry class
        
        PID:6640
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6692
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        184⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        185⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        186⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        187⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7024
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        189⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        190⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        191⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        192⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        193⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        194⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        195⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        196⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        197⤵
        Modifies registry class
        
        PID:6940
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        198⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        199⤵
        Modifies registry class
        
        PID:7144
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        200⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        201⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        202⤵
        Drops file in System32 directory
        
        PID:6588
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        203⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        204⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        205⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        206⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        207⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6960
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6216
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        210⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        211⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        212⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6932
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        214⤵
        Drops file in System32 directory
        
        PID:7216
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        215⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        216⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        217⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        218⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        219⤵
        Modifies registry class
        
        PID:7452
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        220⤵
        Drops file in System32 directory
        
        PID:7508
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        221⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        222⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        223⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        224⤵
        Modifies registry class
        
        PID:7664
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        225⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7704
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        226⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        227⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7828
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7872
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        230⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        231⤵
        Modifies registry class
        
        PID:7952
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        232⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8040
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        234⤵
        Drops file in System32 directory
        
        PID:8092
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        235⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8168
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        237⤵
        Drops file in System32 directory
        
        PID:7176
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        238⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        239⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        240⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7412
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        241⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        242⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        243⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        244⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        245⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        246⤵
        Modifies registry class
        
        PID:7900
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        247⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        248⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        249⤵
        Modifies registry class
        
        PID:8112
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        250⤵
        Drops file in System32 directory
        
        PID:8188
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        251⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        252⤵
        Drops file in System32 directory
        
        PID:7376
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        253⤵
        Drops file in System32 directory
        
        PID:7492
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        254⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        255⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7852
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7976
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        258⤵
        Drops file in System32 directory
        
        PID:8100
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        259⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        260⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        261⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7836
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8000
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        264⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        265⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        266⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        267⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        268⤵
        Modifies registry class
        
        PID:8028
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        269⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        270⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        271⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        272⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        273⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        274⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        275⤵
        Modifies registry class
        
        PID:8456
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8496
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        277⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        278⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        279⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        280⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        281⤵
        Drops file in System32 directory
        
        PID:8732
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        282⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        283⤵
        Modifies registry class
        
        PID:8828
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        284⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        285⤵
        Modifies registry class
        
        PID:8916
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8952
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        287⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        288⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9104
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        290⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8180
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8260
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        293⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8352
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        294⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        295⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        296⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        297⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        298⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        299⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        300⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        301⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9032
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        303⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        304⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        305⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        306⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8568
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        308⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        309⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        310⤵
        Modifies registry class
        
        PID:9016
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        311⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        312⤵
        Drops file in System32 directory
        
        PID:8272
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        313⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        314⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        315⤵
        Drops file in System32 directory
        
        PID:9064
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        316⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        317⤵
        Drops file in System32 directory
        
        PID:8780
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        318⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        319⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        320⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        321⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        322⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        323⤵
        Drops file in System32 directory
        
        PID:9272
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        324⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        325⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        326⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        327⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        328⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        329⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        330⤵
        Modifies registry class
        
        PID:9556
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        331⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        332⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9676
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        334⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        335⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9816
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        337⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        338⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        339⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        340⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10028
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        342⤵
        Drops file in System32 directory
        
        PID:10072
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        343⤵
        Drops file in System32 directory
        
        PID:10112
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        344⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10192
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10236
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        347⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        348⤵
        Modifies registry class
        
        PID:9328
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        349⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        350⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9544
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        352⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        353⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        354⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        355⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9888
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        357⤵
        Drops file in System32 directory
        
        PID:9956
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        358⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        359⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        360⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        361⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        362⤵
        Modifies registry class
        
        PID:9308
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9428
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        364⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        365⤵
        Drops file in System32 directory
        
        PID:9624
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        366⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        367⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        368⤵
        Drops file in System32 directory
        
        PID:9972
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        369⤵
        Modifies registry class
        
        PID:10080
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        370⤵
        Drops file in System32 directory
        
        PID:8268
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        371⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        372⤵
        Modifies registry class
        
        PID:9500
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        373⤵
        Drops file in System32 directory
        
        PID:9640
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        374⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        375⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        376⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        377⤵
        Modifies registry class
        
        PID:9504
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        378⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        379⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        380⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        381⤵
        Drops file in System32 directory
        
        PID:10156
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        382⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        383⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        384⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        385⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        386⤵
        Drops file in System32 directory
        
        PID:10356
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        387⤵
        Modifies registry class
        
        PID:10404
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        388⤵
        Drops file in System32 directory
        
        PID:10460
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        389⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        390⤵
        Drops file in System32 directory
        
        PID:10544
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        391⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        392⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        393⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        394⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10716
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        395⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10752
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        396⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        397⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        398⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        399⤵
        Modifies registry class
        
        PID:10920
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        400⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        401⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        402⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        403⤵
        Modifies registry class
        
        PID:11088
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        404⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        405⤵
        Modifies registry class
        
        PID:11172
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        406⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        407⤵
        Modifies registry class
        
        PID:11252
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        408⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        409⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        410⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        411⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10532
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        412⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        413⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        414⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        415⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10904
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        417⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        418⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        419⤵
        Modifies registry class
        
        PID:11108
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        420⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11164
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        421⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10292
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        423⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        424⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        425⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        426⤵
        Modifies registry class
        
        PID:10816
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        427⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10916
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        428⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        429⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        430⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        431⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10416
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        432⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        433⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        434⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        435⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        436⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        437⤵
        Drops file in System32 directory
        
        PID:10952
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        438⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        439⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        440⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        441⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        442⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        443⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        444⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        445⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        446⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        447⤵
        Drops file in System32 directory
        
        PID:11480
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        448⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11520
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        449⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        450⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        451⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        452⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11696
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11744
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        454⤵
        Modifies registry class
        
        PID:11776
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        455⤵
        
        PID:11820
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        456⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        457⤵
        Drops file in System32 directory
        
        PID:11904
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        458⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        459⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        460⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        461⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        462⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        463⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        464⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        465⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12244 -s 416
        466⤵
        Program crash
        
        PID:11336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 12244 -ip 12244
1⤵
PID:11300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaqgek32.exe

Filesize
74KB

MD5
62f9010375136eacb95e898f2c8fed5f

SHA1
4fe9f219869a1815d8460d411098c38ad584d489

SHA256
ce26a374b66cdb6e3bf9096c7c90cb7ac7a2c1765e91511403d55d9acb57b82a

SHA512
b72e52b8e18975b91525d2ee0b4e86311201c1b7ded6a81f2c4aa0c15a4c0c6c1f6e8c1e0acbaeee312c33c00cefe6a9a3d61b108f4b116f43f12abc50b308cf

Download Submit
C:\Windows\SysWOW64\Abkjdnoa.exe

Filesize
74KB

MD5
d7bffd12014a758ab9f65e26188ffc56

SHA1
22bd2fb852b10b1b2515e6f3aaa628177911daf7

SHA256
5f58614fc485137c042744b609661dfb5c50e94ab448b1d4ac7102533e13e152

SHA512
dbc6f9227f896bb298d32f8d8eb8a11b4c141751afd0e8d9d092aa628bf0f5595985d06a1cf2007650a2868904f862f28e60624b5c0cc81d1ab22269add8f5d5

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
74KB

MD5
2169431f48e6494536f12d6e09d58cc9

SHA1
e3fd950607ca39a5b917b49bf799569faf1bfed7

SHA256
5dd79aa4792d17078bc24b056fac3ea2454c11ae1ea6e04c1db7abfc37417677

SHA512
4766f95dea756f139fdd97880be5dbdddb0e061e520ad7b08fa74f83e0db69d3606f26ba1c18c183d8ceae5154ff90dbf74a28be57d2b13de7bc473da4b87e8a

Download Submit
C:\Windows\SysWOW64\Ajkhdp32.exe

Filesize
74KB

MD5
bb7d9e1e34885af08cb2851fd20a830d

SHA1
1469fca1fcf8ed28270412310dd9e081c943ba86

SHA256
94f6ce65fb6a988973f00de7d5a6c84093d502d50b925baf5538c394b9957c0e

SHA512
3cc295e4cf2fab6e4fe126463baf930fc8eb233dac6aceb1cd6c3bb05cddf77a426eb9607105f155d4d55db97ef8fd9c541a85cfaef554a79343587070747d6c

Download Submit
C:\Windows\SysWOW64\Aniajnnn.exe

Filesize
74KB

MD5
8ec05adc388e80fd696047437ddfd35c

SHA1
db3282e6f80951f2f6ff12db0f44fdfd4c169816

SHA256
64f1be398d3a253dc9e7bd60834dea44cafb327e508ddfaf72233c33c99e1bb5

SHA512
30274f97603f90859ec3dfc8667f584173b986a555b6c2ef22d1d7a8d7ad04a8fc641bd2550fd4419d2f1c80c2a4ac440daaf726be35068b8c6b83b71806da74

Download Submit
C:\Windows\SysWOW64\Cgfgaq32.dll

Filesize
7KB

MD5
d8a5e3ef0966db47e07671e0b767c0e5

SHA1
4b94797bdc80c390820cf61764fb182f09c9e047

SHA256
5a6ba350e62d5c06fa0a1c51b2b5bf620b59c79cc13f3f532188ad3d63c88c34

SHA512
b0940df9e477fad1d8af740d9eb05484dd9af4da398d23b0c700010b846e48be402794c4e7d65bf34a8820295ebc38216305979a7f72897df8efe8b4bb42f6dd

Download Submit
C:\Windows\SysWOW64\Conclk32.exe

Filesize
74KB

MD5
2d55bdc39637cd6fbf75c61e2c3a8ab2

SHA1
11f21f53c65c7dc378e36fbb9c5d9b38e2c45492

SHA256
c43fc9825cd36c2c8ecddb8ab1133fd6a8c9ecc10f3066dc15e33b6e04862718

SHA512
bc40a0da90245dc98d2b1349fa03c054c87c52d5831a660830af2a478d734aad261d315d5dcce00fba935a5f3c9af631e631d14a084a9562f5d20dbff707be44

Download Submit
C:\Windows\SysWOW64\Deagdn32.exe

Filesize
74KB

MD5
2cf463d4f626d91beb154f8a7377b1ab

SHA1
2f4a1cf248f14943145456874375aed104218b41

SHA256
068cdeb0720ef40a0d2c57999fbaa234ffeed27a3f264aeba8be81414a586840

SHA512
b9ed2449bef1cf3f88ccddc880afec18b2b4f855fa670934bbc4016b3b971c6cbb9e7d91ed36494eda8ad255f43937096040c734bb68ca0600b2137a4d4a810f

Download Submit
C:\Windows\SysWOW64\Hiefcj32.exe

Filesize
74KB

MD5
7357c8b7318671a78b1ad8b1cce27973

SHA1
a756bc7d33d7fd876a563d4ab0d24f6f0bfcb316

SHA256
76387d90b0f20fa534e8f7cf8bfad86fb3ac0316da730c26e095c42031f85979

SHA512
be2ef6caa0612628d6a6526192c083c90566c4458b30ca6e5f8278cc3a49aa054d5cb758b0ab36a4ceb50978c40ce5fa5126f74c1106271611293a8994ea72eb

Download Submit
C:\Windows\SysWOW64\Nbhkac32.exe

Filesize
74KB

MD5
d3e5fe9fd5589857ab17acab4c098e53

SHA1
3124c66cd09b5b51c314a379e4080d2fbb6e1a1c

SHA256
1d60eae1c1828e5e5651cdb41edb592a239f3f00d8d54b996acc977119a24c01

SHA512
9e63fa3d3bcd8aa5952d7ce11d3ee92068e278af3f873ecac7e66997e685c9a5a5cefbfa24fd66a4899c1aab6faddd4f6a32730f01bf2976e81c15f070456278

Download Submit
C:\Windows\SysWOW64\Ncihikcg.exe

Filesize
74KB

MD5
13100f75b848f26424b76500f2d4da28

SHA1
b8d3cd9af21e31aee635630baed74dc9711641a2

SHA256
d618f24813be149f34a8bf88f845695c94f511fe91ac1e24988ddb22be4b533a

SHA512
2926125fd9d9114bd91122a08824b320d85721558b1a53d5f11e5f4e92b4960d33b49ae623093049d1af595a2cc671ccb30864dc8685e5fea126f677d1391371

Download Submit
C:\Windows\SysWOW64\Nddkgonp.exe

Filesize
74KB

MD5
1a59d2edee82c593b9e036cad4b351c9

SHA1
bf1139d9b8bde79336e2b283b0358b95a32bc274

SHA256
a8b3f458c1f4c5300820897d1b1012c8395587c96ca1573cb50f34042a55bf61

SHA512
e26a52d3f5023dae545d34093335954bddd62b53c2798571229a3f5bfd701e9e5a67ac05fb559cec39246b0b49007b6a99842c20d9e6849d6f4446d12f52963f

Download Submit
C:\Windows\SysWOW64\Ndidbn32.exe

Filesize
74KB

MD5
4b84f20eb7a7f1b10e10235d925b2ad5

SHA1
581e78d7a82a6c031e88b71fb29d7c1db7bb13b9

SHA256
bc8ddd63e75c1ac6febf8c5944a8bc15af5f2944da3ccc68e7fd1480a4b962cb

SHA512
556a6abe98ae97becbb757c775b4f07f8b9b391e1d121337c72376eabc957da5285905fa80418575705d9ebeddec9534ddbcf14e65c9d99a3cf90ba53415edc6

Download Submit
C:\Windows\SysWOW64\Nggqoj32.exe

Filesize
74KB

MD5
e280e2d0679e59b4d7b946a86298923b

SHA1
7cdca242da30b36abb6030072d1f2882ad39386d

SHA256
ee843ed584c676732fb570777bc1f09dc8564ba878d9580c982b543e69aa7c32

SHA512
040d1b7f6526168758f31a38c7683732eb40a91928c01af73e4b154f8b73ae3e85d3c98e84c0bb77f3c2172fdbff40d7f2f1f1d92f369d0ed7949a5539653887

Download Submit
C:\Windows\SysWOW64\Ngpjnkpf.exe

Filesize
74KB

MD5
08a44d814b8582b1c3591547092a7fc7

SHA1
312589363c8703be2e3e58dd3d4f79cae5cc9033

SHA256
ec3ecbf22863719913f71631183cc52365cbf0e3dc6d28ace1ef53a09fcb82f5

SHA512
cc2ca03b948aee1d9c79f2528d7caafb1a2022cc6544683f8190aaa25f90a7293cf6fcb5b89d7526fe992bd211900a3cbab1293fb6c0df7333b17640fbbbd67e

Download Submit
C:\Windows\SysWOW64\Njcpee32.exe

Filesize
74KB

MD5
d07008ee05ece3567fec05f39aedbcdd

SHA1
c33acd7b6ca7c81b6d80f4d1e77f0346867c9954

SHA256
61da9f822c8fb8cc312ebd59776cccab8f9a42a11644119c6c883ffe906ed8dc

SHA512
41ecfcc4e0759ab07f7476d5eafb22a08533e75d31442d5465988c60a9931d654bad0719dc76e3d113ace71fb87d9ac0ebf3a3fe7ecaa0acba4761304c415192

Download Submit
C:\Windows\SysWOW64\Njfmke32.exe

Filesize
74KB

MD5
58c2a249496ff801733805d05c5c36b1

SHA1
7d49658f154e8218b97b0024723cd261f098f7ce

SHA256
623b9991b177fd6904e4c04fe4fec7d97b72ad75482adffbf9086dd110d30ac0

SHA512
9c95f3ce02d6690c0fb754e7e0d40e35a73ad3a206f2b14e2880e596e2924d1ef0bbe7ed5fdf8ae9278a0c0f6e7cdd559f8f3896f86e2e707983b4a6b1c95b71

Download Submit
C:\Windows\SysWOW64\Nkncdifl.exe

Filesize
74KB

MD5
f8da5d0cfb128accb0c278a899e760c2

SHA1
383f3cb6b04344e896c6d09f9a3d4a39ef24a913

SHA256
76e2e4d058c36acd94b04995ab3cf18c9c7db44e2783bde8f38bf9b5fd0fb851

SHA512
65407a9c35373a6a09abea882427f2eb1833bda3b1154c06a1b1c96e74f65a0f6f41162bba50e29e4c0c12aa824a4b5be5d5608c0c819f9b7da8e154445cb997

Download Submit
C:\Windows\SysWOW64\Nkqpjidj.exe

Filesize
74KB

MD5
fa1366ec778d4e06444ba51b01d12948

SHA1
5d537ca54acc6d2a27ffb31e705a9cb0861c181e

SHA256
1436656144c19fb6219f335de146eae1c6ce9e9f085d20195fffc9b07ca04a41

SHA512
63aebf5d3c7d252659004f3eea538d98271564271a03d79900f6fba58a29b354d0079ee063987fb647ca36d1d63890a6e78e3a06abe7ff177d336899f4f824f4

Download Submit
C:\Windows\SysWOW64\Nnjbke32.exe

Filesize
74KB

MD5
b1ede80880fa4de00128208349d95b73

SHA1
851013ff8dd6a27c7051a11fe2f45548b4dfee05

SHA256
7960844f8cadaf5072e134647e1a07d42eddfac89c7369ccf0903955bddbd9e9

SHA512
8f9ac84f0a4424e6cd89376b66a18323b21237e8bd031a4491274edf6f99ffc7ef8a148fa2de4dae71957efe1913743d00eef70bd6e3638b7580c45901ec0b98

Download Submit
C:\Windows\SysWOW64\Nnmopdep.exe

Filesize
74KB

MD5
70fa03e2517fb12832606b9ebe3f74f4

SHA1
ce03194756ed898792a09676a809a6dcd2771406

SHA256
5784a31cc0d527847db46183e9460b34e3127f2415f8921588dd88461d72cacb

SHA512
a138507e0237f55681ad4840eecaa5b2317c505d506464603a4b73a1dee7353fa460f227dbdf1eb0f5dffe4b42782c9c1bae1d3d836c14ad73626cefc7e0190e

Download Submit
C:\Windows\SysWOW64\Nqmhbpba.exe

Filesize
74KB

MD5
12f8153380a74a0c65cc2521e25c78f6

SHA1
591bed703a7b2bf505ffcfe77c7588cb987aafaa

SHA256
339235bf560766aef046228cf2821c14af302c6343d809ef2f02768ee81238c1

SHA512
6f5ff841d7547688dde5adbc00d60ed4ea86526127e438bdbc740bba2c8c83dc3ebc8c48272e8ad67a44726ba554a046bc985680fc3ac10bf6214b2087320ee4

Download Submit
C:\Windows\SysWOW64\Obdkma32.exe

Filesize
74KB

MD5
5494a2d5e668f6236945fd61832d39b6

SHA1
0a46fcb7eb1339abea43d247e360c56435089fd0

SHA256
bdbbc466e5e49a7118e111ac889590b3db5b3061c58de0dde7c632cd97edf35d

SHA512
7b5b2b703a55d42d4801b2a1a70fa432a5f5949459e0d870f636b7b0ae0d37189754d2db6fe142dd70090138dee1f09cf00109c03b8d46b43f6ac751883946cb

Download Submit
C:\Windows\SysWOW64\Obfhba32.exe

Filesize
74KB

MD5
042415f42ebd728b3565bb94fe2f84ba

SHA1
1cc472d483df5fc4d6b2a2bfb510fd87d173b8e4

SHA256
2999a8750fcef05617ad00a81e7c496db0c6aeca60ac5f3cb7dc6cc327670424

SHA512
29b449c51e1e81b91803f7688b255e8814b92c0eb1cb12b1733bb918223ddb40c1fadd971bfca57bb55bfbc69ecd4c0a55314df6542353d95984ed1671b8157e

Download Submit
C:\Windows\SysWOW64\Oboaabga.exe

Filesize
74KB

MD5
c713b4bc7bf6a44c97bad41f26183d5e

SHA1
550281158e8cf8cf6840cae2727256dc67ff0a50

SHA256
ba707430a7ff128cf01ef08f1b9b2f772ad4d440e4cbc0657c0c52ddc42837c8

SHA512
717b1bb00fec5b5517c094802d676de6023eae3b6a7c1132de262feece8947b8578a6c25dbe76567fd9556dea60adf2d69239c7fde3cbad50c8d5ee490a1e46b

Download Submit
C:\Windows\SysWOW64\Oboaabga.exe

Filesize
74KB

MD5
64d79e075daeec9b11380a343b025e3d

SHA1
c18e3391ab169e3128e8ee76014f68cba4288074

SHA256
fce6c8785f3c68dc79155b7eb24fd235b2a9ffb5b0c72da04a8d3df2858eeae6

SHA512
f9f0fe169c047d5b706795412dcc790be8cc69473c653ea54344d2a4ad0ee426db530b36aedf9de1fe1751646c595afac4525f777a3ea450c989426c8da2c408

Download Submit
C:\Windows\SysWOW64\Ocegdjij.exe

Filesize
74KB

MD5
ddbdaaa9f50c69d0af1811938ca295e3

SHA1
3f84b70a43e4650412e5eb7a22c07961827e34f4

SHA256
a776b746f474b0aa7766653ada010aad6f8bcf04316c26bbee33d75bdc101db2

SHA512
0ed23a218de57717762e27a2e83d7e39fb4ce269aec54a2d397e397a2c58d2592d7c005a879223c8a0ac162d0aca29c94656e8c4b310687acc0a53bab2f26fc0

Download Submit
C:\Windows\SysWOW64\Odednmpm.exe

Filesize
74KB

MD5
80dc0b66d733b2d571ea5a57c62e1e4a

SHA1
8d27f300c8965e9acfc1321e283f8c27507df076

SHA256
a583031e4858a1d39d7a5477f08b5b8f82ab60b5caeb2904c125ff2fbc792b5f

SHA512
dd88e51973a287809ddc130b6cd03613e5ffc45de47f3b77bd1373ae0470fd0fd8e677ecc61262fd34d06f9aef1b35ea7672a5dc16c61bc78f6d63599003edb3

Download Submit
C:\Windows\SysWOW64\Odpjcm32.exe

Filesize
74KB

MD5
368c3c3c3cbc501d1bb88262f2f45f65

SHA1
0c1adaa3fc9e95f79117b347b50ec69f0347bfb4

SHA256
ebaf7f4b1a683e7a6e9f7dec8a31c0169db6ac860168c01dae0c60bdb9aae072

SHA512
d1ea406965c9eccf49e3fe00023b91fea5caabd2f9037bc5bb5bb3a7cc91d1d8d8b14d9570cf40bd3e2d12aaabc3e43112ce9e486f52075d24b3559356bd35e9

Download Submit
C:\Windows\SysWOW64\Ogcpjhoq.exe

Filesize
74KB

MD5
c654056f7ae5bff7bd2967935a944687

SHA1
b816062cbc4a84e43fcb108bebc15ee805b4f474

SHA256
be2338a9d8adb49e1e44791a5c064cfe1c0953c5aed91c1b0c5e870fc9cc282a

SHA512
697f07446f6b2fd035a5d6b6969ca9b0b699408bc6a445c839af03b5a67a2699f1e12f63f1d5f8e84660f91de51b497e66f073a4813b1110d895d65f8e6bea64

Download Submit
C:\Windows\SysWOW64\Ogjmdigk.exe

Filesize
74KB

MD5
051f8a035f2066eaa10b8222f0b69336

SHA1
0979135578d92c9027fefd1b6037e8a1c1eb489d

SHA256
0855e5c2bd1aa4e580b6ec5eb7b31e0db64ab26c75feae600464a350b358156a

SHA512
664267e8c8c35981660f0b70bd0f8f44c848ad4fe6f0ebde7218f174a4916f99bef7b00d76f56dc9fc02c7e029265c7d8e529ce069bc8aa98f1e64713eed429a

Download Submit
C:\Windows\SysWOW64\Ojmcld32.exe

Filesize
74KB

MD5
8c40686b23758ac97c245a0472639b9a

SHA1
bbacf6b266d1c5d4a3a435ccfa075ac12bd4741e

SHA256
34a6134cfd027f00e67292a6dfa0a1692bc836e9b39ed562ead5cdaa823a117e

SHA512
ec351280cc23f61c78614edd624e93b17e813a6e0ab088239618bbb37ceeb7a7f10f29ebd3eef3c85f83bbec253033dcebb92118f6d2c17e78129be704fbf640

Download Submit
C:\Windows\SysWOW64\Okhfjh32.exe

Filesize
74KB

MD5
5ed3b25e3a2cccdf1bf9b1020b002bcd

SHA1
88825c56fc0b2497ec09c7b95c43a0424838c177

SHA256
91960211375e0ee09a275fc8283b239df16d3c7ac51afdd4fe2699fdafabcf1e

SHA512
26e14a1342e9eea4b162b364b89e4ac1687aadf3d4c47891527dac5144b214a025fe99f900cbb9356e4c07120e83ea58100a2683776efe8c4600ae174581b3b6

Download Submit
C:\Windows\SysWOW64\Okloegjl.exe

Filesize
74KB

MD5
ef7a1286c6029bc3bbcb0e0c24a03858

SHA1
5fbbd42c2cf2dc449a46fb350caa40207622c10f

SHA256
2eab7dfef626f21432d2c4d6244660681e58adc8218f97cda20a4d11e33888b0

SHA512
50b9025934424f481865cccd4cc2624acceaeb228c7a3e771b674776146ad84aa497a38c70ba028ec3c5b54a9e9755336c159ae7ba44389087d5caea97b377e6

Download Submit
C:\Windows\SysWOW64\Onfbfc32.exe

Filesize
74KB

MD5
90e7806b879e1619f84d4bd312b1e089

SHA1
777a8ecd6f9853ec20e823accd4eaf4fdbbc7d10

SHA256
55ade843115910fc04cda5bc7b970d7c8f2d6de93409c206fdb6873970f958ee

SHA512
289799ab93c4c542b789e09f704201d243de458af5aa835c820cc25a48795d743c9ce5c261c0c946e60ebff039432fb6b7219f733e5453b889bd8b38047d5275

Download Submit
C:\Windows\SysWOW64\Oqkdcn32.exe

Filesize
74KB

MD5
eae951370e74a0d15b093e558ea05b46

SHA1
b05e77cd0bca069c823a2e5f58f38538b4ea9270

SHA256
c5a5c23395669072ad0f5e0b450776285df3ec6a18c576b5538afd8ab0c2a64c

SHA512
329a5ed52abd77991c1918514a90332a7ec2dd7aa3caf507b2f56fb8834933bb4d9aa49cdd8de91cb255f11190998d04db57b5a220e695102a4c47eb066ef9cd

Download Submit
C:\Windows\SysWOW64\Pcjapi32.exe

Filesize
74KB

MD5
d6d81fbee2622e85c2352099ac0a959a

SHA1
30241cb6db4be0e91ef45ed85db0132a1dbbdafc

SHA256
5a7ebb060c83de4a37d4b4835d81cf799f0d0374458cdd37db3d27a41ad5233f

SHA512
8f73310fd40aca225b5485ba3efb29e6f1481c22a816d417a1a44a700915e36d8622e84a36babf4905a26ec36fce32cf7bb6302e96b7affcb72193bcd08d65cf

Download Submit
C:\Windows\SysWOW64\Pcojkhap.exe

Filesize
74KB

MD5
84b9d06c467f3e3cedf8599223c40c17

SHA1
2679d4959d2868513fee4d1f43fd3dc53ba42890

SHA256
37d1502f3e1f60e1eb462a0848aabfc2a13ac0ec8f5314ab43a94831a8a27dc4

SHA512
c137cee70df02825057fd8caf4b9a34c58448b6cba02ea0735551b7531182af4f6118fd1928db9cb8061699f555389d330901958a46818af97a414f22e98d2a0

Download Submit
C:\Windows\SysWOW64\Pghieg32.exe

Filesize
74KB

MD5
bb094b4c840e19b3ba9a4a22d613a37f

SHA1
726aea287046a1c60868133acb991cd78918da80

SHA256
b9acef3fbcfa8d4600711af017ee40dd7fa9a6d32c935cfe37ab9734669f6a73

SHA512
b3457fe40d2618f81db022de9e6b88195d0b6d25e8ccadfa3e3245b27b8cec283391a9a1fbf10d2157434d1501add73ae8f60095d73e0cc473cf6bbd91a535ea

Download Submit
C:\Windows\SysWOW64\Pjdilcla.exe

Filesize
74KB

MD5
0ce695f6401f830abca79d7dd70f8b16

SHA1
79d0d37c1053c0c38dc6902a882d8546ae0374d5

SHA256
dd7bdcd6c1c77e691b23b4c6b8851ea1be7dda84da33fadd5ba79e893d452c1e

SHA512
33748411d27e51cae221ce65ba82630a0816947e3f1aef3f2aa738b57a38b29eb94b5ab2ce14bd25c386aacc34c8d7c10b87474aedafdd69551ebccbc805d29b

Download Submit
C:\Windows\SysWOW64\Pnbbbabh.exe

Filesize
74KB

MD5
2c57ad955a0aea82a7f11333243917c6

SHA1
fe9d908484f3262ce8667a5486cc1ec11e827cd5

SHA256
b9551612f04832edee1b18825734a3d2ceb94c9fa6d2158eb7384f629b09c834

SHA512
43bab6a0921f85af57d1a95130fc652309b1b54e83c186eefde7766543b3553c78b974a92e5f33f3ad334f9290b6aec7ab846edc068e8148377e8d2c74147070

Download Submit
C:\Windows\SysWOW64\Pqnaim32.exe

Filesize
74KB

MD5
3e4edcacd5045b0b03eb87468f55b972

SHA1
d1e8593a87dec959d4441552a445c2ea743dac2b

SHA256
48cb1df3d3b409921512c1227ba6a74238e2c61a6e5579763f28fee930485cbf

SHA512
1f0213b18e7483dcb1695a01e4ef522eb10ebcaff473bc34ea3a0ae15bdb416ba692077d609d0b8032c1bfdc5a6e647da57fa6ceffc6dbb77223801c864b0038

Download Submit
C:\Windows\SysWOW64\Qbimoo32.exe

Filesize
74KB

MD5
c41f781447a063ad36059fe057b8dd5b

SHA1
807f7def8429c3cfa365f637d896863c196a62bb

SHA256
a971f68196de7323ab62c25f009909590357e01ac46cfdaf1bf67e736fdf6316

SHA512
7d9d61e6aad4e90eec64024dee65ae1e3ef8c37b56a0e44f47c4003e9c1d7c7ce5e30ad2fcf5619990d0e60e2cc082622bfc30f789ef658ef40701f71aed4b58

Download Submit
memory/64-32-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/392-346-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/452-334-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/568-364-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/664-184-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/828-268-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/940-44-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/956-7-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1124-60-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1140-436-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1192-192-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1216-418-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1352-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1356-376-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1372-262-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1392-304-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1416-400-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1512-208-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1580-80-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1684-152-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1716-322-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1732-48-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1976-286-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2244-136-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2248-310-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2376-216-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2532-382-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2748-340-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2924-442-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2940-16-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2960-160-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2964-175-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3004-358-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3108-248-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3196-352-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3200-236-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3204-128-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3276-424-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3380-172-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3508-101-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3532-119-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3596-256-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3696-24-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3764-412-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3780-68-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3872-406-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4032-200-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4052-95-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4260-388-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4308-284-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4356-239-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4372-298-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4380-316-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4432-274-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4456-328-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4520-144-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4544-370-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4576-394-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4752-430-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4792-112-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4868-224-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4888-103-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4932-292-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4956-72-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads