96f26e25dcbb334e436a56029d132bba2e0632dd5f2a598d1713efcf7cfe13b7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96f26e25dcbb334e436a56029d132bba2e0632dd5f2a598d1713efcf7cfe13b7.exe
Size

128KB
MD5

b796a73cfb502dce7d0aa3c8783abb9a
SHA1

515cb22345035286d09cd0d79b2c69526e8a2808
SHA256

96f26e25dcbb334e436a56029d132bba2e0632dd5f2a598d1713efcf7cfe13b7
SHA512

c849d0954c0b1ec4fa50ff428735e5b3797927f9817ea6822e5896a27a013e0135ce0070dcbbea68f66e210538f88590742207e4bdaae5b9c2f63d47d2991c1a
SSDEEP

3072:zfwMQyI/6jNAdd7KG7UDd0pCrQIFdFtLQ:MddmG7Ux0ocIPF9Q

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbifelba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbpgbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jblpek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obidhaog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbaipkbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alabgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldoaklml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocpgod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llemdo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iifokh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlnnmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kipkhdeq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjhbgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dojcgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kboljk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dadeieea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfcbjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqmjog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbnpqk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceaehfjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipbdmaah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfoafi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddgkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eabbjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmlhii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glebhjlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ecmeig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfjjppmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daolnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibqpimpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbjlfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opdghh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqfmde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjghpn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daolnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fafkecel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbpnkama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ildkgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmkfhc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgkjhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opdghh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bblckl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aanjpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkjmlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iifokh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alabgd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnlhfn32.exe

Executes dropped EXE 64 IoCs

pid	Process
4060	Mdiklqhm.exe
4860	Mjeddggd.exe
3916	Mamleegg.exe
916	Mdkhapfj.exe
556	Mcnhmm32.exe
2180	Mjhqjg32.exe
1128	Mpaifalo.exe
3740	Mcpebmkb.exe
648	Mjjmog32.exe
4444	Maaepd32.exe
4724	Mdpalp32.exe
832	Njljefql.exe
4560	Nacbfdao.exe
1904	Ndbnboqb.exe
3380	Nceonl32.exe
1836	Nklfoi32.exe
760	Njogjfoj.exe
2416	Nnjbke32.exe
1356	Nbhkac32.exe
4380	Ndghmo32.exe
2916	Ngedij32.exe
3140	Nkqpjidj.exe
1720	Nqmhbpba.exe
3456	Ndidbn32.exe
4788	Nggqoj32.exe
4952	Nqpego32.exe
3532	Ogjmdigk.exe
1132	Ojhiqefo.exe
3632	Oboaabga.exe
2568	Oqbamo32.exe
4644	Ocqnij32.exe
1052	Okhfjh32.exe
2152	Obangb32.exe
1988	Oqdoboli.exe
4940	Occkojkm.exe
4232	Ojmcld32.exe
1364	Odbgim32.exe
2288	Ojopad32.exe
1000	Oqihnn32.exe
4980	Okolkg32.exe
2380	Ojalgcnd.exe
2212	Obidhaog.exe
992	Odgqdlnj.exe
2168	Pkaiqf32.exe
3884	Pnpemb32.exe
3020	Pghieg32.exe
3400	Pkceffcd.exe
452	Pqpnombl.exe
2236	Pcojkhap.exe
2896	Pjhbgb32.exe
3528	Pndohaqe.exe
4716	Pabkdmpi.exe
3660	Pcagphom.exe
4748	Pkhoae32.exe
1416	Pbbgnpgl.exe
1804	Peqcjkfp.exe
1632	Pkjlge32.exe
4764	Pnihcq32.exe
3656	Qcepkg32.exe
2832	Qnkdhpjn.exe
3596	Qajadlja.exe
2444	Qgciaf32.exe
3460	Qnnanphk.exe
3512	Acjjfggb.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Nckndeni.exe	Npmagine.exe
File opened for modification	C:\Windows\SysWOW64\Oqihnn32.exe	Ojopad32.exe
File created	C:\Windows\SysWOW64\Nmogab32.dll	Dkjmlk32.exe
File created	C:\Windows\SysWOW64\Glhonj32.exe	Gdqgmmjb.exe
File created	C:\Windows\SysWOW64\Lphoelqn.exe	Lgokmgjm.exe
File created	C:\Windows\SysWOW64\Pllfhkno.dll	Bhdbhcck.exe
File opened for modification	C:\Windows\SysWOW64\Jfaedkdp.exe	Jcbihpel.exe
File created	C:\Windows\SysWOW64\Kfoafi32.exe	Kdqejn32.exe
File created	C:\Windows\SysWOW64\Baacma32.dll	Aqkgpedc.exe
File opened for modification	C:\Windows\SysWOW64\Chagok32.exe	Cdfkolkf.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Diphbb32.dll	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Qajadlja.exe	Qnkdhpjn.exe
File created	C:\Windows\SysWOW64\Fdgdgnbm.exe	Faihkbci.exe
File opened for modification	C:\Windows\SysWOW64\Gmoeoidl.exe	Gdhmnlcj.exe
File opened for modification	C:\Windows\SysWOW64\Ipknlb32.exe	Immapg32.exe
File opened for modification	C:\Windows\SysWOW64\Pndohaqe.exe	Pjhbgb32.exe
File created	C:\Windows\SysWOW64\Hfnphn32.exe	Hodgkc32.exe
File created	C:\Windows\SysWOW64\Agjhgngj.exe	Aqppkd32.exe
File created	C:\Windows\SysWOW64\Nbhkac32.exe	Nnjbke32.exe
File created	C:\Windows\SysWOW64\Pkceffcd.exe	Pghieg32.exe
File opened for modification	C:\Windows\SysWOW64\Cajcbgml.exe	Colffknh.exe
File opened for modification	C:\Windows\SysWOW64\Bmkjkd32.exe	Bjmnoi32.exe
File created	C:\Windows\SysWOW64\Gbbkaako.exe	Gododflk.exe
File created	C:\Windows\SysWOW64\Hafgeo32.dll	Gcfqfc32.exe
File created	C:\Windows\SysWOW64\Pclgkb32.exe	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Fcnopdeh.dll	Fdlnbm32.exe
File created	C:\Windows\SysWOW64\Onjegled.exe	Ofcmfodb.exe
File created	C:\Windows\SysWOW64\Nnjaqjfh.dll	Bhhdil32.exe
File opened for modification	C:\Windows\SysWOW64\Ickchq32.exe	Ildkgc32.exe
File opened for modification	C:\Windows\SysWOW64\Cdhhdlid.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Pcagphom.exe	Pabkdmpi.exe
File created	C:\Windows\SysWOW64\Linjpeof.dll	Eaklidoi.exe
File opened for modification	C:\Windows\SysWOW64\Fhemmlhc.exe	Ffgqqaip.exe
File created	C:\Windows\SysWOW64\Hmjdjgjo.exe	Hioiji32.exe
File created	C:\Windows\SysWOW64\Elfana32.dll	Adcmmeog.exe
File opened for modification	C:\Windows\SysWOW64\Dhkapp32.exe	Demecd32.exe
File created	C:\Windows\SysWOW64\Fbpnkama.exe	Fkffog32.exe
File created	C:\Windows\SysWOW64\Kfjhkjle.exe	Kboljk32.exe
File created	C:\Windows\SysWOW64\Kefkme32.exe	Kbhoqj32.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Njljefql.exe	Mdpalp32.exe
File created	C:\Windows\SysWOW64\Lcjakp32.dll	Ahhblemi.exe
File opened for modification	C:\Windows\SysWOW64\Ckcgkldl.exe	Chdkoa32.exe
File opened for modification	C:\Windows\SysWOW64\Kimnbd32.exe	Kfoafi32.exe
File opened for modification	C:\Windows\SysWOW64\Gokdeeec.exe	Gmlhii32.exe
File opened for modification	C:\Windows\SysWOW64\Pjhlml32.exe	Pgioqq32.exe
File opened for modification	C:\Windows\SysWOW64\Ajckij32.exe	Afhohlbj.exe
File opened for modification	C:\Windows\SysWOW64\Bnmcjg32.exe	Bjagjhnc.exe
File opened for modification	C:\Windows\SysWOW64\Pnpemb32.exe	Pkaiqf32.exe
File created	C:\Windows\SysWOW64\Hlkefpan.dll	Pkaiqf32.exe
File created	C:\Windows\SysWOW64\Edpnfo32.exe	Eabbjc32.exe
File opened for modification	C:\Windows\SysWOW64\Fdegandp.exe	Febgea32.exe
File opened for modification	C:\Windows\SysWOW64\Oqdoboli.exe	Obangb32.exe
File created	C:\Windows\SysWOW64\Mjipjg32.dll	Qajadlja.exe
File created	C:\Windows\SysWOW64\Mlefklpj.exe	Migjoaaf.exe
File opened for modification	C:\Windows\SysWOW64\Pfhfan32.exe	Pcijeb32.exe
File created	C:\Windows\SysWOW64\Cajlhqjp.exe	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Dopigd32.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Dgcifj32.dll	Mdkhapfj.exe
File opened for modification	C:\Windows\SysWOW64\Obidhaog.exe	Ojalgcnd.exe
File created	C:\Windows\SysWOW64\Agkbbg32.dll	Ddmhja32.exe
File created	C:\Windows\SysWOW64\Cfmajipb.exe	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Dgdelcpg.dll	Jcefno32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11712	11536	WerFault.exe	567

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhidjpqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdqgmmjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jpnchp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jifhaenk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nacbfdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pncgmkmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehgqln32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdmpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfjodai.dll"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhkephlb.dll"	Fdgdgnbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifjodl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Icplcpgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jeaikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klngdpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnlhfn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oqdoboli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojmcld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfgefhai.dll"	Hobkfd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jblpek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnneknob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ampkof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipkobd32.dll"	Nnjbke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdgdgnbm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbnafb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgddhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Menjdbgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odgqdlnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bahmfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdkfmkdc.dll"	Kdgljmcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgfqmfde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pacghh32.dll"	Iihkpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npibja32.dll"	Ilidbbgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmjapi32.dll"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bapiabak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onjegled.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcojkhap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkhoae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgpjhl32.dll"	Beeflhdh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhkapp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekhjmiad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klngdpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocbddc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diphbb32.dll"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Behbag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlopkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Addjcmqn.dll"	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cbjoljdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eabbjc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkdbpe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgmngglp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 4060	3056	96f26e25dcbb334e436a56029d132bba2e0632dd5f2a598d1713efcf7cfe13b7.exe	87
PID 3056 wrote to memory of 4060	3056	96f26e25dcbb334e436a56029d132bba2e0632dd5f2a598d1713efcf7cfe13b7.exe	87
PID 3056 wrote to memory of 4060	3056	96f26e25dcbb334e436a56029d132bba2e0632dd5f2a598d1713efcf7cfe13b7.exe	87
PID 4060 wrote to memory of 4860	4060	Mdiklqhm.exe	88
PID 4060 wrote to memory of 4860	4060	Mdiklqhm.exe	88
PID 4060 wrote to memory of 4860	4060	Mdiklqhm.exe	88
PID 4860 wrote to memory of 3916	4860	Mjeddggd.exe	89
PID 4860 wrote to memory of 3916	4860	Mjeddggd.exe	89
PID 4860 wrote to memory of 3916	4860	Mjeddggd.exe	89
PID 3916 wrote to memory of 916	3916	Mamleegg.exe	90
PID 3916 wrote to memory of 916	3916	Mamleegg.exe	90
PID 3916 wrote to memory of 916	3916	Mamleegg.exe	90
PID 916 wrote to memory of 556	916	Mdkhapfj.exe	91
PID 916 wrote to memory of 556	916	Mdkhapfj.exe	91
PID 916 wrote to memory of 556	916	Mdkhapfj.exe	91
PID 556 wrote to memory of 2180	556	Mcnhmm32.exe	92
PID 556 wrote to memory of 2180	556	Mcnhmm32.exe	92
PID 556 wrote to memory of 2180	556	Mcnhmm32.exe	92
PID 2180 wrote to memory of 1128	2180	Mjhqjg32.exe	93
PID 2180 wrote to memory of 1128	2180	Mjhqjg32.exe	93
PID 2180 wrote to memory of 1128	2180	Mjhqjg32.exe	93
PID 1128 wrote to memory of 3740	1128	Mpaifalo.exe	94
PID 1128 wrote to memory of 3740	1128	Mpaifalo.exe	94
PID 1128 wrote to memory of 3740	1128	Mpaifalo.exe	94
PID 3740 wrote to memory of 648	3740	Mcpebmkb.exe	95
PID 3740 wrote to memory of 648	3740	Mcpebmkb.exe	95
PID 3740 wrote to memory of 648	3740	Mcpebmkb.exe	95
PID 648 wrote to memory of 4444	648	Mjjmog32.exe	96
PID 648 wrote to memory of 4444	648	Mjjmog32.exe	96
PID 648 wrote to memory of 4444	648	Mjjmog32.exe	96
PID 4444 wrote to memory of 4724	4444	Maaepd32.exe	97
PID 4444 wrote to memory of 4724	4444	Maaepd32.exe	97
PID 4444 wrote to memory of 4724	4444	Maaepd32.exe	97
PID 4724 wrote to memory of 832	4724	Mdpalp32.exe	98
PID 4724 wrote to memory of 832	4724	Mdpalp32.exe	98
PID 4724 wrote to memory of 832	4724	Mdpalp32.exe	98
PID 832 wrote to memory of 4560	832	Njljefql.exe	99
PID 832 wrote to memory of 4560	832	Njljefql.exe	99
PID 832 wrote to memory of 4560	832	Njljefql.exe	99
PID 4560 wrote to memory of 1904	4560	Nacbfdao.exe	100
PID 4560 wrote to memory of 1904	4560	Nacbfdao.exe	100
PID 4560 wrote to memory of 1904	4560	Nacbfdao.exe	100
PID 1904 wrote to memory of 3380	1904	Ndbnboqb.exe	101
PID 1904 wrote to memory of 3380	1904	Ndbnboqb.exe	101
PID 1904 wrote to memory of 3380	1904	Ndbnboqb.exe	101
PID 3380 wrote to memory of 1836	3380	Nceonl32.exe	102
PID 3380 wrote to memory of 1836	3380	Nceonl32.exe	102
PID 3380 wrote to memory of 1836	3380	Nceonl32.exe	102
PID 1836 wrote to memory of 760	1836	Nklfoi32.exe	103
PID 1836 wrote to memory of 760	1836	Nklfoi32.exe	103
PID 1836 wrote to memory of 760	1836	Nklfoi32.exe	103
PID 760 wrote to memory of 2416	760	Njogjfoj.exe	104
PID 760 wrote to memory of 2416	760	Njogjfoj.exe	104
PID 760 wrote to memory of 2416	760	Njogjfoj.exe	104
PID 2416 wrote to memory of 1356	2416	Nnjbke32.exe	105
PID 2416 wrote to memory of 1356	2416	Nnjbke32.exe	105
PID 2416 wrote to memory of 1356	2416	Nnjbke32.exe	105
PID 1356 wrote to memory of 4380	1356	Nbhkac32.exe	106
PID 1356 wrote to memory of 4380	1356	Nbhkac32.exe	106
PID 1356 wrote to memory of 4380	1356	Nbhkac32.exe	106
PID 4380 wrote to memory of 2916	4380	Ndghmo32.exe	107
PID 4380 wrote to memory of 2916	4380	Ndghmo32.exe	107
PID 4380 wrote to memory of 2916	4380	Ndghmo32.exe	107
PID 2916 wrote to memory of 3140	2916	Ngedij32.exe	108

C:\Users\Admin\AppData\Local\Temp\96f26e25dcbb334e436a56029d132bba2e0632dd5f2a598d1713efcf7cfe13b7.exe
"C:\Users\Admin\AppData\Local\Temp\96f26e25dcbb334e436a56029d132bba2e0632dd5f2a598d1713efcf7cfe13b7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\Mdiklqhm.exe
  C:\Windows\system32\Mdiklqhm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\SysWOW64\Mjeddggd.exe
    C:\Windows\system32\Mjeddggd.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\SysWOW64\Mamleegg.exe
      C:\Windows\system32\Mamleegg.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3916
    - - C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:916
      - C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3740
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:648
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:832
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1904
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        23⤵
        Executes dropped EXE
        
        PID:3140
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        24⤵
        Executes dropped EXE
        
        PID:1720
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3456
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        26⤵
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        27⤵
        Executes dropped EXE
        
        PID:4952
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        28⤵
        Executes dropped EXE
        
        PID:3532
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        29⤵
        Executes dropped EXE
        
        PID:1132
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        30⤵
        Executes dropped EXE
        
        PID:3632
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        31⤵
        Executes dropped EXE
        
        PID:2568
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        32⤵
        Executes dropped EXE
        
        PID:4644
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        33⤵
        Executes dropped EXE
        
        PID:1052
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2152
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1988
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        36⤵
        Executes dropped EXE
        
        PID:4940
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4232
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        38⤵
        Executes dropped EXE
        
        PID:1364
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2288
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        40⤵
        Executes dropped EXE
        
        PID:1000
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        41⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2380
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2212
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:992
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2168
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        46⤵
        Executes dropped EXE
        
        PID:3884
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3020
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        48⤵
        Executes dropped EXE
        
        PID:3400
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        49⤵
        Executes dropped EXE
        
        PID:452
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2236
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2896
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        52⤵
        Executes dropped EXE
        
        PID:3528
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4716
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        54⤵
        Executes dropped EXE
        
        PID:3660
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4748
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        56⤵
        Executes dropped EXE
        
        PID:1416
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        57⤵
        Executes dropped EXE
        
        PID:1804
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        58⤵
        Executes dropped EXE
        
        PID:1632
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        59⤵
        Executes dropped EXE
        
        PID:4764
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        60⤵
        Executes dropped EXE
        
        PID:3656
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2832
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3596
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        63⤵
        Executes dropped EXE
        
        PID:2444
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        64⤵
        Executes dropped EXE
        
        PID:3460
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        65⤵
        Executes dropped EXE
        
        PID:3512
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1456
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        67⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3612
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        69⤵
        Drops file in System32 directory
        
        PID:2036
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        70⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        71⤵
        
        PID:448
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        72⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        73⤵
        
        PID:8
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        74⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        75⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        76⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        77⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        78⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        79⤵
        Drops file in System32 directory
        
        PID:4564
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        80⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        81⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        82⤵
        Modifies registry class
        
        PID:1328
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        83⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        84⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        85⤵
        
        PID:208
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        86⤵
        Modifies registry class
        
        PID:2740
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        87⤵
        Drops file in System32 directory
        
        PID:4548
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        88⤵
        
        PID:932
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4520
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        90⤵
        Modifies registry class
        
        PID:3624
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        91⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5176
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        93⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        94⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5292
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5336
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        97⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        98⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        99⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        100⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        101⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        102⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        103⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        104⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        105⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        106⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5800
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        108⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        109⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        110⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        111⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        112⤵
        Drops file in System32 directory
        
        PID:6040
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        113⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        114⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        115⤵
        Drops file in System32 directory
        
        PID:5144
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        116⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        117⤵
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        118⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        119⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        120⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        121⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        122⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5704
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        124⤵
        Drops file in System32 directory
        
        PID:5784
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        125⤵
        Modifies registry class
        
        PID:5860
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        126⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        127⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        128⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        129⤵
        Drops file in System32 directory
        
        PID:3588
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        130⤵
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5360
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        132⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        133⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5656
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        135⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        136⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        137⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        138⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        139⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        141⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6000
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        143⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        144⤵
        Drops file in System32 directory
        
        PID:5512
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        145⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        146⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        147⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        148⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        149⤵
        Modifies registry class
        
        PID:5868
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        150⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6188
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        152⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        153⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        154⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        155⤵
        Modifies registry class
        
        PID:6364
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6404
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        157⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        158⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        159⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        160⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        161⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        162⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        163⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6748
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        165⤵
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        166⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        167⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        168⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        169⤵
        Drops file in System32 directory
        
        PID:6972
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        170⤵
        Modifies registry class
        
        PID:7012
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        171⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        172⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        173⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        174⤵
        Drops file in System32 directory
        
        PID:5428
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        175⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        176⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        177⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        178⤵
        Modifies registry class
        
        PID:6412
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        179⤵
        Drops file in System32 directory
        
        PID:6484
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        180⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        181⤵
        Drops file in System32 directory
        
        PID:6612
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6684
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        183⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6816
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        185⤵
        Drops file in System32 directory
        
        PID:6904
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        186⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        187⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7048
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        188⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        189⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        190⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        191⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        192⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        193⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6644
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        195⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        196⤵
        Drops file in System32 directory
        
        PID:6888
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        197⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        198⤵
        Drops file in System32 directory
        
        PID:7036
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        199⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        200⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        201⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        202⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        203⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        204⤵
        Modifies registry class
        
        PID:7040
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        205⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        206⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        207⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        208⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        209⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        210⤵
        Modifies registry class
        
        PID:6396
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7200
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        212⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        213⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        214⤵
        Drops file in System32 directory
        
        PID:7320
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        215⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        216⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        217⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        218⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        219⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        220⤵
        Drops file in System32 directory
        
        PID:7572
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        221⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        222⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        223⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        224⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        225⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        226⤵
        Drops file in System32 directory
        
        PID:7824
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        227⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        228⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        229⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        230⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8048
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        232⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8148
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        234⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        235⤵
        Modifies registry class
        
        PID:7196
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        236⤵
        Modifies registry class
        
        PID:7272
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7304
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7396
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        239⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        240⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        241⤵
        Modifies registry class
        
        PID:7624
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        242⤵
        Modifies registry class
        
        PID:7704
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        243⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        244⤵
        Modifies registry class
        
        PID:7848
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        245⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        246⤵
        Drops file in System32 directory
        
        PID:7980
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        247⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        248⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        249⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7316
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        251⤵
        Drops file in System32 directory
        
        PID:7376
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7520
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        253⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        254⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        255⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        256⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        257⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        258⤵
        Modifies registry class
        
        PID:7260
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7500
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        260⤵
        Modifies registry class
        
        PID:7684
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        261⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        262⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7288
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        264⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        265⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        266⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7840
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        268⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        269⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        270⤵
        Drops file in System32 directory
        
        PID:8308
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8352
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        272⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        273⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        274⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        275⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8620
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8668
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        278⤵
        Modifies registry class
        
        PID:8712
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        279⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        280⤵
        Drops file in System32 directory
        
        PID:8796
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        281⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8880
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        283⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        284⤵
        Modifies registry class
        
        PID:8956
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8996
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        286⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        287⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        288⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        289⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        290⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        291⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8328
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        293⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        294⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        295⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8732
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        297⤵
        Modifies registry class
        
        PID:8828
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        298⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        299⤵
        Drops file in System32 directory
        
        PID:8948
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        300⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        301⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        302⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        303⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        304⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        305⤵
        Modifies registry class
        
        PID:8520
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        306⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        307⤵
        Modifies registry class
        
        PID:8804
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        308⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        309⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        310⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        311⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        312⤵
        Modifies registry class
        
        PID:8380
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        313⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        314⤵
        
        PID:368
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        315⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        316⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        317⤵
        Drops file in System32 directory
        
        PID:8872
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        318⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        319⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9192
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        321⤵
        Modifies registry class
        
        PID:9112
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        322⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        323⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        324⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        325⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        326⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        327⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        328⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        329⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        330⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        331⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        332⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        333⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9760
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        335⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        336⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        337⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        338⤵
        Modifies registry class
        
        PID:9932
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        339⤵
        Drops file in System32 directory
        
        PID:9968
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        340⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10052
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        342⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        343⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        344⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        345⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        346⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        347⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        348⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        349⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9512
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        351⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9620
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        353⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        354⤵
        Modifies registry class
        
        PID:9756
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        355⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9880
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        357⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        358⤵
        Drops file in System32 directory
        
        PID:10060
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        359⤵
        Modifies registry class
        
        PID:10136
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        360⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        361⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        362⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        363⤵
        Drops file in System32 directory
        
        PID:9400
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        364⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        365⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9796
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        367⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        368⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        369⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        370⤵
        Drops file in System32 directory
        
        PID:9300
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        371⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        372⤵
        Modifies registry class
        
        PID:9684
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        373⤵
        Modifies registry class
        
        PID:9876
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        374⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        375⤵
        Modifies registry class
        
        PID:10232
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        376⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        377⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        378⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9732
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        380⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        381⤵
        Modifies registry class
        
        PID:10036
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        382⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        383⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        384⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        385⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        386⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        387⤵
        Modifies registry class
        
        PID:10448
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        388⤵
        Drops file in System32 directory
        
        PID:10488
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        389⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        390⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10568
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        391⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        392⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        393⤵
        Modifies registry class
        
        PID:10704
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        394⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10792
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        396⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10836
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        397⤵
        Modifies registry class
        
        PID:10880
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        398⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        399⤵
        Modifies registry class
        
        PID:10956
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        400⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        401⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        402⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        403⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        404⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        405⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        406⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        407⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        408⤵
        Drops file in System32 directory
        
        PID:10344
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        409⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        410⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        411⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        412⤵
        Modifies registry class
        
        PID:10608
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        413⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        414⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        415⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        416⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:10948
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        418⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        419⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11136
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        421⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        422⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        423⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        424⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        425⤵
        Drops file in System32 directory
        
        PID:10596
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        426⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        427⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10828
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        428⤵
        Modifies registry class
        
        PID:10900
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        429⤵
        Drops file in System32 directory
        
        PID:10992
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        430⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        431⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        432⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10440
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        434⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        435⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        436⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        437⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        438⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        439⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        440⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        441⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        442⤵
        Drops file in System32 directory
        
        PID:10736
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        443⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        444⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        445⤵
        Drops file in System32 directory
        
        PID:10760
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        446⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11296
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        447⤵
        Drops file in System32 directory
        
        PID:11340
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        448⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        449⤵
        
        PID:11420
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        450⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11468
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        451⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        452⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11600
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        454⤵
        Modifies registry class
        
        PID:11636
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        455⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        456⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        457⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        458⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        459⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11856
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        460⤵
        Modifies registry class
        
        PID:11892
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        461⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        462⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        463⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        464⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        465⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        466⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        467⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        468⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        469⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12256
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        470⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11272
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        471⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:11408
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        472⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        473⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11536 -s 408
        474⤵
        Program crash
        
        PID:11712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 11536 -ip 11536
1⤵
PID:11668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ekhjmiad.exe

Filesize
128KB

MD5
4985aea9861a0efbd40ab4db246cb3ae

SHA1
431008dec8a3b2b81e0a9157d17304919d73491f

SHA256
9ea3fe2ba0beb35649b8c5b2e76cb95b39c1dd2e921febcac82a1ad028cf3243

SHA512
dc9a67a23b3b9ddaae25a8662940fe45045159d7d752731d0bef41456a6cab449a4137700a96e4d259f390cdecfb7afa145cb7ffa6f06609a0cf75617776d680

Download Submit
C:\Windows\SysWOW64\Iblfnn32.exe

Filesize
128KB

MD5
78494cc551efab054145aaa981fb7a10

SHA1
ce5ada634ecc219aec6d49ec1c91fa6196187a70

SHA256
1e4ee79434c5e81dceb1a6d43d525344009f2055ef97bc886fedbaef947ba71d

SHA512
2846e2b0fb6f2d428120bab750da4c0cb8377792e7c4fc27201dc55b3fd17bb03af667bff04d25da23d26acd03d784966ced8744717fa2234f4a2a13463fa1f3

Download Submit
C:\Windows\SysWOW64\Jplfcpin.exe

Filesize
128KB

MD5
e1bd52656ee4885864f0847ed1164022

SHA1
484e3d6bd0ad77c209e4c86b93317bd034867627

SHA256
0b21482d0e10201b6777c3327c61aab4fe0639f4e58c2350117c827801e3fca9

SHA512
3130428ddd70a02906942c5c221fc3cc1850d16d9472c2b7a2aaf66d4c62401286e0de919e1e72bbf58c2c8231b61d81ba27558cd3f77bf34cabded1cf1c653d

Download Submit
C:\Windows\SysWOW64\Kbhoqj32.exe

Filesize
128KB

MD5
26051bc9ef8b562b39269f5dd6d67be6

SHA1
2a232a8acbb072c6fb936e2cf0558a0a6f388d7d

SHA256
1672936a3d241938df93fc734d85602249b984f44d99646a6d82d490959b0d9a

SHA512
59eda9b69b1cc1fd77802b43cdcfb3bce6a924cfed0b47cb7482b85385b59e953c0317c8ce205229dd1e64224b67d700a3f169eecb7dae1c384a3d5f8f64167e

Download Submit
C:\Windows\SysWOW64\Maaepd32.exe

Filesize
128KB

MD5
5df13fa058750278aa836899a12c08d0

SHA1
7a30961a81f8c7e99adfaf3e6f2c093d683a853a

SHA256
2304a64c6ac3e6ffc3926b6cf2cb2de58bf4e0cd3032fd82ad4b7a06b359dbab

SHA512
e6a299d6618356466dd599724636b7493527fc1f12503d1626e3e7205d3d8457f0331cf1172515c3dc79b5ecb9689be8e120a1b889c93a16a426692495ecfbd7

Download Submit
C:\Windows\SysWOW64\Mamleegg.exe

Filesize
128KB

MD5
f1e741b732d8ea809715d8979c15dd57

SHA1
672413b57c12a232e9c8c7446b5d7b14c0b8e7c2

SHA256
0371d48e8c22504448ee0d1dffb99e1fa02f7a6d5e4eef008e02c42f03f36629

SHA512
0ce18771bfedc24eac77e2170769805255c7624581848a5c89ce566955e29a09b51f28923de7b2adfbe9fababc12d0acef41d518eaae862299de3a11fbc90730

Download Submit
C:\Windows\SysWOW64\Mcnhmm32.exe

Filesize
128KB

MD5
89d2280e77e785c42335b11a52302b73

SHA1
a8f60f1d1434bb42e39946ef6eb75294f396c010

SHA256
7f908d1c56106e5105d44b2536d10ea170915b00cb3fa97fdc5eac2f5eef38ac

SHA512
b1a214873e33aaea1d7628c917976cdef3910f333856dd73526b1b1908b9c24608ff38c03ab915da799e5a3ef8749023155a9750b0aa08a619c238633e166a75

Download Submit
C:\Windows\SysWOW64\Mcpebmkb.exe

Filesize
128KB

MD5
869c532e07744cff25ffbcae8ab1ad2d

SHA1
528d4e06a3a7409b20e52eacebeb1c8ef541af6b

SHA256
3db9ad75089b5793b00139fd1c0cec6fabd5e77bd6a170010c7ffcc3337082bf

SHA512
1f1e63fb3dbf4cfe178a16a8d6202a7b7c0e0f74adfddcc54458ddcc8c84c70d003cf437f7d569838dc186a375f43617df4a04914e87a048b7582763780c0110

Download Submit
C:\Windows\SysWOW64\Mdiklqhm.exe

Filesize
128KB

MD5
3a7c9a427bc357a3a45613e0d53e4256

SHA1
64ac0a250241940b13044ca0980fc743412fc73a

SHA256
392d22391d2607aaaf402704bbd2736be477fe56aa20e9acdaf69daf9b6236c4

SHA512
01d5d7b48ed44864412cdbf83c52fb02d19a369c9956604b6e71f06af3f0d17bac6d2f03d9cc3e99dc79414b8a8c02411b0d6743609bb68c6eafcdadf7962c8c

Download Submit
C:\Windows\SysWOW64\Mdkhapfj.exe

Filesize
128KB

MD5
29453f281d42cdff9677d52bed9c30c3

SHA1
e670aa31b708e4091444af8c91b42208b4e3e361

SHA256
68416d4c15f7308c26a87cceff69479c64c3f5dc354612e2432be210add46b7a

SHA512
c7ecf52ed25a9cd97905740621ec28ca9ee50ffb8b87c0cc58ba4c294da0c9c6f6747c896750c3b5404c857866c3a038b9ee5100d45f0598094f7b6be1781060

Download Submit
C:\Windows\SysWOW64\Mdpalp32.exe

Filesize
128KB

MD5
74be7cbf247f69b2f98ed227e536308a

SHA1
27c42d5f7a9aba8940ec38987d9c7bdcf364f16b

SHA256
7e4ad04e6707f3e9fb2317edbe76ecbf426ea83634500ffaf74b37f0ac60da96

SHA512
60e32a017cdc0fa0575e209ca71eb24ad11940520b7613e8d2dbf04c9616951509db397ccdba6766277faf72634515a949cf3e2efa9c7d068c9af0486c8fcaf3

Download Submit
C:\Windows\SysWOW64\Mjeddggd.exe

Filesize
128KB

MD5
1301539e1ea4154eea76a2a244a2cd3b

SHA1
90dc496dbcb6a19fd08192d3da48ccde33da0e60

SHA256
92cfcf4c7a69d5b0d3f5228f79dc75acb9f2200ce582e1b6f2bd488b46ef80cb

SHA512
86f814bf28fd34d33d5272ad0ff5e802a02120e3d9d63574fa2fbab46cd0b933f83d59505fa8374db4b79516bad00b89b1e3fc6ea65e1b03afd7f1e0e4318fbf

Download Submit
C:\Windows\SysWOW64\Mjhqjg32.exe

Filesize
128KB

MD5
d8cd9dd187de65c648e5fe9adb55e53c

SHA1
749d478d7de9b4ab748686f5748c3aee9524d7ec

SHA256
4c29f1aded25dae09c54661019ec865d530c4ac5e7b66348f8cce6a40d57f4cf

SHA512
e5bf778fdb3b0505f83846b32d373edebd819d3d7ee82ccfc91b351215f6b2bf2e60a877d462c1e3911109dbcdba84ac3a70ef65cea0b8189e918230a03b7a79

Download Submit
C:\Windows\SysWOW64\Mjjmog32.exe

Filesize
128KB

MD5
816bbf1f4a0888b852066d5fbc7bb107

SHA1
7dde7fa591df8a65376a7114be70def15a7cd25d

SHA256
96ae3ac61ba28d3b13029b1a5f845c06e8f6836232c8abd563acd5b10d68efee

SHA512
2f05c78576d6404d18f90b0bc4fb2ec364c0cdbfb598b0027e0856fa501c53735f456480e016802d0b4dd7e0dad67553088a6fccde3ddc7a5168891ffc6569ad

Download Submit
C:\Windows\SysWOW64\Mpaifalo.exe

Filesize
128KB

MD5
bbe85f27b5895c749f7999c99f91da80

SHA1
bca69ebba5c562b15586368afe683d11233bfc53

SHA256
35cb55ad34bb19d9045b43045f9ad7beaa039b0967f8a55cb51d20a69fa64026

SHA512
cc7b4a092be4e7698272c63e5b54b2c83e050ed4177155ffdb08baeed424ac305c6319205e8d964126c505c7e7110edca5ec7ff958ddaba770f1126c9aafd7a8

Download Submit
C:\Windows\SysWOW64\Nacbfdao.exe

Filesize
128KB

MD5
d2f70085c634f64b26142f33f359aaff

SHA1
0d87664e811b568cf30704a20bbef102979396bc

SHA256
6326c9ed5b613289249aa5c11e04f0c669446feae84c7ff052dd23e12f7f2c79

SHA512
fe8a44013bf2aefdefe64439c1deaffd2ae3f1b1bea4d4bf7408021b5bd4a39b90ecaf27d9cd21f648bf0ff588594d386e54155da81683b5d4b81677ac626580

Download Submit
C:\Windows\SysWOW64\Nbhkac32.exe

Filesize
128KB

MD5
0eb5a41c72279e36b519618e2ecc7733

SHA1
d9a18e90493f3943b72558a4f233c55907de852d

SHA256
e9807e1daedc83f87e2f2d509f41a5748f69c329d1b222a7ffc52ee5a044d973

SHA512
5a414d9c6a6b3ce477dec7a7f84edc60dda6c9388ef7cab910210b5b7e39db985b561834e0d5218844251843e40e1293f33d1e0e7dfe6ff8dda58fc57205ac47

Download Submit
C:\Windows\SysWOW64\Nceonl32.exe

Filesize
128KB

MD5
c3bc50ca1d43226c1ed6c9493dff4b29

SHA1
939747c211f78a5967d188258ed98b37a33f118e

SHA256
3faf5d333b607ebb4f56d35eb338eb73589d752c951413b731b7f870a243fef2

SHA512
ad900fcc96ceca6c1361a29abbad86a5075c6cb2cb4311e416fa3b088fac3b816f3b0edf6fc6083f33a222fb80816b8cd6e6cbc6790c3c156a7e14fd4fa7603c

Download Submit
C:\Windows\SysWOW64\Ndbnboqb.exe

Filesize
128KB

MD5
fa1bf57238cbe3ec0dd7c3adc60c1533

SHA1
0eca88aa4faf935d4722e4d8eca7992b1f4048d5

SHA256
d32675316dd7e1f9ee70780ced35b6c41c56d598302f876c08f7495ea446078f

SHA512
27585009b896dd528d20c61f76792a7a4560d9230f0e83ee665b6a25d9f8f85cf59052bc8233fb3f5182142b2a3d9b1b7165ef8c82eef7b5ade919c59fa71fcb

Download Submit
C:\Windows\SysWOW64\Ndghmo32.exe

Filesize
128KB

MD5
431397edace6d09ff6e707630895597c

SHA1
c1ddfe2aca7b70aedb818e65b892d2cabc93c35b

SHA256
07c4044cec8e6ed7804e4f14d48d6b02ea65c53425e4f5a9ea0c368b22bddc89

SHA512
a09458cdfb4b2cda35b718eee61ab70708fd2ff3bd823857da996b69f30213a643345f6f110863d96f9a7eeb7ac8b7c5e48156a5dd0424998b860868ec1121db

Download Submit
C:\Windows\SysWOW64\Ndidbn32.exe

Filesize
128KB

MD5
35de5533298581ff21bbee015daed899

SHA1
d1bc26e2fddcae910811f36c54bdeaf1275a8680

SHA256
c54fc5250b6d3c0ff8d7e245704bf0b1652e58b7c7ddc79421e42f21c9b155ab

SHA512
e0d4e58fcbdc2f3af7f1bc11237bf0d826832ceb92d414c134c810c9d999156279f0cb9d54bb77a477fa243d2469dc9929c9cbc5b518e5bfad35139363208f60

Download Submit
C:\Windows\SysWOW64\Ngedij32.exe

Filesize
128KB

MD5
c826069e26c8aed871731af8b05be7fc

SHA1
502d5c335c58a2ce2ebc939da8179e127e8bb8ed

SHA256
83518be5d3d4a5a944814d92c7c8c562f1a356db50ac6f761d205ffc5134dabc

SHA512
64fb8e093f3d840058d59046fa7068118deb17ba22c2301520f74d566cd8f09879ed2c1a6d2fb1ba759d08d5ea7f022ba2ee7df1c1cbaa78844599483c63b3a1

Download Submit
C:\Windows\SysWOW64\Nggqoj32.exe

Filesize
128KB

MD5
ed84852f30fa041588471144ac5d6eb8

SHA1
5e5cad98b74ee01476a4399c337143a124bf6ebe

SHA256
53a582b73d9b2d90678a7183fd380ed95f51e46e2226356c5577460f42b19018

SHA512
7c07b8bd0e6e080517be3bfa433f71dd7856637e6b2da296981e76c603b6778e30b3815ffc6930d42c88b754f0230632fd4fcc74c4b2d15ce3868ee1cdb580a2

Download Submit
C:\Windows\SysWOW64\Njljefql.exe

Filesize
128KB

MD5
37e267af1926942ccc9f9a97c2ec9eb9

SHA1
8ef550acdd9ddcfa941806873ad8f041c829f13f

SHA256
380769ad06d7de866d7d666265aabe0bd8a1440172e6549de2d7eaaad22c4633

SHA512
9bcfd038e4282923d1f14e95f39a60d4a5fe081cf38bc6bbfb7d77c7c3516163c0283a8c3a5aa652608da1844be11a62e376a3b48df0e5fcca55dee97723f22a

Download Submit
C:\Windows\SysWOW64\Njogjfoj.exe

Filesize
128KB

MD5
4b6f81dee43bfc3953bc60a3b40bf79c

SHA1
96add5f5bb2db6a97aad48cd6f819d490860f7b5

SHA256
11411c2bf65cd8ef42203b2666a5d945028516c4b9dc67f49fdb2446293c901c

SHA512
b255e7130d215ff8636642b5ed18977113568d7a4aaf4b3d0955b9c6367743efadcc1b1d8dccd7a1deaa8877744b6ecfbe950dcea3cb1cc44fea4c56bf57fe67

Download Submit
C:\Windows\SysWOW64\Nklfoi32.exe

Filesize
128KB

MD5
626344960b9d4e3f1acc7f332dbe40b3

SHA1
0f353863381d239f2b216ebdab3461db2b793125

SHA256
1450533d89b7a45997b0f7e263ef1025ab885f1894671f2d83c70e5254836f83

SHA512
6a60c341689890aaf691eaff23784470eee617322a69dd2a9a72ddbdf9be5b8a9cd5b7c97902359235a063a9cfad3ed99b5135191536b553eaabb6a2da706bf0

Download Submit
C:\Windows\SysWOW64\Nkqpjidj.exe

Filesize
128KB

MD5
81f0d359c673ad3984505e3ec9a239b6

SHA1
c24b653eb6c49dd4590ba4dc4d1d8cd2ddbfe208

SHA256
0c151d8c50bb00fdf7fe823bee7bcc2a04587bd0c69a2afc5dae99b8872fb5e8

SHA512
2c49b39287ed635a1c678800a59a3e6809312a37ec3188aedb3f243a7d54faec6e8b04d30645b174d1525cc43639215660438865520c5415e5478ed6c53761f9

Download Submit
C:\Windows\SysWOW64\Nnjbke32.exe

Filesize
128KB

MD5
1fa5c8e93e1b147dc9dda814b4bab1a1

SHA1
e298778ad476974d785c72fac343991fe3f72879

SHA256
927e030bc8ab694058d3f7990d567bc50f8aa0c4e7ea4902520d418122eed7ca

SHA512
32e16db7eeb29be8ccfc13068ec36af4fccd599c1da5f11414fbb9fcb60baf739489a2145a11cf42ed3b62e9ed46d1eb7debbc982b484f48bbc2de1c9f72643e

Download Submit
C:\Windows\SysWOW64\Nqmhbpba.exe

Filesize
128KB

MD5
1907e37cfad941044083d4163549d49a

SHA1
36d4ee7669e4d36e56bf825eb9e90d8ef04a3ffd

SHA256
bd312a8a0145abf00a2b65df75b46f9f0d382e0408ef8e4f3728559d4725ac04

SHA512
52867a8eede6688658366236642af84a0f854f11c2cb1c4bb50c4aa23acd4905d7de86a4d10852876e293bd1451e8b8bd8f31296a0e29184ea8f74166317420d

Download Submit
C:\Windows\SysWOW64\Nqpego32.exe

Filesize
128KB

MD5
662a8b72edb5ab135e71c21a639adfe4

SHA1
58665f76beb8fe4c3d640ecde46d0d9b5c74b226

SHA256
01830f9f97dfec64d4a84dd642ac384bf3ad755c8be166418b7e4e5e3dc1e7f0

SHA512
b295bca2b4a89a118d5545bad8c97ae7de732cb23c6847c38e404b64c77cc276847b337aea8d44cc04210a10a5177d99d3906f447be3828d481816f60b034cdf

Download Submit
C:\Windows\SysWOW64\Oboaabga.exe

Filesize
128KB

MD5
97c615b8e13a0642f6fe6595647ffeda

SHA1
a45ee6525c4f3acefe77d45c368734f4146a7958

SHA256
c3fbc7895a73c32a47ba239944dcce1782736f4ebb29244fcd88812a2bfe6d64

SHA512
cd96acdd888506ace5d4bd21df6b473168a92decbb1f88591ccad104a0bdda4ccb629633f7323628dba7fa4e639ffe71eb7afcc0d357e20e0ef9bc8faec67b34

Download Submit
C:\Windows\SysWOW64\Ocqnij32.exe

Filesize
128KB

MD5
80a96c50427d0eebc98357bf671d8b10

SHA1
2b576e1cd29b7a51faf06c9fb4f1cfbf5d629546

SHA256
4f254460ef739920f562c3ba4169f813b7127f97af424830ff41c481773bc265

SHA512
302e8f8a2309532fb615346ad608dafcbe33077d26d16ad3bc6f3d6fdfb3782c1e29801e9121794d81e6a02ef17e3cd48c983bdeafe291be17fde1ad72290b61

Download Submit
C:\Windows\SysWOW64\Ogjmdigk.exe

Filesize
128KB

MD5
aa766bf0ab68a58ae83d4be21c87e63a

SHA1
db7f05a120f45993194f3f030d05fedf33a7cb4a

SHA256
866bb7642199e053fb1561d32e2336480c356e269cb092652fdcd88fd8dec8d8

SHA512
054aeceea221112708c31e26551a9149d912118e700885103fdaaacdeb64b66359dfa4d96095b7527c70f757652c34f60a307f39dd914363d676e43edb06b4d5

Download Submit
C:\Windows\SysWOW64\Ojhiqefo.exe

Filesize
128KB

MD5
f3dadc09d12044132911eec67efb3fb8

SHA1
a76662a48e48fbceefe323a11f61e7197943f806

SHA256
3565b8367e0d5cf94ce5acdecdc13988bc7b2daaeb7e8f2b50b12f29c6dda7de

SHA512
cccf1b8c3bc0c7dce9e16e0ddd5b4b64220f90c125b75be13475243a4af1f13ccb0f82cce0ec17217e4e9bd06ad1207f1bd3a73998750bfe7a2adb1343a248db

Download Submit
C:\Windows\SysWOW64\Okhfjh32.exe

Filesize
128KB

MD5
44e040fb128e28bf6816ba7d942fd4c5

SHA1
ab2104a1d255060d8ce7711a073df15845d9dfb0

SHA256
a21f1a70beb4a121ed8990ec76c36ce6908c59bf26a98fcc47ad49e8b9fb25b7

SHA512
2dd9c14fb1384c581da360c6f8dbabb258090a27b215d1383a9bbcf5e83cf21033bc93a346fc3043521c85813c02a247276468112ffe4be041c94124cf0d25f6

Download Submit
C:\Windows\SysWOW64\Okhfjh32.exe

Filesize
64KB

MD5
890cb81e186e0d763be1c8d0e40b447b

SHA1
271d22d7e4cb712cfade5780ced9ee45a7f81ca7

SHA256
eee2a2b1a6d9eda5bc99bd68f1eced62235a1858335fc154fa84f9032cad3dff

SHA512
0e30abe9434c0299a3e132af6846408b5142e5b7dde3ea932d70e304f71fd416db4cd111543ecd869d135110de0e4ddcacbca01f74df185c8ff4b2c75118b0a2

Download Submit
C:\Windows\SysWOW64\Oqbamo32.exe

Filesize
128KB

MD5
d2320ae62ad5532a19d93cc50e76949b

SHA1
7193f12f9788997b86ca2dd9ada174127cd6e208

SHA256
2e1ae6407ce336eebd9425b43f4bf92da4365e8e25da19c8a6b507fa17abf0a3

SHA512
0e8014bbca68a1d7157789910d5cd8981cf7fadefad69e2885de4f463d563af883aa50ea552ed452e21f86915c2c9a1df9567db6e57dbc029f92e651a380bd6e

Download Submit
memory/452-352-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/556-43-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/648-79-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/760-156-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/832-132-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/916-32-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/992-326-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1000-298-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1052-283-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1128-56-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1132-242-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1356-185-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1364-286-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1416-394-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1632-410-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1720-195-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1804-404-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1836-148-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1904-143-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1988-284-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2152-269-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2168-328-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2180-52-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2212-316-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2236-358-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2288-296-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2380-310-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2416-164-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2444-436-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2568-258-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2832-424-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2896-364-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2916-194-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3020-344-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3056-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3140-196-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3380-144-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3400-346-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3456-203-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3460-442-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3528-373-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3532-276-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3596-430-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3632-250-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3656-418-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3660-382-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3740-64-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3884-334-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3916-24-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4060-7-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4232-285-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4380-192-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4444-88-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4560-165-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4644-277-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4716-376-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4724-87-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4748-392-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4764-412-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4788-228-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4860-16-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4940-274-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4952-236-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4980-304-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads