c4af60a36cde08f68fdff0fda778405de663db3d3e23097163d90df7aa637b88

Analysis

max time kernel
90s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4af60a36cde08f68fdff0fda778405de663db3d3e23097163d90df7aa637b88.exe
Size

45KB
MD5

3a4c4aeab3e2dbb1d954dde2c64a35ac
SHA1

c4216454a7cb0da0c73e264ce3ac37ab6056daf8
SHA256

c4af60a36cde08f68fdff0fda778405de663db3d3e23097163d90df7aa637b88
SHA512

a5559335ac96d71649852fd2ff26920ed084a36ee1c96c37d285658b7a4dea3a13c032611454f821ea708b07ba636e00bacee6db7cdb52d82b9f89be5e7b7629
SSDEEP

768:Y2/Eyy49cOdaivbapWuJBvDWBz0GaqbZlIlwIaRtVVSu6O/i+KmyOa2CeqGSu6Wq:YMy4Xdaijap76BzPZb8lwPHSu6Wi+Km6

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mipcob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqknig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pagdol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fllpbldb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icplcpgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jefbfgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbabgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pagdol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icifbang.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofnckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fafkecel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdegandp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcddpdpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iikhfg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eamhodmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odkjng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jplfcpin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbjlfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojopad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Likjcbkc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncfdie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olkhmi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aanjpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chdkoa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghopckpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chmeobkq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkmchi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbgmcnhf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbfkbhpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Andgoobc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcdmga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghlcnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpjlklok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgfqmfde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Echknh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfembo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npcoakfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nljofl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpnchp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lenamdem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcmabg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onjegled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcagphom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlopkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojllan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbefaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kboljk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klgqcqkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kepelfam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odednmpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehgqln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibqpimpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mncmjfmk.exe

Executes dropped EXE 64 IoCs

pid	Process
4492	Lphfpbdi.exe
4960	Lgbnmm32.exe
676	Mjqjih32.exe
2752	Mahbje32.exe
4796	Mciobn32.exe
2412	Mkpgck32.exe
3928	Mnocof32.exe
856	Mcklgm32.exe
3856	Mkbchk32.exe
4732	Mnapdf32.exe
3092	Mpolqa32.exe
2504	Mcnhmm32.exe
3116	Mkepnjng.exe
452	Mncmjfmk.exe
4596	Mpaifalo.exe
1324	Mcpebmkb.exe
1428	Mkgmcjld.exe
2828	Mnfipekh.exe
4548	Mdpalp32.exe
4592	Mcbahlip.exe
3348	Nkjjij32.exe
1836	Nqfbaq32.exe
2500	Nnjbke32.exe
2308	Ncgkcl32.exe
4264	Nbhkac32.exe
4744	Ndghmo32.exe
1212	Ngedij32.exe
328	Nbkhfc32.exe
3756	Ndidbn32.exe
4376	Nbmelbid.exe
3888	Ncnadk32.exe
920	Ojhiqefo.exe
4676	Oboaabga.exe
2296	Ogljjiei.exe
3432	Onfbfc32.exe
4276	Oqdoboli.exe
3412	Occkojkm.exe
3328	Ojmcld32.exe
4828	Obdkma32.exe
2884	Ocegdjij.exe
4748	Ojopad32.exe
4488	Obfhba32.exe
4940	Odednmpm.exe
2740	Okolkg32.exe
4332	Oqkdcn32.exe
2032	Pgemphmn.exe
4088	Pnpemb32.exe
3984	Pqnaim32.exe
2448	Pghieg32.exe
4772	Pjffbc32.exe
1376	Pbmncp32.exe
4908	Peljol32.exe
4524	Pgjfkg32.exe
3380	Pabkdmpi.exe
1932	Pcagphom.exe
3820	Pkhoae32.exe
3640	Pnfkma32.exe
2096	Peqcjkfp.exe
1676	Pkjlge32.exe
4380	Pjmlbbdg.exe
4204	Pagdol32.exe
1904	Qcepkg32.exe
3320	Qjpiha32.exe
3472	Qjbena32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hipegc32.dll	Pjffbc32.exe
File created	C:\Windows\SysWOW64\Cnnobj32.dll	Acocaf32.exe
File created	C:\Windows\SysWOW64\Chghdqbf.exe	Cehkhecb.exe
File opened for modification	C:\Windows\SysWOW64\Jeklag32.exe	Jblpek32.exe
File created	C:\Windows\SysWOW64\Daconoae.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Gfniiokn.dll	Pcagphom.exe
File opened for modification	C:\Windows\SysWOW64\Hodgkc32.exe	Hmfkoh32.exe
File created	C:\Windows\SysWOW64\Hhmkaf32.dll	Mpjlklok.exe
File created	C:\Windows\SysWOW64\Mgimcebb.exe	Mcmabg32.exe
File created	C:\Windows\SysWOW64\Pdmpje32.exe	Pqbdjfln.exe
File created	C:\Windows\SysWOW64\Odegmceb.dll	Mnapdf32.exe
File opened for modification	C:\Windows\SysWOW64\Foabofnn.exe	Fhgjblfq.exe
File created	C:\Windows\SysWOW64\Olfdahne.dll	Cmiflbel.exe
File opened for modification	C:\Windows\SysWOW64\Mkbchk32.exe	Mcklgm32.exe
File created	C:\Windows\SysWOW64\Camphf32.exe	Conclk32.exe
File created	C:\Windows\SysWOW64\Mplhql32.exe	Mlampmdo.exe
File created	C:\Windows\SysWOW64\Gmdlbjng.dll	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Mdmnlj32.exe	Mpablkhc.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Chjaol32.exe
File opened for modification	C:\Windows\SysWOW64\Occkojkm.exe	Oqdoboli.exe
File created	C:\Windows\SysWOW64\Pagdol32.exe	Pjmlbbdg.exe
File created	C:\Windows\SysWOW64\Bjbndobo.exe	Blpnib32.exe
File created	C:\Windows\SysWOW64\Mcgdgamg.dll	Cajcbgml.exe
File created	C:\Windows\SysWOW64\Mpjlklok.exe	Mlopkm32.exe
File created	C:\Windows\SysWOW64\Jfaklh32.dll	Kemhff32.exe
File created	C:\Windows\SysWOW64\Bkjlibkf.dll	Mlhbal32.exe
File created	C:\Windows\SysWOW64\Agjhgngj.exe	Aqppkd32.exe
File created	C:\Windows\SysWOW64\Bdknoa32.dll	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Qjpiha32.exe	Qcepkg32.exe
File opened for modification	C:\Windows\SysWOW64\Anbkio32.exe	Acmflf32.exe
File created	C:\Windows\SysWOW64\Hkkhqd32.exe	Himldi32.exe
File opened for modification	C:\Windows\SysWOW64\Jpijnqkp.exe	Jioaqfcc.exe
File opened for modification	C:\Windows\SysWOW64\Bcoenmao.exe	Belebq32.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Codhke32.dll	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Opbnic32.dll	Nbkhfc32.exe
File opened for modification	C:\Windows\SysWOW64\Eofbch32.exe	Ekjfcipa.exe
File opened for modification	C:\Windows\SysWOW64\Ligqhc32.exe	Lekehdgp.exe
File opened for modification	C:\Windows\SysWOW64\Cnicfe32.exe	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Echknh32.exe	Ekacmjgl.exe
File created	C:\Windows\SysWOW64\Lllcen32.exe	Lingibiq.exe
File created	C:\Windows\SysWOW64\Mmbfpp32.exe	Mgimcebb.exe
File created	C:\Windows\SysWOW64\Lgbnmm32.exe	Lphfpbdi.exe
File opened for modification	C:\Windows\SysWOW64\Pgemphmn.exe	Oqkdcn32.exe
File opened for modification	C:\Windows\SysWOW64\Abemjmgg.exe	Ajneip32.exe
File created	C:\Windows\SysWOW64\Bahmfj32.exe	Abemjmgg.exe
File created	C:\Windows\SysWOW64\Mpbbmhgf.dll	Behbag32.exe
File created	C:\Windows\SysWOW64\Mlcadgkl.dll	Docmgjhp.exe
File opened for modification	C:\Windows\SysWOW64\Kpjcdn32.exe	Kipkhdeq.exe
File created	C:\Windows\SysWOW64\Qihfjd32.dll	Bmbplc32.exe
File opened for modification	C:\Windows\SysWOW64\Pkjlge32.exe	Peqcjkfp.exe
File created	C:\Windows\SysWOW64\Llgjjnlj.exe	Lmdina32.exe
File opened for modification	C:\Windows\SysWOW64\Acjclpcf.exe	Adgbpc32.exe
File created	C:\Windows\SysWOW64\Mecaoggc.dll	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Knfoif32.dll	Ojgbfocc.exe
File opened for modification	C:\Windows\SysWOW64\Bjfaeh32.exe	Bclhhnca.exe
File created	C:\Windows\SysWOW64\Ajneip32.exe	Adcmmeog.exe
File created	C:\Windows\SysWOW64\Lhclbphg.dll	Fbnafb32.exe
File created	C:\Windows\SysWOW64\Fqqlehck.dll	Helfik32.exe
File opened for modification	C:\Windows\SysWOW64\Iiaephpc.exe	Hfcicmqp.exe
File opened for modification	C:\Windows\SysWOW64\Ajfhnjhq.exe	Agglboim.exe
File opened for modification	C:\Windows\SysWOW64\Chmndlge.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Bejogg32.exe	Bblckl32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10792	10628	WerFault.exe	522

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chfgkj32.dll"	Nilcjp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Faihkbci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dejpjp32.dll"	Foabofnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhondp32.dll"	Gkmlofol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bemlmgnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dahode32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmipecpd.dll"	Fllpbldb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpebpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glgmkm32.dll"	Olcbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Peqcjkfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acjjfggb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hffdjk32.dll"	Blmacb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qqfmde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifmafkkf.dll"	Gfembo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Filmeaek.dll"	Qbimoo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjghpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edihepnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Baicac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdfibe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhfonc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iihkpg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icifbang.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Madnnmem.dll"	Lmppcbjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebooppnl.dll"	Ojmcld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aaepqjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbgbgj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qjpiha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Boepel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mogqfgka.dll"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ladjgikj.dll"	Ofnckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jocbigff.dll"	Pnakhkol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qcgffqei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhapkbgi.dll"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Behbag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpijnqkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkoqfnpl.dll"	Jeklag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghilmi32.dll"	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klohppck.dll"	Chmeobkq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohfjnoma.dll"	Ickchq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipbdmaah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnjlpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjdlbifk.dll"	Jcgbco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjjplc32.dll"	Kboljk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Leihbeib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcfhgi32.dll"	Pabkdmpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gohibf32.dll"	Cklaknjd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibnccmbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jglkll32.dll"	Odednmpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jijjfldq.dll"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acocaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iicbehnq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llemdo32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 4492	4980	c4af60a36cde08f68fdff0fda778405de663db3d3e23097163d90df7aa637b88.exe	85
PID 4980 wrote to memory of 4492	4980	c4af60a36cde08f68fdff0fda778405de663db3d3e23097163d90df7aa637b88.exe	85
PID 4980 wrote to memory of 4492	4980	c4af60a36cde08f68fdff0fda778405de663db3d3e23097163d90df7aa637b88.exe	85
PID 4492 wrote to memory of 4960	4492	Lphfpbdi.exe	86
PID 4492 wrote to memory of 4960	4492	Lphfpbdi.exe	86
PID 4492 wrote to memory of 4960	4492	Lphfpbdi.exe	86
PID 4960 wrote to memory of 676	4960	Lgbnmm32.exe	87
PID 4960 wrote to memory of 676	4960	Lgbnmm32.exe	87
PID 4960 wrote to memory of 676	4960	Lgbnmm32.exe	87
PID 676 wrote to memory of 2752	676	Mjqjih32.exe	88
PID 676 wrote to memory of 2752	676	Mjqjih32.exe	88
PID 676 wrote to memory of 2752	676	Mjqjih32.exe	88
PID 2752 wrote to memory of 4796	2752	Mahbje32.exe	89
PID 2752 wrote to memory of 4796	2752	Mahbje32.exe	89
PID 2752 wrote to memory of 4796	2752	Mahbje32.exe	89
PID 4796 wrote to memory of 2412	4796	Mciobn32.exe	90
PID 4796 wrote to memory of 2412	4796	Mciobn32.exe	90
PID 4796 wrote to memory of 2412	4796	Mciobn32.exe	90
PID 2412 wrote to memory of 3928	2412	Mkpgck32.exe	91
PID 2412 wrote to memory of 3928	2412	Mkpgck32.exe	91
PID 2412 wrote to memory of 3928	2412	Mkpgck32.exe	91
PID 3928 wrote to memory of 856	3928	Mnocof32.exe	92
PID 3928 wrote to memory of 856	3928	Mnocof32.exe	92
PID 3928 wrote to memory of 856	3928	Mnocof32.exe	92
PID 856 wrote to memory of 3856	856	Mcklgm32.exe	93
PID 856 wrote to memory of 3856	856	Mcklgm32.exe	93
PID 856 wrote to memory of 3856	856	Mcklgm32.exe	93
PID 3856 wrote to memory of 4732	3856	Mkbchk32.exe	94
PID 3856 wrote to memory of 4732	3856	Mkbchk32.exe	94
PID 3856 wrote to memory of 4732	3856	Mkbchk32.exe	94
PID 4732 wrote to memory of 3092	4732	Mnapdf32.exe	95
PID 4732 wrote to memory of 3092	4732	Mnapdf32.exe	95
PID 4732 wrote to memory of 3092	4732	Mnapdf32.exe	95
PID 3092 wrote to memory of 2504	3092	Mpolqa32.exe	96
PID 3092 wrote to memory of 2504	3092	Mpolqa32.exe	96
PID 3092 wrote to memory of 2504	3092	Mpolqa32.exe	96
PID 2504 wrote to memory of 3116	2504	Mcnhmm32.exe	97
PID 2504 wrote to memory of 3116	2504	Mcnhmm32.exe	97
PID 2504 wrote to memory of 3116	2504	Mcnhmm32.exe	97
PID 3116 wrote to memory of 452	3116	Mkepnjng.exe	98
PID 3116 wrote to memory of 452	3116	Mkepnjng.exe	98
PID 3116 wrote to memory of 452	3116	Mkepnjng.exe	98
PID 452 wrote to memory of 4596	452	Mncmjfmk.exe	99
PID 452 wrote to memory of 4596	452	Mncmjfmk.exe	99
PID 452 wrote to memory of 4596	452	Mncmjfmk.exe	99
PID 4596 wrote to memory of 1324	4596	Mpaifalo.exe	100
PID 4596 wrote to memory of 1324	4596	Mpaifalo.exe	100
PID 4596 wrote to memory of 1324	4596	Mpaifalo.exe	100
PID 1324 wrote to memory of 1428	1324	Mcpebmkb.exe	101
PID 1324 wrote to memory of 1428	1324	Mcpebmkb.exe	101
PID 1324 wrote to memory of 1428	1324	Mcpebmkb.exe	101
PID 1428 wrote to memory of 2828	1428	Mkgmcjld.exe	102
PID 1428 wrote to memory of 2828	1428	Mkgmcjld.exe	102
PID 1428 wrote to memory of 2828	1428	Mkgmcjld.exe	102
PID 2828 wrote to memory of 4548	2828	Mnfipekh.exe	103
PID 2828 wrote to memory of 4548	2828	Mnfipekh.exe	103
PID 2828 wrote to memory of 4548	2828	Mnfipekh.exe	103
PID 4548 wrote to memory of 4592	4548	Mdpalp32.exe	104
PID 4548 wrote to memory of 4592	4548	Mdpalp32.exe	104
PID 4548 wrote to memory of 4592	4548	Mdpalp32.exe	104
PID 4592 wrote to memory of 3348	4592	Mcbahlip.exe	105
PID 4592 wrote to memory of 3348	4592	Mcbahlip.exe	105
PID 4592 wrote to memory of 3348	4592	Mcbahlip.exe	105
PID 3348 wrote to memory of 1836	3348	Nkjjij32.exe	106

C:\Users\Admin\AppData\Local\Temp\c4af60a36cde08f68fdff0fda778405de663db3d3e23097163d90df7aa637b88.exe
"C:\Users\Admin\AppData\Local\Temp\c4af60a36cde08f68fdff0fda778405de663db3d3e23097163d90df7aa637b88.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\Lphfpbdi.exe
  C:\Windows\system32\Lphfpbdi.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\SysWOW64\Lgbnmm32.exe
    C:\Windows\system32\Lgbnmm32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\Windows\SysWOW64\Mjqjih32.exe
      C:\Windows\system32\Mjqjih32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:676
    - - C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2752
      - C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:856
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3092
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1428
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3348
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        23⤵
        Executes dropped EXE
        
        PID:1836
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        24⤵
        Executes dropped EXE
        
        PID:2500
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        25⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4264
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        27⤵
        Executes dropped EXE
        
        PID:4744
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        28⤵
        Executes dropped EXE
        
        PID:1212
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:328
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        30⤵
        Executes dropped EXE
        
        PID:3756
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        31⤵
        Executes dropped EXE
        
        PID:4376
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        32⤵
        Executes dropped EXE
        
        PID:3888
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        33⤵
        Executes dropped EXE
        
        PID:920
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        34⤵
        Executes dropped EXE
        
        PID:4676
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        35⤵
        Executes dropped EXE
        
        PID:2296
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        36⤵
        Executes dropped EXE
        
        PID:3432
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4276
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        38⤵
        Executes dropped EXE
        
        PID:3412
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3328
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        40⤵
        Executes dropped EXE
        
        PID:4828
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        41⤵
        Executes dropped EXE
        
        PID:2884
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4748
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        43⤵
        Executes dropped EXE
        
        PID:4488
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4940
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        45⤵
        Executes dropped EXE
        
        PID:2740
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4332
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        47⤵
        Executes dropped EXE
        
        PID:2032
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        48⤵
        Executes dropped EXE
        
        PID:4088
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        49⤵
        Executes dropped EXE
        
        PID:3984
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        50⤵
        Executes dropped EXE
        
        PID:2448
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4772
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        52⤵
        Executes dropped EXE
        
        PID:1376
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        53⤵
        Executes dropped EXE
        
        PID:4908
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        54⤵
        Executes dropped EXE
        
        PID:4524
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3380
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1932
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        57⤵
        Executes dropped EXE
        
        PID:3820
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        58⤵
        Executes dropped EXE
        
        PID:3640
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2096
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        60⤵
        Executes dropped EXE
        
        PID:1676
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4380
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4204
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1904
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3320
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        65⤵
        Executes dropped EXE
        
        PID:3472
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        66⤵
        Modifies registry class
        
        PID:3356
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        67⤵
        Modifies registry class
        
        PID:4284
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        68⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        69⤵
        
        PID:208
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2304
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        71⤵
        Drops file in System32 directory
        
        PID:2168
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        72⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        73⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        74⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3052
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1244
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        76⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        77⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        78⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        79⤵
        Modifies registry class
        
        PID:5092
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        80⤵
        Drops file in System32 directory
        
        PID:2996
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        81⤵
        Drops file in System32 directory
        
        PID:436
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        82⤵
        Drops file in System32 directory
        
        PID:3304
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        83⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        84⤵
        Modifies registry class
        
        PID:2980
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        85⤵
        Modifies registry class
        
        PID:4520
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        86⤵
        
        PID:544
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        87⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        88⤵
        Drops file in System32 directory
        
        PID:3660
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        89⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        90⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        91⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3144
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        92⤵
        Modifies registry class
        
        PID:2160
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        93⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        94⤵
        Drops file in System32 directory
        
        PID:2904
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        95⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        96⤵
        
        PID:1136
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        97⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        98⤵
        Modifies registry class
        
        PID:744
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        99⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        100⤵
        Modifies registry class
        
        PID:3972
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        101⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        102⤵
        Modifies registry class
        
        PID:3960
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        103⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        104⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:552
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        106⤵
        Modifies registry class
        
        PID:4560
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        107⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        108⤵
        
        PID:608
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        109⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        110⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5212
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        112⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        113⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        114⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        115⤵
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        116⤵
        Drops file in System32 directory
        
        PID:5440
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5484
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        118⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        119⤵
        Drops file in System32 directory
        
        PID:5572
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        120⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        121⤵
        Drops file in System32 directory
        
        PID:5652
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        122⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        123⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        124⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        125⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        126⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        127⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        128⤵
        Drops file in System32 directory
        
        PID:5972
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        129⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        130⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        131⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        132⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        133⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        134⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        135⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        136⤵
        Modifies registry class
        
        PID:5332
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        137⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        138⤵
        Drops file in System32 directory
        
        PID:5464
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5512
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        140⤵
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        141⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        142⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5816
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        144⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        145⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6068
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        147⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        148⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        149⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        150⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        151⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        152⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        153⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        154⤵
        Drops file in System32 directory
        
        PID:5824
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        155⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        156⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        157⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        158⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5472
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5660
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5844
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        163⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        164⤵
        Modifies registry class
        
        PID:5324
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        165⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        166⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        167⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        168⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        169⤵
        Drops file in System32 directory
        
        PID:6000
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        170⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        171⤵
        Drops file in System32 directory
        
        PID:5180
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        172⤵
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        173⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        174⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        175⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        176⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        177⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6344
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        179⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        180⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        181⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6504
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        183⤵
        Modifies registry class
        
        PID:6548
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6584
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        185⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        187⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        188⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        189⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        190⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        191⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        192⤵
        Drops file in System32 directory
        
        PID:6920
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        193⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        194⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        195⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        196⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        197⤵
        Drops file in System32 directory
        
        PID:7136
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        198⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        199⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        200⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        201⤵
        Drops file in System32 directory
        
        PID:6392
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        202⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        203⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        204⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6612
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6688
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        207⤵
        Drops file in System32 directory
        
        PID:6756
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        208⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        209⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        210⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        211⤵
        Modifies registry class
        
        PID:7028
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        212⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6156
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        214⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        215⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        216⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        217⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        218⤵
        Modifies registry class
        
        PID:6732
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        219⤵
        Modifies registry class
        
        PID:6816
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        220⤵
        Modifies registry class
        
        PID:6928
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        221⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        222⤵
        Modifies registry class
        
        PID:7128
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6272
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        224⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6680
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        226⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6992
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        228⤵
        Modifies registry class
        
        PID:6204
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        229⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        230⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        231⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        232⤵
        Drops file in System32 directory
        
        PID:6452
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        233⤵
        Modifies registry class
        
        PID:6876
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        234⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6356
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        236⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7216
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        238⤵
        Modifies registry class
        
        PID:7252
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        239⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        240⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        241⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7424
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        243⤵
        Drops file in System32 directory
        
        PID:7460
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        244⤵
        Modifies registry class
        
        PID:7504
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        245⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        246⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7632
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        248⤵
        Drops file in System32 directory
        
        PID:7676
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7720
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        250⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7804
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        252⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        253⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        254⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        255⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        256⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        257⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        258⤵
        Drops file in System32 directory
        
        PID:8104
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        259⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        260⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        261⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7292
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        263⤵
        Modifies registry class
        
        PID:7336
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        264⤵
        Modifies registry class
        
        PID:7408
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        265⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        266⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        267⤵
        Drops file in System32 directory
        
        PID:7640
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        268⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        269⤵
        Modifies registry class
        
        PID:7772
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        270⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        271⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        272⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8036
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        274⤵
        Drops file in System32 directory
        
        PID:8128
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        275⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7248
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7392
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        278⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        279⤵
        Modifies registry class
        
        PID:7576
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        280⤵
        Drops file in System32 directory
        
        PID:7708
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        281⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        282⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8068
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        284⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7240
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7420
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7528
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        288⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        289⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        290⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        291⤵
        Drops file in System32 directory
        
        PID:7200
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        292⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        293⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7324
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        295⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        296⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        297⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7468
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        299⤵
        Drops file in System32 directory
        
        PID:8092
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        300⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        301⤵
        Drops file in System32 directory
        
        PID:8276
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        302⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        303⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        304⤵
        Drops file in System32 directory
        
        PID:8404
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8456
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        306⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        307⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        308⤵
        Modifies registry class
        
        PID:8600
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8648
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        310⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        311⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        312⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        313⤵
        Modifies registry class
        
        PID:8812
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        314⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8900
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        316⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        317⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        318⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        319⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        320⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        321⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        322⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        323⤵
        Modifies registry class
        
        PID:8168
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8272
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        325⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        326⤵
        Drops file in System32 directory
        
        PID:8396
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        327⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        328⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        329⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        330⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8752
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        332⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        333⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        334⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        335⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9084
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9156
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        338⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        339⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8376
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        341⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        342⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        343⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        344⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8936
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        346⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        347⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        348⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        349⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        350⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8696
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        352⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        353⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        354⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        355⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        356⤵
        Drops file in System32 directory
        
        PID:8632
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        357⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        358⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        359⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        360⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        361⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        362⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        363⤵
        Modifies registry class
        
        PID:9140
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        364⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        365⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        366⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        367⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        368⤵
        Modifies registry class
        
        PID:9428
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        369⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        370⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        371⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9552
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        372⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        373⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        374⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        375⤵
        Modifies registry class
        
        PID:9716
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9756
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        377⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        378⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        379⤵
        Drops file in System32 directory
        
        PID:9876
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        380⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        381⤵
        Drops file in System32 directory
        
        PID:9960
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        382⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        383⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        384⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        385⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        386⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        387⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9236
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        389⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        390⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        391⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        392⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        393⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9640
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        395⤵
        Modifies registry class
        
        PID:9708
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        396⤵
        Modifies registry class
        
        PID:9804
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        397⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        398⤵
        Modifies registry class
        
        PID:9920
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9988
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10064
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        401⤵
        Drops file in System32 directory
        
        PID:10148
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        402⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        403⤵
        Drops file in System32 directory
        
        PID:8588
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4692
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        405⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9424
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        406⤵
        Drops file in System32 directory
        
        PID:9580
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        407⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        408⤵
        Drops file in System32 directory
        
        PID:9784
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        409⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        410⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9980
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        411⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        412⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        413⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9276
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        414⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        415⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        416⤵
        Drops file in System32 directory
        
        PID:9824
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        417⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        418⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        419⤵
        Modifies registry class
        
        PID:9488
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        420⤵
        Drops file in System32 directory
        
        PID:9968
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        421⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        422⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        423⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        424⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        425⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        426⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        427⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        428⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        429⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        430⤵
        Drops file in System32 directory
        
        PID:10336
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        431⤵
        Drops file in System32 directory
        
        PID:10376
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        432⤵
        Modifies registry class
        
        PID:10420
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        433⤵
        Modifies registry class
        
        PID:10464
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        434⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        435⤵
        Modifies registry class
        
        PID:10540
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        436⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        437⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10628 -s 396
        438⤵
        Program crash
        
        PID:10792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 10628 -ip 10628
1⤵
PID:10704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acmflf32.exe

Filesize
45KB

MD5
c5342477b9381cc8aee6e09c6cc6a690

SHA1
28ba1be8db271f50d4c9fffd829fab00a33f87a6

SHA256
421d51ea03b8dc2844fcfb700ff51827349616361e65d1b9b16d5c9668c6e805

SHA512
b3509cbf66e677d7b7f37e31c702d0e7eaef92903778b3b69a7fba80f5528faf88092f434d82f7a299686d9308ded8cd478af57f7641f1e4e8bd067cf40c7dbe

Download Submit
C:\Windows\SysWOW64\Ahmlgd32.exe

Filesize
45KB

MD5
d344469ca55793e73c5281e5be52ca19

SHA1
13ab0f90bd8311e32288b6c61186c6d9f46532c4

SHA256
0942bcd07b43d446757464e19a6ffee38477948a80fe41add4f254f075f7ce0a

SHA512
a4334885b169ccc34567600d437b68c8b17c118e2866da7792acf59f5892b6b1cedc6763cd1cfbd7f42ceef915f0d5d39983e68cec7629ee51ad16cc02510c71

Download Submit
C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
45KB

MD5
b77c98f18ce2d992110a8c3a9a62e6f1

SHA1
de5910a00c6c47bccd1a9da1504d3001a7003b77

SHA256
c5b1895561d44488f3493804cb7a89d77946d5f2a27ebcdc5969e4af86cd79ca

SHA512
45c88765a1e92ae741298deae78b39a644654053438e482eb32a6d63225c0989cb22e577601448ef2f8cd6447c54043bb3828980a711380eaacf34f0bf7f0b20

Download Submit
C:\Windows\SysWOW64\Dfnjafap.exe

Filesize
45KB

MD5
0efb4bce407e6ba03c582116fe83783f

SHA1
0a9c37659729252a96d79c37c4d14aed180ddf4c

SHA256
9754b16c70e72ba8660158f99067653c9cf5d4c2d8ebed8dae4421f5e28c1c32

SHA512
0ba4084812d2f5eb2665b0d906c5e8bcfdfa303aac5b32d6a07bfdf5d096fd9504555d152cbfe9cb0099f6d81617830e1fac56578fe06cce55dfe621d7a2cb68

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
45KB

MD5
55c5d6727c8ae49e1d0f8aac3ae01403

SHA1
9c1d28c481a2bbccb57a0510d5ddeb8ae14fbe3c

SHA256
bfa265b25a14d1b1ed5e557ace0f49ff3e5d1403ac7df488d7cedfb6e54d136d

SHA512
3cbd68a5617bcbf850c29da4d75e967a9ee2551b1140c67ddeb7444e817fd0a83a91a1a2826f7c32eebb82d4fb99d4ec407dc91c356dfd6cbfd6dd625373ff2d

Download Submit
C:\Windows\SysWOW64\Fbpnkama.exe

Filesize
45KB

MD5
bdb03e5ac4be7a2b90ae85a93a6d59a4

SHA1
4fbdddbdec33f9acded147da3a0dda34c65f8473

SHA256
03c52218ceec718f10749f371cdf4f4162acc2976caa87705fc338c34f092e04

SHA512
025832f07239bc79068972247d7b1dcba58912a42db12402ccf7cd7768ab9c9b31568e75fceb872f6daff068ee5f69bdc779e9aef30fe0f1bbf56b0583e0c02f

Download Submit
C:\Windows\SysWOW64\Gblngpbd.exe

Filesize
45KB

MD5
1b80fa0e8822a86253aef00e59939b1d

SHA1
2c54a147d6b9dac0a01e4062c5523fbea0463ead

SHA256
fabd9ccbd9222f1403c5abfd1265ca3dea94635814fc74e4da644cdddd433f0a

SHA512
9031cd7c7e70004d3508892991e47e2ef94c813ad93bc5e1efca396ead90a79bc9b871b95ecfcf4cd89cef6ec3a8187afe54c7187e546fb4264f24a579bfbef8

Download Submit
C:\Windows\SysWOW64\Gdeqhl32.exe

Filesize
45KB

MD5
0ed3d16aafecc4b1e98fdc1fb4607401

SHA1
be089b84e6f4bbfee90e0866a3f20ae2ad35e119

SHA256
a4410bca7101510c787a6fcc00ad878a52f04400aeae882031d3c9f015852c42

SHA512
4af92d1b4f0b3c6750096e50c202d32c987c17a7c521f79bf1aece9b9ecc1dd92ff9aa1dc34fb937d9737fa6c41aed303f35dfad357b7e88f9e4596140cff6f2

Download Submit
C:\Windows\SysWOW64\Glhonj32.exe

Filesize
45KB

MD5
c7eb028a24e23e853c64e1fa1d844a08

SHA1
49c638786c5483113e6b1fbbd0d63c193e120f9c

SHA256
e9cfacc147f54f39e18cd376e785c1fddafbacddde83eb941587b4819f1eb05e

SHA512
cfd4ed0dd17e87296fe19bc76eaa72c669102159fc114b7c36c782035a7d400a2708aeba135bddf16f6b1d6fdb04da065d43c37c43193a4ecfa07dae5dfa73d5

Download Submit
C:\Windows\SysWOW64\Hbgmcnhf.exe

Filesize
45KB

MD5
747534a9b6e64e6950fe870f34c07591

SHA1
525f93ec5c0cb0a810148b9b21c7a997f65b76f7

SHA256
a3e35dfe3ad9d1992b9913357245f4eea6510d61c3a4c3ac71bcd5613ff65479

SHA512
98d8d181754388f03e8d0c3930ad8ab78f7dcb6f88b02b2c79c190a01981913665151b6517d82f51738afdcde27a9ac6c814269ec9137a0b190ed995427dc484

Download Submit
C:\Windows\SysWOW64\Klqcioba.exe

Filesize
45KB

MD5
30959179ae3c6ec5adaa1fa367ff08b6

SHA1
3ad313b275c40dfe784b0266fea883ca01ca913b

SHA256
4175daaaf01a55ea2f1bb8c80efd2c6a5fa827b317ae9dbbf4767982462e141c

SHA512
7c8e4a1ebcdc05a213f27e5d51669af1e52562949ec9cf5609d07341f29a0155939db8d7088e641e949e67ddb3d65ca1033a1d22612991553d931b5294030d2c

Download Submit
C:\Windows\SysWOW64\Lgbnmm32.exe

Filesize
45KB

MD5
50e540e54a928641febf981fc77f524a

SHA1
0390a6f00f88fcd62b423757a8fddbc3a8448636

SHA256
e303f4c94d32d52f0d19511d9219e9c579492119bc10ade1e538f3ba9f083ecc

SHA512
81308582e9b15c47dc4016f4e5aee8e771036dbaa03e53a065fcb2eba6638b246ccf3b76271119ba4823eb97102665367534db5f6285bfdffdfd4f806035a98e

Download Submit
C:\Windows\SysWOW64\Llgjjnlj.exe

Filesize
45KB

MD5
c38c74767c568381cdec138ffa41c480

SHA1
1d46a1c16657059ca02c680a039412781a12b00f

SHA256
1149f44e4d74c689764b5ea86bc390270b3a90bb8bc2297a4141fc3d90579a80

SHA512
fae96ed5b3bde2a495b6b6aed40cd024251d18988c44ee66d0ffe398ec3778e3a8521003739d6535990809454d6b3c6ebb0f22940cc72cf3d5fde7831107ad73

Download Submit
C:\Windows\SysWOW64\Lpebpm32.exe

Filesize
45KB

MD5
d6d89fef1a991af39a1b02857ebf1c13

SHA1
6f2340d40ea42564869947f1632564412d6033cb

SHA256
bce2f3f1d6cc450ea493a7e71bdaee4eab0769af1a15f5f4da480ef509f2a11e

SHA512
8a7708d0f9d35c5355f3c6f4bfff47ad638a219883649a5fd94956dbf690190c392a1cd3521019119ec1aa4b9ab29cc492848471c958f6288fda54aaf714a7fa

Download Submit
C:\Windows\SysWOW64\Lphfpbdi.exe

Filesize
45KB

MD5
1fe48792d71dbf2e4ca3e9c845bfe3ad

SHA1
611ce36db8753232ca3509c553dc937301732aac

SHA256
caf87832cd73417c9c2a5f4261423e543716942bc301a2db1430fbf682d4796d

SHA512
6de39e33b761be8d19a55b285ff8a397917846ef421d3fb295fc5a69be9cda7c35c4c0e7cd527263226a2e532b32135323f4643487123940ea54996745c070ab

Download Submit
C:\Windows\SysWOW64\Mahbje32.exe

Filesize
45KB

MD5
55242268aac830d85c852f247173927b

SHA1
87c667fe6315cde5d8d4fb7d4c232d320ed35e51

SHA256
00de9af4cc57337b2b1a1e46d43ee9bc336bbf53818aae105e06acc36e1a8dbb

SHA512
b39e32a44174fb4f408baa654dc44b41d603c1638859f26f7ad5f92cd1ad79fb760df0a1942a761070c4064830810c85182e4a21b47150df1c41878b4ed1c6bd

Download Submit
C:\Windows\SysWOW64\Mcbahlip.exe

Filesize
45KB

MD5
b40036afa9d5bd97c9e3b0dff74b12f9

SHA1
f5fa59000de2ec643cbdedca6399fa3ff2c66629

SHA256
a65e20cfd523374331f0ee54743b8f66f1a30abcc5ef2694811821629ae37ca5

SHA512
8de25f48a954630317e503f91a06c12dc5bcd13d94564cbd6a903d7cc242db9df708f886cbfac7937085daf56c8cb2c595fb70974c54a810174dfa2634e0d849

Download Submit
C:\Windows\SysWOW64\Mciobn32.exe

Filesize
45KB

MD5
dd36b646bad7540e5fb2fed5d27c9fe3

SHA1
f86bce281106efbafcc6753754a2867459d49b2a

SHA256
2f464ae2eeecf898eaf228a2cb6e6093f7a64e9849efec4398a3e2f06a3884b9

SHA512
f8877d524a5a228dcc3583f933b51ed62d9edbe5f9082849a6e847c8a0dd4befc31857e14065b52361c6d0dcab2ddeeb31d813eda393d3e575d303f18798080a

Download Submit
C:\Windows\SysWOW64\Mcklgm32.exe

Filesize
45KB

MD5
d10a639a3a6212ddea5825eec683243b

SHA1
d2082a005665bc8351362a21b2743c156c99c900

SHA256
24f9101db518cabd0335ed2126fa5c0b50e1ece1b83ead7c7bc8df2b88e1ce35

SHA512
e1fadab64bbbe063b9c0e1302217552cacfbe5587c541f907a3308855b9ab7fc2375ece188efbb4dfe72d2c0185527717c7d130c8994022ed6a84a7b767f975d

Download Submit
C:\Windows\SysWOW64\Mcnhmm32.exe

Filesize
45KB

MD5
31c760cef8b772db41e2766c82845607

SHA1
174fb939c0d9d78215b56cfee16d8af029d004fc

SHA256
ecf908f0fb62a6b8ef3e5ffc4491c1d58d6a12a80fd54207db77efe8b9515ea0

SHA512
5c33a87a5d11597aac7e55a3c5b9cc5cb6bde21494e3a3ab6afadd27595208e9530ec7480a137e4ce8d143d07b8301b5bc55589c91d93f1a82f3bf917200cf87

Download Submit
C:\Windows\SysWOW64\Mcpebmkb.exe

Filesize
45KB

MD5
57e836a0bb8ace16cecad2e8f5ae356b

SHA1
6c5cdc136e5c420956bbb7a2b507059c0bd6e35d

SHA256
aa0cd2ae67a261140779c8219f78a61cb5ef38463510719c8fa0a0058cc5ee54

SHA512
7ac881669a4eaa992d471b147c0edbafdc8a196ae2e7efb73f3f355a2c3af96f1a85daf37a67cfa91261d08d863b8a1dfd42d3c2b216f6618990736048d563e7

Download Submit
C:\Windows\SysWOW64\Mdpalp32.exe

Filesize
45KB

MD5
5224b01031f627b0ad4f71459e223bf6

SHA1
f0825e08452cb804ea3a3be64cc741e6828e899d

SHA256
68f5bb320b021404463d89701dde3991424528fad4849546918893c53c073217

SHA512
558225f02b27612cee0d79db605dab17adc2ec86160c615eaa864b966590ed8c9bc8a9b34bd286a5df6619059638e265118263f124674ee4b4aacfaa768900cb

Download Submit
C:\Windows\SysWOW64\Mjqjih32.exe

Filesize
45KB

MD5
9d061f57ba0273cdc2a4af8b6b4cacf7

SHA1
25764cf227a2b3205695dd8c19e54845b8208b77

SHA256
a0ab21a55e58fdd57d143dac49898f1fd07c4a97801a89b9cbb7555bf00786c5

SHA512
96ede03acef703860689c68e7b77c95c365306a5172d33ea1e8bec388b8411ec457c37550648bad99166d192e3bb2c294da69f46490ca39ccb211c47817340d3

Download Submit
C:\Windows\SysWOW64\Mkbchk32.exe

Filesize
45KB

MD5
f9be4ea356796525acf5c862b5f8accd

SHA1
6f84cd0009dffa04aace68bfd5d37586693cfecd

SHA256
92a5566ec73e56f12972cefe9aee3cc9d4f0b77aa20054d766acc03ea8367461

SHA512
faa99a3a053d817efe9db2d49f5df33c63f85265d006434753e3e88853c38efa8c480b47f3963216f9a25122097b28529689e105ddfe6488ba60cbc32385b875

Download Submit
C:\Windows\SysWOW64\Mkepnjng.exe

Filesize
45KB

MD5
cf3be342c594226254932c830726cfff

SHA1
35c44a341b926b997c78796c45aaa41d57a9daec

SHA256
58d00d5ae2327e0a6ca35c8a40d2c64f2545a886b9579793eb7f0e8ae9b9e950

SHA512
67a2454d704d8cac8b153e1720ce6c4189332beb71583d0c3a39047d148ccaf91bcc0838fff4ab1845e959a511c86c2f3c2f608c7191d482644c0da64464e38c

Download Submit
C:\Windows\SysWOW64\Mkgmcjld.exe

Filesize
45KB

MD5
914d7cca907e84aad00d2a1459fd9ea2

SHA1
d10ca1df75885420f83f2f0937e04c9b6a62ac67

SHA256
7b94b65d71718d532709e8c23c9f142f5d0c4f6467c79c013b66ac248aea4945

SHA512
9b5248db747c4773525b6825db4e4c85e8f366e0c0f8165a59a1aa1a6e731f19bcda8efff0049ad5a6c8b34232777efd5d339300c4c8c4ecc0cb4752fcbe1c5d

Download Submit
C:\Windows\SysWOW64\Mkpgck32.exe

Filesize
45KB

MD5
59c6470e81c38d336408a2e6382becc6

SHA1
7f8b378b3ee9dea038ff4842655738c6e6905f01

SHA256
927960cc3945e8945084fcdb9fe1b1f4575210e7d90ed14ef56235ecbd921cb2

SHA512
c1190ff70805c14d6b8094cf4bff78b070ff32e9c8b6173eedaa2656aabbf1238bab2ff34b3414e8054a4b844487fc4dec09475cf8bbf066abb5ecfb118c370e

Download Submit
C:\Windows\SysWOW64\Mnapdf32.exe

Filesize
45KB

MD5
586fdf5727b811d9775551984012e40e

SHA1
91307e948e0abab090715252a682ed60ff06e9cd

SHA256
007ab3574018d794ffc45a71e3a9ef9bd59be0f74e546b33e554feed35d01a51

SHA512
9166b708be7e7010ca9548d338dd619df5784eb5c9d480ce9c84f934c6e2244debe0449347997146b2cda7427e12d9d72d45446d49bc380c00fec791f2cf7945

Download Submit
C:\Windows\SysWOW64\Mncmjfmk.exe

Filesize
45KB

MD5
ad25a7fcb21048ee574873618295b1ca

SHA1
dec5c56c4b023481b73bce8235e305e3b8ea5126

SHA256
9e96c9858d8befd4d1d343f82ba7492dfefea8b9f0966fdf73e3d12c216e8d33

SHA512
e1a95dd063cab074f6c65005edb4dbfef4ebf3f1dd5af82559cad4e8f528d3c1098b5d76f6291c322c1c52863305cfa8c7454fb79125fe679637ca2771b0a3b9

Download Submit
C:\Windows\SysWOW64\Mnfipekh.exe

Filesize
45KB

MD5
3da01d1d79da3ba658fed39466a4ee57

SHA1
c1ef8147266ffe17e0975005f80d6a4d0f02697c

SHA256
aaee86ca1d4052c6fee6e1f6d9cae381d3b5833e504709dbae2d768cce062d1e

SHA512
93123dfe0a0855a6ccf268a457d396649a0f80569cd209fe8c7f81a3997a8eb7287bfdd656237a12b4bb8d3422bfb6a82d331c44c4415cb9fcc1c7ac174c4e52

Download Submit
C:\Windows\SysWOW64\Mnocof32.exe

Filesize
45KB

MD5
a171b2ce6692451e49a930ac10ce3677

SHA1
af38c831f77556f68f845bd16b8081f5b64941d7

SHA256
2724bb7563150d9406a50b90197a6d7b091665825204102190bffec7df52a7ee

SHA512
d39df2d2be6a2aeca3c255025349fb7ad6590bbe74c5fdd0af2fb4257b6ef557002612e66fa724bb80a8e04f3c9f35a9f2ad3178804625b1cfae328bc481fcd9

Download Submit
C:\Windows\SysWOW64\Mpaifalo.exe

Filesize
45KB

MD5
6e21a0cca6ac2f17e0d6c7866fa4b9a3

SHA1
6a91d98f7f7750a7d58e0c9f58c41d4e697e8aa9

SHA256
6a951e4de965f89ecde565dcc28fc0cf681c6c8d1d137174b8223c85d8accb99

SHA512
fd6a8100eecab2bb3436be22c8e9976836773d10fef4c4c1adc9b34e32dd68d64b5b332136be1034c79895d2a1559458ba37536e032d278921e1c73ccdfd6c3f

Download Submit
C:\Windows\SysWOW64\Mpolqa32.exe

Filesize
45KB

MD5
c77c11c4150ebb20d2ee7e3daffe0385

SHA1
47a398e85bfd851b7c299afede8a0674123e6fbf

SHA256
25df72059f81e117935c8ac72f6b5dbee77513a49e0cadc27378f76240042284

SHA512
d268930e7576ee9900f64668d7c737ebb96a7a04325d3b9d0f87559ec8524075eaf40223acb983b81191ac67654704848bab7253369d5cf290aac8955da6a2d7

Download Submit
C:\Windows\SysWOW64\Nbhkac32.exe

Filesize
45KB

MD5
203fc4b9be06d1e8f6d7d76166dfbefe

SHA1
ccfdbc556b344a16b4b5de3bfb953f02f3379f28

SHA256
acdd5e62c32efeeb64de8bad66110f2ca965fab6a90566d2110e2f202dfe9065

SHA512
4e4dadbcc832ebf4506d1e21697647904cb981d4bfc25aec4618a6f8f0f3edf8ebc270c8edc2d4e69dd601b24d674d79843b8478ff8dbf7bfdca56a0adf61fc0

Download Submit
C:\Windows\SysWOW64\Nbkhfc32.exe

Filesize
45KB

MD5
01c1c6eb3c9a4346e9923b51a695095f

SHA1
dbaf3a84d37958d5f39a411070f183b9197c1ff3

SHA256
e2bb2d7f162504f288dd7fe372bdbfd3bf6f4d40053a02464406d73c77697302

SHA512
ce41d579d07f31490a3241066ad6704acd5cda7c8cc069be9a532454b0a6964c4c7b6c225006bba52b8bf85c05bacd05075ed38e79452dba11f19e282eeb46ca

Download Submit
C:\Windows\SysWOW64\Nbmelbid.exe

Filesize
45KB

MD5
4fb5ff499cbc18156be428ae4bfdfa58

SHA1
2a900e737daa5d6497b1763d688286b25eaaa7e4

SHA256
bbddb23313ac6a9b9133c96e7c8c36830c3d9735af5387be6b3f808e530bc8b0

SHA512
24d3425a1767786764e3504d5099be94e7f047eedae0bc1302c13441327a24f14662b04e4ed21b6e98d78751b9c3322c56342f13038a800c5f85529b13c7538b

Download Submit
C:\Windows\SysWOW64\Ncgkcl32.exe

Filesize
45KB

MD5
f7fd7755679ab5d69a8f5055c1b7d9f3

SHA1
0f69f1ba382ae2aba572880a9ede6b7f3a26ab0b

SHA256
9fb4e2e098dc38602919fce8210b8e31f718dd3d541087f843f643528da78ad5

SHA512
b5e0804b6c82c08f4fd18f5749b0b148220431e0ab70822d6eb3f1ea5779a1453cf963fd00cd987f020b708cd1970a77c3150189885776420d3d2c42611c6282

Download Submit
C:\Windows\SysWOW64\Ncnadk32.exe

Filesize
45KB

MD5
afe059bc1f8f79e3bdfb4e4d91bba35c

SHA1
b9ef778ebd59499553b4b65aa165158fb3322404

SHA256
19826faaaf7f24abf2d7c84dfa4362a6d5f201e013e3958dcbb2728575a67bd4

SHA512
436794995d44183423c52e8c33bee5116e9db342922237a110a9ecbae287538a52841c3fddfc89125964c6c4e1621bb87ba7d9f889ddbb49cbd00ce581d8312c

Download Submit
C:\Windows\SysWOW64\Ndghmo32.exe

Filesize
45KB

MD5
7b6ce6d4c716dba033260239cc8b6393

SHA1
42a910f7be6ad35821b4cf2ad7dd775965c2afe7

SHA256
3991793b6a30abcfbae64a1c55ba77364405c286ca9840ea03d3ae35a1ebf8f6

SHA512
b2cb4af4ac4a52ab9d856fe11ed37c46518439e02f1e41ff11043541938524280a84bb9f69bc60c86a4ad4a787530c926a86dde76aab5dbc16fdebb2774c375f

Download Submit
C:\Windows\SysWOW64\Ndidbn32.exe

Filesize
45KB

MD5
a5feaaa5718179769cc17d0d69069181

SHA1
a746f29a77c95975cb10ee8f7d3eb4c30708de35

SHA256
0cfa400a52b9cdf682d16518ea4de2294c020a2e36185de38704703625838a15

SHA512
583dc109d628beee077a602caf9e2517bc018499874e07869392498208dbfb7cbf2ff740966a3ff288c97605046769b279a0425e93dbbeb9574ac19fba92c5b5

Download Submit
C:\Windows\SysWOW64\Ngedij32.exe

Filesize
45KB

MD5
ce2024b1ee4dc2839d913e319e7bd801

SHA1
4631d49e70b6b70874e204935d9bc2ca969ca77c

SHA256
69663b01aafc38a1f280ecb5ad50982752c226f60f07ef880697cb86bcb0d3f9

SHA512
e9a7584169a0cc713dd36d3249c1bb423563fe31d679a5210d19489f462655da9579afb5f9eb4547d35a6eeabf6861553890fc8a4dc39a32c0f323484ae7914f

Download Submit
C:\Windows\SysWOW64\Nkjjij32.exe

Filesize
45KB

MD5
346a0d6a195b0807f692155bf204159c

SHA1
aa7f6bff73ef552a3b56b83911f289d5ca07683e

SHA256
9256e7059c9f91dbd173d09086395fb3815f8911bc6abb0aeda53160813f1d84

SHA512
c027b7e1c87f769874c1a527f9fe047bf2997ca3e665eee788556821b80b1fbb4a603b8c71dbac7f912943d68832f14fb4595eb8c2a534ce40aff929754c82ad

Download Submit
C:\Windows\SysWOW64\Nnjbke32.exe

Filesize
45KB

MD5
27e948cd69fc0d4594d1921d077183d9

SHA1
a3106e48fa3320051050f32ee79a72de963dcac4

SHA256
bc9c57fa5ef9e0fd90420e8d1cbb23dbf0f9be467bce98be40f4f352448ce27e

SHA512
a5068d89be2c7de833926ca2e8f9754c44b89510673ddce3e88506dc41e9f269bc9a5394e2cebabb279d7602a353a3db6b320db3afca9066d7bda465436fa658

Download Submit
C:\Windows\SysWOW64\Nqfbaq32.exe

Filesize
45KB

MD5
0016abf1d11e79eaffbadea4fdbbbbcd

SHA1
62ccd1864e70b95ac30c9762d6aba3ddd29d0d1a

SHA256
8375c931d2f6cdd14fc53904e1e5b09ea89be42e76b40fad2e3cf8534d769f3a

SHA512
e1fa2dd311f7e0fd477d740b8c2917b254ae6620031c6870cf9918934710f2c148d0228a34563beaf0e0912678c1d31f64d43e26f6dbdf0168a4e82d55aac70f

Download Submit
C:\Windows\SysWOW64\Ojhiqefo.exe

Filesize
45KB

MD5
e1b38a74799b3bb62e05192f6162b1af

SHA1
d82a7e839a80de34bb3b2a56ef7727327d5007cd

SHA256
4d44cd066eeb072539b49bb560d66dee775798f6e22588f0f1d1e805e569d1b5

SHA512
c21239b1ba012057cee0b2bf69fc48df5eda94aaae83f93e04a1f9f09f4e336fa4af36ece84c1f049a98af91e4bd295dc40138f5470215cea9aee4b6cc87f1aa

Download Submit
C:\Windows\SysWOW64\Oqdoboli.exe

Filesize
45KB

MD5
7ccf939760ff21252df51d3148847df4

SHA1
77e56a1eaf86d944b935d576bcdc2962d4a8c365

SHA256
ad60cba7397c29faf06bb93206d43558c2bdb818fdf2b13bbe9db7c666080312

SHA512
7b520892733bf8bbd183cd873fb6829008d81644a081b00867a17ce14e8e7841fceb68e1c43716146a28713d5998146264baafb1b2797900ad68bbac2fd58d4c

Download Submit
C:\Windows\SysWOW64\Pcbmka32.exe

Filesize
45KB

MD5
750a01b8de599e81fc539b2a49ca68f6

SHA1
2475bdabbe482f2053a83fe4c0afa8962c6f9695

SHA256
8a68ccc1d2a52aefb70e86a5e8ed71cb520a5126e1b2df9aec6c8027f2271407

SHA512
e0d0d7109c0d886839b896663c348b96b1f19c6be5fa26f91993621b96960102cd2524eeafbd8e0bb49d8f043c10c1c8a2b86761b531a5484d008b73584cc9f2

Download Submit
C:\Windows\SysWOW64\Qcepkg32.exe

Filesize
45KB

MD5
6f89e950c1a3069ae2558167234571c1

SHA1
3035d3df795087a6d3a844e120fa2f223d7fafc8

SHA256
4899847a6a26a043989d967e6116251ac34890b82026c410eba2128e73cb656c

SHA512
adda965956634d4ecf38b7d79454c23a3845f7a0356be673b4d7a4c953e2ddfc894889b45ad9d8e5112144ba5623db003b79592da145a33b9194d0bf1f6328d8

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
45KB

MD5
74b257968a2cf23a3dec37889438910f

SHA1
4506cc9582d5f43b32269a147b20cf41b3eb56a9

SHA256
d046e87823c1b5e8bc92954a7a285e8ca6e5c0ded4e6d6836488795eacf026f3

SHA512
781fa1a9db00d330bc485d94fe7fe12d0c611c2a1c257ca84cf6bc5bf3f9c4de58a54f24a6ffe74f0b849462d3a455ce54b83caf65f19f15c5aeeb8ef98652df

Download Submit
memory/328-224-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/452-112-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/676-24-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/856-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/920-256-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1212-215-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1324-128-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1376-375-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1428-136-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1676-418-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1836-175-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1904-436-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1932-394-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2032-344-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2096-412-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2296-268-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2308-191-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2412-48-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2448-362-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2500-183-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2504-100-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2740-328-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2752-32-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2828-144-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2884-304-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3092-88-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3116-110-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3320-442-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3328-292-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3348-167-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3380-392-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3412-286-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3432-274-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3640-410-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3756-231-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3820-404-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3856-72-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3888-248-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3928-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3940-2915-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3984-352-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4064-2913-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4088-350-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4204-430-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4264-199-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4276-280-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4332-335-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4376-240-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4380-424-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4488-316-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4492-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4524-382-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4548-152-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4592-159-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4596-119-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4676-262-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4732-80-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4744-207-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4748-310-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4772-364-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4796-40-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4828-298-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4908-381-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4940-322-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4960-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4980-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9276-2925-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9280-2920-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9336-2917-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9412-2924-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9548-2916-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9564-2923-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9612-2931-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9764-2912-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9784-2930-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9868-2929-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9980-2928-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/10052-2921-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/10176-2926-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/10212-2914-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/10284-2909-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/10336-2908-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/10376-2907-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/10420-2906-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/10464-2905-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/10504-2904-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/10580-2902-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/10628-2901-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads