7377e0cadc0c3865a46367246df18f1251aacbd8c78f73dd15b6b553e372ed6d

Analysis

max time kernel
105s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7377e0cadc0c3865a46367246df18f1251aacbd8c78f73dd15b6b553e372ed6d.exe
Size

176KB
MD5

2054c731a1d21a532f82f4fa28b7cb4c
SHA1

3719583deef83a80831546d10e35c18fa551c5d9
SHA256

7377e0cadc0c3865a46367246df18f1251aacbd8c78f73dd15b6b553e372ed6d
SHA512

09c45ad7f15a4c8f062b245b18589e60c5e5de328f00856754b2ff6dd4ed0105a4d15e75d59e853a02063a757eee8b85eef05026f03c29e58f4a0b9cb26e0025
SSDEEP

3072:oK3evpwp2JaGPXuhuXGQmVDeCyqOGbo92ynnbVHvzIYVrLo:NexM2JBPXuapoaCPXbo92ynnZlVrU

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkmefd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkjlge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbgdlq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmppcbjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjhlml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbnafb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfpcgpae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbgdlq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hecmijim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqbamo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhgjblfq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ligqhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlednamo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqhacgdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bagflcje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aldomc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bejogg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kplpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gicinj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kemhff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhnnep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fchddejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofqpqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojhiqefo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkapp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aelcfilb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agglboim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjpaooda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpnchp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Menjdbgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjpaooda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhkapp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njefqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikbnacmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekcpbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iehfdi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofeilobp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdkcmdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkgqfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdiooblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocegdjij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obfhba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcckif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odmgcgbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgimcebb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anfmjhmd.exe

Executes dropped EXE 64 IoCs

pid	Process
3972	Nnhfee32.exe
3804	Ndbnboqb.exe
4528	Nklfoi32.exe
972	Nnjbke32.exe
3076	Nqiogp32.exe
316	Ncgkcl32.exe
224	Nkncdifl.exe
3584	Nbhkac32.exe
3948	Ncihikcg.exe
1212	Nnolfdcn.exe
2376	Nqmhbpba.exe
3500	Ndidbn32.exe
3148	Nggqoj32.exe
3352	Njfmke32.exe
4540	Nbmelbid.exe
1204	Ndkahnhh.exe
3712	Ogjmdigk.exe
5020	Okeieh32.exe
4652	Ojhiqefo.exe
556	Ondeac32.exe
3744	Oboaabga.exe
748	Oqbamo32.exe
4468	Odnnnnfe.exe
4432	Ocqnij32.exe
4840	Okhfjh32.exe
1892	Ojjffddl.exe
3032	Obangb32.exe
4580	Oqdoboli.exe
2520	Odpjcm32.exe
4280	Ogogoi32.exe
4984	Okjbpglo.exe
1624	Ocegdjij.exe
3976	Okloegjl.exe
3312	Obfhba32.exe
1964	Ogcpjhoq.exe
2196	Pbkamqmd.exe
4328	Pghieg32.exe
4956	Pbmncp32.exe
2264	Peljol32.exe
4572	Pgjfkg32.exe
3752	Pjhbgb32.exe
836	Pbpjhp32.exe
216	Pgmcqggf.exe
1656	Pnfkma32.exe
412	Pkjlge32.exe
3088	Pagdol32.exe
3612	Qgallfcq.exe
3764	Qnkdhpjn.exe
960	Qchmagie.exe
4640	Qbimoo32.exe
2876	Aegikj32.exe
1108	Alabgd32.exe
1088	Anpncp32.exe
4672	Aanjpk32.exe
4388	Acmflf32.exe
1900	Aldomc32.exe
1940	Abngjnmo.exe
5092	Aelcfilb.exe
3060	Ahkobekf.exe
3180	Ajiknpjj.exe
1904	Aacckjaf.exe
4992	Aealah32.exe
1620	Ajneip32.exe
2808	Bdfibe32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ffgqqaip.exe	Fchddejl.exe
File created	C:\Windows\SysWOW64\Mlampmdo.exe	Megdccmb.exe
File created	C:\Windows\SysWOW64\Abkobg32.dll	Bnhjohkb.exe
File created	C:\Windows\SysWOW64\Dkjmlk32.exe	Dhkapp32.exe
File opened for modification	C:\Windows\SysWOW64\Hkdbpe32.exe	Hmabdibj.exe
File created	C:\Windows\SysWOW64\Eheqhpfp.dll	Iiaephpc.exe
File created	C:\Windows\SysWOW64\Jioaqfcc.exe	Jbeidl32.exe
File opened for modification	C:\Windows\SysWOW64\Ncianepl.exe	Npjebj32.exe
File created	C:\Windows\SysWOW64\Qlgene32.dll	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Fpaeonmc.dll	Boepel32.exe
File opened for modification	C:\Windows\SysWOW64\Fohoigfh.exe	Fljcmlfd.exe
File created	C:\Windows\SysWOW64\Fdgdgnbm.exe	Ffddka32.exe
File opened for modification	C:\Windows\SysWOW64\Ifgbnlmj.exe	Icifbang.exe
File created	C:\Windows\SysWOW64\Cbeedbdm.dll	Lmppcbjd.exe
File created	C:\Windows\SysWOW64\Cegdnopg.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Dhkapp32.exe	Daaicfgd.exe
File created	C:\Windows\SysWOW64\Ajneip32.exe	Aealah32.exe
File created	C:\Windows\SysWOW64\Pcbdco32.dll	Cdfbibnb.exe
File opened for modification	C:\Windows\SysWOW64\Bfabnjjp.exe	Accfbokl.exe
File created	C:\Windows\SysWOW64\Bfdodjhm.exe	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Eegdfm32.dll	Ahkobekf.exe
File opened for modification	C:\Windows\SysWOW64\Clpgpp32.exe	Cdiooblp.exe
File opened for modification	C:\Windows\SysWOW64\Gfngap32.exe	Gcojed32.exe
File created	C:\Windows\SysWOW64\Namdcd32.dll	Klqcioba.exe
File created	C:\Windows\SysWOW64\Dejacond.exe	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Colffknh.exe	Chbnia32.exe
File created	C:\Windows\SysWOW64\Gokgpogl.dll	Qgqeappe.exe
File created	C:\Windows\SysWOW64\Clpgpp32.exe	Cdiooblp.exe
File opened for modification	C:\Windows\SysWOW64\Iehfdi32.exe	Ifefimom.exe
File created	C:\Windows\SysWOW64\Ifjodl32.exe	Ibnccmbo.exe
File created	C:\Windows\SysWOW64\Menjdbgj.exe	Mdmnlj32.exe
File created	C:\Windows\SysWOW64\Aainof32.dll	Eleiam32.exe
File created	C:\Windows\SysWOW64\Oehldcbk.dll	Bblckl32.exe
File opened for modification	C:\Windows\SysWOW64\Lffhfh32.exe	Kdgljmcd.exe
File created	C:\Windows\SysWOW64\Ehaaclak.dll	Pmdkch32.exe
File created	C:\Windows\SysWOW64\Afhohlbj.exe	Acjclpcf.exe
File opened for modification	C:\Windows\SysWOW64\Dkifae32.exe	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Ncgkcl32.exe	Nqiogp32.exe
File opened for modification	C:\Windows\SysWOW64\Dhbgqohi.exe	Dahode32.exe
File opened for modification	C:\Windows\SysWOW64\Gkaejf32.exe	Gicinj32.exe
File created	C:\Windows\SysWOW64\Hmabdibj.exe	Gdjjckag.exe
File created	C:\Windows\SysWOW64\Abckpb32.dll	Jlkagbej.exe
File created	C:\Windows\SysWOW64\Bjjplc32.dll	Jcllonma.exe
File created	C:\Windows\SysWOW64\Kpgfooop.exe	Klljnp32.exe
File created	C:\Windows\SysWOW64\Leihbeib.exe	Lffhfh32.exe
File created	C:\Windows\SysWOW64\Cecenn32.dll	Dkjmlk32.exe
File opened for modification	C:\Windows\SysWOW64\Bgehcmmm.exe	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Mdjagjco.exe	Mmpijp32.exe
File created	C:\Windows\SysWOW64\Mhciec32.dll	Colffknh.exe
File created	C:\Windows\SysWOW64\Gcbifaej.dll	Jmhale32.exe
File created	C:\Windows\SysWOW64\Mmbfpp32.exe	Melnob32.exe
File created	C:\Windows\SysWOW64\Ofeilobp.exe	Ocgmpccl.exe
File created	C:\Windows\SysWOW64\Qceiaa32.exe	Qqfmde32.exe
File created	C:\Windows\SysWOW64\Aoqimi32.dll	Qcgffqei.exe
File opened for modification	C:\Windows\SysWOW64\Bjpaooda.exe	Bdfibe32.exe
File created	C:\Windows\SysWOW64\Nlaqpipg.dll	Pgioqq32.exe
File created	C:\Windows\SysWOW64\Ifoihl32.dll	Pqbdjfln.exe
File created	C:\Windows\SysWOW64\Mnjgghdi.dll	Amddjegd.exe
File opened for modification	C:\Windows\SysWOW64\Bchomn32.exe	Baicac32.exe
File created	C:\Windows\SysWOW64\Beglgani.exe	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Ceoibflm.exe	Cacmah32.exe
File opened for modification	C:\Windows\SysWOW64\Fcckif32.exe	Fohoigfh.exe
File created	C:\Windows\SysWOW64\Eifnachf.dll	Cmlcbbcj.exe
File opened for modification	C:\Windows\SysWOW64\Dfknkg32.exe	Ddmaok32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10144	9456	WerFault.exe	502

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogjmdigk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdgljmcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkobg32.dll"	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laffdj32.dll"	Hfnphn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdbinofi.dll"	Jmpgldhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmalco32.dll"	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jheiojpj.dll"	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aainof32.dll"	Eleiam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dammlf32.dll"	Heocnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihlnnp32.dll"	Jlednamo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlokddim.dll"	Febgea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gijloo32.dll"	Kmdqgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoohalad.dll"	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipdejo32.dll"	Ipnjab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpgmha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbceejpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pponmema.dll"	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Debheb32.dll"	Aanjpk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjbndobo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpqdba32.dll"	Bhikcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifoihl32.dll"	Pqbdjfln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebdijfii.dll"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Okeieh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkhbdg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdehlk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlampmdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omocan32.dll"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajneip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npibja32.dll"	Ilidbbgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpnlpnih.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilidbbgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehaaclak.dll"	Pmdkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jehokgge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hqdeld32.dll"	Kmijbcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Canidb32.dll"	Kipkhdeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnjlpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqjikg32.dll"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbnafb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gofkje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gcimkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lffhfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdmai32.dll"	Oqfdnhfk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcbmka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdnjgmle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cibifp32.dll"	Hcdmga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlnnmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahkobekf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhikcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fhjfhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpeohm32.dll"	Hecmijim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncdgcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	7377e0cadc0c3865a46367246df18f1251aacbd8c78f73dd15b6b553e372ed6d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojhiqefo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dafbne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjghpn32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 3972	2188	7377e0cadc0c3865a46367246df18f1251aacbd8c78f73dd15b6b553e372ed6d.exe	84
PID 2188 wrote to memory of 3972	2188	7377e0cadc0c3865a46367246df18f1251aacbd8c78f73dd15b6b553e372ed6d.exe	84
PID 2188 wrote to memory of 3972	2188	7377e0cadc0c3865a46367246df18f1251aacbd8c78f73dd15b6b553e372ed6d.exe	84
PID 3972 wrote to memory of 3804	3972	Nnhfee32.exe	85
PID 3972 wrote to memory of 3804	3972	Nnhfee32.exe	85
PID 3972 wrote to memory of 3804	3972	Nnhfee32.exe	85
PID 3804 wrote to memory of 4528	3804	Ndbnboqb.exe	86
PID 3804 wrote to memory of 4528	3804	Ndbnboqb.exe	86
PID 3804 wrote to memory of 4528	3804	Ndbnboqb.exe	86
PID 4528 wrote to memory of 972	4528	Nklfoi32.exe	87
PID 4528 wrote to memory of 972	4528	Nklfoi32.exe	87
PID 4528 wrote to memory of 972	4528	Nklfoi32.exe	87
PID 972 wrote to memory of 3076	972	Nnjbke32.exe	88
PID 972 wrote to memory of 3076	972	Nnjbke32.exe	88
PID 972 wrote to memory of 3076	972	Nnjbke32.exe	88
PID 3076 wrote to memory of 316	3076	Nqiogp32.exe	89
PID 3076 wrote to memory of 316	3076	Nqiogp32.exe	89
PID 3076 wrote to memory of 316	3076	Nqiogp32.exe	89
PID 316 wrote to memory of 224	316	Ncgkcl32.exe	90
PID 316 wrote to memory of 224	316	Ncgkcl32.exe	90
PID 316 wrote to memory of 224	316	Ncgkcl32.exe	90
PID 224 wrote to memory of 3584	224	Nkncdifl.exe	91
PID 224 wrote to memory of 3584	224	Nkncdifl.exe	91
PID 224 wrote to memory of 3584	224	Nkncdifl.exe	91
PID 3584 wrote to memory of 3948	3584	Nbhkac32.exe	92
PID 3584 wrote to memory of 3948	3584	Nbhkac32.exe	92
PID 3584 wrote to memory of 3948	3584	Nbhkac32.exe	92
PID 3948 wrote to memory of 1212	3948	Ncihikcg.exe	93
PID 3948 wrote to memory of 1212	3948	Ncihikcg.exe	93
PID 3948 wrote to memory of 1212	3948	Ncihikcg.exe	93
PID 1212 wrote to memory of 2376	1212	Nnolfdcn.exe	94
PID 1212 wrote to memory of 2376	1212	Nnolfdcn.exe	94
PID 1212 wrote to memory of 2376	1212	Nnolfdcn.exe	94
PID 2376 wrote to memory of 3500	2376	Nqmhbpba.exe	95
PID 2376 wrote to memory of 3500	2376	Nqmhbpba.exe	95
PID 2376 wrote to memory of 3500	2376	Nqmhbpba.exe	95
PID 3500 wrote to memory of 3148	3500	Ndidbn32.exe	96
PID 3500 wrote to memory of 3148	3500	Ndidbn32.exe	96
PID 3500 wrote to memory of 3148	3500	Ndidbn32.exe	96
PID 3148 wrote to memory of 3352	3148	Nggqoj32.exe	97
PID 3148 wrote to memory of 3352	3148	Nggqoj32.exe	97
PID 3148 wrote to memory of 3352	3148	Nggqoj32.exe	97
PID 3352 wrote to memory of 4540	3352	Njfmke32.exe	98
PID 3352 wrote to memory of 4540	3352	Njfmke32.exe	98
PID 3352 wrote to memory of 4540	3352	Njfmke32.exe	98
PID 4540 wrote to memory of 1204	4540	Nbmelbid.exe	99
PID 4540 wrote to memory of 1204	4540	Nbmelbid.exe	99
PID 4540 wrote to memory of 1204	4540	Nbmelbid.exe	99
PID 1204 wrote to memory of 3712	1204	Ndkahnhh.exe	100
PID 1204 wrote to memory of 3712	1204	Ndkahnhh.exe	100
PID 1204 wrote to memory of 3712	1204	Ndkahnhh.exe	100
PID 3712 wrote to memory of 5020	3712	Ogjmdigk.exe	101
PID 3712 wrote to memory of 5020	3712	Ogjmdigk.exe	101
PID 3712 wrote to memory of 5020	3712	Ogjmdigk.exe	101
PID 5020 wrote to memory of 4652	5020	Okeieh32.exe	102
PID 5020 wrote to memory of 4652	5020	Okeieh32.exe	102
PID 5020 wrote to memory of 4652	5020	Okeieh32.exe	102
PID 4652 wrote to memory of 556	4652	Ojhiqefo.exe	103
PID 4652 wrote to memory of 556	4652	Ojhiqefo.exe	103
PID 4652 wrote to memory of 556	4652	Ojhiqefo.exe	103
PID 556 wrote to memory of 3744	556	Ondeac32.exe	104
PID 556 wrote to memory of 3744	556	Ondeac32.exe	104
PID 556 wrote to memory of 3744	556	Ondeac32.exe	104
PID 3744 wrote to memory of 748	3744	Oboaabga.exe	105

C:\Users\Admin\AppData\Local\Temp\7377e0cadc0c3865a46367246df18f1251aacbd8c78f73dd15b6b553e372ed6d.exe
"C:\Users\Admin\AppData\Local\Temp\7377e0cadc0c3865a46367246df18f1251aacbd8c78f73dd15b6b553e372ed6d.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\Nnhfee32.exe
  C:\Windows\system32\Nnhfee32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\SysWOW64\Ndbnboqb.exe
    C:\Windows\system32\Ndbnboqb.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Windows\SysWOW64\Nklfoi32.exe
      C:\Windows\system32\Nklfoi32.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4528
    - - C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:972
      - C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3076
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:316
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3584
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3948
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1212
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3352
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4652
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3744
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:748
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        24⤵
        Executes dropped EXE
        
        PID:4468
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        25⤵
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        26⤵
        Executes dropped EXE
        
        PID:4840
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        27⤵
        Executes dropped EXE
        
        PID:1892
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        28⤵
        Executes dropped EXE
        
        PID:3032
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        29⤵
        Executes dropped EXE
        
        PID:4580
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        30⤵
        Executes dropped EXE
        
        PID:2520
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        31⤵
        Executes dropped EXE
        
        PID:4280
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        32⤵
        Executes dropped EXE
        
        PID:4984
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1624
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        34⤵
        Executes dropped EXE
        
        PID:3976
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3312
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        36⤵
        Executes dropped EXE
        
        PID:1964
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        37⤵
        Executes dropped EXE
        
        PID:2196
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        38⤵
        Executes dropped EXE
        
        PID:4328
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        39⤵
        Executes dropped EXE
        
        PID:4956
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        40⤵
        Executes dropped EXE
        
        PID:2264
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        41⤵
        Executes dropped EXE
        
        PID:4572
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        42⤵
        Executes dropped EXE
        
        PID:3752
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        43⤵
        Executes dropped EXE
        
        PID:836
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        44⤵
        Executes dropped EXE
        
        PID:216
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        45⤵
        Executes dropped EXE
        
        PID:1656
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:412
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        47⤵
        Executes dropped EXE
        
        PID:3088
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        48⤵
        Executes dropped EXE
        
        PID:3612
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        49⤵
        Executes dropped EXE
        
        PID:3764
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        50⤵
        Executes dropped EXE
        
        PID:960
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        51⤵
        Executes dropped EXE
        
        PID:4640
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        52⤵
        Executes dropped EXE
        
        PID:2876
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        53⤵
        Executes dropped EXE
        
        PID:1108
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        54⤵
        Executes dropped EXE
        
        PID:1088
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4672
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        56⤵
        Executes dropped EXE
        
        PID:4388
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1900
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        58⤵
        Executes dropped EXE
        
        PID:1940
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5092
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3060
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        61⤵
        Executes dropped EXE
        
        PID:3180
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        62⤵
        Executes dropped EXE
        
        PID:1904
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4992
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1620
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2808
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1924
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        67⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        68⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        69⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        70⤵
        Modifies registry class
        
        PID:2668
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        71⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        72⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4364
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        74⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        75⤵
        Drops file in System32 directory
        
        PID:4880
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2572
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        77⤵
        Modifies registry class
        
        PID:3808
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        78⤵
        Modifies registry class
        
        PID:2244
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        79⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        80⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        81⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        82⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        83⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        84⤵
        Drops file in System32 directory
        
        PID:2364
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        85⤵
        Drops file in System32 directory
        
        PID:4376
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        86⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        87⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        88⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        89⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        90⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        91⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        92⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        93⤵
        Drops file in System32 directory
        
        PID:3592
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        94⤵
        Drops file in System32 directory
        
        PID:4040
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        95⤵
        Drops file in System32 directory
        
        PID:2088
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        96⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4080
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        98⤵
        
        PID:372
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        99⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        100⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        101⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        102⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        103⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        104⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4888
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        106⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        107⤵
        Drops file in System32 directory
        
        PID:4960
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5028
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        109⤵
        Drops file in System32 directory
        
        PID:3260
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        110⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5160
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        112⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        113⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        114⤵
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        115⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        116⤵
        Drops file in System32 directory
        
        PID:5384
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        117⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        118⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        119⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        120⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5592
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        122⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        123⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        124⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        125⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        126⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        127⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5856
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        128⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        129⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        130⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        131⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        132⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        133⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        134⤵
        Drops file in System32 directory
        
        PID:5140
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        135⤵
        Drops file in System32 directory
        
        PID:5200
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5272
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        137⤵
        Modifies registry class
        
        PID:5332
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        138⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        139⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        140⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        141⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        142⤵
        Drops file in System32 directory
        
        PID:5696
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        143⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        144⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        146⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        147⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        148⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        149⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5276
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5368
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        152⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        153⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        154⤵
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        155⤵
        Modifies registry class
        
        PID:5360
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        156⤵
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        157⤵
        Drops file in System32 directory
        
        PID:6024
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        158⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        159⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        160⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        161⤵
        Modifies registry class
        
        PID:6004
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        162⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5896
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        164⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        165⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5672
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        167⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        168⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        169⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        170⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5752
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        172⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        173⤵
        Modifies registry class
        
        PID:6160
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        174⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        175⤵
        Drops file in System32 directory
        
        PID:6240
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        176⤵
        Drops file in System32 directory
        
        PID:6276
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        177⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        178⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        179⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        180⤵
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        181⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        182⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        183⤵
        Modifies registry class
        
        PID:6572
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        184⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        185⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6700
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        187⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6780
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        189⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        190⤵
        Modifies registry class
        
        PID:6860
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        191⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        192⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        193⤵
        Drops file in System32 directory
        
        PID:6984
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        194⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        195⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        196⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        197⤵
        Drops file in System32 directory
        
        PID:7156
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6184
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        199⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6308
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        201⤵
        Modifies registry class
        
        PID:6340
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        202⤵
        Drops file in System32 directory
        
        PID:6432
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        203⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        204⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        205⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        206⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        207⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        208⤵
        Drops file in System32 directory
        
        PID:6720
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        209⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        210⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        211⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        212⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        213⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        214⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        215⤵
        Modifies registry class
        
        PID:6348
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        216⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        217⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        218⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        219⤵
        Drops file in System32 directory
        
        PID:6768
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        220⤵
        Drops file in System32 directory
        
        PID:6928
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        221⤵
        Modifies registry class
        
        PID:7012
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        222⤵
        Drops file in System32 directory
        
        PID:7136
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        223⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        224⤵
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        225⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        226⤵
        Modifies registry class
        
        PID:6808
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        227⤵
        Modifies registry class
        
        PID:6868
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7096
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        229⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6644
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        231⤵
        Drops file in System32 directory
        
        PID:6764
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7140
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        233⤵
        Modifies registry class
        
        PID:6636
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        234⤵
        Modifies registry class
        
        PID:7020
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        235⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        236⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        237⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        238⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        239⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        240⤵
        Modifies registry class
        
        PID:7332
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        241⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        242⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        243⤵
        Modifies registry class
        
        PID:7448
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        244⤵
        Drops file in System32 directory
        
        PID:7488
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        245⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        246⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        247⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        248⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        249⤵
        Modifies registry class
        
        PID:7692
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        250⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        251⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        252⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        253⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        254⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        255⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7980
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        257⤵
        Drops file in System32 directory
        
        PID:8028
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8072
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        259⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8108
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        260⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8152
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        261⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7196
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        263⤵
        Modifies registry class
        
        PID:7272
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        264⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        265⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7496
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        267⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        268⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        269⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        270⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        271⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        272⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        273⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        274⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        275⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        276⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        277⤵
        Modifies registry class
        
        PID:7252
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        278⤵
        Drops file in System32 directory
        
        PID:7328
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        279⤵
        Modifies registry class
        
        PID:7476
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        280⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        281⤵
        Drops file in System32 directory
        
        PID:7680
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        282⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7884
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        284⤵
        Drops file in System32 directory
        
        PID:8016
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        285⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        286⤵
        Drops file in System32 directory
        
        PID:7200
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7380
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        288⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        289⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        290⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        291⤵
        Modifies registry class
        
        PID:8056
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        292⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        293⤵
        Modifies registry class
        
        PID:7552
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        294⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        295⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        296⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        297⤵
        Drops file in System32 directory
        
        PID:7948
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        298⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        299⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        300⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        301⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        302⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        303⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8328
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        305⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        306⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        307⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8496
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        309⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8584
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        311⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        312⤵
        Modifies registry class
        
        PID:8672
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        313⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        314⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8808
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        316⤵
        Drops file in System32 directory
        
        PID:8844
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8884
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        318⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        319⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        320⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        321⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        322⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        323⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        324⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9184
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        325⤵
        Drops file in System32 directory
        
        PID:8196
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8268
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        327⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        328⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8400
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        329⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8536
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        331⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        332⤵
        Modifies registry class
        
        PID:8660
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        333⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        334⤵
        Drops file in System32 directory
        
        PID:8792
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        335⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        336⤵
        Drops file in System32 directory
        
        PID:8916
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        337⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        338⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        339⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        340⤵
        Drops file in System32 directory
        
        PID:7960
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8276
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        342⤵
        Drops file in System32 directory
        
        PID:8380
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8476
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        344⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        345⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        346⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8896
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        348⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9108
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9212
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8420
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        352⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        353⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        354⤵
        Drops file in System32 directory
        
        PID:8908
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        355⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        356⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8348
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8628
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        358⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        359⤵
        Drops file in System32 directory
        
        PID:8232
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        360⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        361⤵
        Drops file in System32 directory
        
        PID:9148
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        362⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        363⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        364⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        365⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        366⤵
        Drops file in System32 directory
        
        PID:9332
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        367⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        368⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9416
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        369⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        370⤵
        Modifies registry class
        
        PID:9504
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        371⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        372⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        373⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        374⤵
        Modifies registry class
        
        PID:9668
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        375⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        376⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        377⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        378⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        379⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        380⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        381⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        382⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        383⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        384⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        385⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10132
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        386⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        387⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        388⤵
        Modifies registry class
        
        PID:9016
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9280
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        390⤵
        Drops file in System32 directory
        
        PID:9324
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        391⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9404
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        392⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        393⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9516
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        394⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        395⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        396⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        397⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        398⤵
        Modifies registry class
        
        PID:9868
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        399⤵
        Modifies registry class
        
        PID:9948
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9992
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        401⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10096
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        402⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        403⤵
        Drops file in System32 directory
        
        PID:8448
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9288
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        405⤵
        Drops file in System32 directory
        
        PID:9384
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9484
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        407⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9724
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        409⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        410⤵
        Drops file in System32 directory
        
        PID:9908
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        411⤵
        Modifies registry class
        
        PID:10024
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        412⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        413⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9340
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        415⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        416⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9932
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        418⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        419⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        420⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9456 -s 396
        421⤵
        Program crash
        
        PID:10144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 9456 -ip 9456
1⤵
PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aglemn32.exe

Filesize
176KB

MD5
51ebdfae7266be2752192806c6a02f01

SHA1
1525b8d6853a06b734a56f8bd82b9002ec14f449

SHA256
019575d26c328746db09570050a5a958859eaaa66bd21a0169d9226544b722db

SHA512
f2c26c4bcc1bba59067d9ff505831efc8d60047250bd456ba44e684b9f79c274c4905fe5559800b3acb430af3c2f6c3dafed5768041dd893dea405943a795752

Download Submit
C:\Windows\SysWOW64\Bhdbhcck.exe

Filesize
176KB

MD5
5b46e3903794177bfa65aec7f3553b4c

SHA1
55120bd87dd5bbb8e77d531940fec606e329c5cd

SHA256
8b5a883119a7935644bfb30ac077f291bfe9b91bfc9cb9753e10a246d2d0050b

SHA512
2c4c0cba730e43ea1c073219f291c397013755f57e8b1822631fd76d0aeba7400465a722abf2addaaedbdc38cc962f549ca901d54fd6eeeb8fc4b08f8ed2b387

Download Submit
C:\Windows\SysWOW64\Calhnpgn.exe

Filesize
176KB

MD5
75289ea187c094c97eca3e19d67b6104

SHA1
2e0d2763f780469b81948659131aa5d2e9ff6be8

SHA256
2a23f90ca5ffbb9992e2ee8ab89edadadacc503afe98a2c7a7bf13de72b64ee2

SHA512
b3c3d2df495da21717a3aeaab0365dde6872f24854215316b2f24d0e0fbaa3dc137ced1ce138cce989b4bb449d4fd7c2ce91b30e199ef3e6b4a92524c9d4bf4e

Download Submit
C:\Windows\SysWOW64\Cdfbibnb.exe

Filesize
176KB

MD5
edb63027922ca85831f9211f95cc4335

SHA1
65e2628cea0863a5ac27817aa6e7f0ac8d5db938

SHA256
974e66e8ea587d228c8bdfb235166c83bd8d40ed3e6b8565a88119934e75e18a

SHA512
efb4fb144c4d0ad903c19bc672b396f0db9437539533c07ae0eb6c339a231ab56f0fe58284854835bb6e73eebe3ed9d1bb494efc19e5885045e0546168ca3728

Download Submit
C:\Windows\SysWOW64\Chpada32.exe

Filesize
176KB

MD5
4a3f1f8ae387aa4b1f99b0b78cf7881a

SHA1
2aae31bf8738909b1b64bcd26466c8e10b6ab01f

SHA256
782e3e97113c6bd5ef23ff21a2a378d202e0f9d887f453832dd8343d540353fc

SHA512
d4bcf66f1faca78afa9cc29d0315448ace97026dbf02add89926c2784d3a440d50b0a834faee0a72e1d5fe01ed75f7565a47718c5d4b798335b8f632799e88e3

Download Submit
C:\Windows\SysWOW64\Fdgdgnbm.exe

Filesize
176KB

MD5
719fd7fde8bd03015668ba0eb60897b4

SHA1
4cf5a265e7d239761707d3d98f612e898c198ff4

SHA256
e1771a377e23d5943e7b4c98825c2f60b24dfca9fa66e663c2598d56602df209

SHA512
26ec6b8b787f9d648f927d7cfad3f21598c3a0ae6000df8486d76963f640354f3658f9b6b2bc32a220d9204a6807ae5192f1e4939300af32ca093db8c02464f4

Download Submit
C:\Windows\SysWOW64\Hbeqmoji.exe

Filesize
176KB

MD5
9774305bead1c79cd8715d6776fb872b

SHA1
f86f4eb78714f8c5c092c92c54a3153488185dbd

SHA256
28674b0c996c99e4b715a12f61fc748dfb257630f5f8d362e25317c953ba101f

SHA512
1bb3948b81ce4c132b3ae0bec9f350f73d4f8897334a1b2217e08d24c2a67c215d411b52fcc09e3ae82200321993fda40db617b802154e5057209e8befb025d2

Download Submit
C:\Windows\SysWOW64\Hcdmga32.exe

Filesize
176KB

MD5
e3e3d29ac659eeb53d90d8df1956d7c3

SHA1
e5bfc7adc9c9e629e589e1cbd6a8b35728a8172a

SHA256
4d22b4cf8d5e67e64dcc07aefa97a8a59f1e0cf6b98428052d82a86b8d25dbe3

SHA512
ce0a6b2ecca73008676466d33eae3a900a1bd0dca3da486d63881072a12a8723ba7c8912af674a1f1a95851fb0bf6d3be640b04eca6a6d2ece4894f53479f63a

Download Submit
C:\Windows\SysWOW64\Hfnphn32.exe

Filesize
176KB

MD5
98c32a9cff1ba7ce6a98064f6d7ca54d

SHA1
f9a9e67b90ba00a75131457090c15b0374cf0bcf

SHA256
c23576bf57e204573b5fa1dadea64574edaef8a1c988a43a2f7f391f5e2c83ba

SHA512
30d0eb093777a841688c0957149596ec1ec67b9895a75e236bc205f05caa232c7b6b25e3c1e2724b0d2d101131ef0bd8f26f0e343e3598fc61a9b73b1b0dc2f9

Download Submit
C:\Windows\SysWOW64\Hihbijhn.exe

Filesize
176KB

MD5
2b1db0870e3f95414afea769244423a6

SHA1
30f657e2ab99111889885b29904c3c38677f09d1

SHA256
73eb66ef83221cf510554ce0740ea5f612a335e323b8f3196e3d591965e799d7

SHA512
eb058449ec43fd7f547ed466d02b331614135620eeaa360e80a8e983a26ebd0fa886551f4718e5d34d2161958f94e2f75450857f970205219455ba2fef1d1b54

Download Submit
C:\Windows\SysWOW64\Hioiji32.exe

Filesize
176KB

MD5
6ac53cc5c28281e498979235f7a391c1

SHA1
c32ca0b70c95f273f76e294937f3d7340e439dd4

SHA256
fee099e10b4db60acaad3592ea7c317f8c3fcc658cf777344d3154c3c9def6da

SHA512
9324c4f9bbf70a8834f4b6947b8a0dfae3afee5bfc1d9b0fe8d5d920cc75a03c36de8c8d9e61ce91d9ac062501908c4b693ea337b9007b2c0777f326853bca24

Download Submit
C:\Windows\SysWOW64\Iejcji32.exe

Filesize
176KB

MD5
4b17b0779fed7248fe3c1f0b8ebcbb34

SHA1
8813a06239ab992be7fadaea6e61deebcdad4a64

SHA256
708b0509e2f72538fb3dc618f165f72c43b06cd4f11adccfc30cf710a62cf28d

SHA512
f2fdd562de1d86189609903341ac9422511e601ce02fc6d3925bbae10f57044b1178152df15922399f18abfc72bc009436474fb02a3b0934c3a2798df750621e

Download Submit
C:\Windows\SysWOW64\Iiaephpc.exe

Filesize
176KB

MD5
696f9cc18adb93fb7aae39f9bc554ae0

SHA1
10501dabbc1056faaadb5aa5fc4fae3fa26af4f7

SHA256
07a17435c63329930b625c9657a16a9b4e20c9ceeb93749451e6ac49999ecd77

SHA512
7f13a325511d5347005f93261fdb027ed81c7ea4382ed32e9743af6ea98676c5c8c80a424bcf4c42fa7274fa53b423687086d9ae4e55eb87148323a2d4c67477

Download Submit
C:\Windows\SysWOW64\Ipknlb32.exe

Filesize
176KB

MD5
ba3f048f2fd3c1ef99dc3c7f5eb6bda0

SHA1
ff7b3f8cefd5a45881d4c48df565f50ac19be28b

SHA256
c672723219ab092b203b96bdfff1adce015b3abebc93e7668b489ce995e93d09

SHA512
03df19002c92f16edb77eb2405ff3c38a2fc892b1d952192bb4b5a8b1d43d4dabb763ece967f3323bdfd1b11c9ac919103a1dd3e5d5516e3792d2a8268996423

Download Submit
C:\Windows\SysWOW64\Jblpek32.exe

Filesize
176KB

MD5
c1c595bcabec38126f72a009344ea65d

SHA1
fd75401aa657346e6a0749a7f6742214b935c090

SHA256
5f525477fa44ba7ca4e1c5ad150180236ca288c94ac8ac0937d64faa57cb2183

SHA512
aa3e733a5a9e18ec6773df3540efae2b3f316a2a047eac7dde5ca69e6308548ffb089df5c9bbc3c5ccd966a721dd81ac4a86169c79f40504a7f5c34dbb0c8625

Download Submit
C:\Windows\SysWOW64\Jmmjgejj.exe

Filesize
176KB

MD5
ddc8cea1c4a465f080f48071a36e0f50

SHA1
30d30144299599e5645b94a3c0643c2285e6615d

SHA256
ff4b42295d0f62aa2164ba1962232a76ed25c5c5091b8b8926573c8b1713334e

SHA512
8cd1c89f9ea5b14487421e25000046dc0bfdae03744d420050d9d66f5c904b7cd4c96b81fbff31a3feea53b9b65f795d79f528fbd30900a6727abb023ee3bbe5

Download Submit
C:\Windows\SysWOW64\Kdgljmcd.exe

Filesize
176KB

MD5
0ec34c7b8f94c6566491ee9ea94efd5d

SHA1
81d74c3d418530417457add2005c4201706413de

SHA256
5b0a14fde5d9c891cda564a24cc006105a0ff1fb4e52fa10842ea1d4805113ea

SHA512
b7a42bd5dd361d2c17f20b9abf833f87bb885c8e4d6a23c1884f904913e5799bd47152220471b325d832f9f3b450fef947c2da1fc83bb1e80147113f0eee6410

Download Submit
C:\Windows\SysWOW64\Kfoafi32.exe

Filesize
176KB

MD5
afce849fdb1567a1b7a61872eaa4368a

SHA1
7aa637add3e4ab97bfd921f59c9cf057493434c2

SHA256
b2fe3cfcfe712b0675ff1b2e0af2d7cc0b90eb22735ce351ed052dadb08dc67b

SHA512
f86b2459fdfb09c57f89634f36ec577f7aacce8b64fcbf06c22bee392a48782fe39f0ccd1e67d6741b41a2dec728deb8c01161f3afec5fb9f48b60394aafa0f0

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
176KB

MD5
f6afdf076ed7f47da5e9120d415010e7

SHA1
1057f5cc4ccca53b96e5ce7737a047d52473a6cb

SHA256
39db9271b098b1d7b7bbb8ed711ef8aca0e46ce21ab225aa14b62c09448cbc11

SHA512
13781b3334f2bb9202f37e02d436713f7b86b4f58a4d82a6455ddd0e0a2a855ff5eb6eddece51ab7926bf34a8a126987c158a023d2763ed527bcf5a86e62bc13

Download Submit
C:\Windows\SysWOW64\Kpjcdn32.exe

Filesize
176KB

MD5
213850a8710d6445db2d806ffd1edc13

SHA1
d45f35cc6b4bf8465e16446ab30a83fbf6bce865

SHA256
2cb2af0c5ab40f61f2da371d06438e983120e2850c1650ac429f91271b82a272

SHA512
99d40debfea99178050e28d8964b342f2a0e264abab6560ecb7da6ca9443b484db2ba543b6296d5a55110a4384e7fef40c6e4266b4f031e9c45327ce448aaa9e

Download Submit
C:\Windows\SysWOW64\Lingibiq.exe

Filesize
176KB

MD5
f5ce045a0dd12888807fc725cae57526

SHA1
805e7a6b123d2bb10b93d6b766709415aa3c8d43

SHA256
870a473ffd9d49650dacc8365b519ba035e9f1fa8b73a42e214ea8e7ada718f0

SHA512
15a9452f8eb783c677f285ffefbfa0db929671ed1ca93721bd7f7543a7fc85ce1195fd64239cc91ee3ae59d09b1d3c2667917c9890e1de5a49d7d20fba13b611

Download Submit
C:\Windows\SysWOW64\Nbhkac32.exe

Filesize
176KB

MD5
0c3ed93a94874628afa669c0da0bb795

SHA1
f2d01fa87176438680f5f4129a908f8f44104b7b

SHA256
0be9873336c1d93d40bd8f96e1225a8e4b8b69ee9fe621763068695136558136

SHA512
e5fbb96415fe03fbcfc25a40e13c330cdc5b6d6470f976a2d73a436633eb7e6148ae19988fd236ed3d940df3d816d64d6db3302c26abc63525ddfee1765a89d6

Download Submit
C:\Windows\SysWOW64\Nbmelbid.exe

Filesize
176KB

MD5
277fe40e4627d88c7c5c40e514b764f8

SHA1
9ea1cff548e4746e075cabd1418be542bf613c31

SHA256
e01e4b4f4a9fb839e6cc30cfac6dd8f1a39c219ab0c290e3668c47673b45ec18

SHA512
6eefaa3f1a7eaf512f6717889036deeae6d1715b7109dfda84ba90620a2f260db3a47875e4128f846b00de13c5c77e146c6d2a3c6e461cd77801cbb855b45f46

Download Submit
C:\Windows\SysWOW64\Ncgkcl32.exe

Filesize
176KB

MD5
ed70158c8ae04fd7d2b52d47f08243d2

SHA1
01cb09133cd6767dc037246fd5081a0fbe84a6b1

SHA256
ad7ffe8bcfc982f93e6398241cf391352b9a9f767f25c57e9bbe1d241f78f522

SHA512
acc095464f7af4c66abaad990181c09d7fdd84abc1c9bb37f9dc36a9e57e4e026022884997d27a134e923cb6e93cee3ea5c39774901786c06719dce496dc173b

Download Submit
C:\Windows\SysWOW64\Ncihikcg.exe

Filesize
176KB

MD5
82bcae3c015692d172b5233313c4ad3f

SHA1
f64ffaa17b6fa2d3b8cb4da20796dbaa0ad54100

SHA256
c58d56628b9c18e8e8e59dcc7b0cdd71cf8e8b4a6f8d1aca2e1dc070d209212e

SHA512
a57971d90cc5c588de462b593c9d6a79d77da26efeeb31c34ca152e8f9d5fde79c72b45d326c2918a85f0af31e25a0b44e4e0ec68cf7ce22942332d37bb2ce8f

Download Submit
C:\Windows\SysWOW64\Ndbnboqb.exe

Filesize
176KB

MD5
ee6973bafac0ee6179e812af7135a723

SHA1
47d185dc2840f82bf56f47a67239f96c6d90b8ce

SHA256
21b38c23dfba4307816c8e026293acf74dfd597bfed106b9119cdac3c3a9210f

SHA512
1ff875fa26a67ce8415728003c1d21ad55e0d155bb4ddc26de56b43fc468132f63e4ad9d79caf56882137daf44f2fcf1e20b6c5f86c0153f1d62977a2c30a123

Download Submit
C:\Windows\SysWOW64\Ndidbn32.exe

Filesize
176KB

MD5
a718c8f52468e4931c1d43e611819513

SHA1
dd2dc87cbd9d3cf5858586ec490faa69358b2e7a

SHA256
c17f9c081df41125b257ab9542c93cf354647aa3a595ed455deee8526aac21a3

SHA512
062599d313f3f2e49b303c0ea70e4fff3a618cfd2ca865c9f630ecc9902e29ad9f0e33660213d8a9b3c46dd94cfe6cfe14bc3ca3e2af0c7324150447fe148e7f

Download Submit
C:\Windows\SysWOW64\Ndkahnhh.exe

Filesize
176KB

MD5
92d98b578f6fe661afa720fcc67d6e86

SHA1
592678e4ccd7b3102363505e19dab3a65700aab2

SHA256
bd0e071c758af3acf98f34b040412ffebb18059b9303fb6435eda0c49b2b7e7b

SHA512
58b23d888cdb094524fa9d0173dceea262e3a14913c61096797859821bb25f198a6607e352edbcf5a9b96d85b5daa76ce66624df36c35eb28643c0910cd9b16d

Download Submit
C:\Windows\SysWOW64\Nggqoj32.exe

Filesize
176KB

MD5
2ab7952cea4d47ba769048df0c29d101

SHA1
3e7b29cdfb7e64d7de95d532b83f484557f04a2b

SHA256
4b221b3064ec0268833bdbb44b4d011dc95b6ad2a024c03a0da579540b7e0cbc

SHA512
66d5b7554ebc030b651aae3a559479bcbd06d85b68712b159678ed12e66f3f849764533ac497b456038e95dbdada9f4f1f6a265b6aa679e13d0c689cf97ab279

Download Submit
C:\Windows\SysWOW64\Njfmke32.exe

Filesize
176KB

MD5
855b2e7f091a0b5dfc3298ed9413ee8c

SHA1
02940fc07f3cae508e97035c787e52e50ce1fb61

SHA256
4568c712d56604934e95e75b655683700882b2059b90b4ea278477eb8a335e98

SHA512
f35c53aee73c34e4424b185e2d0466541ebbae315d7bd8f824f4bce5b0440c325219c4fdf03dcff84e460b627327de032757a1744f25a3e1065aa5b774bd8983

Download Submit
C:\Windows\SysWOW64\Nklfoi32.exe

Filesize
176KB

MD5
cebdf7cd6f66cb0cb95279d78ba4bcba

SHA1
10076c34fb10b8a2d0ffae560e2453836cd76668

SHA256
666c0f750b2b0a1c980ed4eabf9cd2f3aac95e7462d3f1d0261299bc6b5f39e7

SHA512
8bc45ed5404d7d4792f496e068b788be37e0cc600258fa9a5b35a8efd8a91a6c8577230bfec7b0513fb21540b4c3701debf567227054e29bb6b7dc18c288d49a

Download Submit
C:\Windows\SysWOW64\Nkncdifl.exe

Filesize
176KB

MD5
6daf72737cff94a714f74f7d2500859a

SHA1
52ea230c50cab61940bbfcd6c77895816630525b

SHA256
28986f2c96c562c7de8ae134edbec15257940f56c5ae280bd83c57054cfa581f

SHA512
ae6c28074eb990764c7ff854fe98c4399abcff6f44ea42804d0eec1b41b1bb444db059c31567a0d2057e7113dc7ba1ab14a5d6e300ab36560ef3021fc0b299e7

Download Submit
C:\Windows\SysWOW64\Nnhfee32.exe

Filesize
176KB

MD5
295ed0f4c4f36171d3032799c6cb4678

SHA1
5fcce062374da2fe413e966f558f9f0215aca0f5

SHA256
c21f4d236a863b6fe89cc926fa6383fbaa76878f84d0dad498ebe0596fb4da88

SHA512
49211586f08e8eca76e4d76bb3e9b3832d8bd8818664fbd72643e02113b6a945debd875fd690d4f9f378dc0cd8edd99da21354764c039294e7f0fd743809d0a7

Download Submit
C:\Windows\SysWOW64\Nnjbke32.exe

Filesize
176KB

MD5
9e2e2d6ccc6d60c72194fffc4f768b48

SHA1
7560fd7e3416a2eceee5b0d47ba1df453636a278

SHA256
29336603ee578497494097c1a0b258f19b669c8ae534261bcbde34e6302f338b

SHA512
466ceec613c47a35422374b7094b07394d4893bec8b3c17c388dedf05fe139965778cf7593c7da6f607bee59e4951f04dee26344cf73c3ee2e718d4b868cefff

Download Submit
C:\Windows\SysWOW64\Nnolfdcn.exe

Filesize
176KB

MD5
0129376f95629f2e8e840e07345d93b8

SHA1
da57cdb45f9292e4ce4eac71ef9b3bf3c6d2f385

SHA256
2cca47dd72b28d12bb582a6b44e983fa6ade1cdbd2fec190dd7321e8f73e1b4c

SHA512
4cfb6a44150b5016e41b4b7a2154184d0f3d189b145ce5da28466658c3345fa08ab9205d000c9280a696c521c9e2e95ee2d7059b317bcd51eeb763dd762fbf04

Download Submit
C:\Windows\SysWOW64\Nqiogp32.exe

Filesize
176KB

MD5
0f65e88b57df2f3eae2839d7137d0507

SHA1
82951ebf9ec076ce17824e19a3334ae2389ace4f

SHA256
bd497060937516b83354fe4b8e838b77214aa7ac5294fe879a3de22f08dbc2ea

SHA512
fdb981ae36e092aef6d6195652483b18faf07b6298158d2ad56aee1c37b074703f08ebaa5d5c179af2b6d51aa6146ebff0e6695b4053745955d8582bb9af32e7

Download Submit
C:\Windows\SysWOW64\Nqmhbpba.exe

Filesize
176KB

MD5
2fef677501adbd4eb6142e8735d6c284

SHA1
736adddf07f1bbfa3018236c9cda7e4bc18c0231

SHA256
85b3f3f9cb6f1742def2c7b3ab6290b1e4b08dc3d2c7a89bd134d6b8a830ba60

SHA512
47db7d635d7a19b43132eb3eb886fc49376d23c08fb628b29af50b7910dfa03c71ab257640378012e5eaf3375f6c4a2fa5acd51c84be3062a2291d9ec076fdd5

Download Submit
C:\Windows\SysWOW64\Obangb32.exe

Filesize
176KB

MD5
39b80beb3e4be1429dbb9d7d6ceac55c

SHA1
ebaa8ea80764d6b3c810afaecf68165634d9177f

SHA256
923e91c79fb8b653cffd44678193a557b8ce4f0ac2c076c066a6f22f4ec87f53

SHA512
99291a0cb8844ce855d022c882ef9c377162812df77f4e5a594a353834939cf3fa8e8e12f8825cfbf0da28928b3f2432292a623569465aa68673c7ab2ee89d95

Download Submit
C:\Windows\SysWOW64\Oboaabga.exe

Filesize
176KB

MD5
4ac987c138f2a17c4cddc8d952027934

SHA1
caf6dc5526a915fd24240a763db1035e25d9af35

SHA256
268b1688ee07dcf8ffb7a3a87923229233a42a1c8e40d7714c3a1b7bd91864a5

SHA512
b708f9255c3ca1b41fab54c5439cb46cecd5920a2cddcadba6265f248b62e439e09cf20a2bd9ca8b43ce02637999a93f33ca83c8c2633b84ef32b792e126453b

Download Submit
C:\Windows\SysWOW64\Ocegdjij.exe

Filesize
176KB

MD5
14b96b2b1a61438c8f0599989857fd24

SHA1
925885538222313248536365840af5671779c9f0

SHA256
bd19f81be8646eed2035390354298a8d4c3f9f114e01c34ae25e332d6886fd92

SHA512
59a49e5a125a74a550b37ffe5c1026c1cb3285b9ef1ee6ec99aa139aa9d12e892f2b92c174a4de0ee6ada23c35e95d8ad7371f53f28c8f47b5fb8add5151d76c

Download Submit
C:\Windows\SysWOW64\Ocegdjij.exe

Filesize
159KB

MD5
68e2f1cf7a3ddd6e120415ec0d239474

SHA1
8796a2daa9ad47b4c022e22d6a7c4c89512db5dc

SHA256
ffab85979b3020ceb4c9650fa89d02b63abf52a9ce50ad777545aa527079f093

SHA512
f05aad1f84e74c4e8fa93d9ec50cdbfd90b4c9ebc9b8075a2f5366f70c71ff4a1a47c2cd04b26adc819a0cedeb87b99f1bbc8b5a5390cec3c0b776d4a189feb3

Download Submit
C:\Windows\SysWOW64\Ocqnij32.exe

Filesize
176KB

MD5
6ec2666527a56ad5f306d7aef381f3a5

SHA1
f56598fdf06b4163026ae89cdd02336b8a0e9282

SHA256
deaf4e2af99ce9cfa6084575c4b1cbab6025c361f501b53311bd01154517206c

SHA512
61c736fc11137d01517cd4aeb43a3ca3e39af1ca9777774defd7e9ce2603ec4f64cfc2e44901bce7374417b29f52acc8decba4710e0b91a4c807a47c5fc11058

Download Submit
C:\Windows\SysWOW64\Odnnnnfe.exe

Filesize
176KB

MD5
0fb9a4c63e96a11eb98a92809fb3ca98

SHA1
55d154b03fc29bf2accc889ffd2d730c94cd03bc

SHA256
5175c2827fe5494e8676599896a9368b2448e5d66e6b71552d528d42b7978639

SHA512
e855d0b7542e08c9ef0fdcdebb26cfe843c673ecf4bde940ddcc72765809c589af295a74a322276ce4b0034453e3eb5a554851bbe61333412e26e91e2a15d3cd

Download Submit
C:\Windows\SysWOW64\Odpjcm32.exe

Filesize
176KB

MD5
96ac44450953d93c045f24242791fab3

SHA1
e7e2249c421cda2034448b430917142c41c26c50

SHA256
743aae26c851813e077ce00411b3040d4d164204a5e09611c0d354337be3ad85

SHA512
43390278c2f193f67bf0cec247fd4b97af78721623af9a1fc7d83bafddcb64d53d8aacb0dc31d6015fd0849b4aa32deff3867a8bba1ad8241a20b439f4658cdf

Download Submit
C:\Windows\SysWOW64\Ogcpjhoq.exe

Filesize
176KB

MD5
ef5a179dcd16141c9d9263103c4dfeeb

SHA1
fd38f7e1358bcb122e4052f3b067197fce052fa4

SHA256
a00dcad73d25ed299565ebed269ec1d8804ea7a3678e2bca0080ee29971b06e5

SHA512
8a766c1374adcd57c1de59f09cf9d686d59feda6690f9e849c83a0b1d29c133e6cc2c64dea353337804b8dfba044995e2f0acabd09d280cc8292053cafacde27

Download Submit
C:\Windows\SysWOW64\Ogjmdigk.exe

Filesize
176KB

MD5
8cc0172754e36786c7c40dc26dcc1630

SHA1
cd7f9367d2a93f226e096334bb48f39c481178af

SHA256
29e3b98a0ed70a618148b958fc90089369a7e8b918deeee49e76d4380134cd54

SHA512
4202fafefb70fee0d582f03282eeab99f1493d592959b3bbc69fd76135d999e3b109cb6de154fbb3b5224aca8761d86996e2aeedc18b8ab877af7506936465be

Download Submit
C:\Windows\SysWOW64\Ogogoi32.exe

Filesize
176KB

MD5
1f9db1dc13e011c98c9361e4184abaf3

SHA1
7ecb2a84b5963c35ec71563686a7e3985bb268c0

SHA256
81cc58f3f37b11668146e8d23dd32ba7f7a9ef3769c87b0bb1d6a78970493b9b

SHA512
722ac79e6eda435ca8694b18ec001f55e38d3a1401a8d52c7f6c15eb89717363016c3b192915ea169b8f5ac1e9dd72d3ae3a89d2f92232a828399ca13dba5d06

Download Submit
C:\Windows\SysWOW64\Ojhiqefo.exe

Filesize
176KB

MD5
33ef03444d74cd332ea564e7aa2fc3c0

SHA1
f736c8c9508263fff41634fc1c0d968a17f91faa

SHA256
66a8e69c913f0d9de7f4432b87a55bd1ddb346632da9f903de9847e3bfa4b35f

SHA512
e381864611ad0d973ec691d2a995ffeca3e153b3d5a3af85b372c150a04ad94e4dfde2dd24598ffe6ea3801a5a3fa2c0b24c41959f4737507830e07fc8eba50f

Download Submit
C:\Windows\SysWOW64\Ojjffddl.exe

Filesize
176KB

MD5
2fce91673a4506c95d9342a00f751af6

SHA1
34528f42b00ccd9cad1aad60f80db90e12ad054b

SHA256
303c04e452bece5203d7f28fb512f4c314d6b0048294afda8d608e9ad14dacfb

SHA512
026afa45962b0f437c8efa90495d5a1e720e961b5c2289469929dd492417814b2651a5773693608451fb08453376c41d060a54f5c80da65b5f3497557c657010

Download Submit
C:\Windows\SysWOW64\Okeieh32.exe

Filesize
176KB

MD5
f02b2087d340812fbe296cb5b9aa4759

SHA1
e161ce8ed790cfd621f55a4c72f477dd794a9c4d

SHA256
2da7b370571bfcb64504402104c13355cf42f0bd691c4b520ba4953611749ff3

SHA512
998ddeb13953550f2bd3ca2da6949e9256c3c23baa5e41615e9431cdfa8cb87e347c13629fb722e88daf9a7962f2affaf58e4a5efbaf35ca6a56d52e93647eed

Download Submit
C:\Windows\SysWOW64\Okhfjh32.exe

Filesize
176KB

MD5
f4c9581d7b09c544909b781b44502e2d

SHA1
e18e5c995fe2b7a59f7f227533f13d5aacb40087

SHA256
32ebe563ede611d26e5720428daadecb91fadd3094df1a3ef700e86e82acd0f0

SHA512
c1c8fa7d079b15730306a323c98434d1d875819f6d401c86883f88ecb0aae770c7a894dfa12cf01ef4be39ca7108a536e111d07d65856efc4fed6f7890e6d676

Download Submit
C:\Windows\SysWOW64\Okjbpglo.exe

Filesize
176KB

MD5
7cab15f73a90f380bb9a3a2b69586386

SHA1
75e8d6458d59afc6bc602fcca352d8d873c0e277

SHA256
2bd8a89d76120f1c9849ace6d8f97e4a91abf4068afdf20cff92213f4a556383

SHA512
cdf114adc132ea1b3545003bf4c112e5eb9cf1e309186cce48d24f63dbaa4c760404968ec75598f89f7adad7acd4bcc26de98dd4f0e3ac1dd6cf81d7d2d7dcc6

Download Submit
C:\Windows\SysWOW64\Ondeac32.exe

Filesize
176KB

MD5
dba5c88c45d30e294d25d3d0fc520e93

SHA1
c4e41a106707f229a45b120c0c2f3021b66945c9

SHA256
3f6e17ea2e77bc49e48db2e1ebda823fe7f8cae4e4918029c5c3ed9d85c91b07

SHA512
a37f3b39e72bc048dee1ae67b8328672b8273775bf03b0225a1623d5879b812ba9c561a607ef84ea0fed16540b43638eaa161141038425774a3e26db37c946ec

Download Submit
C:\Windows\SysWOW64\Oqbamo32.exe

Filesize
176KB

MD5
76bb25b445661aa4ec1dc31963a21c08

SHA1
acf52b9b25339c0e4a4efaffe4b012280dfa312d

SHA256
ac85fd67c7200fe49f2fc9748e664d5de21538f2e02f6b387a4f9a02af99ed06

SHA512
77535dcf2fd03eca6a7fc953d411cac8381e17e434aabb12605cb7fe22e3060d62ccfb053a1a7cf79a9bdc5a0f8dbfd11d7fa07483f404247b05b0e74f142230

Download Submit
C:\Windows\SysWOW64\Oqdoboli.exe

Filesize
176KB

MD5
0e13fa4a2a4b7a102dfaa0a1a7606a04

SHA1
32349b057d1e85c9ed599b0338098613c5821cad

SHA256
5fcabe4d092de427b9749f7e7f6365219c25029b30172c7407fd3413d034fb8e

SHA512
22c65f775b7549cde177716678538d25b09b5ba3e5c19ece931b3900dc19b83e07b012bc6dfa123d25064c41584db7f2f5382597332032fee06849edcc28f829

Download Submit
C:\Windows\SysWOW64\Pmoahijl.exe

Filesize
176KB

MD5
fe489b34b6f4cad53f047c61a96e9949

SHA1
7282e652759197d8aa6feb39e3019a05a03556c4

SHA256
29c7af8d203f10631bd747a9276a5052d98fb4a454fba0e41da67feab4f67a7e

SHA512
62f85fbccbe7a42696020a99862a02370b7e9371f369f63b24ada7cdefea4f1d3a636642a2830bb1f38b73c96ec94dac77d8cb6c3f032e5e671128b0ee933bcb

Download Submit
C:\Windows\SysWOW64\Pnfkma32.exe

Filesize
176KB

MD5
d2766ce218dc79e8533fc7e793e65f84

SHA1
8800d4c261e03ef463f30900d9369ad8c6b3e0b0

SHA256
96c68d6877f13af273d88cf9ca0239314d3c7515a1da4956fa0a5a788c7f4529

SHA512
34f1359e69a3818b158e91583ac4ddcdaffa258adc71b0e18b95e5865024676f419fa908d0953f798929faa4f8f5324bb8a21d4f8bea8d3af73864ae87d392ec

Download Submit
memory/216-324-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/224-57-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/316-49-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/412-340-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/556-224-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/748-236-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/836-318-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/960-360-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/972-33-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1088-384-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1108-378-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1204-179-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1212-88-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1624-268-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1656-330-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1892-260-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1900-402-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1904-432-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1940-408-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1964-276-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2188-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2188-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2188-1-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2196-282-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2264-300-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2376-94-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2520-243-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2876-372-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3032-240-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3060-420-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3076-41-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3088-342-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3148-110-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3180-426-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3312-270-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3352-114-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3500-98-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3584-65-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3612-348-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3712-249-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3744-252-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3752-312-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3764-354-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3804-21-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3948-72-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3972-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3976-269-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4280-261-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4328-288-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4388-396-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4432-257-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4468-239-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4528-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4540-122-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4572-306-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4580-242-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4640-366-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4652-195-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4672-394-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4840-258-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4956-294-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4984-262-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5020-187-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5092-418-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads