f589118b4d360e67ae9a5062aa430f3a14691392aade5d32e606d0570994d26a

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

077a9c186f4ef7d1cea4508e6a344f3a.exe
Size

112KB
MD5

077a9c186f4ef7d1cea4508e6a344f3a
SHA1

56d24ed6a1672f6045f8c3f4bf71b6fe4a05b39f
SHA256

f589118b4d360e67ae9a5062aa430f3a14691392aade5d32e606d0570994d26a
SHA512

d1a3f44f64f2450004179db3c671bf19de4282d4d0bec1181a94876b41d0fb19b0b7ca1f360e6b656e961eadad8fd53d66c1cc3fee9b72a7102483cd7c7e3174
SSDEEP

3072:eItU93g9QMKNQULGFkFPSuKBFeJLCQnFIBOaCUjKaVLjd:e59+dWouKBFeJLbnCBbC+nVLjd

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbphglbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oiccje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqgojmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fnckpmql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmjkic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehndnh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dafppp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpdennml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idjlpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oohnonij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Phajna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohlqcagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bkibgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enmjlojd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llnnmhfe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjaqpbkh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dnmaea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ebdlangb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cabomkll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpleig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Opnbae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qpcecb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qmgelf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oocddono.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pofjpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddkbmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fndpmndl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pflplnlg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjpobg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jngbjd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beeoaapl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajqgidij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpiqfima.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fajgkfio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fielph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gndick32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppdbgncl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnodaecc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocohmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kemooo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfcdfbqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lncjlq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nfgmjqop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fajgkfio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gipdap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ehlhih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbenoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ockdmmoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofnckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oclkgccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ahofoogd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jebfng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fndpmndl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egdqae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbgoof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpgeee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibgdlg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifihif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgeakekd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jhplpl32.exe

Executes dropped EXE 64 IoCs

pid	Process
3948	Melnob32.exe
1576	Mcpnhfhf.exe
4228	Mnebeogl.exe
3688	Ndokbi32.exe
4808	Nljofl32.exe
2368	Nebdoa32.exe
4816	Ndcdmikd.exe
4132	Nfgmjqop.exe
1244	Ndhmhh32.exe
1300	Nnqbanmo.exe
3004	Ogifjcdp.exe
2472	Odmgcgbi.exe
3920	Ofnckp32.exe
2392	Opdghh32.exe
1472	Ojllan32.exe
864	Ogpmjb32.exe
4364	Oqhacgdh.exe
1824	Ogbipa32.exe
5012	Pqknig32.exe
5076	Pfhfan32.exe
3352	Pqmjog32.exe
3096	Pggbkagp.exe
3672	Pqpgdfnp.exe
2144	Pflplnlg.exe
3684	Pqbdjfln.exe
3068	Pgllfp32.exe
1552	Pqdqof32.exe
2340	Qnhahj32.exe
2680	Aclpap32.exe
2948	Ajfhnjhq.exe
368	Acnlgp32.exe
2644	Ajhddjfn.exe
4596	Aeniabfd.exe
1152	Aminee32.exe
3528	Agoabn32.exe
1996	Bmkjkd32.exe
2676	Bfdodjhm.exe
4184	Beeoaapl.exe
4256	Bjagjhnc.exe
1920	Bcjlcn32.exe
1888	Bfhhoi32.exe
3020	Beihma32.exe
3344	Bjfaeh32.exe
2784	Belebq32.exe
4600	Cjinkg32.exe
3184	Cabfga32.exe
3244	Cnffqf32.exe
2192	Ceqnmpfo.exe
5016	Cnicfe32.exe
2436	Chagok32.exe
1036	Cmnpgb32.exe
3780	Cdhhdlid.exe
2620	Cmqmma32.exe
3444	Ddjejl32.exe
3748	Djdmffnn.exe
720	Dejacond.exe
3120	Dfknkg32.exe
1896	Daqbip32.exe
1048	Dkifae32.exe
3456	Ddakjkqi.exe
1680	Dkkcge32.exe
3136	Deagdn32.exe
5104	Dgbdlf32.exe
3088	Dahhio32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Eajbghaq.dll	Hnlodjpa.exe
File created	C:\Windows\SysWOW64\Mhldbh32.exe	Mcoljagj.exe
File created	C:\Windows\SysWOW64\Ajjokd32.exe	Acqgojmb.exe
File opened for modification	C:\Windows\SysWOW64\Efkphnbd.exe	Edmclccp.exe
File created	C:\Windows\SysWOW64\Fkihnmhj.exe	Edopabqn.exe
File created	C:\Windows\SysWOW64\Jngbjd32.exe	Jocefm32.exe
File created	C:\Windows\SysWOW64\Aamebb32.dll	Cgnomg32.exe
File opened for modification	C:\Windows\SysWOW64\Mbjnbqhp.exe	Mfcmmp32.exe
File created	C:\Windows\SysWOW64\Gdodhh32.dll	Opcqnb32.exe
File opened for modification	C:\Windows\SysWOW64\Jbiejoaj.exe	Jjamia32.exe
File created	C:\Windows\SysWOW64\Nbphglbe.exe	Nmcpoedn.exe
File created	C:\Windows\SysWOW64\Bobabg32.exe	Bdmmeo32.exe
File created	C:\Windows\SysWOW64\Mcoljagj.exe	Mpapnfhg.exe
File created	C:\Windows\SysWOW64\Dndfnlpc.dll	Oonlfo32.exe
File created	C:\Windows\SysWOW64\Jeqbpb32.exe	Jkhngl32.exe
File created	C:\Windows\SysWOW64\Gejain32.dll	Oaifpi32.exe
File opened for modification	C:\Windows\SysWOW64\Bphgeo32.exe	Bmjkic32.exe
File created	C:\Windows\SysWOW64\Lnjkcfod.dll	Fbmohmoh.exe
File created	C:\Windows\SysWOW64\Kpjbdk32.dll	Ddkbmj32.exe
File created	C:\Windows\SysWOW64\Ojllan32.exe	Opdghh32.exe
File opened for modification	C:\Windows\SysWOW64\Npbceggm.exe	Nclbpf32.exe
File opened for modification	C:\Windows\SysWOW64\Medqcmki.exe	Mbedga32.exe
File created	C:\Windows\SysWOW64\Dinmhkke.exe	Dpehof32.exe
File created	C:\Windows\SysWOW64\Fmbgla32.dll	Aogbfi32.exe
File created	C:\Windows\SysWOW64\Dicdcemd.dll	Npbceggm.exe
File created	C:\Windows\SysWOW64\Nnfiop32.dll	Imgicgca.exe
File created	C:\Windows\SysWOW64\Ebdlangb.exe	Ekjded32.exe
File created	C:\Windows\SysWOW64\Dahhio32.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Hbhhgenc.dll	Ekbihd32.exe
File opened for modification	C:\Windows\SysWOW64\Igfkfo32.exe	Idgojc32.exe
File created	C:\Windows\SysWOW64\Hmofee32.dll	Dikpbl32.exe
File created	C:\Windows\SysWOW64\Hdilnojp.exe	Hnodaecc.exe
File created	C:\Windows\SysWOW64\Pnfiplog.exe	Ohlqcagj.exe
File created	C:\Windows\SysWOW64\Lpggmhkg.dll	Cmnpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Ombcji32.exe	Ofhknodl.exe
File opened for modification	C:\Windows\SysWOW64\Dkndie32.exe	Dhphmj32.exe
File opened for modification	C:\Windows\SysWOW64\Odmgcgbi.exe	Ogifjcdp.exe
File created	C:\Windows\SysWOW64\Gkiaej32.exe	Gpcmga32.exe
File opened for modification	C:\Windows\SysWOW64\Llcghg32.exe	Llqjbhdc.exe
File opened for modification	C:\Windows\SysWOW64\Nodiqp32.exe	Nijqcf32.exe
File created	C:\Windows\SysWOW64\Dcmann32.dll	Ncjginjn.exe
File created	C:\Windows\SysWOW64\Aplpihjd.dll	Dmpfbk32.exe
File opened for modification	C:\Windows\SysWOW64\Afpjel32.exe	Qpeahb32.exe
File opened for modification	C:\Windows\SysWOW64\Edmclccp.exe	Eigonjcj.exe
File created	C:\Windows\SysWOW64\Bpajnp32.dll	Jkjcbe32.exe
File created	C:\Windows\SysWOW64\Gpihol32.dll	Fknbil32.exe
File created	C:\Windows\SysWOW64\Nahffe32.dll	Jhpqaiji.exe
File created	C:\Windows\SysWOW64\Ogifjcdp.exe	Nnqbanmo.exe
File opened for modification	C:\Windows\SysWOW64\Qfbobf32.exe	Qljjjqlc.exe
File created	C:\Windows\SysWOW64\Pdmdnadc.exe	Pfiddm32.exe
File opened for modification	C:\Windows\SysWOW64\Fmgejhgn.exe	Fkihnmhj.exe
File created	C:\Windows\SysWOW64\Inpoggcb.dll	Qfmfefni.exe
File created	C:\Windows\SysWOW64\Dibkjmof.dll	Mgehfkop.exe
File created	C:\Windows\SysWOW64\Dannij32.exe	Dgejpd32.exe
File created	C:\Windows\SysWOW64\Ffpicn32.exe	Fpeafcfa.exe
File created	C:\Windows\SysWOW64\Ojqhdcii.dll	Mlofcf32.exe
File created	C:\Windows\SysWOW64\Amfobp32.exe	Qfmfefni.exe
File opened for modification	C:\Windows\SysWOW64\Pqdqof32.exe	Pgllfp32.exe
File created	C:\Windows\SysWOW64\Mhibfmcl.dll	Bppfmigl.exe
File created	C:\Windows\SysWOW64\Npbblbdb.dll	Phganm32.exe
File opened for modification	C:\Windows\SysWOW64\Dkhgod32.exe	Dglkoeio.exe
File created	C:\Windows\SysWOW64\Dejacond.exe	Djdmffnn.exe
File opened for modification	C:\Windows\SysWOW64\Opcqnb32.exe	Ohlimd32.exe
File opened for modification	C:\Windows\SysWOW64\Ffpicn32.exe	Fpeafcfa.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6860	8136	WerFault.exe	664

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdllgpbm.dll"	Lncjlq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aaldccip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mfpell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lifcnk32.dll"	Gnmlhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Emoinpcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qjiipk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Khlklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Obqanjdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ggcfja32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lejnmncd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Niklpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khlaie32.dll"	Mpclce32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iafkld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njbgmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjmkqm32.dll"	Fkcboack.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjhjimfo.dll"	Ddifgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gnkaalkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hhihdcbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipmcpl32.dll"	Mifcejnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fgoakc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iijfhbhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hghklqmm.dll"	Khlklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Popodg32.dll"	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpoqijhk.dll"	Ekgbccni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Khlklj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kpiqfima.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lokdnjkg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkhgod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kbhmbdle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjmgbm32.dll"	Gkcigjel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bpfkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjdeo32.dll"	Feapkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mblkhq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dpphjp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jbagbebm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckmllpik.dll"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kaafjamj.dll"	Emhldnkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbmoin32.dll"	Hdilnojp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Emhldnkj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kniieo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hhaggp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaejqcdo.dll"	Joqafgni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dgeenfog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cidcnbjk.dll"	Foclgq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fdlkdhnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jlgoek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mhoahh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgpilmfi.dll"	Gbbajjlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Haplhc32.dll"	Kkhpdcab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ngndaccj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmofee32.dll"	Dikpbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kijchhbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mlofcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pqbdjfln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgplfcko.dll"	Afnnnd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jibmgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oonlfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gpdennml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kfcdfbqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fgoakc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oebfih32.dll"	Fajgkfio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cclaff32.dll"	Ghmbno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dahhio32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 3948	4928	077a9c186f4ef7d1cea4508e6a344f3a.exe	85
PID 4928 wrote to memory of 3948	4928	077a9c186f4ef7d1cea4508e6a344f3a.exe	85
PID 4928 wrote to memory of 3948	4928	077a9c186f4ef7d1cea4508e6a344f3a.exe	85
PID 3948 wrote to memory of 1576	3948	Melnob32.exe	86
PID 3948 wrote to memory of 1576	3948	Melnob32.exe	86
PID 3948 wrote to memory of 1576	3948	Melnob32.exe	86
PID 1576 wrote to memory of 4228	1576	Mcpnhfhf.exe	88
PID 1576 wrote to memory of 4228	1576	Mcpnhfhf.exe	88
PID 1576 wrote to memory of 4228	1576	Mcpnhfhf.exe	88
PID 4228 wrote to memory of 3688	4228	Mnebeogl.exe	89
PID 4228 wrote to memory of 3688	4228	Mnebeogl.exe	89
PID 4228 wrote to memory of 3688	4228	Mnebeogl.exe	89
PID 3688 wrote to memory of 4808	3688	Ndokbi32.exe	90
PID 3688 wrote to memory of 4808	3688	Ndokbi32.exe	90
PID 3688 wrote to memory of 4808	3688	Ndokbi32.exe	90
PID 4808 wrote to memory of 2368	4808	Nljofl32.exe	91
PID 4808 wrote to memory of 2368	4808	Nljofl32.exe	91
PID 4808 wrote to memory of 2368	4808	Nljofl32.exe	91
PID 2368 wrote to memory of 4816	2368	Nebdoa32.exe	92
PID 2368 wrote to memory of 4816	2368	Nebdoa32.exe	92
PID 2368 wrote to memory of 4816	2368	Nebdoa32.exe	92
PID 4816 wrote to memory of 4132	4816	Ndcdmikd.exe	93
PID 4816 wrote to memory of 4132	4816	Ndcdmikd.exe	93
PID 4816 wrote to memory of 4132	4816	Ndcdmikd.exe	93
PID 4132 wrote to memory of 1244	4132	Nfgmjqop.exe	94
PID 4132 wrote to memory of 1244	4132	Nfgmjqop.exe	94
PID 4132 wrote to memory of 1244	4132	Nfgmjqop.exe	94
PID 1244 wrote to memory of 1300	1244	Ndhmhh32.exe	95
PID 1244 wrote to memory of 1300	1244	Ndhmhh32.exe	95
PID 1244 wrote to memory of 1300	1244	Ndhmhh32.exe	95
PID 1300 wrote to memory of 3004	1300	Nnqbanmo.exe	96
PID 1300 wrote to memory of 3004	1300	Nnqbanmo.exe	96
PID 1300 wrote to memory of 3004	1300	Nnqbanmo.exe	96
PID 3004 wrote to memory of 2472	3004	Ogifjcdp.exe	98
PID 3004 wrote to memory of 2472	3004	Ogifjcdp.exe	98
PID 3004 wrote to memory of 2472	3004	Ogifjcdp.exe	98
PID 2472 wrote to memory of 3920	2472	Odmgcgbi.exe	99
PID 2472 wrote to memory of 3920	2472	Odmgcgbi.exe	99
PID 2472 wrote to memory of 3920	2472	Odmgcgbi.exe	99
PID 3920 wrote to memory of 2392	3920	Ofnckp32.exe	100
PID 3920 wrote to memory of 2392	3920	Ofnckp32.exe	100
PID 3920 wrote to memory of 2392	3920	Ofnckp32.exe	100
PID 2392 wrote to memory of 1472	2392	Opdghh32.exe	101
PID 2392 wrote to memory of 1472	2392	Opdghh32.exe	101
PID 2392 wrote to memory of 1472	2392	Opdghh32.exe	101
PID 1472 wrote to memory of 864	1472	Ojllan32.exe	102
PID 1472 wrote to memory of 864	1472	Ojllan32.exe	102
PID 1472 wrote to memory of 864	1472	Ojllan32.exe	102
PID 864 wrote to memory of 4364	864	Ogpmjb32.exe	103
PID 864 wrote to memory of 4364	864	Ogpmjb32.exe	103
PID 864 wrote to memory of 4364	864	Ogpmjb32.exe	103
PID 4364 wrote to memory of 1824	4364	Oqhacgdh.exe	104
PID 4364 wrote to memory of 1824	4364	Oqhacgdh.exe	104
PID 4364 wrote to memory of 1824	4364	Oqhacgdh.exe	104
PID 1824 wrote to memory of 5012	1824	Ogbipa32.exe	105
PID 1824 wrote to memory of 5012	1824	Ogbipa32.exe	105
PID 1824 wrote to memory of 5012	1824	Ogbipa32.exe	105
PID 5012 wrote to memory of 5076	5012	Pqknig32.exe	106
PID 5012 wrote to memory of 5076	5012	Pqknig32.exe	106
PID 5012 wrote to memory of 5076	5012	Pqknig32.exe	106
PID 5076 wrote to memory of 3352	5076	Pfhfan32.exe	107
PID 5076 wrote to memory of 3352	5076	Pfhfan32.exe	107
PID 5076 wrote to memory of 3352	5076	Pfhfan32.exe	107
PID 3352 wrote to memory of 3096	3352	Pqmjog32.exe	108

C:\Users\Admin\AppData\Local\Temp\077a9c186f4ef7d1cea4508e6a344f3a.exe
"C:\Users\Admin\AppData\Local\Temp\077a9c186f4ef7d1cea4508e6a344f3a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\Melnob32.exe
  C:\Windows\system32\Melnob32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\SysWOW64\Mcpnhfhf.exe
    C:\Windows\system32\Mcpnhfhf.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Windows\SysWOW64\Mnebeogl.exe
      C:\Windows\system32\Mnebeogl.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4228
    - - C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3688
      - C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2368
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1244
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1300
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2472
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3920
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1472
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:864
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3352
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        23⤵
        Executes dropped EXE
        
        PID:3096
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        24⤵
        Executes dropped EXE
        
        PID:3672
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2144
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3684
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3068
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        28⤵
        Executes dropped EXE
        
        PID:1552
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        29⤵
        Executes dropped EXE
        
        PID:2340
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        30⤵
        Executes dropped EXE
        
        PID:2680
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        31⤵
        Executes dropped EXE
        
        PID:2948
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        32⤵
        Executes dropped EXE
        
        PID:368
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        33⤵
        Executes dropped EXE
        
        PID:2644
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        34⤵
        Executes dropped EXE
        
        PID:4596
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1152
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        36⤵
        Executes dropped EXE
        
        PID:3528
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        37⤵
        Executes dropped EXE
        
        PID:1996
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2676
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4184
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        40⤵
        Executes dropped EXE
        
        PID:4256
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        41⤵
        Executes dropped EXE
        
        PID:1920
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        42⤵
        Executes dropped EXE
        
        PID:1888
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        43⤵
        Executes dropped EXE
        
        PID:3020
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        44⤵
        Executes dropped EXE
        
        PID:3344
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        45⤵
        Executes dropped EXE
        
        PID:2784
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        46⤵
        Executes dropped EXE
        
        PID:4600
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        47⤵
        Executes dropped EXE
        
        PID:3184
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        48⤵
        Executes dropped EXE
        
        PID:3244
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2192
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        50⤵
        Executes dropped EXE
        
        PID:5016
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        51⤵
        Executes dropped EXE
        
        PID:2436
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1036
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        53⤵
        Executes dropped EXE
        
        PID:3780
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        54⤵
        Executes dropped EXE
        
        PID:2620
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        55⤵
        Executes dropped EXE
        
        PID:3444
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3748
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        57⤵
        Executes dropped EXE
        
        PID:720
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        58⤵
        Executes dropped EXE
        
        PID:3120
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1896
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        60⤵
        Executes dropped EXE
        
        PID:1048
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        61⤵
        Executes dropped EXE
        
        PID:3456
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        62⤵
        Executes dropped EXE
        
        PID:1680
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        63⤵
        Executes dropped EXE
        
        PID:3136
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5104
        
        C:\Windows\SysWOW64\Dahhio32.exe
        
        C:\Windows\system32\Dahhio32.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3088
        
        C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2688
        
        C:\Windows\SysWOW64\Emoinpcd.exe
        
        C:\Windows\system32\Emoinpcd.exe
        67⤵
        Modifies registry class
        
        PID:3692
        
        C:\Windows\SysWOW64\Ekbihd32.exe
        
        C:\Windows\system32\Ekbihd32.exe
        68⤵
        Drops file in System32 directory
        
        PID:3124
        
        C:\Windows\SysWOW64\Edknqiho.exe
        
        C:\Windows\system32\Edknqiho.exe
        69⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\Eejjjl32.exe
        
        C:\Windows\system32\Eejjjl32.exe
        70⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Ekgbccni.exe
        
        C:\Windows\system32\Ekgbccni.exe
        71⤵
        Modifies registry class
        
        PID:2640
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        72⤵
        
        PID:756
        
        C:\Windows\SysWOW64\Ehkclgmb.exe
        
        C:\Windows\system32\Ehkclgmb.exe
        73⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\Emhldnkj.exe
        
        C:\Windows\system32\Emhldnkj.exe
        74⤵
        Modifies registry class
        
        PID:3104
        
        C:\Windows\SysWOW64\Fhmpagkp.exe
        
        C:\Windows\system32\Fhmpagkp.exe
        75⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Foghnabl.exe
        
        C:\Windows\system32\Foghnabl.exe
        76⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\Feapkk32.exe
        
        C:\Windows\system32\Feapkk32.exe
        77⤵
        Modifies registry class
        
        PID:4432
        
        C:\Windows\SysWOW64\Fgbmccpg.exe
        
        C:\Windows\system32\Fgbmccpg.exe
        78⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\Fnmepn32.exe
        
        C:\Windows\system32\Fnmepn32.exe
        79⤵
        
        PID:556
        
        C:\Windows\SysWOW64\Fhbimf32.exe
        
        C:\Windows\system32\Fhbimf32.exe
        80⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Fefjfked.exe
        
        C:\Windows\system32\Fefjfked.exe
        81⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Fkcboack.exe
        
        C:\Windows\system32\Fkcboack.exe
        82⤵
        Modifies registry class
        
        PID:3496
        
        C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        83⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\Fnckpmql.exe
        
        C:\Windows\system32\Fnckpmql.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2104
        
        C:\Windows\SysWOW64\Gglpibgm.exe
        
        C:\Windows\system32\Gglpibgm.exe
        85⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\Gaadfkgc.exe
        
        C:\Windows\system32\Gaadfkgc.exe
        86⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\Ggnlobej.exe
        
        C:\Windows\system32\Ggnlobej.exe
        87⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Gadqlkep.exe
        
        C:\Windows\system32\Gadqlkep.exe
        88⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\Ghniielm.exe
        
        C:\Windows\system32\Ghniielm.exe
        89⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Gnkaalkd.exe
        
        C:\Windows\system32\Gnkaalkd.exe
        90⤵
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Ggcfja32.exe
        
        C:\Windows\system32\Ggcfja32.exe
        91⤵
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        92⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Hkehkocf.exe
        
        C:\Windows\system32\Hkehkocf.exe
        93⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Hbpphi32.exe
        
        C:\Windows\system32\Hbpphi32.exe
        94⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        95⤵
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Hnfamjqg.exe
        
        C:\Windows\system32\Hnfamjqg.exe
        96⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Hhlejcpm.exe
        
        C:\Windows\system32\Hhlejcpm.exe
        97⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        98⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Hdbfodfa.exe
        
        C:\Windows\system32\Hdbfodfa.exe
        99⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Inkjhi32.exe
        
        C:\Windows\system32\Inkjhi32.exe
        100⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Igcoqocb.exe
        
        C:\Windows\system32\Igcoqocb.exe
        101⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Inmgmijo.exe
        
        C:\Windows\system32\Inmgmijo.exe
        102⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Idgojc32.exe
        
        C:\Windows\system32\Idgojc32.exe
        103⤵
        Drops file in System32 directory
        
        PID:5768
        
        C:\Windows\SysWOW64\Igfkfo32.exe
        
        C:\Windows\system32\Igfkfo32.exe
        104⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Idjlpc32.exe
        
        C:\Windows\system32\Idjlpc32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5880
        
        C:\Windows\SysWOW64\Ioopml32.exe
        
        C:\Windows\system32\Ioopml32.exe
        106⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Ifihif32.exe
        
        C:\Windows\system32\Ifihif32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5972
        
        C:\Windows\SysWOW64\Indmnh32.exe
        
        C:\Windows\system32\Indmnh32.exe
        108⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Ienekbld.exe
        
        C:\Windows\system32\Ienekbld.exe
        109⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Jkhngl32.exe
        
        C:\Windows\system32\Jkhngl32.exe
        110⤵
        Drops file in System32 directory
        
        PID:6104
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        111⤵
        
        PID:796
        
        C:\Windows\SysWOW64\Jfpojead.exe
        
        C:\Windows\system32\Jfpojead.exe
        112⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Jgakbm32.exe
        
        C:\Windows\system32\Jgakbm32.exe
        113⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Jbgoof32.exe
        
        C:\Windows\system32\Jbgoof32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5268
        
        C:\Windows\SysWOW64\Jpkphjeb.exe
        
        C:\Windows\system32\Jpkphjeb.exe
        115⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Knefeffd.exe
        
        C:\Windows\system32\Knefeffd.exe
        116⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        117⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Klkcdj32.exe
        
        C:\Windows\system32\Klkcdj32.exe
        118⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Kbekqdjh.exe
        
        C:\Windows\system32\Kbekqdjh.exe
        119⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Khbdikip.exe
        
        C:\Windows\system32\Khbdikip.exe
        120⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        121⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5956
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        123⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        124⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Llbidimc.exe
        
        C:\Windows\system32\Llbidimc.exe
        125⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Lnqeqd32.exe
        
        C:\Windows\system32\Lnqeqd32.exe
        126⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        127⤵
        Modifies registry class
        
        PID:5284
        
        C:\Windows\SysWOW64\Lhijijbg.exe
        
        C:\Windows\system32\Lhijijbg.exe
        128⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Lbnngbbn.exe
        
        C:\Windows\system32\Lbnngbbn.exe
        129⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Lihfcm32.exe
        
        C:\Windows\system32\Lihfcm32.exe
        130⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Loeolc32.exe
        
        C:\Windows\system32\Loeolc32.exe
        131⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Lflgmqhd.exe
        
        C:\Windows\system32\Lflgmqhd.exe
        132⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Lpekef32.exe
        
        C:\Windows\system32\Lpekef32.exe
        133⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Leadnm32.exe
        
        C:\Windows\system32\Leadnm32.exe
        134⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        135⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Mbedga32.exe
        
        C:\Windows\system32\Mbedga32.exe
        136⤵
        Drops file in System32 directory
        
        PID:3428
        
        C:\Windows\SysWOW64\Medqcmki.exe
        
        C:\Windows\system32\Medqcmki.exe
        137⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Mpieqeko.exe
        
        C:\Windows\system32\Mpieqeko.exe
        138⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Mfcmmp32.exe
        
        C:\Windows\system32\Mfcmmp32.exe
        139⤵
        Drops file in System32 directory
        
        PID:4836
        
        C:\Windows\SysWOW64\Mbjnbqhp.exe
        
        C:\Windows\system32\Mbjnbqhp.exe
        140⤵
        
        PID:208
        
        C:\Windows\SysWOW64\Mblkhq32.exe
        
        C:\Windows\system32\Mblkhq32.exe
        141⤵
        Modifies registry class
        
        PID:2972
        
        C:\Windows\SysWOW64\Mifcejnj.exe
        
        C:\Windows\system32\Mifcejnj.exe
        142⤵
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Mockmala.exe
        
        C:\Windows\system32\Mockmala.exe
        143⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Nhlpfgbb.exe
        
        C:\Windows\system32\Nhlpfgbb.exe
        144⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Nbadcpbh.exe
        
        C:\Windows\system32\Nbadcpbh.exe
        145⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Niklpj32.exe
        
        C:\Windows\system32\Niklpj32.exe
        146⤵
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Npedmdab.exe
        
        C:\Windows\system32\Npedmdab.exe
        147⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Nebmekoi.exe
        
        C:\Windows\system32\Nebmekoi.exe
        148⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Nojanpej.exe
        
        C:\Windows\system32\Nojanpej.exe
        149⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        150⤵
        Drops file in System32 directory
        
        PID:6188
        
        C:\Windows\SysWOW64\Ohgoaehe.exe
        
        C:\Windows\system32\Ohgoaehe.exe
        151⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Ooagno32.exe
        
        C:\Windows\system32\Ooagno32.exe
        152⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        153⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        154⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6404
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        156⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        157⤵
        Drops file in System32 directory
        
        PID:6488
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        158⤵
        Drops file in System32 directory
        
        PID:6532
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        159⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Oohnonij.exe
        
        C:\Windows\system32\Oohnonij.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6624
        
        C:\Windows\SysWOW64\Ojnblg32.exe
        
        C:\Windows\system32\Ojnblg32.exe
        161⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Pjpobg32.exe
        
        C:\Windows\system32\Pjpobg32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6708
        
        C:\Windows\SysWOW64\Ppjgoaoj.exe
        
        C:\Windows\system32\Ppjgoaoj.exe
        163⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        164⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Poodpmca.exe
        
        C:\Windows\system32\Poodpmca.exe
        165⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Pfillg32.exe
        
        C:\Windows\system32\Pfillg32.exe
        166⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Plcdiabk.exe
        
        C:\Windows\system32\Plcdiabk.exe
        167⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Pgihfj32.exe
        
        C:\Windows\system32\Pgihfj32.exe
        168⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Pcpikkge.exe
        
        C:\Windows\system32\Pcpikkge.exe
        169⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Phlacbfm.exe
        
        C:\Windows\system32\Phlacbfm.exe
        170⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7116
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        172⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Qljjjqlc.exe
        
        C:\Windows\system32\Qljjjqlc.exe
        173⤵
        Drops file in System32 directory
        
        PID:6196
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        174⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        175⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Ajqgidij.exe
        
        C:\Windows\system32\Ajqgidij.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6424
        
        C:\Windows\SysWOW64\Aqmlknnd.exe
        
        C:\Windows\system32\Aqmlknnd.exe
        177⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Aqoiqn32.exe
        
        C:\Windows\system32\Aqoiqn32.exe
        178⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Agiamhdo.exe
        
        C:\Windows\system32\Agiamhdo.exe
        179⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Aqaffn32.exe
        
        C:\Windows\system32\Aqaffn32.exe
        180⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Afnnnd32.exe
        
        C:\Windows\system32\Afnnnd32.exe
        181⤵
        Modifies registry class
        
        PID:6724
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        182⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6864
        
        C:\Windows\SysWOW64\Bqkill32.exe
        
        C:\Windows\system32\Bqkill32.exe
        184⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Bgeaifia.exe
        
        C:\Windows\system32\Bgeaifia.exe
        185⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Bifmqo32.exe
        
        C:\Windows\system32\Bifmqo32.exe
        186⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Bppfmigl.exe
        
        C:\Windows\system32\Bppfmigl.exe
        187⤵
        Drops file in System32 directory
        
        PID:7160
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        188⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Cmdfgm32.exe
        
        C:\Windows\system32\Cmdfgm32.exe
        189⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Cgjjdf32.exe
        
        C:\Windows\system32\Cgjjdf32.exe
        190⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6564
        
        C:\Windows\SysWOW64\Cfogeb32.exe
        
        C:\Windows\system32\Cfogeb32.exe
        192⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Cmipblaq.exe
        
        C:\Windows\system32\Cmipblaq.exe
        193⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Cgndoeag.exe
        
        C:\Windows\system32\Cgndoeag.exe
        194⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        195⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7104
        
        C:\Windows\SysWOW64\Cffmfadl.exe
        
        C:\Windows\system32\Cffmfadl.exe
        197⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Dmpfbk32.exe
        
        C:\Windows\system32\Dmpfbk32.exe
        198⤵
        Drops file in System32 directory
        
        PID:6372
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        199⤵
        Drops file in System32 directory
        
        PID:6504
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        200⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Dhjckcgi.exe
        
        C:\Windows\system32\Dhjckcgi.exe
        201⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\Dikpbl32.exe
        
        C:\Windows\system32\Dikpbl32.exe
        202⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6972
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        203⤵
        Drops file in System32 directory
        
        PID:7148
        
        C:\Windows\SysWOW64\Dinmhkke.exe
        
        C:\Windows\system32\Dinmhkke.exe
        204⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6648
        
        C:\Windows\SysWOW64\Epjajeqo.exe
        
        C:\Windows\system32\Epjajeqo.exe
        206⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Emnbdioi.exe
        
        C:\Windows\system32\Emnbdioi.exe
        207⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        208⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        209⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Eigonjcj.exe
        
        C:\Windows\system32\Eigonjcj.exe
        210⤵
        Drops file in System32 directory
        
        PID:7180
        
        C:\Windows\SysWOW64\Edmclccp.exe
        
        C:\Windows\system32\Edmclccp.exe
        211⤵
        Drops file in System32 directory
        
        PID:7224
        
        C:\Windows\SysWOW64\Efkphnbd.exe
        
        C:\Windows\system32\Efkphnbd.exe
        212⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        213⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Edopabqn.exe
        
        C:\Windows\system32\Edopabqn.exe
        214⤵
        Drops file in System32 directory
        
        PID:7392
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        215⤵
        Drops file in System32 directory
        
        PID:7452
        
        C:\Windows\SysWOW64\Fmgejhgn.exe
        
        C:\Windows\system32\Fmgejhgn.exe
        216⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Fpeafcfa.exe
        
        C:\Windows\system32\Fpeafcfa.exe
        217⤵
        Drops file in System32 directory
        
        PID:7548
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        218⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        219⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Fhofmq32.exe
        
        C:\Windows\system32\Fhofmq32.exe
        220⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        221⤵
        Drops file in System32 directory
        
        PID:7724
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        222⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        223⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Fibojhim.exe
        
        C:\Windows\system32\Fibojhim.exe
        224⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7900
        
        C:\Windows\SysWOW64\Fdhcgaic.exe
        
        C:\Windows\system32\Fdhcgaic.exe
        226⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Fielph32.exe
        
        C:\Windows\system32\Fielph32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7984
        
        C:\Windows\SysWOW64\Gpcmga32.exe
        
        C:\Windows\system32\Gpcmga32.exe
        228⤵
        Drops file in System32 directory
        
        PID:8024
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        229⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        230⤵
        Modifies registry class
        
        PID:8112
        
        C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        231⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Gnlgleef.exe
        
        C:\Windows\system32\Gnlgleef.exe
        232⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        233⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7328
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        235⤵
        Modifies registry class
        
        PID:7444
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        236⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Hnaqgd32.exe
        
        C:\Windows\system32\Hnaqgd32.exe
        237⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Hgiepjga.exe
        
        C:\Windows\system32\Hgiepjga.exe
        238⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Hncmmd32.exe
        
        C:\Windows\system32\Hncmmd32.exe
        239⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        240⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        241⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        242⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        243⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Iafonaao.exe
        
        C:\Windows\system32\Iafonaao.exe
        244⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        245⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        246⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Ikcmbfcj.exe
        
        C:\Windows\system32\Ikcmbfcj.exe
        247⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        248⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        249⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Jhijqj32.exe
        
        C:\Windows\system32\Jhijqj32.exe
        250⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        251⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Jbaojpgb.exe
        
        C:\Windows\system32\Jbaojpgb.exe
        252⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Jdpkflfe.exe
        
        C:\Windows\system32\Jdpkflfe.exe
        253⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        254⤵
        Drops file in System32 directory
        
        PID:8176
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        255⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        256⤵
        Drops file in System32 directory
        
        PID:7588
        
        C:\Windows\SysWOW64\Jjamia32.exe
        
        C:\Windows\system32\Jjamia32.exe
        257⤵
        Drops file in System32 directory
        
        PID:7692
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        258⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        259⤵
        Modifies registry class
        
        PID:8136
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        260⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        261⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        262⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Kjffdalb.exe
        
        C:\Windows\system32\Kjffdalb.exe
        263⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        264⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        265⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        266⤵
        Modifies registry class
        
        PID:8148
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        267⤵
        Modifies registry class
        
        PID:7864
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        268⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        269⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Kniieo32.exe
        
        C:\Windows\system32\Kniieo32.exe
        270⤵
        Modifies registry class
        
        PID:8320
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        271⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        272⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        273⤵
        Drops file in System32 directory
        
        PID:8524
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        274⤵
        Modifies registry class
        
        PID:8572
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8636
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        276⤵
        Drops file in System32 directory
        
        PID:8712
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        277⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        278⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        279⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        280⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        281⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        282⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        283⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        284⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        285⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        286⤵
        Drops file in System32 directory
        
        PID:9192
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        287⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        288⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        289⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        290⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        291⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        292⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        293⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        294⤵
        Drops file in System32 directory
        
        PID:2320
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8548
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8628
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        297⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        298⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        299⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        300⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        301⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        302⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        303⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        304⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        305⤵
        Modifies registry class
        
        PID:1488
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        306⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        307⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        308⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        309⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        310⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        311⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        312⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1244
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        314⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        315⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        316⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        317⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        318⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        319⤵
        
        PID:720
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5104
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        321⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        322⤵
        Drops file in System32 directory
        
        PID:2132
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        323⤵
        Drops file in System32 directory
        
        PID:2868
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        324⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        325⤵
        
        PID:1136
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        326⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        327⤵
        Modifies registry class
        
        PID:1900
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        328⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        329⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        330⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        331⤵
        Drops file in System32 directory
        
        PID:3672
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        332⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        333⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8804
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        335⤵
        Drops file in System32 directory
        
        PID:8852
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        336⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8928
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        338⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9048
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        340⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        341⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9168
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        343⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        344⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        345⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8316
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        347⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        348⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        349⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        350⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        351⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        352⤵
        Drops file in System32 directory
        
        PID:8544
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        353⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        354⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        355⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2476
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        357⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        358⤵
        Modifies registry class
        
        PID:4252
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4860
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        360⤵
        Drops file in System32 directory
        
        PID:1156
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        361⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        362⤵
        Drops file in System32 directory
        
        PID:1068
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        363⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4272
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        365⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        366⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        367⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        368⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        369⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        370⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        371⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        372⤵
        Modifies registry class
        
        PID:464
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        373⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        374⤵
        
        PID:760
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        375⤵
        Drops file in System32 directory
        
        PID:2784
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        376⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        377⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3120
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        379⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        380⤵
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        381⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        382⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3496
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        384⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        385⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        386⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        387⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        388⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2860
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        390⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        391⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        392⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        393⤵
        Drops file in System32 directory
        
        PID:5324
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        394⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        395⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        396⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        397⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5636
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        399⤵
        Drops file in System32 directory
        
        PID:6276
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        400⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        401⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9176
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        402⤵
        Modifies registry class
        
        PID:6364
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        403⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        404⤵
        Modifies registry class
        
        PID:3424
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        405⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Damfao32.exe
        
        C:\Windows\system32\Damfao32.exe
        406⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8328
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        408⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        409⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Dqbcbkab.exe
        
        C:\Windows\system32\Dqbcbkab.exe
        410⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        411⤵
        Drops file in System32 directory
        
        PID:5884
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        412⤵
        Modifies registry class
        
        PID:6756
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        413⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        414⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        415⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4516
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        416⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5912
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        418⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6140
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        420⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        421⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        422⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        423⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        424⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3792
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        425⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        426⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        427⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        428⤵
        
        PID:3372
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        429⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        430⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        431⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        432⤵
        Drops file in System32 directory
        
        PID:2620
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        433⤵
        Modifies registry class
        
        PID:5820
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        434⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5080
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        436⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        437⤵
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        438⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        439⤵
        Modifies registry class
        
        PID:4808
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        440⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        441⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        442⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        443⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        444⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        445⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        446⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        447⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        448⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        449⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        450⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        451⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9076
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        452⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Ggmmlamj.exe
        
        C:\Windows\system32\Ggmmlamj.exe
        453⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        455⤵
        Modifies registry class
        
        PID:8384
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        456⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        457⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7044
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        458⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        459⤵
        Modifies registry class
        
        PID:5628
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        460⤵
        Drops file in System32 directory
        
        PID:6680
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        461⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        462⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        463⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        464⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        465⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        466⤵
        Modifies registry class
        
        PID:1296
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        467⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        468⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        469⤵
        Modifies registry class
        
        PID:7060
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        470⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        471⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        472⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        473⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        474⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        475⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6824
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        476⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        477⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        478⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        479⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        480⤵
        Modifies registry class
        
        PID:2152
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        481⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        482⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        483⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        484⤵
        Modifies registry class
        
        PID:6180
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        485⤵
        Modifies registry class
        
        PID:6300
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        486⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        487⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        488⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5640
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        489⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        490⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        491⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        492⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        493⤵
        Modifies registry class
        
        PID:7860
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        494⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        495⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        496⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        497⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5692
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        498⤵
        Modifies registry class
        
        PID:6400
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        499⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        500⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        501⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        502⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        503⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        504⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        505⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7752
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        506⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        507⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        508⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        509⤵
        Drops file in System32 directory
        
        PID:2372
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        510⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        511⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        512⤵
        Drops file in System32 directory
        
        PID:8180
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        513⤵
        Drops file in System32 directory
        
        PID:5424
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        514⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        515⤵
        Modifies registry class
        
        PID:6376
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        516⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        517⤵
        Modifies registry class
        
        PID:8160
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        518⤵
        Modifies registry class
        
        PID:7544
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        519⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        520⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:540
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        521⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        522⤵
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        523⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        524⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        525⤵
        Drops file in System32 directory
        
        PID:4112
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1912
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        527⤵
        Drops file in System32 directory
        
        PID:396
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        528⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        529⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        530⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        531⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        532⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        533⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        534⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        535⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        536⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8056
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        537⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7724
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        538⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        539⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6396
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        540⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        541⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        542⤵
        Modifies registry class
        
        PID:7220
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        543⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        544⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5444
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        545⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        546⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        547⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        548⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        549⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        550⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        551⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        552⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        553⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        554⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        555⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        556⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        557⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        558⤵
        Drops file in System32 directory
        
        PID:7632
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        559⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        560⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1896
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        561⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Aibibp32.exe
        
        C:\Windows\system32\Aibibp32.exe
        562⤵
        
        PID:544
        
        C:\Windows\SysWOW64\Gnmlhf32.exe
        
        C:\Windows\system32\Gnmlhf32.exe
        563⤵
        Modifies registry class
        
        PID:7276
        
        C:\Windows\SysWOW64\Gqkhda32.exe
        
        C:\Windows\system32\Gqkhda32.exe
        564⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Gcjdam32.exe
        
        C:\Windows\system32\Gcjdam32.exe
        565⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Gnohnffc.exe
        
        C:\Windows\system32\Gnohnffc.exe
        566⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Gdiakp32.exe
        
        C:\Windows\system32\Gdiakp32.exe
        567⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Gggmgk32.exe
        
        C:\Windows\system32\Gggmgk32.exe
        568⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Gkcigjel.exe
        
        C:\Windows\system32\Gkcigjel.exe
        569⤵
        Modifies registry class
        
        PID:7316
        
        C:\Windows\SysWOW64\Gbmadd32.exe
        
        C:\Windows\system32\Gbmadd32.exe
        570⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8136 -s 424
        571⤵
        Program crash
        
        PID:6860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 8136 -ip 8136
1⤵
PID:6660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aclpap32.exe

Filesize
112KB

MD5
5f98bbbc9d5cfb966aaefdd511b500b3

SHA1
9db58fd8cea793fccccdb4439a242d11b7627175

SHA256
aa0b22daf09ed3d160e8075e6b515b278d4a092fa27e4857211fc10bcddb6519

SHA512
3c40422057c6dab98a088e14eec399ceb0eacedcdbe1698aba5311ca618b83bc55eb49bcda6709aa9ab9d1f11aedc12ac8b0186bda10feffc6d7d6e3157f7ec6

Download Submit
C:\Windows\SysWOW64\Acnlgp32.exe

Filesize
112KB

MD5
83604a848c0f58e1106dca7c7a5f0bee

SHA1
18bce48803547a06a3a9b2962a53f24e72f83cad

SHA256
18d97b85e5bf3e8b9c39a4f9b770550d6a97be61ccff4b592a03d6944ab92aac

SHA512
ff4ab9a83a0af37e87eb342a75f517032fc0105319baae25d86aa683dc114eda446b5236f67828dd390dfc040b44ea4a8cb2c73542dde4f7b4bd611e41a7eeec

Download Submit
C:\Windows\SysWOW64\Ajfhnjhq.exe

Filesize
112KB

MD5
c543d1e1cef6670a3223d4050b69ff1b

SHA1
0f8bd821a804484b08e708dd7a63ae1c69277259

SHA256
6159d420358d021f3e5cc8ddb51d9124281c06c14c54c1503c733437ce2cfe77

SHA512
0cb0554e7ef58eb84dca32d85aa650358e3b32b65109f35f3abc5adc4941a357bc63516d4ae4119332df4e00171e8a3ad5d6983713571d0f5a26d3108106a3d7

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
112KB

MD5
3b7bf20365ae4be8b30e81d73238ab5e

SHA1
5d6b7f2c675074338b295d9a7410426fd919c1ad

SHA256
1ed227134d19fa4c4ecaec1a966dab519e34b92a9b09ff8b821306f9a592d640

SHA512
cc20b52db8fd60193017be5b5e0d329acff992a64881dc25a9713a60b0edcb7f25313cc0a864dacc9904ec979b0b8808bdec9986ffb49769182dc6d904603ebd

Download Submit
C:\Windows\SysWOW64\Aqmlknnd.exe

Filesize
112KB

MD5
40ca9ef57bfe79934ff81d5214f07dd6

SHA1
f55d45e32c71cc1f61217c9a6ffdfb99065dfcd3

SHA256
fcc892bf8683a539de8cead761971e20bf0e34754917b277710e21f05dddbb24

SHA512
040db74189482b482332cac9bcce6dc7ff6f0c1540e1a1a3afa5f3c348a0ef5f3d4e984f2aaa4068c5e67f0969f3ac9f3656def3eb37d755596edcbbaa98e6c6

Download Submit
C:\Windows\SysWOW64\Chfgkj32.dll

Filesize
7KB

MD5
c9dee70de9334c2077b00e35a28fe568

SHA1
e13c4c24514d2b16a2dcdd8adb7ac3b4af1f8ce2

SHA256
90ff97cfc602ed1935fd8a889080eb096171f594adbe234f9da89e0cc61b2a13

SHA512
58a368a54490d645a1d003982145c474fc2196909fe7e9d800a40e5f6aaab460c0ae8a2bd0de4034b33dc826e95d25affadb161e286d7ac329aacdad0aa77804

Download Submit
C:\Windows\SysWOW64\Dannij32.exe

Filesize
112KB

MD5
7b74e257a6cd0c9d71e9a8c6a21de933

SHA1
a79bc580f926ee2c36c95338d7665944f06396a9

SHA256
9fa7eb8f470bf1eaa9ae4f272467a26179a590635ed5fe7176b37db5cad9a6f7

SHA512
5b29ab013579e1a317dfc5c0845e64bff1e7539cd8d5458e4b0aa001792f8457f64763ca28f529758d76dac28e7f4ae8b35654917ca5e7ccb17b05d38e6818e8

Download Submit
C:\Windows\SysWOW64\Eejjjl32.exe

Filesize
112KB

MD5
7400e4ce1256c15c951a7d86c391517e

SHA1
7239f0815a8073eb1b4b1bda1a67a406c2e9e87b

SHA256
5807c35fe33ceb73b9c5497a3ab5d1a6e5fc66dfdf8bad1aa5829e523deaf8c6

SHA512
fb4bc65004da83d52dd8c48b70b5d07fb81ea3a36eece5781789191239b2e7c93e577da553428c236e4f4c75b42f70d8749fb08a45c087ebae7b095aa15b9f97

Download Submit
C:\Windows\SysWOW64\Epjajeqo.exe

Filesize
112KB

MD5
5123fcceca5ae412ded3cbbe3987622e

SHA1
d3cb61955399aec87c56e064585e847abc7040a6

SHA256
b222ef6f0f6832ccb256f4febcf99e6f3c7e04d43b36362ad95d3ae0a1d0d3e1

SHA512
aa78a1c7f4176eccf087211564eeb6308be0d693b9859211bcf8ebae8b562d040435db98df62d3adeeeb06a1696f3603b9f25f204769bca2d651daf442787883

Download Submit
C:\Windows\SysWOW64\Fhbimf32.exe

Filesize
112KB

MD5
e028d175c24a7d547d3b751e870e4de1

SHA1
8f38c6e56c944390500ac3f9b4f45edd70be3a8b

SHA256
41c105b9ba455f643d86ce71354a21401a7acbd08abdb32343df59a4f437c3a8

SHA512
47786230fde0859b6973c4105cbd11076030e8de718460dbb2dda071366224371d5435c96e91433393f408e2f5aab7e23fbefaf1080c67212045b68536bd1225

Download Submit
C:\Windows\SysWOW64\Fhmpagkp.exe

Filesize
112KB

MD5
805c5486c5ec642dfb31ede644950d1c

SHA1
00b0606bca2956ae7b04043b1ff260dd2a7cd276

SHA256
7d879c4a5c5f6e94d1fbf01b6bc74c3d1ef86982f5a0175c0475318e175b6e14

SHA512
d872af0ac4e9becb1ef8fb88fb1b1ad08e137bcb7815c8fec63351360392297db7af99ae1f7297de58de8f2d6ef35cc5e05cf45d9be695092c3e5ea605e3b3c2

Download Submit
C:\Windows\SysWOW64\Gicgpelg.exe

Filesize
112KB

MD5
ecbc513a62a27e9426e6e30efc212ac7

SHA1
4b1ee5b1743b045b2ad8009183a79f81c038571e

SHA256
de44a366061d9f4b1ce0efa06ecf5bb61a74594eec9d4a1e463a0b5c855df1ef

SHA512
0670b95144bbeb0fe21ae208493be7b3491c95d58a6002e0d35f8cb4bf63b2f718d5c8fd23eef2ba9881668bc86b8a2607bc2ba1fbaacd3e80ac5a3d863a6c4a

Download Submit
C:\Windows\SysWOW64\Gipdap32.exe

Filesize
112KB

MD5
3cf3ae2941013c57eda5bbfaf16e937e

SHA1
daf14c55b4984da8dec2dc9bf1577c4bbcc3e369

SHA256
63646e7067053074f1d3b134e9ec18a3c8adf8fdc1af81db36be09a7dab6523b

SHA512
83dac1e38299d7b92522d84f098429675a8011bad15d19d724416aa04bbc84e9c85dfcd4ed31aca174242b68d77832b22c3c24cd96ef61e2afedfbdcddd48df6

Download Submit
C:\Windows\SysWOW64\Hacbhb32.exe

Filesize
112KB

MD5
12729aff2206d43cc3fc81a1efc259a2

SHA1
2e39a6a245b63bd3b48cd20bddaf3c87a5a7c1f9

SHA256
9a25884e4d5efbc5ac8e3ccfceab0fb16b51bb83cc171d1d5fcb4b8dd49b9a04

SHA512
ed4db44d17a664fd0515dbb514f3c4be707439b0ae9c7fe011fa5e21ee4a0b5d59c2f0b8bfa8d7e07f117eacf8a33c6f601201f14112fae97fd363804ebee4a2

Download Submit
C:\Windows\SysWOW64\Ijcahd32.exe

Filesize
112KB

MD5
74731fe1a8aebfb2a8577cc3381d89f0

SHA1
a278eb644f7ba3b72dfe3a89a68387e2c80eb442

SHA256
bd42aa7264a31943c199e0c8ad090521d792da7719bda12143aca7ba81d576eb

SHA512
fbd003af65042491331a7fe10c20caceeca26155000a1f58a3112cac2995bda7f86d8c2fec3ae523ecae2280a8a6b05876c6d3dd08f167572f1771efc600acfe

Download Submit
C:\Windows\SysWOW64\Jeqbpb32.exe

Filesize
112KB

MD5
bc3d00dc6d32a88706d3a967ea8d5d1b

SHA1
eadc0c16dc8c7d0db88de2a2163362a5d8544903

SHA256
d7c99f689aa1395ed5d139376a4e048d70be9241fd06ce62920c9290396c7201

SHA512
cd24fa6d5d5dd6b622c9c0b08a68b90f52efd66c03c04068ee712f57e9e6fac5d514d4421628a3df1dbd5788a1758afe0b74836dbeaafd4230caea4aaaa9dc47

Download Submit
C:\Windows\SysWOW64\Kcjjhdjb.exe

Filesize
64KB

MD5
b7408209d8c158a1e9f4263bf8f02ed5

SHA1
562806b15ada5b2b492b222125f3ce48044b4bfc

SHA256
8b353fc73e9b2579f55b0c734d267b4e5fef8b64c45642390dcd578a7a91c713

SHA512
a4371cc7c1c33046c7ad551f387b9a90694784b27b2d2c72461246ce8116c17b51657e22c6b947cc27bd9b67d3f6ba0add7a361c00f3e95eb3f992740cca1cc7

Download Submit
C:\Windows\SysWOW64\Llcghg32.exe

Filesize
112KB

MD5
ed5a81a0fa29857e15e1dc504d40bf54

SHA1
7ac0434831d4fbf21ff490af5ef8411f5ea44caf

SHA256
100b2d0f63b69bfd1b487bfbe2a900e8d4326fed5ef0ca67365193bc9051a46f

SHA512
78b305cf58008bab0bbb72dd8af4ac5082f002c34a634658749d42270debabf9748e94ba074fa86fe01e401a42efd5d907d853b8a9c6fbdcc9a00e9c8c2ebb15

Download Submit
C:\Windows\SysWOW64\Mcpnhfhf.exe

Filesize
112KB

MD5
311b8c9627dfc3c0e8f8c811809d82b7

SHA1
6f961c5e7187eeac0a7861502c7caee84a6ccf27

SHA256
31521eba8651f838100bbd7860fffebd27423f1d05f66c1c76cb8a5b8f356273

SHA512
bce639434d2174859d00f2530e7d8febecb46ef80a179c3289c60371ec45a9e8e8bd2bc508056ae7aaf03c62d7bb04f7c6d8d2a3a96baa211bdb1fb310be9f58

Download Submit
C:\Windows\SysWOW64\Melnob32.exe

Filesize
112KB

MD5
1ccfeb25b9775f9284f9998562c10b95

SHA1
6122a29f4f14a74bdba7202518b205ee969ed398

SHA256
e1a6ce6b32169b0fdce54f08b82ab9737b0ca155f62a3489c2be9b8f0dedc255

SHA512
0d5f1277eecbb7f7add9849bbdb0ae3311be999d460f0303af3b1402691e96d287b5f136be0f11d7e6cd33a6c217a514f594c9a69962f0dda396bcff19e167df

Download Submit
C:\Windows\SysWOW64\Mnebeogl.exe

Filesize
112KB

MD5
731e6282cc23ba002ba53f343bd128dc

SHA1
7cecafd914f8877c4bc9051ae155ed6c4c708f23

SHA256
1f9cd1a5c8615a914c7205421a5ba253652d6e188319b599fac650be5fb66d91

SHA512
ea5a84cba105bcbc5fd60b9985b15abb65d78aa3c8d1ffeb8b44d4f9e9c0c39cf7851ed1991798f3ec7987ffe0244a73857426659b340411d65596167087056f

Download Submit
C:\Windows\SysWOW64\Ndcdmikd.exe

Filesize
112KB

MD5
45efc240bfb7f0c0527167ea1fb30db2

SHA1
5c56884ea1d29c57bc19020982973112a299148e

SHA256
fb99d0e058888a7b8f7555238127b4d74b0d921888b33798b0d644875362d317

SHA512
640af2336b23bccb8c97cccd97f14b0e0cd8ffe3a56a688a71798c89750dc0d0979633ecc54644eb40573008ec1114e3ff19d8957adaedb8ab166be30aab617b

Download Submit
C:\Windows\SysWOW64\Ndhmhh32.exe

Filesize
112KB

MD5
5c720348ddcebb289725b1eb45ce4bed

SHA1
d7b4a51216e56cd729b6c22ee33019020486f29a

SHA256
3354d4e7629973aab098f8da869d177add403646ccb7a031cf34d5c33fee427d

SHA512
5e71be8936b3cc0859c6da7690ecc55d842348cc3eab00b010e9f118108cd73e27adc55569b8acb07bf3cd2ae9df7c87f9c980cda4ee94d27bb9a791c6b66e0e

Download Submit
C:\Windows\SysWOW64\Ndokbi32.exe

Filesize
112KB

MD5
81acb8332123487e1b57c6845595ac2b

SHA1
23478f4cbb75b41ef620a5fee15ee0b9e49dcf5b

SHA256
8d11154517a0d81b93e1c170eda8870b849868208600b8f8621bab0214eb4f2e

SHA512
c479dbbf5719454f1f75d166fdeaf7b5a5041077e1126997907acbe131b1d401d5512fcad3e1ad7b0f459a083b8517f4e719adbe3ce9b8923d875f926d66b191

Download Submit
C:\Windows\SysWOW64\Nebdoa32.exe

Filesize
112KB

MD5
e96a6657c5347d630263e613efa9c9c7

SHA1
1a7506416a8658266a06e9b28aa9c27acdfbac3b

SHA256
a591cf67180043e304ed5138aee1e095a88018ed57765e1149c47e1106bd021f

SHA512
f91b7d0c2b9799ab698de5c6fe3ecd1c64420f02ab2c869e73d66271498bfa7bf79abe87d31f12016b191855a4364fa4b6eb15d3575201feefce65e29d721a43

Download Submit
C:\Windows\SysWOW64\Nfgmjqop.exe

Filesize
112KB

MD5
cd0131c3479f8ea50a07c57289e36256

SHA1
38d8754c24653c4b41f92adafd745686509f2940

SHA256
711a457ca67a4bf93532590699976c4e1743d0af342f4584076d70c2016df130

SHA512
a9619219d3867a208db7768ba39cd010bccf492d75269bfcf4102c13b0a2f17573516222e0c0a6e81f97292482be037c8b9d09e61ed5b1949426028b36586992

Download Submit
C:\Windows\SysWOW64\Nljofl32.exe

Filesize
112KB

MD5
2bfe8b777f390e4561eda789033a5871

SHA1
470fdc63bbc6629e2d1c15adcc2f09bfb2db01c5

SHA256
bbb570c6c5363ebb357bd4dbc54f19e15781f03bfaa2888e66a3ad18916971c6

SHA512
0ed3903ae5929a879cfb4fe3936b18bd43ea98cb2bba992ac328163c1ce8b6cd9fcbed72a358075c5ea27bc6c469800ad62b74005471412de3e186676989e4a6

Download Submit
C:\Windows\SysWOW64\Nnqbanmo.exe

Filesize
112KB

MD5
debdc4cdff7e613b44f6b265c11e74da

SHA1
a727ed91b2d606afe7a26ee87cc333cdce97ab22

SHA256
176f863a03111b0d062f0ee1aa3c4c78986f00c7dac0741b7f690dfd29160280

SHA512
28154868e042fe9d0ca39cf58178fb5eb29bdfa3913afd512ade883a774b920bae5e78ca6b0cfb63332cc7d32c4410593f448357dbfda6fd7af91c901ad166eb

Download Submit
C:\Windows\SysWOW64\Odmgcgbi.exe

Filesize
112KB

MD5
445af6e76b93d46b8bb4211eb688c626

SHA1
c8a3d0248dd4c81a06622bd02bbb0cee4c423f7a

SHA256
28dd905fdaf4cc8b1a14e9cc3bc711b880f24a61b06daa922da061102035ebae

SHA512
62dc3f8e6b3ac724c9c34498356f2bd8524c7c8ab0e377ebdd0a09ea43e0e591864e8c9a1394d87957b53c01b6fbbb290d878cac73cce4549b01e4298cc931a5

Download Submit
C:\Windows\SysWOW64\Ofnckp32.exe

Filesize
112KB

MD5
fffb38415ca2f7fbf4aefdca276478ea

SHA1
c14125759b1b0686ee4405be395e7b6321513159

SHA256
0b6b0c418621a095053d6a6db3aec35abb9fc759aa394dffd4c3a3ae4f37135b

SHA512
314079376305f35b902f24484e709957e6a742a7cee1fb7319600fb0effc9f11ad3ca8c841e11f64304b6fe846bd5a156b3897aa2539794258caaac983e15ad9

Download Submit
C:\Windows\SysWOW64\Ogbipa32.exe

Filesize
112KB

MD5
b6655f67345da5b983a39509b7e7fa81

SHA1
f3997deb61ca3bec6c4f3e9ab7878050e5aa80f1

SHA256
6e49794078d5bb12b7cc058836c08ae53830debb918964e9ae8d55174bb80feb

SHA512
0011807352658ab379e7d438066421f0e826c0ba92c9deaa442b525bf3b351ceb325e1b4479019ee3b2a8cee6517b3f4dd88c8a398f308863e74a7fa733868a9

Download Submit
C:\Windows\SysWOW64\Ogifjcdp.exe

Filesize
112KB

MD5
f0298b6c743add82509821965b8787cb

SHA1
d2b36e9446bebad100d9eeba37673b01de8bc0eb

SHA256
ee4da422d59fbd333e2dee86735939dabf888972898236147b27341f54b0f138

SHA512
3146fe374fd54dd25c613fcf705fb3084df3993277dbb11a4577f939c9746baf472856110ab296eb51a34e65476bf1e13b26706ddf185f0b07f9a59207768cf9

Download Submit
C:\Windows\SysWOW64\Ogpmjb32.exe

Filesize
112KB

MD5
75c6056c75d186101060aac903cf2727

SHA1
2248944f3d55d5bfd9363371ada9e7b973da157d

SHA256
48c5b5585c4cecde9269da22c210f14232d885a4a9bb2a95ed507e4314c21b7f

SHA512
9ce1cf8c4402af12faed2f8f4394671e85b4f47c1b3ffd781c308a3f6c23a97436db33ef219079fcec31465c976439fedf06f33fed322d047d2853f34a797a6d

Download Submit
C:\Windows\SysWOW64\Ojllan32.exe

Filesize
112KB

MD5
abf6b54ab5861a8ea6b21eea28a0d822

SHA1
a913c2fa9425f6a510ab5c2d0b0f42e8f5e3df31

SHA256
2adae1ee08496bb2b87c2640f46b7681b12ac475a8332a83e9db1c38aad688e3

SHA512
d4825c98b13046ff0c2837cf5baf5c9e25a4521951f063b61804261c3a9439754f3d0e74979c400e54ffd1f5bae7241d3cebabb7930ea67f5ce435aa286aa253

Download Submit
C:\Windows\SysWOW64\Opdghh32.exe

Filesize
112KB

MD5
eb189d3647116d729b7af330fd895bfc

SHA1
e5056e9c06c15def2f642b28729e6cac07b109bc

SHA256
cf1dbdabead504d5ec96128ef45727fd42d41b3324e7a613cc3c1a630c63d81f

SHA512
7d88c69f262021747e10594b1dfa5cbd23424fcb0546204bddd8f17d29e4726cb1b8516081397cd81ca08b5781419592f12946057fe01dbb61cb832f8bec615a

Download Submit
C:\Windows\SysWOW64\Oqhacgdh.exe

Filesize
112KB

MD5
6402636f4dfcfaab52a5f6b6a7163563

SHA1
eab60a17ba9b47e8b6463cedc0d842de8c1c4d3a

SHA256
a30a9454830a792d7752ebd01ef354f0fe4889733da13bd53f60ead7ce642389

SHA512
97c8ebcaf2b2aac61101bdaf51505423db3cd812439c4fae08887d24f6ea27b258abdb8affb77fd63ad52c71e612c6be908d5f2c323ccebafc18cf1f61358e23

Download Submit
C:\Windows\SysWOW64\Pfhfan32.exe

Filesize
112KB

MD5
d7a7e9a55109402e7a3bffd41f094674

SHA1
f1ee55214cce8e714cf1d169dae10791acf2c007

SHA256
339a22a618312b72b1e48686af170f456f009b4af6fd929312315177739478a7

SHA512
21bc1005972f71c6e4923dc637376107743ad40ea89025bf5f84e1d43cf22450a30806b531ab5219c32c517f90f63c8a650a2ff3e33ce1c7857ccc0680577868

Download Submit
C:\Windows\SysWOW64\Pfiddm32.exe

Filesize
112KB

MD5
ac4e0a808dcc9a48405b627a0b42da75

SHA1
faa89668714f01d88be2d439988d48f2d80d8fbc

SHA256
26e56bc94ef7a873b6a7af0223e35bf457426b5fe7046c5178fe770d85d2f110

SHA512
492f9c55dcd3b01e47ac564f410122631922bb82cfa8e10f9c420aff44044898e5c6795cc7a6742e66eec3db454d524be6bb40e3e1f8f5e1de16ef08a1682e0b

Download Submit
C:\Windows\SysWOW64\Pflplnlg.exe

Filesize
112KB

MD5
2feea1bb55ff502ca2063633bfbc4d34

SHA1
249ecfbf9535fe2d5e286b9711ccf88d5a2acd3b

SHA256
6426341fe7c237b0a4f69f7a09b74fe8caba26d508ba4dbdcb7ae0d6e9b71603

SHA512
d19a0ccccee528efe5eb6816fcecc94dc527a378b7ca7b67839a967f64ee08f561781d259bce6e0fceba98aceb5c2da1e5f48ccedc2a58d28d8acd319dd483bf

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
112KB

MD5
a5b08050850432ae18ebc758e2859883

SHA1
56c89b47750fe5e38c819f46f6c89ff455676631

SHA256
eeb63ae36e82351730f2a5c987c6eb57e1cd7a716806101983ff643c20d2a7a8

SHA512
9f4dd237b42dc6eb527667bad3134a8877c7c4f89f56e6284ffd4fa0b41cd7cd534b5b9b677d7ee0365bba56642e6f49bc922ca440557a1ac88d1fdce833e78c

Download Submit
C:\Windows\SysWOW64\Pgllfp32.exe

Filesize
112KB

MD5
ad193299392300f5fd7aeccf97fa0e6f

SHA1
1e658f5a01f1efd5a61cd9aa14afb5183df3cfa1

SHA256
6849784e533c63ee203946c1f41ddc2af03533921ecc312ce5af108c0d932f37

SHA512
d8011fd1e7088bc03014a33a6e4930247715cee03ba03fe33156461ac073489daf99c2a5ea221355f47110ba6795709e08a73bb7fc704ee1aad1a92b878b9518

Download Submit
C:\Windows\SysWOW64\Pqbdjfln.exe

Filesize
112KB

MD5
fccb06533bc19dc9a31abd2c313fd788

SHA1
8b7a7a5e74a312705abf492432043baac5a8eb15

SHA256
45fb9a6f27e9307f41dbb0c515f60376a821d0996ea845dcfff17bba0b97d499

SHA512
49554f3131d68dbae93d22efcc7b2c785c87e0bc563f867e5e516b207e0af17ea7a178880d0e3d1aee9fa474cae84601504a9baa1e7e267773a5b4a12ed17145

Download Submit
C:\Windows\SysWOW64\Pqdqof32.exe

Filesize
112KB

MD5
cea11631454cf85353c661fb16944929

SHA1
959a82dbca1dcc84922688945e9a41ca48a2dd32

SHA256
8d8d6fe9dc7708d192540e84ec886a35962e923a83b369bc67594da331deb09c

SHA512
b2eed65e724a261d49747c2556ce99480667add2fb2c8cf698fa1f7fe44faff680fe45f5811894e60d26ffaff159be1fcd67e24c59ec3c2ba0a7df0ea25ae001

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
112KB

MD5
16549c8b89d1a61228dd006f5b20e64c

SHA1
afb708520503161de925ca5cef42af016f98c280

SHA256
9aa698483ec09f55fda46afb64e840c5b02a94073561c1e177b6d7f4e9a4d4b4

SHA512
00f5ed2cfcd97b5c3d4117237491ea08e0390e2d8a71179ffde44c8421c5e0f6b2d123c3322ebb92f153265af5185fba2ff77d22cd321a824ce6ded34feb99ae

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
112KB

MD5
93b52789978df1c5326eb74978160a94

SHA1
3f0754c6e30a21a3dc31870060464b5f0698001d

SHA256
672725cc66cfdf5be606993084d33879f3be37c6ce90ef15ec789a6c40bc29f4

SHA512
273282c22d3278f041dd90337bac76c384d8af0f91abf03519ca5d8193bcce17dd11f28a08e382abc815bc3a775aa18b32aacde1c5d37ae437f4a1c9a9a023e8

Download Submit
C:\Windows\SysWOW64\Pqpgdfnp.exe

Filesize
112KB

MD5
479a1314b3e8fd22fef4a9b955c695ae

SHA1
4f42999ee70950dc56eba62f3db58b6b3d8649c6

SHA256
44b34ba2b92296e7f8c9a539223c0ab4408bb1763d583403127472068e491d5d

SHA512
ebdcf878b5f6f26f4d481f6002c7ec4117a5a841cb85bec6c2ee1ac678ba5988838e07e7a6be45f922653f3d28a37740f490f39023ed93a7535cd630024eca6e

Download Submit
C:\Windows\SysWOW64\Qnhahj32.exe

Filesize
112KB

MD5
1aeeddb582c53ca7ef25a9d1fed7eee9

SHA1
7104d7c59b63a99ff0cd6ff047593cfcddad36b5

SHA256
f53816e7748ebdd104b78c87208b72cc7622eaa2ef998a90f8fee194bc71733c

SHA512
7a1f75b103836945e6bf1a5bcf12807ef875f862402362d4d9a680af38da2cb9cf9742f2d5661392e5099e979ca3f6a8c259cfe804c09ab169c123b6f272cdb1

Download Submit
memory/368-248-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/720-400-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/864-128-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1036-370-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1048-418-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1152-268-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1244-71-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1300-79-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1472-119-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1552-215-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1576-16-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1680-430-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1824-144-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1888-310-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1896-412-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1920-304-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1996-280-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2144-191-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2192-352-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2340-223-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2368-47-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2392-112-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2436-368-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2472-96-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2620-386-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2644-255-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2676-286-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2680-232-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2784-328-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2948-240-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3004-87-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3020-320-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3068-208-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3096-176-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3120-406-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3136-436-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3184-340-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3244-346-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3344-322-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3352-168-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3444-392-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3456-424-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3528-274-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3672-183-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3684-200-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3688-32-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3748-394-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3780-376-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3920-104-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3948-8-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4132-63-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4184-292-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4228-24-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4256-298-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4364-135-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4596-262-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4600-334-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4808-40-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4816-56-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4928-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5012-152-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5016-358-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5076-159-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5104-442-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads