cd494bdf243469bd6ccabe50ea35b0f28c18fcf5b9ff3c4c69bb24023082631e

Analysis

max time kernel
101s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb2c3f923137007ca6e90930fb129f2d.exe
Size

79KB
MD5

fb2c3f923137007ca6e90930fb129f2d
SHA1

3992b2a8f2305d374986ced91f3582e10a8cb627
SHA256

cd494bdf243469bd6ccabe50ea35b0f28c18fcf5b9ff3c4c69bb24023082631e
SHA512

98c129b06eeb10c9125becb7ecc96f2475326106a4f3684778b3de8aceb1e6dafa66be89c7e136ea9bf5cff89fc6484fb94333f83be94e36036553e23dc19261
SSDEEP

1536:c2K6JJqC3PKAwfIqKjB0nq0pqj2pma7xUEXiFkSIgiItKq9v6DK:c2tDqC3+xzhrNUEXixtBtKq9vV

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcioiood.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceoibflm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chghdqbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njciko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gblngpbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpbmco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecjhcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmlpoqpg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mibpda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obangb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfcicmqp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecandfpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaepqjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhjfhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qajadlja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jplfcpin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojmcld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojllan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmkadgpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pabkdmpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnkdhpjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dedkdcie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hijooifk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkkojgao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocqnij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbmelbid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qecppkdm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nilcjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alabgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Immapg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogpmjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Peqcjkfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eekaebcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhkapp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfpcgpae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lphoelqn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mchhggno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdjagjco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqnaim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkljak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edpnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbqlfkmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cecbmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmdkch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bejogg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehnglm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Febgea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcojed32.exe

Executes dropped EXE 64 IoCs

pid	Process
632	Mcbahlip.exe
2216	Nkjjij32.exe
4704	Nacbfdao.exe
1492	Nqfbaq32.exe
3076	Ngpjnkpf.exe
316	Njogjfoj.exe
224	Nafokcol.exe
3584	Nddkgonp.exe
3948	Ngcgcjnc.exe
3664	Nnmopdep.exe
1908	Nqklmpdd.exe
4916	Ncihikcg.exe
2308	Nkqpjidj.exe
4764	Nnolfdcn.exe
2812	Ndidbn32.exe
3232	Nggqoj32.exe
4668	Njfmke32.exe
2964	Nbmelbid.exe
3052	Ncnadk32.exe
2148	Ojhiqefo.exe
3100	Oboaabga.exe
4088	Ocqnij32.exe
3280	Okhfjh32.exe
3048	Obangb32.exe
1736	Okjbpglo.exe
768	Ojmcld32.exe
3060	Oqgkhnjf.exe
4888	Ocegdjij.exe
2108	Ojopad32.exe
3044	Obfhba32.exe
4636	Ocgdji32.exe
1620	Ogcpjhoq.exe
4440	Onmhgb32.exe
4124	Obidhaog.exe
3468	Pcjapi32.exe
2328	Pjdilcla.exe
4328	Pqnaim32.exe
3804	Pclneicb.exe
3748	Pkceffcd.exe
4648	Pnbbbabh.exe
2668	Pqpnombl.exe
2036	Pkfblfab.exe
3452	Pndohaqe.exe
384	Pabkdmpi.exe
3204	Pgmcqggf.exe
3496	Pkhoae32.exe
4952	Pnfkma32.exe
1108	Pbbgnpgl.exe
4748	Peqcjkfp.exe
5020	Pgopffec.exe
4140	Pjmlbbdg.exe
2296	Qecppkdm.exe
1472	Qkmhlekj.exe
2244	Qnkdhpjn.exe
1048	Qajadlja.exe
4768	Qgciaf32.exe
2952	Qbimoo32.exe
1928	Acjjfggb.exe
5060	Alabgd32.exe
4108	Anpncp32.exe
2404	Aejfpjne.exe
3976	Ajfoiqll.exe
2808	Abngjnmo.exe
1924	Aelcfilb.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ahoimd32.exe	Aaepqjpd.exe
File created	C:\Windows\SysWOW64\Nnenbk32.dll	Cehkhecb.exe
File opened for modification	C:\Windows\SysWOW64\Eekaebcm.exe	Ecmeig32.exe
File created	C:\Windows\SysWOW64\Gcddpdpo.exe	Gohhpe32.exe
File created	C:\Windows\SysWOW64\Idodkeom.dll	Mnebeogl.exe
File created	C:\Windows\SysWOW64\Clncadfb.dll	Ogpmjb32.exe
File created	C:\Windows\SysWOW64\Pmfhig32.exe	Pncgmkmj.exe
File created	C:\Windows\SysWOW64\Oahicipe.dll	Afoeiklb.exe
File opened for modification	C:\Windows\SysWOW64\Balpgb32.exe	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Mkijij32.dll	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Gleeed32.dll	Ncnadk32.exe
File created	C:\Windows\SysWOW64\Dldpkoil.exe	Dhidjpqc.exe
File created	C:\Windows\SysWOW64\Mjljbfog.dll	Fdialn32.exe
File created	C:\Windows\SysWOW64\Jfaedkdp.exe	Jbeidl32.exe
File opened for modification	C:\Windows\SysWOW64\Ojoign32.exe	Ogpmjb32.exe
File created	C:\Windows\SysWOW64\Oiqbfn32.dll	Anpncp32.exe
File created	C:\Windows\SysWOW64\Ajneip32.exe	Ahoimd32.exe
File created	C:\Windows\SysWOW64\Cafigg32.exe	Cogmkl32.exe
File created	C:\Windows\SysWOW64\Fpkknm32.dll	Ndfqbhia.exe
File opened for modification	C:\Windows\SysWOW64\Dhnnep32.exe	Dadeieea.exe
File created	C:\Windows\SysWOW64\Mmnldp32.exe	Mibpda32.exe
File created	C:\Windows\SysWOW64\Aihbcp32.dll	Mmnldp32.exe
File created	C:\Windows\SysWOW64\Panfqmhb.dll	Pfhfan32.exe
File created	C:\Windows\SysWOW64\Qajadlja.exe	Qnkdhpjn.exe
File created	C:\Windows\SysWOW64\Jbeidl32.exe	Jpgmha32.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Legdcg32.dll	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Kgllfjld.dll	Pnfkma32.exe
File created	C:\Windows\SysWOW64\Bbifelba.exe	Beeflhdh.exe
File opened for modification	C:\Windows\SysWOW64\Cecbmf32.exe	Cbefaj32.exe
File created	C:\Windows\SysWOW64\Jbgkimpf.dll	Dkgqfl32.exe
File created	C:\Windows\SysWOW64\Jcllonma.exe	Jlednamo.exe
File created	C:\Windows\SysWOW64\Menjdbgj.exe	Mdmnlj32.exe
File created	C:\Windows\SysWOW64\Ojgbfocc.exe	Ogifjcdp.exe
File created	C:\Windows\SysWOW64\Igjnojdk.dll	Pcijeb32.exe
File opened for modification	C:\Windows\SysWOW64\Kmdqgd32.exe	Jcllonma.exe
File created	C:\Windows\SysWOW64\Cdicgd32.dll	Ogcpjhoq.exe
File opened for modification	C:\Windows\SysWOW64\Lingibiq.exe	Lebkhc32.exe
File created	C:\Windows\SysWOW64\Afmhck32.exe	Aeklkchg.exe
File opened for modification	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bjagjhnc.exe
File opened for modification	C:\Windows\SysWOW64\Pqpnombl.exe	Pnbbbabh.exe
File created	C:\Windows\SysWOW64\Bdfibe32.exe	Abemjmgg.exe
File opened for modification	C:\Windows\SysWOW64\Hfcicmqp.exe	Hoiafcic.exe
File opened for modification	C:\Windows\SysWOW64\Opdghh32.exe	Oneklm32.exe
File opened for modification	C:\Windows\SysWOW64\Andqdh32.exe	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Lpcfkm32.exe	Lmdina32.exe
File opened for modification	C:\Windows\SysWOW64\Pqdqof32.exe	Pmidog32.exe
File created	C:\Windows\SysWOW64\Ojhiqefo.exe	Ncnadk32.exe
File opened for modification	C:\Windows\SysWOW64\Jcioiood.exe	Jmpgldhg.exe
File opened for modification	C:\Windows\SysWOW64\Ngpjnkpf.exe	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Fdmlkkap.dll	Pjmlbbdg.exe
File created	C:\Windows\SysWOW64\Eemnjbaj.exe	Ecoangbg.exe
File created	C:\Windows\SysWOW64\Gomakdcp.exe	Gkaejf32.exe
File created	C:\Windows\SysWOW64\Mmlpoqpg.exe	Mipcob32.exe
File created	C:\Windows\SysWOW64\Mdjagjco.exe	Mpoefk32.exe
File created	C:\Windows\SysWOW64\Cenahpha.exe	Cfmajipb.exe
File opened for modification	C:\Windows\SysWOW64\Abemjmgg.exe	Ajneip32.exe
File created	C:\Windows\SysWOW64\Opakbi32.exe	Ojgbfocc.exe
File opened for modification	C:\Windows\SysWOW64\Onjegled.exe	Ojoign32.exe
File opened for modification	C:\Windows\SysWOW64\Ojhiqefo.exe	Ncnadk32.exe
File opened for modification	C:\Windows\SysWOW64\Clkndpag.exe	Cddecc32.exe
File opened for modification	C:\Windows\SysWOW64\Dkljak32.exe	Dhnnep32.exe
File created	C:\Windows\SysWOW64\Olgkhn32.dll	Eeidoc32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11128	11032	WerFault.exe	515

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daqbip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkljak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjkolmml.dll"	Fakdpb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ifgbnlmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pabkdmpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckedalaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Likjcbkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eeidoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejckel32.dll"	Jlnnmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncfdie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmidog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajckij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aminee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Clkndpag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdialn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kefkme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhmkaf32.dll"	Mpjlklok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eepjpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ghopckpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbiaapdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gofkje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pohkbc32.dll"	Gblngpbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Miifeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fojhkmkj.dll"	Ligqhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idodkeom.dll"	Mnebeogl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgaoidec.dll"	Pgnilpah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgllfjld.dll"	Pnfkma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fljcmlfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qghlmgij.dll"	Ghaliknf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajfoiqll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bkidenlg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcpclbfa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maickled.dll"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgilhm32.dll"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klqmnp32.dll"	Pgopffec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adopjh32.dll"	Ifjodl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Miifeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cihmlb32.dll"	Nlmllkja.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Neeqea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojgbfocc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajckij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Edpnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmamoe32.dll"	Jfcbjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aomaga32.dll"	Likjcbkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdhmnlcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipnjab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhbbhk32.dll"	Klimip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njnpppkn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcjapi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aahamf32.dll"	Aelcfilb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbifelba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogflbdn.dll"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbjoljdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmkfhc32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 632	1780	fb2c3f923137007ca6e90930fb129f2d.exe	84
PID 1780 wrote to memory of 632	1780	fb2c3f923137007ca6e90930fb129f2d.exe	84
PID 1780 wrote to memory of 632	1780	fb2c3f923137007ca6e90930fb129f2d.exe	84
PID 632 wrote to memory of 2216	632	Mcbahlip.exe	85
PID 632 wrote to memory of 2216	632	Mcbahlip.exe	85
PID 632 wrote to memory of 2216	632	Mcbahlip.exe	85
PID 2216 wrote to memory of 4704	2216	Nkjjij32.exe	86
PID 2216 wrote to memory of 4704	2216	Nkjjij32.exe	86
PID 2216 wrote to memory of 4704	2216	Nkjjij32.exe	86
PID 4704 wrote to memory of 1492	4704	Nacbfdao.exe	87
PID 4704 wrote to memory of 1492	4704	Nacbfdao.exe	87
PID 4704 wrote to memory of 1492	4704	Nacbfdao.exe	87
PID 1492 wrote to memory of 3076	1492	Nqfbaq32.exe	88
PID 1492 wrote to memory of 3076	1492	Nqfbaq32.exe	88
PID 1492 wrote to memory of 3076	1492	Nqfbaq32.exe	88
PID 3076 wrote to memory of 316	3076	Ngpjnkpf.exe	89
PID 3076 wrote to memory of 316	3076	Ngpjnkpf.exe	89
PID 3076 wrote to memory of 316	3076	Ngpjnkpf.exe	89
PID 316 wrote to memory of 224	316	Njogjfoj.exe	90
PID 316 wrote to memory of 224	316	Njogjfoj.exe	90
PID 316 wrote to memory of 224	316	Njogjfoj.exe	90
PID 224 wrote to memory of 3584	224	Nafokcol.exe	91
PID 224 wrote to memory of 3584	224	Nafokcol.exe	91
PID 224 wrote to memory of 3584	224	Nafokcol.exe	91
PID 3584 wrote to memory of 3948	3584	Nddkgonp.exe	92
PID 3584 wrote to memory of 3948	3584	Nddkgonp.exe	92
PID 3584 wrote to memory of 3948	3584	Nddkgonp.exe	92
PID 3948 wrote to memory of 3664	3948	Ngcgcjnc.exe	93
PID 3948 wrote to memory of 3664	3948	Ngcgcjnc.exe	93
PID 3948 wrote to memory of 3664	3948	Ngcgcjnc.exe	93
PID 3664 wrote to memory of 1908	3664	Nnmopdep.exe	94
PID 3664 wrote to memory of 1908	3664	Nnmopdep.exe	94
PID 3664 wrote to memory of 1908	3664	Nnmopdep.exe	94
PID 1908 wrote to memory of 4916	1908	Nqklmpdd.exe	95
PID 1908 wrote to memory of 4916	1908	Nqklmpdd.exe	95
PID 1908 wrote to memory of 4916	1908	Nqklmpdd.exe	95
PID 4916 wrote to memory of 2308	4916	Ncihikcg.exe	96
PID 4916 wrote to memory of 2308	4916	Ncihikcg.exe	96
PID 4916 wrote to memory of 2308	4916	Ncihikcg.exe	96
PID 2308 wrote to memory of 4764	2308	Nkqpjidj.exe	97
PID 2308 wrote to memory of 4764	2308	Nkqpjidj.exe	97
PID 2308 wrote to memory of 4764	2308	Nkqpjidj.exe	97
PID 4764 wrote to memory of 2812	4764	Nnolfdcn.exe	98
PID 4764 wrote to memory of 2812	4764	Nnolfdcn.exe	98
PID 4764 wrote to memory of 2812	4764	Nnolfdcn.exe	98
PID 2812 wrote to memory of 3232	2812	Ndidbn32.exe	99
PID 2812 wrote to memory of 3232	2812	Ndidbn32.exe	99
PID 2812 wrote to memory of 3232	2812	Ndidbn32.exe	99
PID 3232 wrote to memory of 4668	3232	Nggqoj32.exe	100
PID 3232 wrote to memory of 4668	3232	Nggqoj32.exe	100
PID 3232 wrote to memory of 4668	3232	Nggqoj32.exe	100
PID 4668 wrote to memory of 2964	4668	Njfmke32.exe	101
PID 4668 wrote to memory of 2964	4668	Njfmke32.exe	101
PID 4668 wrote to memory of 2964	4668	Njfmke32.exe	101
PID 2964 wrote to memory of 3052	2964	Nbmelbid.exe	102
PID 2964 wrote to memory of 3052	2964	Nbmelbid.exe	102
PID 2964 wrote to memory of 3052	2964	Nbmelbid.exe	102
PID 3052 wrote to memory of 2148	3052	Ncnadk32.exe	103
PID 3052 wrote to memory of 2148	3052	Ncnadk32.exe	103
PID 3052 wrote to memory of 2148	3052	Ncnadk32.exe	103
PID 2148 wrote to memory of 3100	2148	Ojhiqefo.exe	104
PID 2148 wrote to memory of 3100	2148	Ojhiqefo.exe	104
PID 2148 wrote to memory of 3100	2148	Ojhiqefo.exe	104
PID 3100 wrote to memory of 4088	3100	Oboaabga.exe	105

C:\Users\Admin\AppData\Local\Temp\fb2c3f923137007ca6e90930fb129f2d.exe
"C:\Users\Admin\AppData\Local\Temp\fb2c3f923137007ca6e90930fb129f2d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\Mcbahlip.exe
  C:\Windows\system32\Mcbahlip.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Windows\SysWOW64\Nkjjij32.exe
    C:\Windows\system32\Nkjjij32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Windows\SysWOW64\Nacbfdao.exe
      C:\Windows\system32\Nacbfdao.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4704
    - - C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1492
      - C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3076
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:316
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3584
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3948
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3664
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2308
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4764
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2148
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4088
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        24⤵
        Executes dropped EXE
        
        PID:3280
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3048
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        26⤵
        Executes dropped EXE
        
        PID:1736
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:768
        
        C:\Windows\SysWOW64\Oqgkhnjf.exe
        
        C:\Windows\system32\Oqgkhnjf.exe
        28⤵
        Executes dropped EXE
        
        PID:3060
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        29⤵
        Executes dropped EXE
        
        PID:4888
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        30⤵
        Executes dropped EXE
        
        PID:2108
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        31⤵
        Executes dropped EXE
        
        PID:3044
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        32⤵
        Executes dropped EXE
        
        PID:4636
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1620
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        34⤵
        Executes dropped EXE
        
        PID:4440
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        35⤵
        Executes dropped EXE
        
        PID:4124
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3468
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        37⤵
        Executes dropped EXE
        
        PID:2328
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4328
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        39⤵
        Executes dropped EXE
        
        PID:3804
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        40⤵
        Executes dropped EXE
        
        PID:3748
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4648
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        42⤵
        Executes dropped EXE
        
        PID:2668
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        43⤵
        Executes dropped EXE
        
        PID:2036
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        44⤵
        Executes dropped EXE
        
        PID:3452
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:384
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        46⤵
        Executes dropped EXE
        
        PID:3204
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        47⤵
        Executes dropped EXE
        
        PID:3496
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4952
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        49⤵
        Executes dropped EXE
        
        PID:1108
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4748
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5020
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4140
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2296
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        54⤵
        Executes dropped EXE
        
        PID:1472
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2244
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1048
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        57⤵
        Executes dropped EXE
        
        PID:4768
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        58⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        59⤵
        Executes dropped EXE
        
        PID:1928
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5060
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4108
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        62⤵
        Executes dropped EXE
        
        PID:2404
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3976
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        64⤵
        Executes dropped EXE
        
        PID:2808
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1924
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        66⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        67⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        68⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1832
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        70⤵
        Drops file in System32 directory
        
        PID:116
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        71⤵
        Drops file in System32 directory
        
        PID:1628
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        72⤵
        Drops file in System32 directory
        
        PID:4656
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        73⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        74⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        75⤵
        Drops file in System32 directory
        
        PID:1096
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        76⤵
        Modifies registry class
        
        PID:3800
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        77⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        78⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4580
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        80⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        81⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        82⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        83⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        84⤵
        Modifies registry class
        
        PID:4080
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4572
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4100
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        87⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        88⤵
        Drops file in System32 directory
        
        PID:2220
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        89⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        90⤵
        Drops file in System32 directory
        
        PID:1988
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        91⤵
        Modifies registry class
        
        PID:4844
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        92⤵
        Drops file in System32 directory
        
        PID:4204
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3936
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        94⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        95⤵
        
        PID:588
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        96⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        97⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        98⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        99⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        100⤵
        Modifies registry class
        
        PID:4756
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        101⤵
        Drops file in System32 directory
        
        PID:2796
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4928
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        103⤵
        Modifies registry class
        
        PID:4560
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        104⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        105⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        106⤵
        Drops file in System32 directory
        
        PID:4980
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        107⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        108⤵
        Drops file in System32 directory
        
        PID:4388
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        109⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        110⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5252
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        112⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        113⤵
        Drops file in System32 directory
        
        PID:5344
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        114⤵
        Drops file in System32 directory
        
        PID:5392
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5432
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        116⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        117⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        118⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        119⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        120⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5692
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        122⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        123⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        124⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        125⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        126⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        127⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        128⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6100
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        130⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2056
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        131⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        132⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        133⤵
        Drops file in System32 directory
        
        PID:5284
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5352
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        135⤵
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        136⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5624
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        139⤵
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5760
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        141⤵
        Modifies registry class
        
        PID:5852
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        142⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5980
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        144⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        145⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        146⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        147⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        148⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        149⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        150⤵
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        151⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5676
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        152⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        153⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        154⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        155⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        156⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5844
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        158⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6136
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        160⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        161⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5588
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        163⤵
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3736
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        165⤵
        Modifies registry class
        
        PID:5424
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        166⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        167⤵
        Drops file in System32 directory
        
        PID:4368
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        168⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        169⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        170⤵
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        171⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        172⤵
        Modifies registry class
        
        PID:6180
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        173⤵
        Modifies registry class
        
        PID:6216
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        174⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        175⤵
        Drops file in System32 directory
        
        PID:6304
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        176⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6380
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        178⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        179⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        180⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        181⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        182⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        183⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6668
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        185⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        186⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        187⤵
        Modifies registry class
        
        PID:6792
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        188⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        189⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        190⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        191⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        192⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        193⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        194⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        195⤵
        Drops file in System32 directory
        
        PID:7116
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7160
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6168
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        198⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        199⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        200⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        201⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        202⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        203⤵
        Modifies registry class
        
        PID:6612
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        204⤵
        Modifies registry class
        
        PID:6684
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        205⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        206⤵
        Modifies registry class
        
        PID:6820
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        207⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        208⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        209⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        210⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        211⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        212⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        213⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        214⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        215⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        216⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        217⤵
        Drops file in System32 directory
        
        PID:6736
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        218⤵
        Drops file in System32 directory
        
        PID:6856
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        219⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        220⤵
        Modifies registry class
        
        PID:7152
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        221⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        222⤵
        Modifies registry class
        
        PID:6568
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        223⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        224⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7132
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        226⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        227⤵
        Drops file in System32 directory
        
        PID:6620
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6904
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        229⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        230⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        231⤵
        Drops file in System32 directory
        
        PID:6284
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        232⤵
        Drops file in System32 directory
        
        PID:6492
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        233⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7228
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        235⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        236⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        237⤵
        Modifies registry class
        
        PID:7352
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        238⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        239⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        240⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        241⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        242⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        243⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        244⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        245⤵
        Modifies registry class
        
        PID:7680
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        246⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        247⤵
        Modifies registry class
        
        PID:7764
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        248⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        249⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        250⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        251⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        252⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        253⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        254⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        255⤵
        Modifies registry class
        
        PID:8176
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        256⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        257⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        258⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        259⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        260⤵
        Drops file in System32 directory
        
        PID:7528
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        261⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        262⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        263⤵
        Modifies registry class
        
        PID:7792
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        264⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        265⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        266⤵
        Drops file in System32 directory
        
        PID:8064
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        267⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7176
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        269⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        270⤵
        Drops file in System32 directory
        
        PID:7512
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7660
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        272⤵
        Modifies registry class
        
        PID:7756
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7996
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        274⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7260
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        276⤵
        Drops file in System32 directory
        
        PID:7448
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        277⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        278⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        279⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        280⤵
        Drops file in System32 directory
        
        PID:7484
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7948
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        282⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        283⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        284⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        285⤵
        Drops file in System32 directory
        
        PID:7180
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        286⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        287⤵
        Modifies registry class
        
        PID:8284
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        288⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8320
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        289⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        290⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8448
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        292⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        293⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        294⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        295⤵
        Modifies registry class
        
        PID:8608
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        296⤵
        Modifies registry class
        
        PID:8656
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        297⤵
        Modifies registry class
        
        PID:8700
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        298⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        299⤵
        Modifies registry class
        
        PID:8776
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        300⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        301⤵
        Drops file in System32 directory
        
        PID:8864
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        302⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        303⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8988
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        305⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        306⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        307⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        308⤵
        Drops file in System32 directory
        
        PID:9160
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        309⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9204
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        310⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        311⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        312⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        313⤵
        Drops file in System32 directory
        
        PID:8440
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        314⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        315⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8644
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        317⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8772
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        319⤵
        Drops file in System32 directory
        
        PID:8828
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        320⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        321⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        322⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        323⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        324⤵
        Drops file in System32 directory
        
        PID:9140
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        325⤵
        Drops file in System32 directory
        
        PID:8212
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        326⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        327⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        328⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        329⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        330⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8876
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        332⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        333⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        334⤵
        Drops file in System32 directory
        
        PID:9196
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        335⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        336⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        337⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        338⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8892
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        339⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        340⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        341⤵
        Modifies registry class
        
        PID:8392
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        342⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9072
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        344⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        345⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        346⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        347⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        348⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        349⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        350⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        351⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        352⤵
        Modifies registry class
        
        PID:9472
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        353⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        354⤵
        Modifies registry class
        
        PID:9552
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        355⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        356⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9672
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        358⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        359⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        360⤵
        Drops file in System32 directory
        
        PID:9800
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        361⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9880
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        363⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        364⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        365⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        366⤵
        Drops file in System32 directory
        
        PID:10044
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        367⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        368⤵
        Modifies registry class
        
        PID:10136
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        369⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10220
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        371⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        372⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9308
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        373⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        374⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        375⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        376⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        377⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        378⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        379⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        380⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        381⤵
        Drops file in System32 directory
        
        PID:9912
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        382⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9976
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        383⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        384⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        385⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        386⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9284
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        388⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        389⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        390⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        391⤵
        Modifies registry class
        
        PID:9772
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        392⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        393⤵
        Drops file in System32 directory
        
        PID:9968
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        394⤵
        Modifies registry class
        
        PID:10120
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10180
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        396⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        397⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9488
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        398⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        399⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        400⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        401⤵
        Modifies registry class
        
        PID:10156
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9468
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        403⤵
        Modifies registry class
        
        PID:9148
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        404⤵
        Modifies registry class
        
        PID:9888
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        405⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9692
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        407⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        408⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10112
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        410⤵
        Modifies registry class
        
        PID:10272
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        411⤵
        Drops file in System32 directory
        
        PID:10316
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        412⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        413⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        414⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        415⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        416⤵
        Modifies registry class
        
        PID:10532
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10576
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        418⤵
        Modifies registry class
        
        PID:10612
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        419⤵
        Drops file in System32 directory
        
        PID:10652
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        420⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        421⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        422⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        423⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        424⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10868
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        425⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        426⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        427⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        428⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11032 -s 396
        429⤵
        Program crash
        
        PID:11128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 11032 -ip 11032
1⤵
PID:11100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
79KB

MD5
6d498889cf2633212c685c7ec3440cf4

SHA1
40d29f257700a127da7d3ab8e08916ac75f99d43

SHA256
7f8f3b1825fffa3a3bdc4a9c4475b425e8d49bf1f56b5ff1a0ead756fad8d3e2

SHA512
720d341270ab98e9dd88638017468f8ca351c65f521d9215eff238c46a3e23635ff9317f2e6ace15c4269130f359030185989ff858121141e504c2454f21035d

Download Submit
C:\Windows\SysWOW64\Anpncp32.exe

Filesize
79KB

MD5
8e3132b061daf0ddaa258c1673c93294

SHA1
f8b3492585077207304723ef20b6524ba5cb816e

SHA256
75b64b8471d2263813110d4c6ca2084b00c98b9eb4f939dced757d87e3614ece

SHA512
a6cf86e8821757a04511d1e111825a913d387555c9b99c76b4054cf8895b7b5650511c8740ac08f997ea13e26953230c21a64380bd465d9e7ea384109b0f791c

Download Submit
C:\Windows\SysWOW64\Beeflhdh.exe

Filesize
79KB

MD5
3cc0637b27b20b607664437e6db5edaa

SHA1
1173f60b60aab7432b6a986b124d4c89a6cdd601

SHA256
bc3e7d2aa42a2e4309fab5caf96366d886543cb9d8f11466cb0e33c0037776b3

SHA512
b5b11f16fa31d0db8059e62b90c35ca8eb0caa353da3da6cd125f248fe6afebcf8269f3ddf46b45ed39fb4aa175335611200237a42de56c0bb532aa1501bdc94

Download Submit
C:\Windows\SysWOW64\Cenahpha.exe

Filesize
79KB

MD5
1637d03e63a0aef3ce10e8e7e35ec8a1

SHA1
1f386f1f6f95971dbf8f7be5115b4104726ff7c4

SHA256
cc61517ab25a3a26e11a29889c181385d10a00ccbd9d73608c8db4cdbf4a1d69

SHA512
135ec381682adcb7c873cb5ccd7802882ba23d5dd4c376f10825d52a138cc5e41e815dcc96c75ae813c2ea40e45a01b4f9612e564512c657d2a3a1555ee0c54f

Download Submit
C:\Windows\SysWOW64\Ckcgkldl.exe

Filesize
79KB

MD5
6121e18927fcbd71659f7a757d5a3984

SHA1
1eba76133647fcfc2fbadb74f5b557ebeafa720e

SHA256
dab8142d9bf3eb8a01b761ae827c3868f072b99908d0de7351a08f4ca8ef78f7

SHA512
951c2b27fbe7fb63b872d3a4ccbd59172d2bf1da5538a269ed304a954e46d8566cbdb58718b8c41270a093f046bd46dc6ae3628c586e290892c2259e2b992f6f

Download Submit
C:\Windows\SysWOW64\Dfknkg32.exe

Filesize
79KB

MD5
544f42c146f4b3dcaf650407cd2bb646

SHA1
6c4225409cc0e8f5b7fe2ec8ed19da4b70487669

SHA256
6e21445a0f15f662c2ef2e68fff8aeb2993c345feaaf2149552706d984f51ec3

SHA512
dabdc9f404592f90cc6d25bf3bc9dfc2e529607c68d5eea932507d81bbd90ede1389d1a0315e36632d2c6fb105d05b94c978087085b907c1c937f1d7bb80cce5

Download Submit
C:\Windows\SysWOW64\Edpnfo32.exe

Filesize
79KB

MD5
8e66bb0b35122675eb73920174ccba7e

SHA1
eeb56c240d945a71aaf2db784fec3565f3653ba5

SHA256
805102072d2e1d5fcd9816f563ce0ed896fb532ee5b3fcc5c12da900bb96cb07

SHA512
62a5464a862dd557415157ca764c4aef3e96ada5b99735969e3e17ea0844972ce721aefdc4688678b9b8e5b0b135784e6f64e8e61ca104e73a6ef35d73ac87e3

Download Submit
C:\Windows\SysWOW64\Gdqgmmjb.exe

Filesize
79KB

MD5
f5f3df459888a2bdce03d27a26d98b77

SHA1
f244acb653cfae7b4053b5b83cbf0c8d9b793186

SHA256
ff4dbef36bacb6d7131664619ea7986546a566a20ba70c0f8f9defb643fdf8e3

SHA512
2347804939a71fc50e387e116621fc78059908bcb4fb68bced30ef21c55ba18366924d95475b13735ca9d01fb6a73aa0468d11b6d03083024f385d3fc48c7c30

Download Submit
C:\Windows\SysWOW64\Hbeqmoji.exe

Filesize
79KB

MD5
fa5df0be861ad0e08f6f7545dae94e37

SHA1
5c530f0f1fc596e9e953e44f20dfcefe116f7e57

SHA256
e9aaf465b779f7f11420a9439e4c34a3433ae84467509be993d041f6085b141f

SHA512
f079f810df8c90526161f9ce30a642e80c4b84966e08088099a6e589d5a88ef5f9ff8aa077a6c7193d43f944fa86f3bfa4017b74cff6dc894e1c964d087cb316

Download Submit
C:\Windows\SysWOW64\Hijooifk.exe

Filesize
79KB

MD5
4f2a65fbca2c32e91e17a28f6fb60e95

SHA1
760546c7ff0c23a100e50db77bc353f66f1722a5

SHA256
167cfb9ca527e0f6273dc729b12a6ca4e46b12edce6db1f6129bbd90c8a35368

SHA512
b7d3a5db9ef794b0ae46c52be282cc529b0054b2ddf18def66000f0a9ba59a1ad5472794155966d827c3c84833207babd7d15c9e2b7497e31c8ac2fb931c9a79

Download Submit
C:\Windows\SysWOW64\Ifjodl32.exe

Filesize
79KB

MD5
b3bb743ee00c9e6824f92028e1eae4f7

SHA1
e84d20ae3ee2c99941b403f0fca99a4953a95914

SHA256
30102e16e3d40a591c68fddcc7aa18891b3ae0b5d31d9045bd98869d45d49579

SHA512
4e587af2e737f1028d0e92d12271eb00bdd59be8e3d870eef0e396c7f30ff03bdf58d33f34b9f58f16a8f372f04b3e84f36eb4233dcbc63fc15ecbefc59f4109

Download Submit
C:\Windows\SysWOW64\Jcllonma.exe

Filesize
79KB

MD5
0168f9b57a46be64db0027c9386ca8d9

SHA1
5a2a5e9dd1092a720902f203a5ac252c5e9bdb41

SHA256
9e15c72ae2c3a2b07a49925579ffc15549e420852e73176646e80202fe8a6ead

SHA512
2c6d2ba2a86710a2c84f5bad09cd3c3b1489dc9d5ae2a51c7f061fbf423e8fa57017226e14e4e0fa9a55ee00667a318821603b129ecb1248aca2892cc256bc0f

Download Submit
C:\Windows\SysWOW64\Jehokgge.exe

Filesize
79KB

MD5
faf417c5d04d33555fff5f038492e14d

SHA1
1e6c349bb9ba9ea54383a1f6a7b90989e1447080

SHA256
568efdc02e3e90f24fffa398390298e96bbca55e6eed7d511d89ab71a71fa5ab

SHA512
be3284ab0811ac363373ae013c01549faa4f5f2e78b5b68e56c8b3deca1e620bb8bb4eb17b9a365e875beb3db815c40dc84b38b69e219b0912b4cf4690abfc9a

Download Submit
C:\Windows\SysWOW64\Mcbahlip.exe

Filesize
79KB

MD5
2b24c059f47dd70525c85cc691775f3d

SHA1
6fc9e606fa8de52966bfe82be20890b66f4e3733

SHA256
0272528469c1039b4ead4bdef5a9c7e921db140baaa51e9c9690248881ef9918

SHA512
b459136493853463d585e81f1865ca6361420d06f73e6675126ad1c2934f058c7a57ec359146a7b435b5f2332b1a2d721e882ddecb37441a34f2fcb70321284a

Download Submit
C:\Windows\SysWOW64\Nacbfdao.exe

Filesize
79KB

MD5
c86ccb8fab68081920ec63285fac9c5e

SHA1
f4b79c4b3fa7015fa8186e4a032f0eb970dcfd89

SHA256
78512e5cfddd8833d7519440129a9f6f47323c198841e74da8514722b292afbb

SHA512
cf480a8b41c6e43f3329ffc17d4247d88a42d9aa23796431cd158fd66cc8e87035099a9d1adb9e195f41acb2eed993bd855c5014870d969547b39cd6cec35bca

Download Submit
C:\Windows\SysWOW64\Nafokcol.exe

Filesize
79KB

MD5
111f99ddf5a74f255ab3e9e9d52a3766

SHA1
ab388d3d874ce793e82bb9d867a6a875106c6fb1

SHA256
d2e38403721a2c6786c8a5ef4f7903ff5f9bfc0fb4026bbe1711bc1fc335e757

SHA512
0f6b55e72bce21f1999f1d7a30fd1f6434d4800e671a4e8113ab4a82d417b6fcfc0571218dc35bc19e62f10d4fd9be3e624d20de672620386ac03b4370093f22

Download Submit
C:\Windows\SysWOW64\Nbmelbid.exe

Filesize
79KB

MD5
7b2a0f704dcc0c5f06c84b243fd7a14e

SHA1
3df3719d343960e73efde29c00373dbe352684a9

SHA256
acbd2151c69209f1adc702453d1e852f4121340b0d2b2b5e0f154dfa8dcff2f1

SHA512
a6eea5d6006c30822cc33a6b333abdd8188c4013e77de1e49aec0b84530477848e49bac5fbde9fece1d8af90448e58f16b71481425f6d45c9ac02cce3d9cf86d

Download Submit
C:\Windows\SysWOW64\Ncihikcg.exe

Filesize
79KB

MD5
e10064cf4dc6727d879619b51d629390

SHA1
c7196f6fd25f9fe3eee0e2b4bb6c65ce0eadcd5e

SHA256
ee038c084a4954bf5a4e6d9126640ab179cee9718b015559ab66dc265526b5db

SHA512
5b508559d7af6d02adf29a7a68a8b6ec08237ee88c0b97ada7f95a3850faa087cd19b719fce01590ac39bb5927b088ebe4845bf37a14ea469aae15bb66c182a0

Download Submit
C:\Windows\SysWOW64\Ncnadk32.exe

Filesize
79KB

MD5
aa382d58167c778e9331663c683b7f9e

SHA1
8c064fe6108c09e104ad3beedb480acd423dbb11

SHA256
7c90080a2caaa9c77c381c41d563c684e4f5b384a68f6005d1f621bfc7d88f83

SHA512
a9a0616854d2433271b45c316b56c3f3c6ce6fe2add4a4b29abe2a9d6231b12f9d1ceb5f1a8c6516bf79239c8330cf97bd89ba3b37d7cd9f1dad19c533437312

Download Submit
C:\Windows\SysWOW64\Nddkgonp.exe

Filesize
79KB

MD5
e352e58f52f165246fd51af844a66dd7

SHA1
d1c9d0382ddc51d50239fcc70cac7941426f1b16

SHA256
e2a0abf375847fb09ead50e0067307e1cf0fe4ecb9f1b8623a1e55b2079c1aa9

SHA512
dad897753a1054d565bb5b5cabc94f61f31cd4bae8d6be0c20e929c7b543a36b22a3c6705b7cc5b2adb8f64e75316739e32ff2185fad816153f88c700abc475f

Download Submit
C:\Windows\SysWOW64\Ndidbn32.exe

Filesize
79KB

MD5
00840d5656c0b00837d4d1a89f156f1a

SHA1
04f6d6d1b84e683e6d702b8f73c3070c66a161eb

SHA256
037a8a810aba77e6d48404de142f3fec5b7642821220c8d77975e53f6d1e5a27

SHA512
d3aaf3a8721711a6ae124075845dfe9f0f30912e3775197ea97729ac09dff71b9617da41b84fe325daad0b20bf603db42702a6735ad92d5779df250fe1bb519f

Download Submit
C:\Windows\SysWOW64\Ngcgcjnc.exe

Filesize
79KB

MD5
ae9d87a6302fee91dedbc78ac67da7e1

SHA1
861065c7ae4146aca02dd1ba126717b86fa6c4fb

SHA256
f0ba13eb4c1a35fb0d4f611adb64ebfeb69c67db88dea1ffe85e0db345066efa

SHA512
8eb3827e5ca8d4095d97cb86e5f72fec4d9c7ce2c9cdc583bca2facc314175ecd54552ad15466e62725eefbc2dd442b07a65795371c9cdf615b7bdfd071c4aff

Download Submit
C:\Windows\SysWOW64\Nggqoj32.exe

Filesize
79KB

MD5
5ee4d27222c6d6ae6c85ead60cd3c3e8

SHA1
be900127d8aaa1559bbd884ec7b8b182e96c7a4c

SHA256
c37e1babdb786d1e5989b0ffd0546165426a29dca458d6cb8110dc7e3e781e38

SHA512
b16c6de9b581f0e541a93ad6f428c4b35f70b8f73f155ae578dee50bcd608ea882641891525d973f001c5f8c809f3de5bcb26a12dde1f2bc539aa4b83840f889

Download Submit
C:\Windows\SysWOW64\Ngpjnkpf.exe

Filesize
79KB

MD5
11fcc5c5de998cf768f4326e3561bff0

SHA1
a49763d3dee25a091a2c5cbd97cb7a0c3325a009

SHA256
e1259e499362af3742873b4184ae18c63f5a22ac305ada4a6a3f842e61b98a29

SHA512
359c73007a1763abeeded02f6d9a9d5387794e90e13ea64e8505bf93d8732e74dc10643f7b73787febc9add05642196f9a3e3799a4ed736f725d5c804f24fe1f

Download Submit
C:\Windows\SysWOW64\Njfmke32.exe

Filesize
79KB

MD5
2c32d716481e6332ebb89cebea1d8767

SHA1
6b1461e7b225eed5e22832a8db612c157d5c88af

SHA256
6ec488df751621e8dcf1e69f450f3fc296ee918becb0e2a126ec4896f89d5723

SHA512
65b17dfaa31bb2e89ee11125ca09c3ce5847ce08afdb0f124c096c822df9a8d63cb020d85caba9a8855129de4249e4fb184e7d4e28fd3a102dc47c6e0d2d5d38

Download Submit
C:\Windows\SysWOW64\Njogjfoj.exe

Filesize
79KB

MD5
4d345779194769a5a4d66fd33e7fee14

SHA1
6d62952a18b838316056c5ffbadf288a76400011

SHA256
c72085705bf6bc72a039ec8a517d07e4637ec9ae715c9620a7aa7d680991abdd

SHA512
9a7d74bba800d3b6724b05e6ef33d02c0821d1c585d2da236d2fa0d011d97875150ff497dfb19bfaf2a68a49646ab4c852a1897d15591d1413bce279fdfa76ce

Download Submit
C:\Windows\SysWOW64\Nkjjij32.exe

Filesize
79KB

MD5
ca959454c0ea6217c523153d2911500f

SHA1
f543d4742d600a281be312aa416e1cff35824576

SHA256
36e4e30387df0e1dacb19afcdfbc29b611fe222f59cd3836e42c0315af68cf16

SHA512
5a9e777d362133640c8c91772753417b93d54d23972c8a7dc252027bfcc2070ad6999957c371bf90a4bb1f255255487075f56edebb7a0cae3c5b18a13c1a69de

Download Submit
C:\Windows\SysWOW64\Nkqpjidj.exe

Filesize
79KB

MD5
edb4754ad95ed698f7243b2e1c357c7d

SHA1
a1ae3de0d6bba1ebd17d09674dc49c6e5fd8157b

SHA256
f360610e7dd32ff988897b8d8368bf300f1c7bc28c49c597a1ef4717bbe5e8f9

SHA512
e5efc4c0d97dd3b881e5d0688beb176fff65e128da3afb9fff86accedb85e2131a02b503161290af01f2b242ec52004c3ec73ab3e909da3398a11a024f2784a4

Download Submit
C:\Windows\SysWOW64\Nnmopdep.exe

Filesize
79KB

MD5
a13744cd3f15c5ecc8c10648d0cb7e27

SHA1
e9a59bb507045640e11fd82ac4a329fbd303c747

SHA256
9db4e946e7b2b095da955a7b66d5dd286001e530f38e57bf8bc7da3ad219a2fc

SHA512
d765a5e25ca1ef3a3870982d235a0456fec807b2219735eff04028d4b0a3330779a445cd039f1b7d87b3526f61cb0d81293072a54c09a38c28231a887263a497

Download Submit
C:\Windows\SysWOW64\Nnolfdcn.exe

Filesize
79KB

MD5
75f4df5163585d3d45856bbcb04b6236

SHA1
04ddf0202a1d8ad4c02296562f8c76dc5244ff77

SHA256
03925a9929e91eefdd8edfea7eb3e1331f2f1efc7de91228f59f9030c3c5fc10

SHA512
5722f3647bd519d46fd6d4431b9a927c220a510f62d5aa1729601f2ff118529bc1de9c24eabe6cd8d6199da39756f3ce6a9ff16baf96df02d0e2aa570bb55a81

Download Submit
C:\Windows\SysWOW64\Nqfbaq32.exe

Filesize
79KB

MD5
106b5e9e1ea9a78112cb7f1d64d90079

SHA1
5be555d771ae917901169f54cbfe08a8ad4ece73

SHA256
ffee7fb0ae37fd679dc3e26e0ede61531afdde5137e2f2426bb8bb95f174168e

SHA512
182acefe729d25738857dd98452d78bdce2b1fe3756271a4382981b5ec6bd9a3aae8da73e6b095005bb4723f35a898e3f59fde3067e5379d79de4bc89ad4d834

Download Submit
C:\Windows\SysWOW64\Nqklmpdd.exe

Filesize
79KB

MD5
4d30bdcbd6f69351e9a296d347e42c16

SHA1
afcdeeb4a6804a8e4944cc1188d0a0986313f956

SHA256
34ca9823c08f1921aa35f0de7cce1cbef21afa2015ea89fea8e2e5aee9f15be2

SHA512
45ef7ccd8ea4562ed8d12dd531fe971b8aa752903dd6b95cccc362ee9d29fe702eeb333876f52d4f8793259755a64880f97733282c5a6ba441c2a87a53138fd0

Download Submit
C:\Windows\SysWOW64\Obangb32.exe

Filesize
79KB

MD5
47fc4fe0c32360ab3971049c74d797b4

SHA1
7dd65761593dcddc00638d4dbceef212347ba89a

SHA256
c215e52a570204052ec1de7855a5aadaa14960a4bf8f299f4415ff923ff3e993

SHA512
0666d6894a5cd7494b1aba28c94322018224d67bad741b288c3bc946bb38048f5f2daee3373345fdbb2abddf19ac580a254e1d5104f33e12c26a6d049c9ab378

Download Submit
C:\Windows\SysWOW64\Obfhba32.exe

Filesize
79KB

MD5
8754f7459deb17af12d3411280cf96d2

SHA1
9c1c281aa2d484792345f319df0ee7d6f5779385

SHA256
e9eee8b3d3fb29c9f6f1aa2f81df3c1c77eb4594ca5ae4542e2b4e188c987da0

SHA512
d13f5ec49e6915761fd1d8f0934cd5957b4b09af9df6141ed79022380859d1d1e5f547133bca89f698e3728e80b37b2faf8c66d9bb40aef1fa07103f28d63efd

Download Submit
C:\Windows\SysWOW64\Oboaabga.exe

Filesize
79KB

MD5
eff9269287ee7aa86e2513547944bcec

SHA1
5b0163cccd91339b28a5264993086f3d5047b299

SHA256
e5d31bb75407dcf9d5cb88529cea93acc0b6ac4f0d7afb550c728c3bbc9cfbef

SHA512
13b46fe44d2ed372165a7c2361542941b6dd2d7ac3a676d586ab62e25dd83aec0d63141021ca002442997921ce0b814c1a9e20ebfcf41e0d08bc5076cefd909f

Download Submit
C:\Windows\SysWOW64\Ocegdjij.exe

Filesize
79KB

MD5
39310c90741162ac86dc4182f82449f0

SHA1
b9b656b3f1b634b5d93f0928295af6f5502ebe3f

SHA256
edb6c5a051a42b4bbcba1ffe4ff82f952516e3eaee7f09a677aaaece9c08dcc8

SHA512
b851f29fad47adfbdf825a9742ed40f1c8bd8402ee4fabcefc714a3aeee7565a03acffafa3c174b83336fa932095fcdfff11dacbd42dec893e553210cc6f3030

Download Submit
C:\Windows\SysWOW64\Ocgdji32.exe

Filesize
79KB

MD5
91a6bd4357a309d603981f330bc86fcc

SHA1
75d71e77ee818fc39751b9ce5534c05555994a4c

SHA256
a6404373c42f75c427bd56a436f579ff9c1afa535d2472563bb1ed14968cfaab

SHA512
e2b5cdab51133a1d2aa18205852ecb6a5221d1ed5d1ce90cc686db1404c894747317263f335d65eec30cb695dd5123590b3e6a48dc6a53c4cf72a92d443984c9

Download Submit
C:\Windows\SysWOW64\Ocqnij32.exe

Filesize
79KB

MD5
e732b0f6cc0e9f6be5b2b19a7a96814d

SHA1
f8758214fa2d9f112fce67d198f799d6fa6d8678

SHA256
13f99306bafc50f111c2d3a84ba4670d070dc54d58ffd04adc1bf2a5e9e75b88

SHA512
202e7a66dd7b04adc57e087c33eae1fe6cbc0f4be69d2093b5c96f83933dc7ac1dc37a65c29a6cf630e4bcea2c7ba074e5e5005c051dbd113b0f1eb74f026abb

Download Submit
C:\Windows\SysWOW64\Ogcpjhoq.exe

Filesize
79KB

MD5
9c94bd0c765a5d81ee6992b74ee78e5c

SHA1
ebf552cd02821166f7f97629250d50de71890993

SHA256
b77d244716743493e8925859fbfb6a7b4b911cc32fde5d68eca92bb8eb7e1808

SHA512
b4839c838bf882d093fcc0810a67ef10dd2741e89a2cd3cd7a4ff60643330ae315ea2712bee8236fa1497a3e803fca24a5f9f4a6170dfbc02552616559b9ef74

Download Submit
C:\Windows\SysWOW64\Ojhiqefo.exe

Filesize
79KB

MD5
9b476cba11a7d257b14a8bbc6a255b44

SHA1
b3cc371deb69a3c9eba159e9514d3ab2e4a69bd4

SHA256
a9a52086b44002307a6a7c641c3094d447c2e215c4dc24b4e1b8d44f281e793d

SHA512
c10d0f7a3db9079ec2052698688fbf0e0c97fc07e7aa4eb2a34486d0c91c231d22b200e257ab62087380c73b14948aa3c38d09a33495daf423fd6f49583548bd

Download Submit
C:\Windows\SysWOW64\Ojmcld32.exe

Filesize
79KB

MD5
a9193e0ecad8c427152b15a47ebaf73b

SHA1
6ad03424daf8e0029e6c7d1b6c51988742d00246

SHA256
15aaae6cab819ea26314a61eec7a6f450da2d957af08a4730246a0db68e18684

SHA512
640abdda6e8cd35a790d50f34c392c07b086df64c6a8560213351d10d5af25bcf9c6230f0e5d48acdc4776746249bb626dad2cb69b6387deb2530ca6fb6f619e

Download Submit
C:\Windows\SysWOW64\Ojopad32.exe

Filesize
79KB

MD5
1768f64ff3eb961d8c924634f8c51bc4

SHA1
bd83d0089a5f6c7bc6aae68885c6cc15456cb53b

SHA256
c24eaad93244b2efe89f10a09acf5c2b4b632ee0cc136eda60764c0328bd2377

SHA512
39c3c9152f1a95696839a82168f11ec40a3eaaebe009abed08ea6fd8fe884bb3f43bf8fb9cfd49ed1ccf53eaebbe44bd4109261fe1f5a4f8ff52c25ee4a61d10

Download Submit
C:\Windows\SysWOW64\Okhfjh32.exe

Filesize
79KB

MD5
fe9b40f8343fa0d33b333d685046c0b9

SHA1
c511f882301cd82d4ea4fa16c45454a9c7bc5817

SHA256
c3113408d55caf292a65c22dd14830f3d552e5406bc88361ac58fe0390991c3c

SHA512
e8b33d0f5804a14b74e72de0e756b902fa323d06eb3d94500f0459662844d351c05259ef0114144647e6e27a17545caa9e909f527fd770fcb131ddb08528b08a

Download Submit
C:\Windows\SysWOW64\Okjbpglo.exe

Filesize
79KB

MD5
d18fde6bd7f7468e95e6b2635a09e8cf

SHA1
207fd484ef9be300b3b3e8eb8a9b060466424550

SHA256
a988efc18fbd10cea693750e3866b4db70a0b886f1828607ff9187fdb48a359f

SHA512
3d11f6e041c68822449bf4ead9f60fa5c7d331aea7ec17a560f8114d5925e1e736a5a988ae5a7db27ff121005616dd9662d4692d47a5949606053da02530b6e5

Download Submit
C:\Windows\SysWOW64\Oqgkhnjf.exe

Filesize
79KB

MD5
3736b58b12e0f2c65b9c18dc62d4fab6

SHA1
660c5381826bb6ff2f03bd19744ebf9085e58884

SHA256
0ca12d77c4655b04f1d4c454d1ccc849bbe5404cca3515a87336c7ad9c1807be

SHA512
b0fadf4927335a9352d2a425ed391c63a549b5dd2794ef724f31e4f70d132f47296658f5071c744c69d7446578f1379f2ff1254fee54a3ebd4077d5afc308398

Download Submit
C:\Windows\SysWOW64\Pcjapi32.exe

Filesize
79KB

MD5
f0f40fdb4a4dbf1c110699f0ed7204fc

SHA1
2f958afbb8fa38bf6ebba3fd8c8cbba88eebb7c3

SHA256
43d0b6e8e1bb6f2cf9b5c766ba249af98a23efe48fb18f93dcec3aea82c456bf

SHA512
c8bc8e5f380bc32fc593834aae103ab87eeeca58f8bfb0913cdb4ae93cd007cca379636c10df7b2da29a589b0002d5b1b89c18aa11b9a1ded458d31992f624ca

Download Submit
memory/224-57-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/316-49-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/384-333-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/632-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/768-209-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1048-395-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1108-358-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1472-394-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1492-33-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1620-257-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1736-200-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1780-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1780-6-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1908-89-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1928-413-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2036-317-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2108-233-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2148-161-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2216-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2244-388-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2296-382-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2308-105-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2328-281-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2404-431-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2668-311-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2812-121-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2952-407-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2964-145-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3044-241-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3048-193-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3052-153-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3060-216-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3076-41-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3100-169-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3204-340-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3232-130-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3280-185-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3452-327-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3468-275-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3496-341-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3584-65-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3664-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3748-299-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3804-293-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3948-72-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3976-441-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4088-177-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4108-425-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4124-269-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4140-371-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4328-287-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4440-267-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4636-249-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4648-305-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4668-137-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4704-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4748-359-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4764-113-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4768-401-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4888-225-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4916-97-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4952-351-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5020-369-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5060-419-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads