5d2e3c469acbc4fb063b7a9ceb433aea573806aee3ec45d9f94d831274baf401

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5d2e3c469acbc4fb063b7a9ceb433aea573806aee3ec45d9f94d831274baf401.exe
Size

211KB
MD5

3d8af30fb736fb0f1725875e131a5c3e
SHA1

1dbc6232011d6bb1a2a6cb6660c428dc86be38b2
SHA256

5d2e3c469acbc4fb063b7a9ceb433aea573806aee3ec45d9f94d831274baf401
SHA512

d6e57d03f7fe4be049f5aa5b9495b3d058cce198e873e0b66d12bfe715546055f873a83725ccbd15aef8ed7049134e33a391cc00d2b79d9b39ebba5421dce162
SSDEEP

6144:l6hwiG0N6QEseYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/N:l6hrGZseYr75lTefkY660fII

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnebeogl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajdbcano.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aelcfilb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbnpqk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cliaoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdckfk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlgmpogj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipknlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Olcbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Alhhhcal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ekemhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Migjoaaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oncofm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeopki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdlnbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nljofl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qbimoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmkfhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bagflcje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fcfhof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lenamdem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acocaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adcmmeog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcllonma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndaggimg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nebdoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qeemej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcmnpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfaigm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aclpap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aanjpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kpjcdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lllcen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdckfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnnjen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npjebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbaemi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhpjkojk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkaejf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hcmgfbhd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qeemej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfjjppmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qcepkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmabdibj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmfmmcbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpablkhc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocnjidkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	5d2e3c469acbc4fb063b7a9ceb433aea573806aee3ec45d9f94d831274baf401.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Abkjdnoa.exe

Executes dropped EXE 64 IoCs

pid	Process
1844	Oqkdcn32.exe
3580	Pgemphmn.exe
2636	Pjdilcla.exe
3256	Pqnaim32.exe
4320	Pkceffcd.exe
2748	Pqpnombl.exe
4404	Pcojkhap.exe
4480	Pndohaqe.exe
3968	Paegjl32.exe
4640	Peqcjkfp.exe
4912	Pgopffec.exe
3200	Pjmlbbdg.exe
4928	Qcepkg32.exe
4528	Qgallfcq.exe
4772	Qkmhlekj.exe
4300	Qjpiha32.exe
4520	Qbgqio32.exe
1624	Qajadlja.exe
3228	Qeemej32.exe
5108	Qchmagie.exe
1492	Qloebdig.exe
3732	Qjbena32.exe
556	Qbimoo32.exe
1760	Qalnjkgo.exe
2576	Aegikj32.exe
544	Acjjfggb.exe
2200	Agffge32.exe
3564	Ajdbcano.exe
5032	Anpncp32.exe
4584	Abkjdnoa.exe
3180	Aanjpk32.exe
2448	Acmflf32.exe
4236	Ahhblemi.exe
3136	Aldomc32.exe
4732	Ajfoiqll.exe
892	Anbkio32.exe
3704	Abngjnmo.exe
4112	Aelcfilb.exe
4304	Acocaf32.exe
3936	Ahkobekf.exe
1952	Alfkbc32.exe
668	Ajiknpjj.exe
1116	Andgoobc.exe
2096	Aacckjaf.exe
4372	Aeopki32.exe
3832	Adapgfqj.exe
4036	Ahmlgd32.exe
3644	Alhhhcal.exe
2128	Angddopp.exe
2080	Abbpem32.exe
1228	Adcmmeog.exe
3648	Ajneip32.exe
3664	Bdfibe32.exe
3896	Bbgipldd.exe
3612	Bnnjen32.exe
1528	Balfaiil.exe
4244	Bhfonc32.exe
1084	Bdmpcdfm.exe
3904	Bbnpqk32.exe
4872	Blfdia32.exe
3800	Boepel32.exe
3884	Cliaoq32.exe
4884	Cbcilkjg.exe
4268	Cojjqlpk.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Aldomc32.exe	Ahhblemi.exe
File opened for modification	C:\Windows\SysWOW64\Dkifae32.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Djdmffnn.exe	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Iehfdi32.exe	Ipknlb32.exe
File opened for modification	C:\Windows\SysWOW64\Jfaedkdp.exe	Jcbihpel.exe
File created	C:\Windows\SysWOW64\Npjebj32.exe	Ngbpidjh.exe
File created	C:\Windows\SysWOW64\Oncofm32.exe	Ogifjcdp.exe
File created	C:\Windows\SysWOW64\Nfjjppmm.exe	Nggjdc32.exe
File created	C:\Windows\SysWOW64\Iehfdi32.exe	Ipknlb32.exe
File created	C:\Windows\SysWOW64\Aaqfok32.dll	Ifllil32.exe
File created	C:\Windows\SysWOW64\Mgkjhe32.exe	Mpablkhc.exe
File created	C:\Windows\SysWOW64\Bkjlibkf.dll	Mnebeogl.exe
File opened for modification	C:\Windows\SysWOW64\Cjpckf32.exe	Cfdhkhjj.exe
File opened for modification	C:\Windows\SysWOW64\Dhmgki32.exe	Deokon32.exe
File opened for modification	C:\Windows\SysWOW64\Acmflf32.exe	Aanjpk32.exe
File created	C:\Windows\SysWOW64\Efjecajf.dll	Kmkfhc32.exe
File created	C:\Windows\SysWOW64\Gcgnkd32.dll	Njciko32.exe
File created	C:\Windows\SysWOW64\Jilkmnni.dll	Odapnf32.exe
File created	C:\Windows\SysWOW64\Kpbmco32.exe	Kfjhkjle.exe
File created	C:\Windows\SysWOW64\Eonefj32.dll	Megdccmb.exe
File created	C:\Windows\SysWOW64\Oahicipe.dll	Aglemn32.exe
File opened for modification	C:\Windows\SysWOW64\Cajlhqjp.exe	Cjpckf32.exe
File opened for modification	C:\Windows\SysWOW64\Aeopki32.exe	Aacckjaf.exe
File created	C:\Windows\SysWOW64\Mdmaef32.dll	Dlgmpogj.exe
File created	C:\Windows\SysWOW64\Jcllonma.exe	Jlednamo.exe
File opened for modification	C:\Windows\SysWOW64\Dmgbnq32.exe	Dkifae32.exe
File created	C:\Windows\SysWOW64\Lfjhbihm.dll	Chmndlge.exe
File created	C:\Windows\SysWOW64\Bhfonc32.exe	Balfaiil.exe
File created	C:\Windows\SysWOW64\Jlajgl32.dll	Colffknh.exe
File opened for modification	C:\Windows\SysWOW64\Jcbihpel.exe	Jlkagbej.exe
File created	C:\Windows\SysWOW64\Iqjikg32.dll	Banllbdn.exe
File created	C:\Windows\SysWOW64\Efmolq32.dll	Qffbbldm.exe
File created	C:\Windows\SysWOW64\Bcobhnfc.dll	Pjdilcla.exe
File created	C:\Windows\SysWOW64\Aelcfilb.exe	Abngjnmo.exe
File created	C:\Windows\SysWOW64\Adcmmeog.exe	Abbpem32.exe
File created	C:\Windows\SysWOW64\Njciko32.exe	Ncianepl.exe
File opened for modification	C:\Windows\SysWOW64\Qbimoo32.exe	Qjbena32.exe
File created	C:\Windows\SysWOW64\Gohhpe32.exe	Gmjlcj32.exe
File created	C:\Windows\SysWOW64\Npcoakfp.exe	Mnebeogl.exe
File created	C:\Windows\SysWOW64\Ejckel32.dll	Jlnnmb32.exe
File created	C:\Windows\SysWOW64\Pcijeb32.exe	Pnlaml32.exe
File created	C:\Windows\SysWOW64\Jdencjac.dll	Bdmpcdfm.exe
File created	C:\Windows\SysWOW64\Dhcbhjlp.dll	Dhidjpqc.exe
File opened for modification	C:\Windows\SysWOW64\Fchddejl.exe	Fkalchij.exe
File created	C:\Windows\SysWOW64\Jbglkbhg.dll	Fhcpgmjf.exe
File created	C:\Windows\SysWOW64\Ophfae32.dll	Fooeif32.exe
File created	C:\Windows\SysWOW64\Oneklm32.exe	Ofnckp32.exe
File created	C:\Windows\SysWOW64\Ipenkiei.dll	Deoaid32.exe
File opened for modification	C:\Windows\SysWOW64\Jfhlejnh.exe	Jlbgha32.exe
File created	C:\Windows\SysWOW64\Kplpjn32.exe	Kmncnb32.exe
File created	C:\Windows\SysWOW64\Dajbcgdm.dll	Bhfonc32.exe
File opened for modification	C:\Windows\SysWOW64\Demecd32.exe	Dboigi32.exe
File created	C:\Windows\SysWOW64\Bnmcjg32.exe	Bffkij32.exe
File opened for modification	C:\Windows\SysWOW64\Gdjjckag.exe	Gcimkc32.exe
File created	C:\Windows\SysWOW64\Kmfmmcbo.exe	Kikame32.exe
File opened for modification	C:\Windows\SysWOW64\Lenamdem.exe	Lboeaifi.exe
File created	C:\Windows\SysWOW64\Hfggmg32.dll	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Deanodkh.exe	Dohfbj32.exe
File created	C:\Windows\SysWOW64\Fljcmlfd.exe	Elgfgl32.exe
File opened for modification	C:\Windows\SysWOW64\Heocnk32.exe	Hflcbngh.exe
File created	C:\Windows\SysWOW64\Fllifblf.dll	Jfaedkdp.exe
File opened for modification	C:\Windows\SysWOW64\Cfbkeh32.exe	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Echknh32.exe	Eolpmi32.exe
File created	C:\Windows\SysWOW64\Ohjgdmkj.dll	Fdlnbm32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9096	8592	WerFault.exe	418

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajiknpjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fdnjgmle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olpppj32.dll"	Hkdbpe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njciko32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajckij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qjpiha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qajadlja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pkceffcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lpcfkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndhmhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdheac32.dll"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhmkghpm.dll"	Qcepkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ekemhj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Imfdff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jlednamo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kmfmmcbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pjdilcla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phadlp32.dll"	Alhhhcal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hmabdibj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdjagjco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbllbm32.dll"	Pkceffcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjqehkaf.dll"	Demecd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajneip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hkikkeeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmidog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Balpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qgallfcq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qbgqio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieakglmn.dll"	Hioiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qcepkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcfmgfde.dll"	Dkljak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdqejn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Docjlc32.dll"	Immapg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kfjhkjle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ngbpidjh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qjbena32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aldomc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jholncde.dll"	Mdhdajea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiljkifg.dll"	Mlcifmbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hkmefd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npibja32.dll"	Ipdqba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcjkaiib.dll"	Andgoobc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phaedfje.dll"	Jlkagbej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ipbdmaah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efjecajf.dll"	Kmkfhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glbandkm.dll"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aipoal32.dll"	Eolpmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gbdgfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdmpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmamoe32.dll"	Jefbfgig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lllcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Benlnbhb.dll"	Lbmhlihl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Npcoakfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pqnaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anmnemcc.dll"	Acmflf32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 1844	4960	5d2e3c469acbc4fb063b7a9ceb433aea573806aee3ec45d9f94d831274baf401.exe	85
PID 4960 wrote to memory of 1844	4960	5d2e3c469acbc4fb063b7a9ceb433aea573806aee3ec45d9f94d831274baf401.exe	85
PID 4960 wrote to memory of 1844	4960	5d2e3c469acbc4fb063b7a9ceb433aea573806aee3ec45d9f94d831274baf401.exe	85
PID 1844 wrote to memory of 3580	1844	Oqkdcn32.exe	86
PID 1844 wrote to memory of 3580	1844	Oqkdcn32.exe	86
PID 1844 wrote to memory of 3580	1844	Oqkdcn32.exe	86
PID 3580 wrote to memory of 2636	3580	Pgemphmn.exe	87
PID 3580 wrote to memory of 2636	3580	Pgemphmn.exe	87
PID 3580 wrote to memory of 2636	3580	Pgemphmn.exe	87
PID 2636 wrote to memory of 3256	2636	Pjdilcla.exe	88
PID 2636 wrote to memory of 3256	2636	Pjdilcla.exe	88
PID 2636 wrote to memory of 3256	2636	Pjdilcla.exe	88
PID 3256 wrote to memory of 4320	3256	Pqnaim32.exe	89
PID 3256 wrote to memory of 4320	3256	Pqnaim32.exe	89
PID 3256 wrote to memory of 4320	3256	Pqnaim32.exe	89
PID 4320 wrote to memory of 2748	4320	Pkceffcd.exe	90
PID 4320 wrote to memory of 2748	4320	Pkceffcd.exe	90
PID 4320 wrote to memory of 2748	4320	Pkceffcd.exe	90
PID 2748 wrote to memory of 4404	2748	Pqpnombl.exe	91
PID 2748 wrote to memory of 4404	2748	Pqpnombl.exe	91
PID 2748 wrote to memory of 4404	2748	Pqpnombl.exe	91
PID 4404 wrote to memory of 4480	4404	Pcojkhap.exe	92
PID 4404 wrote to memory of 4480	4404	Pcojkhap.exe	92
PID 4404 wrote to memory of 4480	4404	Pcojkhap.exe	92
PID 4480 wrote to memory of 3968	4480	Pndohaqe.exe	93
PID 4480 wrote to memory of 3968	4480	Pndohaqe.exe	93
PID 4480 wrote to memory of 3968	4480	Pndohaqe.exe	93
PID 3968 wrote to memory of 4640	3968	Paegjl32.exe	94
PID 3968 wrote to memory of 4640	3968	Paegjl32.exe	94
PID 3968 wrote to memory of 4640	3968	Paegjl32.exe	94
PID 4640 wrote to memory of 4912	4640	Peqcjkfp.exe	95
PID 4640 wrote to memory of 4912	4640	Peqcjkfp.exe	95
PID 4640 wrote to memory of 4912	4640	Peqcjkfp.exe	95
PID 4912 wrote to memory of 3200	4912	Pgopffec.exe	96
PID 4912 wrote to memory of 3200	4912	Pgopffec.exe	96
PID 4912 wrote to memory of 3200	4912	Pgopffec.exe	96
PID 3200 wrote to memory of 4928	3200	Pjmlbbdg.exe	97
PID 3200 wrote to memory of 4928	3200	Pjmlbbdg.exe	97
PID 3200 wrote to memory of 4928	3200	Pjmlbbdg.exe	97
PID 4928 wrote to memory of 4528	4928	Qcepkg32.exe	98
PID 4928 wrote to memory of 4528	4928	Qcepkg32.exe	98
PID 4928 wrote to memory of 4528	4928	Qcepkg32.exe	98
PID 4528 wrote to memory of 4772	4528	Qgallfcq.exe	99
PID 4528 wrote to memory of 4772	4528	Qgallfcq.exe	99
PID 4528 wrote to memory of 4772	4528	Qgallfcq.exe	99
PID 4772 wrote to memory of 4300	4772	Qkmhlekj.exe	100
PID 4772 wrote to memory of 4300	4772	Qkmhlekj.exe	100
PID 4772 wrote to memory of 4300	4772	Qkmhlekj.exe	100
PID 4300 wrote to memory of 4520	4300	Qjpiha32.exe	101
PID 4300 wrote to memory of 4520	4300	Qjpiha32.exe	101
PID 4300 wrote to memory of 4520	4300	Qjpiha32.exe	101
PID 4520 wrote to memory of 1624	4520	Qbgqio32.exe	102
PID 4520 wrote to memory of 1624	4520	Qbgqio32.exe	102
PID 4520 wrote to memory of 1624	4520	Qbgqio32.exe	102
PID 1624 wrote to memory of 3228	1624	Qajadlja.exe	103
PID 1624 wrote to memory of 3228	1624	Qajadlja.exe	103
PID 1624 wrote to memory of 3228	1624	Qajadlja.exe	103
PID 3228 wrote to memory of 5108	3228	Qeemej32.exe	104
PID 3228 wrote to memory of 5108	3228	Qeemej32.exe	104
PID 3228 wrote to memory of 5108	3228	Qeemej32.exe	104
PID 5108 wrote to memory of 1492	5108	Qchmagie.exe	105
PID 5108 wrote to memory of 1492	5108	Qchmagie.exe	105
PID 5108 wrote to memory of 1492	5108	Qchmagie.exe	105
PID 1492 wrote to memory of 3732	1492	Qloebdig.exe	106

C:\Users\Admin\AppData\Local\Temp\5d2e3c469acbc4fb063b7a9ceb433aea573806aee3ec45d9f94d831274baf401.exe
"C:\Users\Admin\AppData\Local\Temp\5d2e3c469acbc4fb063b7a9ceb433aea573806aee3ec45d9f94d831274baf401.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\Oqkdcn32.exe
  C:\Windows\system32\Oqkdcn32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\SysWOW64\Pgemphmn.exe
    C:\Windows\system32\Pgemphmn.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Windows\SysWOW64\Pjdilcla.exe
      C:\Windows\system32\Pjdilcla.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2636
    - - C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3256
      - C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3200
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4300
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3732
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:556
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        25⤵
        Executes dropped EXE
        
        PID:1760
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        26⤵
        Executes dropped EXE
        
        PID:2576
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        27⤵
        Executes dropped EXE
        
        PID:544
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        28⤵
        Executes dropped EXE
        
        PID:2200
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3564
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        30⤵
        Executes dropped EXE
        
        PID:5032
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4584
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3180
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2448
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4236
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3136
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        36⤵
        Executes dropped EXE
        
        PID:4732
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        37⤵
        Executes dropped EXE
        
        PID:892
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3704
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4112
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4304
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        41⤵
        Executes dropped EXE
        
        PID:3936
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        42⤵
        Executes dropped EXE
        
        PID:1952
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:668
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1116
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2096
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4372
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        47⤵
        Executes dropped EXE
        
        PID:3832
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        48⤵
        Executes dropped EXE
        
        PID:4036
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3644
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        50⤵
        Executes dropped EXE
        
        PID:2128
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2080
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1228
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3648
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        54⤵
        Executes dropped EXE
        
        PID:3664
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        55⤵
        Executes dropped EXE
        
        PID:3896
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3612
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1528
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4244
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1084
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3904
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        61⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        62⤵
        Executes dropped EXE
        
        PID:3800
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3884
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        64⤵
        Executes dropped EXE
        
        PID:4884
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        65⤵
        Executes dropped EXE
        
        PID:4268
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        66⤵
        Drops file in System32 directory
        
        PID:3788
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        67⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        68⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        69⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        70⤵
        Drops file in System32 directory
        
        PID:1548
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        71⤵
        
        PID:3372
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        72⤵
        Drops file in System32 directory
        
        PID:2300
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        73⤵
        Modifies registry class
        
        PID:2116
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4000
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5100
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        76⤵
        Drops file in System32 directory
        
        PID:2624
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        77⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        78⤵
        Modifies registry class
        
        PID:1432
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        79⤵
        Drops file in System32 directory
        
        PID:4144
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        80⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4212
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        82⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        83⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:540
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        84⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        85⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        86⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        87⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        88⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4576
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        90⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        91⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        92⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        93⤵
        Drops file in System32 directory
        
        PID:4788
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        94⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        95⤵
        
        PID:548
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        96⤵
        
        PID:820
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4488
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        98⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        99⤵
        Drops file in System32 directory
        
        PID:2684
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        100⤵
        Drops file in System32 directory
        
        PID:456
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        101⤵
        
        PID:816
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        102⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        103⤵
        Drops file in System32 directory
        
        PID:3116
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        104⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4064
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3576
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        107⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        108⤵
        Modifies registry class
        
        PID:4808
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        109⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        110⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        111⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        112⤵
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        113⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        114⤵
        Drops file in System32 directory
        
        PID:5264
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        115⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        116⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        117⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        118⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        119⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        120⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5552
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        122⤵
        Drops file in System32 directory
        
        PID:5592
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        123⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        125⤵
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        126⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        127⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5876
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        129⤵
        Drops file in System32 directory
        
        PID:5912
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        130⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        131⤵
        Modifies registry class
        
        PID:5992
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        132⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        133⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        134⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        135⤵
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        136⤵
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        137⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        138⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        139⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        140⤵
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5568
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        142⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        143⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        144⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        145⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        146⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        147⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        148⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        149⤵
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        150⤵
        Drops file in System32 directory
        
        PID:5328
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        151⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        152⤵
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        153⤵
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        154⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        155⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        156⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        157⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5420
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        158⤵
        Drops file in System32 directory
        
        PID:5816
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        159⤵
        Drops file in System32 directory
        
        PID:5972
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        160⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        161⤵
        Drops file in System32 directory
        
        PID:5608
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        162⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        163⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        164⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        165⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        166⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        167⤵
        Drops file in System32 directory
        
        PID:6316
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        168⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        169⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        170⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6476
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6528
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        172⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6588
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        173⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        174⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        175⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        176⤵
        Drops file in System32 directory
        
        PID:6776
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6820
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        178⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        179⤵
        Modifies registry class
        
        PID:6896
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        180⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        181⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        182⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        183⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7144
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6172
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        186⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6308
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        188⤵
        Drops file in System32 directory
        
        PID:6360
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        189⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        190⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        191⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        192⤵
        Modifies registry class
        
        PID:6728
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        193⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        194⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        195⤵
        Drops file in System32 directory
        
        PID:6920
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6980
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        197⤵
        Modifies registry class
        
        PID:7064
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        198⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        199⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        200⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        201⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        202⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6684
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6812
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        205⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        206⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        207⤵
        Drops file in System32 directory
        
        PID:7160
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        208⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        209⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        210⤵
        Modifies registry class
        
        PID:6624
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        211⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        212⤵
        Modifies registry class
        
        PID:7044
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        213⤵
        Modifies registry class
        
        PID:6256
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        214⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6912
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        216⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6352
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        218⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        219⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6944
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        221⤵
        Modifies registry class
        
        PID:7204
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        222⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7280
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7320
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7364
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        226⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        227⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        228⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7492
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7528
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7568
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        231⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7612
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        232⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        233⤵
        Modifies registry class
        
        PID:7696
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        234⤵
        Drops file in System32 directory
        
        PID:7736
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7780
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7840
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        237⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7940
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        239⤵
        Drops file in System32 directory
        
        PID:7980
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8020
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        241⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        242⤵
        Drops file in System32 directory
        
        PID:8104
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        243⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        244⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        245⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        246⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        247⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        248⤵
        Drops file in System32 directory
        
        PID:7404
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        249⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        250⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        251⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        252⤵
        Drops file in System32 directory
        
        PID:7632
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        253⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        254⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        255⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        256⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        257⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        258⤵
        Modifies registry class
        
        PID:8088
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        259⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        260⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        261⤵
        Modifies registry class
        
        PID:7296
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        262⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7520
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        264⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        265⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7936
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        267⤵
        Drops file in System32 directory
        
        PID:8016
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8128
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        269⤵
        Modifies registry class
        
        PID:7228
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        270⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7592
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        272⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        273⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        274⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7372
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        276⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        277⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        278⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        279⤵
        Drops file in System32 directory
        
        PID:8056
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        280⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        281⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        282⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        283⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8312
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        285⤵
        Modifies registry class
        
        PID:8356
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        286⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8440
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        288⤵
        Modifies registry class
        
        PID:8476
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        289⤵
        Drops file in System32 directory
        
        PID:8524
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8564
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        291⤵
        Modifies registry class
        
        PID:8604
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8656
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        293⤵
        Drops file in System32 directory
        
        PID:8692
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        294⤵
        Modifies registry class
        
        PID:8740
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        295⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8784
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        296⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        297⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        298⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        299⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        300⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        301⤵
        Drops file in System32 directory
        
        PID:9040
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        302⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        303⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9156
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        305⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8220
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        307⤵
        Drops file in System32 directory
        
        PID:8276
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8384
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8472
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        310⤵
        Modifies registry class
        
        PID:8572
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        311⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        312⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8812
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        314⤵
        Drops file in System32 directory
        
        PID:8904
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8988
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        316⤵
        Modifies registry class
        
        PID:9068
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        317⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        318⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        319⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        320⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8464
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        321⤵
        Drops file in System32 directory
        
        PID:8636
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        322⤵
        Modifies registry class
        
        PID:8720
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        323⤵
        Drops file in System32 directory
        
        PID:8860
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        324⤵
        Modifies registry class
        
        PID:8976
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        325⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        326⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        327⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        328⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8592 -s 420
        329⤵
        Program crash
        
        PID:9096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 8592 -ip 8592
1⤵
PID:8944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aanjpk32.exe

Filesize
211KB

MD5
dc2df69614ca08b8d05bbdb0e0258102

SHA1
04dae0c6bc84909f4cb1a2ac41e8cd66dbca28e5

SHA256
c06140bbd971554810513d117cf7a7303f770300edc89f17254c33c2147ebd3f

SHA512
05c26291aa6dcd1d0f9a641ee641cde84349df2fa4ede5f349cf0fb282d6e964c073c3f098135dbc8ee11f386dbb4be3aa7b819aac72ecaae9ef0a79ff345e56

Download Submit
C:\Windows\SysWOW64\Abkjdnoa.exe

Filesize
211KB

MD5
f1a8201e59b8ed064c42353165676e30

SHA1
35d0125ba166d084b5302265906895786997b88e

SHA256
297d9aa3ea7ddd24d3e0afa2901a476b1a104eee14cac6eb1b783bda6ca73644

SHA512
19f454b0cd6c454dc8c68499ada6ff4c04313b3e209ea2179d036e599612865143e0e78d27b73ffa7cffa3a8960ad3c5aee1333e8b93162fe3867a6e03810541

Download Submit
C:\Windows\SysWOW64\Acjjfggb.exe

Filesize
211KB

MD5
42bbddfb5049e58ed53dbfe393040f4a

SHA1
fabf37355b7a8541c22c2553116c560b2a4242e2

SHA256
0b64caa63ecec26aca0d1ed9a5d2b93bde2d361ddfe22528009bcb216686b03e

SHA512
05cee4f02f03afe8c7cc63c05f74a190334933da3c78e78b4a656c82c27835c5b695a9c201ddb6bf486440289543a957121742ec65e95a02449fb0c6be84eb13

Download Submit
C:\Windows\SysWOW64\Acmflf32.exe

Filesize
211KB

MD5
62b11533c18e1745befa163d0a5abecf

SHA1
b55a8a0b0e525bd19e0fc57e68bfad9688e3a0b1

SHA256
fa04901ee65f5246376129fc747613bdae2090fa2b4df5f395a9c91ba938bae6

SHA512
3a366b0f70aac5b63720ee630d0df58c69796eb91001caf7fac55a7260cb0ba37dd3de401c210b6b38da91e5deaf6bccfdae3419833658fa0dd51196b8b91983

Download Submit
C:\Windows\SysWOW64\Aegikj32.exe

Filesize
211KB

MD5
d93f6a0ae59ac0c1976af926df1416a4

SHA1
9aa97486a7dbb894380ac2ce3561046a79f5c0ec

SHA256
8325b9fda0625abc214ecc8f1722142475db11c77885e3552c3553833c521228

SHA512
a5b200e2c4cc88d059e0dcef8440483f8676bc1fc81f8108508c81a9b414216136a4f053ca5f175e5c900f05d32332c3364a38184947a301e8b7a6e66c3e9129

Download Submit
C:\Windows\SysWOW64\Agffge32.exe

Filesize
211KB

MD5
0b7653e4274b582f221104ee0dcdb19c

SHA1
d49093036d874414a7fcc5112554dd9d198b1e49

SHA256
7e45a8561b02969eacb57ab5a712ff94ccc6a5729d4d3ac8f8ce905c41f261e2

SHA512
fa658cf020e604940c4258efa389c0cb06c66dc85842ac50150ea3390acbce0b41c9c4d8d65075603e9b6365cbcbd3e5700a31b8cee7f3627c4528d3bff4eb38

Download Submit
C:\Windows\SysWOW64\Ajdbcano.exe

Filesize
211KB

MD5
97ae424a5e680f793fa9e45411f9d6f0

SHA1
248011fa77c8d78169eeff23992af1e42e15a8ae

SHA256
99fc7526c5c88fb25d1aceaaa01bafb994afb3603ff7b1eeff59adb239476b35

SHA512
9bcb1cc4d7198c07d1e5298c1a982c0ff59338c60211e23b69afb3865d78fa0c3b175c273c65c0f18a1fd720e3973d70a20da4c61ac88b67ae9f6fbc201e472a

Download Submit
C:\Windows\SysWOW64\Anpncp32.exe

Filesize
211KB

MD5
0610231aeb44907b34fc1f40ef3b634b

SHA1
0331f7d062b7c96d40bfd044ce5bf38be3f7543f

SHA256
828661e95e4cc599ce64381ba34e90781e8b339ee63b0c4141129c28a308f095

SHA512
dcb3657263bdaf8c6c0fc3b9b2f8267fd7ae9ad517810d9f5879be10494d6e73da57ceb99f18baaa3eb9282c2eb6441c2baca4380fb3bb26a7df06dec8d859c5

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
211KB

MD5
a5cc800bb709c767ac0c1bbf8caa8af5

SHA1
c64b9601a1e79d636583da80566b640067e5454e

SHA256
3e4d675be7e7eff382d43eeb6a6d8cc5dee44fc332bdc960a438907be6f0d254

SHA512
bf0d4cc98c900cc3c45bbfe5c6f292b9e62f4935e96f4f68ea9db30ac004577db031e29bbea145244ac2219c6dd2b0eac6cfa173568eb70667b9a70cb74b9a14

Download Submit
C:\Windows\SysWOW64\Ilkojc32.dll

Filesize
7KB

MD5
de396ee661a54f08584017b8efac57da

SHA1
cfe266ef02583dc132f42be73d49228268cba510

SHA256
2dbbee2b52de0c5f1e28a406650e8c760daa538bfc554c95652c7a882464c349

SHA512
0f7335e0fa5a1b22b14ce2e2a7fa791f45293ef7f3a602eace929c36a3b03d343d71f7726fe1632f9d972bb44a12da0a5e79eefa864580cd6965714b45b11df4

Download Submit
C:\Windows\SysWOW64\Lenamdem.exe

Filesize
211KB

MD5
64cbb45ae43bbbaa40cd98bf092ca403

SHA1
45901b482c72ed273c285e4309be4752d59ebbdf

SHA256
367fc6d60fce690c883289ab69e0bf4000ef9ec73a81cbe6f1a890d45742ed55

SHA512
40207153428f7494b4c41b2bae40851f805792f6cc7a440b55f25b3f306c52084a623e960a2f6e5bf6c1e5c0f841e349e22a1a2c380ba4e663ab32f6f281c078

Download Submit
C:\Windows\SysWOW64\Liddbc32.exe

Filesize
64KB

MD5
1722a2663c073d942293af67fdb61216

SHA1
df736ea99bf80f91d61a3205e29333b6b5d75a24

SHA256
5f0e0b4f48e469b36d3b6f63f2c18533a4b8026933c74a52ece0b2ac8c5db7ea

SHA512
69bee702f9c3ee2a5abc2edf94ea6438c2977ba6074478bd175ad1fa0670c63634c8e38d5687352e36e6d182b6222cd5f92e02ddb5062dba512c9a9862435d44

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
211KB

MD5
ba70a1b85eb6841a49279d06f8219820

SHA1
c25df5b82605f6df3decff2cdf67248076213220

SHA256
f5f5cd2a280a8e20fd72a311dddc2674cdbf6547ed736c05a3f462b6ee014bea

SHA512
4bd946c7df1ed4788236354c7d1c9a2e0999dad17c6fad4538be08d2ad74afac53a1964c8d7b9ea1127eec90ee12ef8f4199532faba9fe80b9beba7a8878bd25

Download Submit
C:\Windows\SysWOW64\Oqkdcn32.exe

Filesize
211KB

MD5
2a8fc47c430bff4f3a46e45942527862

SHA1
70aff5f1b6ce6bb17cfa728608a951943137dcfe

SHA256
e94bfe82e0d7a726c4ce514591f68623790132c02917ed19de6e8b23ffa5bded

SHA512
fa1186e1b0af0a369cfaeb9c8694de6e3b458f97e785846e43a4025df85dac4c68c5dae2a3c14ecfc84dfca2de5103d36b0ede5f5196c441c33daa6fec47d341

Download Submit
C:\Windows\SysWOW64\Paegjl32.exe

Filesize
211KB

MD5
185fc684581b6df659423c700af89087

SHA1
c81504ea5a4daffa0e6a918d10973247f58c7497

SHA256
796bd012a4316b491a6fb7527d81baafa8a2c489335f388ce65504660e2a7107

SHA512
c2e98a3b1f15de54c4331847165a084aedf6601a4d98b5441b427b41e64e64bc1615d7836f196217c28376eede184c366ef03e5131a57a026c3c5542ad410fcd

Download Submit
C:\Windows\SysWOW64\Pcojkhap.exe

Filesize
211KB

MD5
c9ff8d775f7bb37f5b8dacde83dbbb66

SHA1
e0f3926ea95544e8bff5cddc8c975b990258380e

SHA256
3406cc2003565b935ab443200b963449d6494d049dfa9e67fe41f91ededb80a3

SHA512
909544e8dc4694f209d28f4404c17293d8ebe4bf8287d104f357ba3735c6a2dec5aa02346dae54a53ae3694d5f1a051532f84067d36f7143c71ba7864a8da425

Download Submit
C:\Windows\SysWOW64\Peqcjkfp.exe

Filesize
211KB

MD5
6a74fb920e3d2045df7b355fcdb5c1a6

SHA1
90faadc9a9ae6d14eb82a18cfb4adabe64a22775

SHA256
f5564d40daf385ce4a4b6072e8883e236f4ab3ca9e8cb49b81ced4a1da1b3c40

SHA512
d583aa776ffc320d464d7b0c21c604155d14027afdfa6c0798ba4f209a0f5637c95a2039e1148afabde30b283907e9fc6542a40d4fab77a1c447ecba6355a1fd

Download Submit
C:\Windows\SysWOW64\Pgemphmn.exe

Filesize
211KB

MD5
2e116631e1c98195c12c6092bd476ca7

SHA1
574b3cf3767b7f550f6a870e4625991ffed407b2

SHA256
1608ce35f00a8d7bfa869f7e3b1bc7561e2eac583cac0d2595f9ce59520bbf8c

SHA512
04f6ea4032a1f60c3488f775e68a8fd5fb4c1b4b2fd0b7c991bf12bc608f5113f5d91fab10a2d605a384aad350f06c54f350ebdae87bb22cba9d366460c0189c

Download Submit
C:\Windows\SysWOW64\Pgopffec.exe

Filesize
211KB

MD5
3dc4394f3c90b4c3c1b6c44ac5c52a48

SHA1
9edfa1fdc7ca6a33249ab313c2e83f2d1d85c806

SHA256
8b692d07f1524878e36bf73861b4156d711acffc2cdbe13f63b950d051a803dc

SHA512
3478a1a648ca3dad5bcee35fd10530e4a6ad36a93073cb6e17afc2b40e3883feabc704ea714956e2fc03ac527eb693c4d6f11e2e76829e62de5e4853dd9cc04c

Download Submit
C:\Windows\SysWOW64\Pjdilcla.exe

Filesize
211KB

MD5
b86d5e94d4e7c4cf37bb42a8a8e6b337

SHA1
ace85e2b0a0fc0219b981ee8299172697a216baf

SHA256
79159b97a5c5104d83495915991f4b1ebb107c0894f7e031ec39fd07138434f9

SHA512
44cf49f8f4a084d08bf70bfebf5f0d462be3bb1504eafa6bbc358829b35b30238eab4c86a294aaf0f0f51caa4208f272fb4428f76809f150c9e6ba167775aba6

Download Submit
C:\Windows\SysWOW64\Pjmlbbdg.exe

Filesize
211KB

MD5
e8324ea971c4b551194a42e01c5f23df

SHA1
6f3398412db631a746db9e71d5f88140bd1638bb

SHA256
e924318fb3b8df848a51194efb63d5c3bc6a4d9face03515c59c7f919f14749c

SHA512
76c2d2ade64406d008dcf83d9e4b40bfbe5a4c8a5d566c5efa858e89aa086ea7b24372cd50742c3658eb89838abb510e0985cb293aff5d0f301895918778d17e

Download Submit
C:\Windows\SysWOW64\Pkceffcd.exe

Filesize
211KB

MD5
611296b47326b21eeb160c78480828b3

SHA1
a13c3c6835998011de7b60d50dc1432f1f310175

SHA256
c2400841dc2d668389eb5c3e9992c2a770ec3138140376724715c0192908b2b1

SHA512
6b0df2c3d943d01635424cca16c9bbe8705fce4a3a47ddf67143e63c0214c842630a8210470402b31f21c4c94d0d06b1092127f68f789b6f4d8c605b565e95d0

Download Submit
C:\Windows\SysWOW64\Pmdkch32.exe

Filesize
211KB

MD5
5ac704213597f5d6185712182a6f4505

SHA1
f65a3e985265420ac34a007a460c152a637cd097

SHA256
068bde92441d31e873272e3d510c38f9eeacecdc9fdf616e670fe8a0200f0ecc

SHA512
9400e93d7d74befd6699bd98e8c847a96cd33790955675a0252560bf122a47bf0efdd0b66dcd0f114891c55e2579eb8489b7b12ba277038606099c7a0525c074

Download Submit
C:\Windows\SysWOW64\Pndohaqe.exe

Filesize
211KB

MD5
26345148a91870e8f2f9055da2e1117a

SHA1
3c536a6fc74dff1a8a7c808fd033b8124061bf73

SHA256
b13fd51498b133fa04b290415c2fa5ea1c6e327fa21104a97574497c232f10ac

SHA512
14ecd26c968858d4e01f8e8d1cf7e2dfc1a162f272274fa67bd7e895d1ad105ab17a5a819be4895739285a81745121e93e3c9f7fac422f1d6414c64a0c4a0eab

Download Submit
C:\Windows\SysWOW64\Pqnaim32.exe

Filesize
211KB

MD5
eef0efe6d75ccb795ff09ab36117dc44

SHA1
618c2e43c80b4b3fde242acf2730c640f5570015

SHA256
0e1e03e1f495e61eb96b0abe08159aa08909c961c95b572bcffff5150e0ee1dd

SHA512
39b1da25092beaa564d967c85f7afaba13cacef1f36ca2a1d963bb45490c0c1abd9623c250a2ee302c49cfb69884f256eb2f9860f6e46cc98b068bcce3471b7d

Download Submit
C:\Windows\SysWOW64\Pqpnombl.exe

Filesize
211KB

MD5
2d658b72fb22ff1a136c5274ba32ff7e

SHA1
e584530ce6d0991401b6625d801e5a7e0791012e

SHA256
9ad19303bd4d3991b71df75aea5da3c00fab89dd5833eb179f61b7f95ecd7eb9

SHA512
05d21eb0e25fd7777bee7713648958517bd75cdf211296e5811f89bd026347850c7c8dce0088636b10509f18108a9a3ae839e38edd60ed06c1d2049cefb9a149

Download Submit
C:\Windows\SysWOW64\Qajadlja.exe

Filesize
211KB

MD5
6beea898bc86947d58d3b2e3c30a5ea6

SHA1
35689ae83cb2f8ddd643ba6c04d7fa344731e39c

SHA256
75340c73d4ab2e7b820257090a23a8efe30daff86c8db6a009f4da971598ff29

SHA512
9d4d3f77072e5108ac7c0d8ce415e6e99b92c7e104273e280f9fc5eb8b6d8f0dda7660b3551433f73f75d168fc1e889b3facb7ab2a5e1b919067e3f97cebd282

Download Submit
C:\Windows\SysWOW64\Qalnjkgo.exe

Filesize
211KB

MD5
75529819eed6b346172ff52a8dfeb397

SHA1
92eec7e8e36a26b7a41ae57ded1be6e8e69401c8

SHA256
6b7d3de896d17335dd5143e5b6fd4f97d57053752e3c260982fdc7c0c453fd12

SHA512
962e7428782dd11c266f1f1ea0da5d20bc961d5c4451a109ac6ba7a8b96575130bad45a1ce4dd5eae71f235137ddb74ecf58914e4b6622ae5f58cb08d50eff4a

Download Submit
C:\Windows\SysWOW64\Qbgqio32.exe

Filesize
211KB

MD5
46a6b53d93f0fc5e18a120dcc62d6093

SHA1
d9ab123083fb73260630e052464c41c8e882b573

SHA256
be40a06b65f37615be005e1182503daa3bbcacb2f15c8f0bf0db79fd20a21c56

SHA512
d927ef3bbb6d7a03dc0e4d16ac6e56a5e084e50660b83b493ac20f901451d615eb6fcf8ac4ce558a87e5a2a367635ca293bb5c4dc8f64d8e157b7dc0fdad77e4

Download Submit
C:\Windows\SysWOW64\Qbimoo32.exe

Filesize
211KB

MD5
576a16961dc7278e1a11b3394545e51a

SHA1
cd46ef45c1a4dea2fdbeb79e2b469933e655de42

SHA256
536ed835a5a22fa02f6396f808e23a5a64e13dc3414b4328228def95f6d99d94

SHA512
08284300521bd2834c8ad3b9649018df9c273b92b71fac932a7b2a596287344e550ab63b06e50f6ada112188e768526d5f504d5c4c3912c1f1a758627c8af9cf

Download Submit
C:\Windows\SysWOW64\Qcepkg32.exe

Filesize
211KB

MD5
f734fc506b14ef6eff03ef04aa644dcb

SHA1
a554795415c33cfbed0939373ddba71b2a8ded34

SHA256
be24725c93a57d08aaf1c4610d1d53a81b95a022905d3a7acf9727d17b4f76d0

SHA512
750c1b56d17704df9e23f19e9110c0323de046d0e2e628c31d5a312c8f9df7eeb2ea2be2a82f612782ae83ca62afe27664b4217c31ebf3b159d73674a95fff4c

Download Submit
C:\Windows\SysWOW64\Qchmagie.exe

Filesize
211KB

MD5
6d729f5ac65176cf0c1e974dfa6b7e9f

SHA1
cd263021bf2d270881b06e3a2c1ba3e077234c09

SHA256
4fbaa39a4b6b25eb0438319f5dfa046f71a24efed7333f1bdfdffb2836afb7ce

SHA512
a546ff93a9205e0f02f0556b52095ca1de3484635acab33b8905853bcc90a7aabb251e86aa68aca7f7cf6739e62bdf5fe76ddd37bbf2c1de64bad72bdaffe4d1

Download Submit
C:\Windows\SysWOW64\Qddfkd32.exe

Filesize
211KB

MD5
9223235c1850ec0f740a10959cf7ddf3

SHA1
127b722dd4bc4f15d7745c48b23a3bd87cebdfbd

SHA256
8404b9b37cb61f84f7ac3b3e42b1ad6c78900a28278179295c32620b9caa3584

SHA512
47248eeea4320ebd3767160140bcfca17db868335b49b18be7a6d4a29a8655a3039d6e2694e25c048181505cbb26f1c90c95d271477d4a28571e79a94fd264ba

Download Submit
C:\Windows\SysWOW64\Qeemej32.exe

Filesize
211KB

MD5
399e3bfddbbae0f553f46e9e4496598f

SHA1
d587c398a883ba74f007cd9339e4bb9b4f9f52cf

SHA256
b8d95d1d5f9199104888573897baaa02c64da05628d2f61f780024462f8515bf

SHA512
fcda44cb58faa20311dd78a1581d0946c9d4cb0422e3a522505b20ba9dec9864269653721e8f1f5004ce7b8c2d212159aeb110b493f49da47c19607da90574db

Download Submit
C:\Windows\SysWOW64\Qgallfcq.exe

Filesize
211KB

MD5
58dcaebb3faa0cc85ae91f667542fa87

SHA1
249ca23593efb10d3ff1d5e761e3f9630a1035f1

SHA256
623ac456ceefecd1805eb24a8432d3a1f71a5a5dcf6c9ade8963327f7c6829f2

SHA512
cead5721d60e61d65b2293f93ad5941a895f72e5dcd7e86aefaabd7e026417113dda5b337e761ddc7516599a13309ec78ef49e004dcaad436ff8a3d639830540

Download Submit
C:\Windows\SysWOW64\Qjbena32.exe

Filesize
211KB

MD5
cf6b27cd0cf0ef2327069fad3e048151

SHA1
e95e9c1aff10833978db86c303a4b3697c141f5a

SHA256
39f9ce8b0da6e721ea6f0a142948c3792656b81715eba0d2d64d2b67ab4b95c9

SHA512
6d3f6a7977ef17c95f2f434881afb64b6576c6aa37070ac6e94a22c0d9d1c6e1e1cf6ca9236de65efa57e0dd53641d0aa11ea8a3e1c6f3951ce66af920968f78

Download Submit
C:\Windows\SysWOW64\Qjpiha32.exe

Filesize
211KB

MD5
4745d47a9deec2c5374d6f7878e04558

SHA1
b4107782beb8a1c5ca89fdcd2a2100fda7bfef26

SHA256
5d9135be7e2943c7de04c9da322c64363d564c395b5f25077ee039d47f2b0931

SHA512
e212117b9860aad5d4365481bf1383f7dc92e2990c761c20a440b2a37b6027103d0ca5a11abe248844594fa69d41bcbca9c78b53fd916c5e0639c0aac4cf7419

Download Submit
C:\Windows\SysWOW64\Qkmhlekj.exe

Filesize
211KB

MD5
6f68f14d92837a5483f3c47248342999

SHA1
7d18941a1dae25161de8354e8815d013eba378af

SHA256
d0d9ef397d03fb4354b822d029436f206ff2a55385c2b8368f60c255b40d4b0d

SHA512
3d67bccb096580bf4e6dd13bff3f731ac3246d280339186f19091d0d191eb6aa5a90cac2cb2b79015fd21ee9b6147ed4424361467dc2f43688e1e2f6c924033a

Download Submit
C:\Windows\SysWOW64\Qloebdig.exe

Filesize
211KB

MD5
f6faad65d43b206579b27c28ca587b9c

SHA1
468db4bb10ef3a68deb102680525e5e4d474be22

SHA256
f82c1c11ce04808474d4500084e4e51b3d63810f0d2f6d617f0f404efdc6d432

SHA512
35608498b2a3e9208be170fe5a799a4dbdb27273c1ed253034cfe27179a0fdafd5c75c9ca41e0c16743829a8547ec644899334c69b7ead1c5900921ce304ae01

Download Submit
memory/544-359-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/556-351-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/668-405-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/892-389-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1084-447-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1116-406-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1228-430-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1492-344-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1528-444-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1624-336-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1760-352-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1844-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1952-404-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2080-429-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2096-412-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2128-426-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2200-364-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2448-379-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2576-357-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2636-28-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2748-54-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3136-382-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3180-374-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3200-96-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3228-341-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3256-36-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3564-366-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3580-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3612-439-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3644-425-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3648-431-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3664-437-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3704-390-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3732-350-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3800-454-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3832-418-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3884-456-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3896-438-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3904-448-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3936-398-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3968-72-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4036-420-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4112-391-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4236-380-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4244-446-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4300-329-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4304-397-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4320-39-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4372-413-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4404-60-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4480-64-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4520-335-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4528-326-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4584-372-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4640-84-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4732-387-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4772-328-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4872-449-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4884-461-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4912-92-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4928-428-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4960-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5032-367-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5108-343-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads