c63661d4fd704cb67c981c747a39b9816534236228ddcf0d839e3d7f0890bfa0

Analysis

max time kernel
88s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

314b27ed630e4b2c710bbeaa50c7db9a.exe
Size

80KB
MD5

314b27ed630e4b2c710bbeaa50c7db9a
SHA1

7aac438d1b17ec58278faa363cec8eb2c4eab14a
SHA256

c63661d4fd704cb67c981c747a39b9816534236228ddcf0d839e3d7f0890bfa0
SHA512

35a9798683c6facc193979c31cf95bab8e8756a08dee034bbfe3151b3f1b806db799afd6b5d5ebe51a27abf5b2bff9fba10425afd9d3248cbffc74bf5d39f688
SSDEEP

1536:l+PozstMQ3VcXNMMF5ot3IwsDjuuuNsM1S7qC2UB5YMkhohBE8VGh:8gzstMQlSF63PoSs9X2UTUAEQGh

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkopnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqnaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qchmagie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlgmpogj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njnpppkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lepncd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bebblb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogkcpbam.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibnccmbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alfkbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmpijp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Becifhfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iblfnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhdbhcck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Meiaib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgallfcq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnbbbabh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhqcam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikpaldog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acocaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjpaooda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhgjblfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlampmdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kikame32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfqlnm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kemhff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dddojq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekcpbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfmepi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbabgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njacpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkidenlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Himldi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbmhlihl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edpnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpgfooop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llgjjnlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbgmcnhf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlampmdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojhiqefo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqbamo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alfkbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjdkjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aealah32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kefkme32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojmcld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gblngpbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lepncd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfjcgn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gofkje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfmepi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chghdqbf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhqcam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofqpqo32.exe

Executes dropped EXE 64 IoCs

pid	Process
4160	Mpolqa32.exe
4060	Mcnhmm32.exe
3536	Mjhqjg32.exe
2660	Maohkd32.exe
1360	Mdmegp32.exe
3456	Mglack32.exe
1892	Mjjmog32.exe
1500	Maaepd32.exe
1468	Mcbahlip.exe
1180	Mgnnhk32.exe
5048	Nnhfee32.exe
4544	Nqfbaq32.exe
4900	Nceonl32.exe
4552	Ngpjnkpf.exe
4648	Nnjbke32.exe
5100	Nddkgonp.exe
5096	Ngcgcjnc.exe
3300	Njacpf32.exe
3932	Nqklmpdd.exe
3616	Ncihikcg.exe
3944	Nkqpjidj.exe
3272	Nqmhbpba.exe
1912	Ncldnkae.exe
3052	Njfmke32.exe
3636	Nqpego32.exe
3244	Ogjmdigk.exe
3224	Ojhiqefo.exe
1488	Ondeac32.exe
4652	Oqbamo32.exe
5008	Okhfjh32.exe
4868	Obangb32.exe
3276	Ojmcld32.exe
2116	Odbgim32.exe
3552	Okloegjl.exe
3884	Onklabip.exe
2204	Obfhba32.exe
3104	Oqihnn32.exe
2372	Ogcpjhoq.exe
3984	Oqkdcn32.exe
2296	Pcjapi32.exe
2104	Pbkamqmd.exe
2940	Pqnaim32.exe
604	Pnbbbabh.exe
3540	Pqpnombl.exe
4512	Pgjfkg32.exe
3060	Pabkdmpi.exe
2176	Pkhoae32.exe
376	Pnfkma32.exe
4392	Pcccfh32.exe
1004	Pkjlge32.exe
64	Pagdol32.exe
3604	Qcepkg32.exe
3812	Qgallfcq.exe
2584	Qjpiha32.exe
2580	Qbgqio32.exe
3304	Qchmagie.exe
2708	Qalnjkgo.exe
2820	Agffge32.exe
3744	Anpncp32.exe
1232	Aejfpjne.exe
5056	Aldomc32.exe
3256	Abngjnmo.exe
4488	Acocaf32.exe
3772	Alfkbc32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bjghpn32.exe	Bldgdago.exe
File created	C:\Windows\SysWOW64\Iikhfg32.exe	Ifllil32.exe
File created	C:\Windows\SysWOW64\Llemdo32.exe	Ligqhc32.exe
File created	C:\Windows\SysWOW64\Pdifoehl.exe	Pmannhhj.exe
File opened for modification	C:\Windows\SysWOW64\Qdbiedpa.exe	Qmkadgpo.exe
File created	C:\Windows\SysWOW64\Meknidfo.dll	Qchmagie.exe
File opened for modification	C:\Windows\SysWOW64\Colffknh.exe	Clnjjpod.exe
File opened for modification	C:\Windows\SysWOW64\Hcpclbfa.exe	Hkikkeeo.exe
File created	C:\Windows\SysWOW64\Flakmgga.dll	Icplcpgo.exe
File created	C:\Windows\SysWOW64\Mmnldp32.exe	Mibpda32.exe
File opened for modification	C:\Windows\SysWOW64\Bldgdago.exe	Bdmpcdfm.exe
File created	C:\Windows\SysWOW64\Hcmgfbhd.exe	Hkfoeega.exe
File created	C:\Windows\SysWOW64\Iccbgbmg.dll	Iejcji32.exe
File created	C:\Windows\SysWOW64\Pmdfog32.dll	Kfoafi32.exe
File created	C:\Windows\SysWOW64\Kfankifm.exe	Kbfbkj32.exe
File created	C:\Windows\SysWOW64\Qgcbgo32.exe	Qddfkd32.exe
File created	C:\Windows\SysWOW64\Kpjcpkfo.dll	Obangb32.exe
File opened for modification	C:\Windows\SysWOW64\Fafkecel.exe	Fohoigfh.exe
File opened for modification	C:\Windows\SysWOW64\Kefkme32.exe	Kdeoemeg.exe
File created	C:\Windows\SysWOW64\Hlfofiig.dll	Njnpppkn.exe
File created	C:\Windows\SysWOW64\Amfoeb32.dll	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Anpncp32.exe	Agffge32.exe
File opened for modification	C:\Windows\SysWOW64\Gbgdlq32.exe	Gfpcgpae.exe
File created	C:\Windows\SysWOW64\Oicmfmok.dll	Aeklkchg.exe
File opened for modification	C:\Windows\SysWOW64\Bhhdil32.exe	Bclhhnca.exe
File created	C:\Windows\SysWOW64\Hmjfkopm.dll	Fhgjblfq.exe
File opened for modification	C:\Windows\SysWOW64\Cndikf32.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Cogflbdn.dll	Danecp32.exe
File created	C:\Windows\SysWOW64\Pgioqq32.exe	Pqpgdfnp.exe
File opened for modification	C:\Windows\SysWOW64\Bagflcje.exe	Bnhjohkb.exe
File created	C:\Windows\SysWOW64\Paihpaak.dll	Fomhdg32.exe
File created	C:\Windows\SysWOW64\Fbnkjc32.dll	Kfmepi32.exe
File opened for modification	C:\Windows\SysWOW64\Mpjlklok.exe	Mipcob32.exe
File created	C:\Windows\SysWOW64\Ncdgcf32.exe	Ndaggimg.exe
File opened for modification	C:\Windows\SysWOW64\Neeqea32.exe	Njnpppkn.exe
File created	C:\Windows\SysWOW64\Jdeflhhf.dll	Ndhmhh32.exe
File created	C:\Windows\SysWOW64\Ljfemn32.dll	Njacpf32.exe
File created	C:\Windows\SysWOW64\Pfaigm32.exe	Pdpmpdbd.exe
File opened for modification	C:\Windows\SysWOW64\Calhnpgn.exe	Cnnlaehj.exe
File opened for modification	C:\Windows\SysWOW64\Kmijbcpl.exe	Kimnbd32.exe
File created	C:\Windows\SysWOW64\Gfkfpo32.dll	Klqcioba.exe
File created	C:\Windows\SysWOW64\Kmfiloih.dll	Aminee32.exe
File created	C:\Windows\SysWOW64\Mjelcfha.dll	Daqbip32.exe
File created	C:\Windows\SysWOW64\Pcpopjlq.dll	Bkidenlg.exe
File created	C:\Windows\SysWOW64\Dhcbhjlp.dll	Dldpkoil.exe
File opened for modification	C:\Windows\SysWOW64\Lphoelqn.exe	Lmiciaaj.exe
File created	C:\Windows\SysWOW64\Aepefb32.exe	Aminee32.exe
File created	C:\Windows\SysWOW64\Hjjdjk32.dll	Beglgani.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Aejfpjne.exe	Anpncp32.exe
File created	C:\Windows\SysWOW64\Dldpkoil.exe	Dekhneap.exe
File opened for modification	C:\Windows\SysWOW64\Gfembo32.exe	Gcfqfc32.exe
File created	C:\Windows\SysWOW64\Ndokbi32.exe	Mnebeogl.exe
File created	C:\Windows\SysWOW64\Idodkeom.dll	Mnebeogl.exe
File created	C:\Windows\SysWOW64\Conclk32.exe	Chdkoa32.exe
File created	C:\Windows\SysWOW64\Fkffog32.exe	Fhgjblfq.exe
File created	C:\Windows\SysWOW64\Hkdbpe32.exe	Hmabdibj.exe
File opened for modification	C:\Windows\SysWOW64\Ajhddjfn.exe	Aeklkchg.exe
File created	C:\Windows\SysWOW64\Bnpppgdj.exe	Bgehcmmm.exe
File created	C:\Windows\SysWOW64\Ddjejl32.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Hlmobp32.dll	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Mgpjhl32.dll	Beeflhdh.exe
File created	C:\Windows\SysWOW64\Kpihae32.dll	Gicinj32.exe
File created	C:\Windows\SysWOW64\Hmhhehlb.exe	Himldi32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10756	10440	WerFault.exe	504

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmgmnjcj.dll"	Bganhm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqpego32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcobhnfc.dll"	Pbkamqmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjghpn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghaliknf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njnpppkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hipfji32.dll"	Bhaebcen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfembo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aaqfok32.dll"	Ifllil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmdina32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhbopgfn.dll"	Neeqea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bbgipldd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcjnop32.dll"	Ildkgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klqcioba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojmcld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgjfkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enoogcin.dll"	Hcpclbfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoglcqao.dll"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjngmo32.dll"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjqaij32.dll"	Dkoggkjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkalchij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmdfog32.dll"	Kfoafi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iihqganf.dll"	Lenamdem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpqiemge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmdina32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aejfpjne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhclbphg.dll"	Fkciihgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmabdibj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llemdo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onklabip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgjfkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chpada32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jplfcpin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Filmclmj.dll"	Oqbamo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gododflk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Himldi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahioknai.dll"	Ncdgcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Okhfjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npfhbbpk.dll"	Dekhneap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbbkaako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iefioj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdqjac32.dll"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjpaooda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eekaebcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fojhkmkj.dll"	Llemdo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgddhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dlgmpogj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfmepi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekacmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcmgfbhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egjpehcm.dll"	Ojmcld32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 4160	4576	314b27ed630e4b2c710bbeaa50c7db9a.exe	87
PID 4576 wrote to memory of 4160	4576	314b27ed630e4b2c710bbeaa50c7db9a.exe	87
PID 4576 wrote to memory of 4160	4576	314b27ed630e4b2c710bbeaa50c7db9a.exe	87
PID 4160 wrote to memory of 4060	4160	Mpolqa32.exe	88
PID 4160 wrote to memory of 4060	4160	Mpolqa32.exe	88
PID 4160 wrote to memory of 4060	4160	Mpolqa32.exe	88
PID 4060 wrote to memory of 3536	4060	Mcnhmm32.exe	89
PID 4060 wrote to memory of 3536	4060	Mcnhmm32.exe	89
PID 4060 wrote to memory of 3536	4060	Mcnhmm32.exe	89
PID 3536 wrote to memory of 2660	3536	Mjhqjg32.exe	90
PID 3536 wrote to memory of 2660	3536	Mjhqjg32.exe	90
PID 3536 wrote to memory of 2660	3536	Mjhqjg32.exe	90
PID 2660 wrote to memory of 1360	2660	Maohkd32.exe	91
PID 2660 wrote to memory of 1360	2660	Maohkd32.exe	91
PID 2660 wrote to memory of 1360	2660	Maohkd32.exe	91
PID 1360 wrote to memory of 3456	1360	Mdmegp32.exe	92
PID 1360 wrote to memory of 3456	1360	Mdmegp32.exe	92
PID 1360 wrote to memory of 3456	1360	Mdmegp32.exe	92
PID 3456 wrote to memory of 1892	3456	Mglack32.exe	93
PID 3456 wrote to memory of 1892	3456	Mglack32.exe	93
PID 3456 wrote to memory of 1892	3456	Mglack32.exe	93
PID 1892 wrote to memory of 1500	1892	Mjjmog32.exe	94
PID 1892 wrote to memory of 1500	1892	Mjjmog32.exe	94
PID 1892 wrote to memory of 1500	1892	Mjjmog32.exe	94
PID 1500 wrote to memory of 1468	1500	Maaepd32.exe	95
PID 1500 wrote to memory of 1468	1500	Maaepd32.exe	95
PID 1500 wrote to memory of 1468	1500	Maaepd32.exe	95
PID 1468 wrote to memory of 1180	1468	Mcbahlip.exe	96
PID 1468 wrote to memory of 1180	1468	Mcbahlip.exe	96
PID 1468 wrote to memory of 1180	1468	Mcbahlip.exe	96
PID 1180 wrote to memory of 5048	1180	Mgnnhk32.exe	97
PID 1180 wrote to memory of 5048	1180	Mgnnhk32.exe	97
PID 1180 wrote to memory of 5048	1180	Mgnnhk32.exe	97
PID 5048 wrote to memory of 4544	5048	Nnhfee32.exe	98
PID 5048 wrote to memory of 4544	5048	Nnhfee32.exe	98
PID 5048 wrote to memory of 4544	5048	Nnhfee32.exe	98
PID 4544 wrote to memory of 4900	4544	Nqfbaq32.exe	99
PID 4544 wrote to memory of 4900	4544	Nqfbaq32.exe	99
PID 4544 wrote to memory of 4900	4544	Nqfbaq32.exe	99
PID 4900 wrote to memory of 4552	4900	Nceonl32.exe	100
PID 4900 wrote to memory of 4552	4900	Nceonl32.exe	100
PID 4900 wrote to memory of 4552	4900	Nceonl32.exe	100
PID 4552 wrote to memory of 4648	4552	Ngpjnkpf.exe	101
PID 4552 wrote to memory of 4648	4552	Ngpjnkpf.exe	101
PID 4552 wrote to memory of 4648	4552	Ngpjnkpf.exe	101
PID 4648 wrote to memory of 5100	4648	Nnjbke32.exe	102
PID 4648 wrote to memory of 5100	4648	Nnjbke32.exe	102
PID 4648 wrote to memory of 5100	4648	Nnjbke32.exe	102
PID 5100 wrote to memory of 5096	5100	Nddkgonp.exe	103
PID 5100 wrote to memory of 5096	5100	Nddkgonp.exe	103
PID 5100 wrote to memory of 5096	5100	Nddkgonp.exe	103
PID 5096 wrote to memory of 3300	5096	Ngcgcjnc.exe	104
PID 5096 wrote to memory of 3300	5096	Ngcgcjnc.exe	104
PID 5096 wrote to memory of 3300	5096	Ngcgcjnc.exe	104
PID 3300 wrote to memory of 3932	3300	Njacpf32.exe	105
PID 3300 wrote to memory of 3932	3300	Njacpf32.exe	105
PID 3300 wrote to memory of 3932	3300	Njacpf32.exe	105
PID 3932 wrote to memory of 3616	3932	Nqklmpdd.exe	106
PID 3932 wrote to memory of 3616	3932	Nqklmpdd.exe	106
PID 3932 wrote to memory of 3616	3932	Nqklmpdd.exe	106
PID 3616 wrote to memory of 3944	3616	Ncihikcg.exe	107
PID 3616 wrote to memory of 3944	3616	Ncihikcg.exe	107
PID 3616 wrote to memory of 3944	3616	Ncihikcg.exe	107
PID 3944 wrote to memory of 3272	3944	Nkqpjidj.exe	108

C:\Users\Admin\AppData\Local\Temp\314b27ed630e4b2c710bbeaa50c7db9a.exe
"C:\Users\Admin\AppData\Local\Temp\314b27ed630e4b2c710bbeaa50c7db9a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\SysWOW64\Mpolqa32.exe
  C:\Windows\system32\Mpolqa32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\SysWOW64\Mcnhmm32.exe
    C:\Windows\system32\Mcnhmm32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Windows\SysWOW64\Mjhqjg32.exe
      C:\Windows\system32\Mjhqjg32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3536
    - - C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2660
      - C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1360
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1892
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1500
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1180
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3300
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3932
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3944
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        23⤵
        Executes dropped EXE
        
        PID:3272
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        24⤵
        Executes dropped EXE
        
        PID:1912
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        25⤵
        Executes dropped EXE
        
        PID:3052
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3636
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        27⤵
        Executes dropped EXE
        
        PID:3244
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3224
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        29⤵
        Executes dropped EXE
        
        PID:1488
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4652
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5008
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4868
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3276
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        34⤵
        Executes dropped EXE
        
        PID:2116
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        35⤵
        Executes dropped EXE
        
        PID:3552
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3884
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        37⤵
        Executes dropped EXE
        
        PID:2204
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        38⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        39⤵
        Executes dropped EXE
        
        PID:2372
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        40⤵
        Executes dropped EXE
        
        PID:3984
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        41⤵
        Executes dropped EXE
        
        PID:2296
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2104
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2940
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:604
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        45⤵
        Executes dropped EXE
        
        PID:3540
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4512
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        47⤵
        Executes dropped EXE
        
        PID:3060
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        48⤵
        Executes dropped EXE
        
        PID:2176
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        49⤵
        Executes dropped EXE
        
        PID:376
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        50⤵
        Executes dropped EXE
        
        PID:4392
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        51⤵
        Executes dropped EXE
        
        PID:1004
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        52⤵
        Executes dropped EXE
        
        PID:64
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        53⤵
        Executes dropped EXE
        
        PID:3604
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3812
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        55⤵
        Executes dropped EXE
        
        PID:2584
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        56⤵
        Executes dropped EXE
        
        PID:2580
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3304
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        58⤵
        Executes dropped EXE
        
        PID:2708
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2820
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3744
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1232
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        62⤵
        Executes dropped EXE
        
        PID:5056
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        63⤵
        Executes dropped EXE
        
        PID:3256
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4488
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3772
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        66⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        67⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        68⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        69⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        70⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4556
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        72⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        73⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1476
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        75⤵
        Modifies registry class
        
        PID:448
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3028
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        77⤵
        Modifies registry class
        
        PID:4904
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        78⤵
        Drops file in System32 directory
        
        PID:2452
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4444
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        80⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        81⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        82⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        83⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5128
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        85⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        86⤵
        Drops file in System32 directory
        
        PID:5228
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        87⤵
        Drops file in System32 directory
        
        PID:5264
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        88⤵
        Modifies registry class
        
        PID:5316
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        89⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        90⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        92⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        93⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        94⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        95⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        96⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        97⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        98⤵
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        99⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        100⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        101⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        102⤵
        Drops file in System32 directory
        
        PID:5928
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        103⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        104⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        105⤵
        Drops file in System32 directory
        
        PID:6068
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        106⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        107⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5176
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        109⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        110⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        111⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        112⤵
        Drops file in System32 directory
        
        PID:5432
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        113⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        114⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        115⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5712
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        117⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        118⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        119⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        120⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        121⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6128
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        123⤵
        Modifies registry class
        
        PID:5168
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        124⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        125⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        126⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        127⤵
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        128⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        129⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        130⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6032
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        132⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        133⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        134⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        135⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        136⤵
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        137⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        138⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5384
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        140⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        141⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        142⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        143⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        144⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        145⤵
        Drops file in System32 directory
        
        PID:5380
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        146⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5836
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6160
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        149⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        150⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        151⤵
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        152⤵
        Drops file in System32 directory
        
        PID:6332
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        153⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        154⤵
        Modifies registry class
        
        PID:6428
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        155⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6508
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        157⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        158⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        159⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        160⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        161⤵
        Modifies registry class
        
        PID:6724
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        162⤵
        Modifies registry class
        
        PID:6764
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        163⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        164⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        165⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6944
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        167⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        168⤵
        Drops file in System32 directory
        
        PID:7024
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        169⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        170⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        171⤵
        Modifies registry class
        
        PID:7148
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        172⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        173⤵
        Drops file in System32 directory
        
        PID:6228
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        174⤵
        Modifies registry class
        
        PID:6284
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        175⤵
        Drops file in System32 directory
        
        PID:6360
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        176⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6496
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        178⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        179⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6628
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        180⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        181⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        182⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        183⤵
        Drops file in System32 directory
        
        PID:6892
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        184⤵
        Modifies registry class
        
        PID:6936
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        185⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        186⤵
        Drops file in System32 directory
        
        PID:7096
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        187⤵
        Modifies registry class
        
        PID:7164
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        188⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6440
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        190⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        191⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6668
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        193⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        194⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7016
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        196⤵
        Modifies registry class
        
        PID:7120
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        197⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6412
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        199⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        200⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        201⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        202⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6576
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        204⤵
        Drops file in System32 directory
        
        PID:6796
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        205⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        206⤵
        Modifies registry class
        
        PID:6240
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        207⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7172
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        209⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        210⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        211⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        212⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7336
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        213⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        214⤵
        Drops file in System32 directory
        
        PID:7424
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        215⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        216⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        217⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        218⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        219⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        220⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        221⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        222⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        223⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        224⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        225⤵
        Modifies registry class
        
        PID:7868
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        226⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        227⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        228⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        229⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        230⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        231⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        232⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        233⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7240
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        235⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        236⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7492
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7600
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        239⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        240⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        241⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        242⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7948
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        243⤵
        Drops file in System32 directory
        
        PID:8032
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        244⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7200
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        246⤵
        Drops file in System32 directory
        
        PID:7288
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        247⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        248⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        249⤵
        Drops file in System32 directory
        
        PID:7712
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7888
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        251⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8048
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        252⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        253⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        254⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        255⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6544
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        257⤵
        Drops file in System32 directory
        
        PID:7504
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        258⤵
        Modifies registry class
        
        PID:7992
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        259⤵
        Modifies registry class
        
        PID:7388
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        260⤵
        Modifies registry class
        
        PID:8184
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        261⤵
        Modifies registry class
        
        PID:7268
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8224
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        263⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8308
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8356
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        266⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        267⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        268⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        269⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        270⤵
        Drops file in System32 directory
        
        PID:8572
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        271⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        272⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        273⤵
        Drops file in System32 directory
        
        PID:8696
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        274⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        275⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        276⤵
        Modifies registry class
        
        PID:8816
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        277⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        278⤵
        Drops file in System32 directory
        
        PID:8896
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        279⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8984
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        281⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        282⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9112
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9148
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        285⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        286⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        287⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        288⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        289⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        290⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        291⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        292⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        293⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        294⤵
        Drops file in System32 directory
        
        PID:8768
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        295⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        296⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        297⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        298⤵
        Drops file in System32 directory
        
        PID:9032
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        299⤵
        Modifies registry class
        
        PID:9088
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9164
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        301⤵
        Modifies registry class
        
        PID:7824
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        302⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        303⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        304⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        305⤵
        Drops file in System32 directory
        
        PID:8676
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        306⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        307⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        308⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        309⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        310⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        311⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8368
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        313⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        314⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        315⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        316⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8428
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        318⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        319⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        320⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        321⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        322⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        323⤵
        Modifies registry class
        
        PID:8764
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        324⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        325⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        326⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        327⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        328⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        329⤵
        Drops file in System32 directory
        
        PID:9404
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        330⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        331⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9548
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        333⤵
        Drops file in System32 directory
        
        PID:9588
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        334⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        335⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        336⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        337⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        338⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        339⤵
        Drops file in System32 directory
        
        PID:9840
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        340⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        341⤵
        Drops file in System32 directory
        
        PID:9920
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        342⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        343⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        344⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        345⤵
        Drops file in System32 directory
        
        PID:10084
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        346⤵
        Modifies registry class
        
        PID:10124
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        347⤵
        Modifies registry class
        
        PID:10164
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        348⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        349⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        350⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9328
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        352⤵
        Modifies registry class
        
        PID:9452
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        353⤵
        Drops file in System32 directory
        
        PID:9492
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        354⤵
        Modifies registry class
        
        PID:9560
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        355⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        356⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9768
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        358⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        359⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        360⤵
        Drops file in System32 directory
        
        PID:9956
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        361⤵
        Modifies registry class
        
        PID:10032
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        362⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        363⤵
        Drops file in System32 directory
        
        PID:10184
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        364⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9324
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        366⤵
        Modifies registry class
        
        PID:9472
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9532
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        368⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        369⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        370⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        371⤵
        Drops file in System32 directory
        
        PID:10028
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        372⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        373⤵
        Drops file in System32 directory
        
        PID:8888
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        374⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        375⤵
        Modifies registry class
        
        PID:9608
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9788
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        377⤵
        Drops file in System32 directory
        
        PID:9948
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        378⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        379⤵
        Modifies registry class
        
        PID:9300
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        380⤵
        Modifies registry class
        
        PID:9740
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        381⤵
        Drops file in System32 directory
        
        PID:9952
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        382⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        383⤵
        Modifies registry class
        
        PID:9656
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        384⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        385⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        386⤵
        Modifies registry class
        
        PID:9992
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        387⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10332
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        389⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        390⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        391⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10460
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        392⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        393⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        394⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10616
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        396⤵
        Drops file in System32 directory
        
        PID:10656
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        397⤵
        Drops file in System32 directory
        
        PID:10700
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        398⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        399⤵
        Drops file in System32 directory
        
        PID:10784
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        400⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10828
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        401⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        402⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        403⤵
        Drops file in System32 directory
        
        PID:10956
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        404⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        405⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        406⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        407⤵
        Drops file in System32 directory
        
        PID:11136
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        408⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        409⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        410⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        411⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        412⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        413⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10440 -s 212
        414⤵
        Program crash
        
        PID:10756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 10440 -ip 10440
1⤵
PID:10640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abpcon32.exe

Filesize
80KB

MD5
d9870f9d65d40f83bc4fa4e4c03d87b0

SHA1
14bc77e6b5cdbe476f85056e9a8c5ace91d8194b

SHA256
b67cf3d6b2ecd893f84812b6ca9a5af769d9b06605affde88a4d635433462369

SHA512
f16b6c8f80794ca14badb3baa2fd312cdf52c572f74d0097ad5935b877bb916a9a2ca15a4622ba61b07a224aeb0d6badb436bfc411aba09300d21e1ee9d2c6f8

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
80KB

MD5
da241194494754fb8d1de696f5a56e8c

SHA1
e738483edfe78d2d9e2c2e60bcd7e7cdcd7717f1

SHA256
293046968bfe31b970e4cb45f0c7b5838b673e7ee8dd19884d841c70f4ad6bf1

SHA512
cc84336c41d70155e1fc4bf867d4fc9c0a73c3f02b78da001a045e1ceba1daddc10489135eea467f1b23852b38a16e8e9344360e3bf04d8de0a9052854d61792

Download Submit
C:\Windows\SysWOW64\Alkdnboj.exe

Filesize
80KB

MD5
163a0fd39383c5dc73124f9ef7eefe98

SHA1
b0c1ccb94d94a2224eb7fbbff23467d4a36f658c

SHA256
c201efc2bcfe2c1a80babe6a89a814e1570642934bc676bc9b4763e43565c105

SHA512
e5ed0d9277d1a7ed76e1f4d180f8e87ba08e5ef4a2e4193e95979fc494364ae5be45ac5eb0c1fc9ceac0711d617e09486795866fb4f1cce7ef4c441e1792b567

Download Submit
C:\Windows\SysWOW64\Aqncedbp.exe

Filesize
80KB

MD5
8b2ffe295886f895c6dc0ab06095836e

SHA1
25d72a20b3b65586379c5c46e1d58fe0990b4ce0

SHA256
42ff00cb2d7da332a86027a7719272b249d215ade87bcc7a06ac1e22251021c3

SHA512
324ed752504a98445eb0455efc83f2f09e372a50bb47c6f151111683933f239330a2d873e3e841d23e5b22a79d1723c822490db6b4976b35b224383243830a45

Download Submit
C:\Windows\SysWOW64\Baaplhef.exe

Filesize
80KB

MD5
2ec909d0856602907f7f79c325ae50df

SHA1
eef88b1e114c32c5481f3884e9888c6484372db8

SHA256
ad55e6426d263cef4229995ea8e41ef76fc9c26a8bea2633a63b6bd427f55f63

SHA512
55fe8b4d0c6df141f31318a495f93d25813065ce9ba66199e5c798052dba0ca937d27f50b132e64bc73b49c5eb1f9eb5c7dcc9a0a954bc3b4f7c3fc31c5e0fbd

Download Submit
C:\Windows\SysWOW64\Becifhfj.exe

Filesize
80KB

MD5
4bfb2af3f7a4d4ee0b08a259167eebf3

SHA1
fd78009bde93a7896b75aef484c9b0b643a3f856

SHA256
c42da587453019a1b5712cfab064a71534e1bd1610fa3329ea13cda2fe510561

SHA512
ca32d28c3fcefd67ab02b97befd0a73f8206ed9bf1baf0b5148c1ebd06cbfc6485765d4162f099a8ac7458b36cefc69ad5af271bc95ffc91930f94001b073a37

Download Submit
C:\Windows\SysWOW64\Cbqlfkmi.exe

Filesize
80KB

MD5
2dd825a9639441e31ae4e1be49b96a3d

SHA1
aad885b8c658f28a380b673790d6e0024a73cea9

SHA256
29bc9b2f9d5bb9c9e91df68180dfa05e29d3b742760fe9db27b6b68923fd9c1b

SHA512
ddb9f2678601d01493c54e9e9849721407776af623340b5c1ee6ebcb3438ca012f39bc1f940d7d242785ea31953a2a03d41e13529cd0424c10b9fcd6fb0effe0

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
80KB

MD5
ce25f1b42bc70d5b6259e684ec4568eb

SHA1
e16c55eec4f67ca36e0dcf68f2dd562319f967d4

SHA256
fdc22e319b103b6b7fbc695f45de7a99d6fe4e8ffa6b4bd58ce0da1b9cb6851a

SHA512
1ac453c6d052cf0b3491b4ef3936f9752fdfa27e94a619a7eee47cef5a545b6943e608e26eab60584dc4d1f130842274d71cc95de41de21c58d8f5cd8ded3892

Download Submit
C:\Windows\SysWOW64\Gbgdlq32.exe

Filesize
80KB

MD5
5352d346d5f8fdd44a192ee6b173c9e7

SHA1
9b06aeedc7377cf2045ce4f037a173199706e024

SHA256
ffba026fa7e1e3f6f642ad77251b65c360ddeace1a7277c657218b6ee550139b

SHA512
365a4622f5d8f63263d054134ddbea422452e846cfac34b7171ef143fc2d70976f8623091c9927bc5dde1427faf78b78a554cab1f83f625a384acb367f26fe1b

Download Submit
C:\Windows\SysWOW64\Hijooifk.exe

Filesize
80KB

MD5
ff5059e0f47d775ee3b61ec563a7f0d9

SHA1
b9c2d0c24345cec9058b994a37e2aff50d3b49f3

SHA256
96971efbcafd106c6288da2035b7b84938b14a5b8067a6cd64a3caef005aab39

SHA512
f8e79f380c643a46d40017f6b5e6d838f40c9ed7555dc634b1629820e5ead2d0db78360300aa3ef8c40440cca438ce60b05e54223361c03f1e727f876c66b3a5

Download Submit
C:\Windows\SysWOW64\Hkfoeega.exe

Filesize
80KB

MD5
c60de515145ec1317355db53f1619a80

SHA1
b3a4328b0188ab319e63e7038206b323c5ceba9c

SHA256
27df8c668a27acca1d9aa878abd8cb066f586617f46fc906539ca21289af034a

SHA512
d6717509805895d69d2f106d95ee9a8ec2e05efb7f692eb587aeb2d72397cce8d17419750a8e8913d2c1d85ad9d575227a108ef230a1e00c36236dda42e2bcf8

Download Submit
C:\Windows\SysWOW64\Iehfdi32.exe

Filesize
80KB

MD5
cb8006b9362807cd9884d90694334bb2

SHA1
a4b2c95af6d2f593e0cead6f220777cdfde7e2bf

SHA256
1d4e91c4912cdd6c4cf114f649b543567f914042ecb477bb70c9e5c2b3fd3dd1

SHA512
17f6caa04e3a06df5a569c0a5acfd94002f266c08656491786b1f79cd53b0726a90849fbb80d0bc8a57f000c9eec213f6b5cac229dea08cb6fab31e5b26c920f

Download Submit
C:\Windows\SysWOW64\Jcbihpel.exe

Filesize
80KB

MD5
dffc9573df9b8513e1de2bc242354ac7

SHA1
349fa7a47ffa23306a7ead1996ccfa3527591bc4

SHA256
afd05ef2cbc9c01342d23b788d888d9931a227c5110ea999b3992a45b5716707

SHA512
683830eedfd899736835816b1b37605443f0900d4f5914cc927e8d3ecad481c9be2f3023bd1b22acf36e1f87394cbf7728147c4cb204649a6dcedb8d40114237

Download Submit
C:\Windows\SysWOW64\Jfoiokfb.exe

Filesize
80KB

MD5
010af288d0f06a1e526b287191c8d852

SHA1
d86060699e70834118a75cef658beedd8ce27438

SHA256
d417a069e0e5f433b2d2fa10b3d970893355e43ad46c9cc4c07b3d28a867208b

SHA512
85fedc64c5f7926aea7fb7378c00275052b7830d78dffdda3fd269885fcd943d20c6f248e380dc92f4afa3f1c9c4ba2a615f6bc5b78e9ebdc14ed1e10f767d11

Download Submit
C:\Windows\SysWOW64\Maaepd32.exe

Filesize
80KB

MD5
46ea599d53ef87199bdf9f58eab309ac

SHA1
0a13347a20f4f8f752e92fac1eec635fad974136

SHA256
770ba830cb0f9b57619d9df409a3d60dcae1f1eb5959754c4974bded27c8ac41

SHA512
5a50f16a51959acbb2dfbd7e4cf222622dec1af6c14301478fbdd39b876c40c6f0fb544909aa6b495141ead6f426fbe8d048aed3e41ee138f87321ec4091a18e

Download Submit
C:\Windows\SysWOW64\Maohkd32.exe

Filesize
80KB

MD5
940a14972c219ac0da8d127c3ac5bbd9

SHA1
b2d7460ef0458110306de62b5e7b153fff7cb92c

SHA256
5bda3346c8288c6a8620daaf3986b20ff15077f4ac517b8100243fb2cccfb7fe

SHA512
0afb81b81e7e885825226aad65f24f9032a6e50805947299a2610610401d77e2c83b7fa1f0f6a529bcac4777f9b660898f09356a48eaf3e1dbd9fb9fcbdac480

Download Submit
C:\Windows\SysWOW64\Mcbahlip.exe

Filesize
80KB

MD5
1d4a7af01d923d285db206982277fa7c

SHA1
0e4071d5f17823c15a152a34a34608619d9e4c80

SHA256
88f1e1e083d6b1ebea5291cd93ac76a3f7edc0bb1573797d2ba068bcaaf8e676

SHA512
40b580525666bca70d6fc9074d17e23607c5265d9a6c670d6ccc82e13772247e1fb31848f8b4737228ec42392803764adbd0f294b00f53650ce14d6c0bb13b68

Download Submit
C:\Windows\SysWOW64\Mcnhmm32.exe

Filesize
80KB

MD5
1fe8e1619f6d5592dddc96f872181a7b

SHA1
c0b48a0f032f4aba90efd9fafeb957034f276071

SHA256
c370bdf949a3c400a3c6979bcb0591aec7940bfd2adbf2d296aa4a81451fa2b8

SHA512
8a01c8d546e6df3c189db3e05c3cb01cadc78370f3d772e7c314090cc8f2b8ca59522ec8bb1058361727a2665c6d67b52abb35dd55282059a0604c7e1a3e476c

Download Submit
C:\Windows\SysWOW64\Mdmegp32.exe

Filesize
80KB

MD5
d6fd56750446456d76f8f4c7a3904ec3

SHA1
e29bbcabcac69d6e1ead0972ba7192d1c136faee

SHA256
5974e2693b2ca4926b993b095636e7dae19fe8bb7fcf8fcb05f2d3f2972f0e84

SHA512
8750d1e7611d684f024ea5edda8f08519fdeb5c99b2b3398bb82d146643c8c031a7789644c7bd040a039f5abcfefff36a49852d9e3675aac60f72adf44b73c6c

Download Submit
C:\Windows\SysWOW64\Mglack32.exe

Filesize
80KB

MD5
32e44ee52e957e147e99a8482a53db97

SHA1
ecafae0314cf588c0d40b08cd03009956c49eede

SHA256
07965c3de79ef09f29ccc4968db4ff2417f78b694a26608cea6ec803291d2e38

SHA512
b72820d583872f8c67bebe5b3e07818b2b066181dd26f278b151d54eeed57316f794f22e37e77003dbd882ba7df6aec907561f05d9cacd425757403769fe955e

Download Submit
C:\Windows\SysWOW64\Mgnnhk32.exe

Filesize
80KB

MD5
ede5f5eaa5d32b5cc58f9684238efe1d

SHA1
d6e1b964bcb9084a8d57c3564607651476346a0e

SHA256
4f479230b71c2103ed9dafc58bf6a84e98e945d49590329d3c86840ca334418e

SHA512
c0a76209c50b1d1ce5a72d563398f7fd8b5a734c719e30b0afcf85b177117b1663ebea5cc8fec5d54e914b2731e33c1b3d595e6c7aa12ab71a5e698d8106dd5b

Download Submit
C:\Windows\SysWOW64\Mjhqjg32.exe

Filesize
80KB

MD5
5b5c651217c8db167441b83db90a8c2c

SHA1
a48041cc5588190cdabfc27b9b56fd6a29695653

SHA256
9354a9f5c8a2d6770ea5a4b5318fe357499ff2a9f96298277ffe1247d18dd8b7

SHA512
1de27efaa8d57af13159ca04cbe5a49ef3704965e344ca75e739b2b824c5b7a6ca74f67fc3c2e360a85350d2ecf6ed97280747909493bff161e3d82d4cea756b

Download Submit
C:\Windows\SysWOW64\Mjjmog32.exe

Filesize
80KB

MD5
503e2402e9bc25f3572c3e97b41b4519

SHA1
929e015c9649ee70961753dba6fafd0cbd618f85

SHA256
68e966f199b39a9b58a5094a466dfcd9efbd19e4e368c282d4a2edac11d205c0

SHA512
dcfae1b657dd8043c98d1f0599e4e8b5a109dedf3cae1b67925bbfc8c8847cd3149bf5479887032a6898c0c90602f1cad274b01324e1d9e53efc41cd12cf7090

Download Submit
C:\Windows\SysWOW64\Mpolqa32.exe

Filesize
80KB

MD5
41113492a3195ba93257bd65b9e6c200

SHA1
9c8ae1062642177797ac6cd815227a1a794defab

SHA256
18e3722645aa7fc13ee4a8a05e8c605d037f1cc13af3abbdea3592d4be7c313a

SHA512
257d7ed589166d33151b4c162301c1460dd04b618a2c26f2a0536549bd1c102fe9df175e4ac87d79db520e8fa6fa9c5f752cb2a475ec73871827554a1ea5a702

Download Submit
C:\Windows\SysWOW64\Nceonl32.exe

Filesize
80KB

MD5
7924f2acb3a93697d7fa66fcae3b8a32

SHA1
06dd5486bb7381a73894ac607459d46a641bfb96

SHA256
b3f2552ece767d62c5df4ff7fa0c15121132889da0711630a252d828cf0594ff

SHA512
1d5f611e48577120740e6519a48b9475eb0fba2856bdbbab628e2b684a68b4d0d5266eccba786e346f47a0e05b9128d484272e72dae8553872eedaa2beae3b9f

Download Submit
C:\Windows\SysWOW64\Ncihikcg.exe

Filesize
80KB

MD5
2079662ca39f4159fc6324e291776bcc

SHA1
eec24b66f808036146fa1f1ac26e524923e18686

SHA256
031c6027b8b1b21709334d6607f878e81ff33ac26bc38cbb1b17310dedc90cd0

SHA512
e2c4b6748466a9f09724ed73b1c5bc97c6182f61460fa38afc17e2cceece5022ebebdfeef77f18cb4a7aa5eb1e658dc76bcbda9114761f92c49234f6707bd40e

Download Submit
C:\Windows\SysWOW64\Ncldnkae.exe

Filesize
80KB

MD5
7689010548d41e6ada0d88db4ad5989c

SHA1
d8ea933648ad80e630a4ad0d4ed922e524688a8e

SHA256
40f27a6554e0cfaf87326321bc777c4f0a4d87f75f01105a5e4f19eeb03a3b72

SHA512
c75a777a065979c818d701934b52002ce73e8805c369aa746fdad4a4859f0a16eebdf585d887dd49e113ab7c9272e24369cf3662f5225a59f5b4bc724017716d

Download Submit
C:\Windows\SysWOW64\Nddkgonp.exe

Filesize
80KB

MD5
eaecb975930d31c9f32010e16c3c79cf

SHA1
5968a8562db360bbffcc2c1afd19625b38965af1

SHA256
69e5e3cdb33527c5c1774b49c2dcec12affee469c6283f51ae2661e2e115b0d0

SHA512
97c292434a10a725496d5820a4de8a9529027f66ce99a148aa8d1b470d3011c2c9a835c0e1d6ed7fdb38cf8072013f4f1a987dda71e8bead8e3db1d10e17c307

Download Submit
C:\Windows\SysWOW64\Ngcgcjnc.exe

Filesize
80KB

MD5
01ac3d5c06ab9aa8b31351c34c96078a

SHA1
61aa2cfa7bd6f21690c7a04df65e390ddcc1c41d

SHA256
6c44aa44874db41d8348f31441b161fb797a8aba4d5edd4669562c019466587b

SHA512
ca29e3e836ee35f2184f439df52dc11b48fd552dd6e205a546c2e3ac725742549ef076fd8079396dc3cc6b5c3d64dc3c45b14a9eff0ea5c39ffb2aba5787a771

Download Submit
C:\Windows\SysWOW64\Ngpjnkpf.exe

Filesize
80KB

MD5
aa074148d89eb0d17c64b0181efa6fb1

SHA1
820914067eedab0e6eae62b6f17e3a9fe6c1167c

SHA256
ae678239919b0a0d0f572685f86fa0cc0bc060ea2a95a67ae888bda5b9d4b60d

SHA512
886573e0b2c6404c46bc21653c9880bb9a8f2091d90330f03f79c2ac7f049c1f45e0cd7519f32b7bafb35dc159eab872a84814111a9a71daf838a4ea86eb060f

Download Submit
C:\Windows\SysWOW64\Njacpf32.exe

Filesize
80KB

MD5
3e44770edf1d0e9928edd1d11e2bc452

SHA1
cbbdc254ce06aa583ff02a784e18fc73482128ac

SHA256
074ef92ff8ad959f0083599066d5b860e7a47e9953827966add5c5b3bdcec7d0

SHA512
c499bf29b28e059464049e9170a86cfa5e060412a8959da6683a66b87b8d6941406652c586ca34076f435577998a3c47ad7db50406481042142d7c95b7b636ce

Download Submit
C:\Windows\SysWOW64\Njciko32.exe

Filesize
80KB

MD5
192826e1ec1cae676a4526a5f8a1d00f

SHA1
fafa94e0d256d19d6d54f235d4c4abf654304aef

SHA256
8b002a693a3cd350259150e7ca5c5fb7c8dec5d2b9703aa31064f7ad23a6ac6b

SHA512
e786dee7db7821266620679d549c5e5be58f3f67d6c38726e7b426625803d40f0e3e4bd63ec696bdcf5748cbe74d0ad122fb2edd90f9eb6fbad7bdca3a84d960

Download Submit
C:\Windows\SysWOW64\Njfmke32.exe

Filesize
80KB

MD5
b9d157e408b5227d3e817d3d3c211232

SHA1
5d007c9a9748954f209da02ab0179d7cb395734b

SHA256
1d54a290b269182d66cf301aef5aefdb70d981cd59b988492e5d190a46754508

SHA512
1f09773ddb87bd408e264b263f52866b391ea141a1d936c816f8febd276edb532a343060d009b4e3cdb22cb7c154935d88cd62c86e7d60603ce051e9777d8a89

Download Submit
C:\Windows\SysWOW64\Nkqpjidj.exe

Filesize
80KB

MD5
12b92b3739f797e074a4fcb160b579d3

SHA1
1d4450902925d9d119519928afafc25948efd275

SHA256
74ef6705e01d23609ecb8b4ddb0fb0212331c6245fc4272d4aa0b39ebf124724

SHA512
1af9dca94d45a940111164294de5c3da7368564ce81a2a10799620e47b00bd075fc99fa15de0886a0d16ae65fed8d7d022c1628da920e26df914c35ea396cabe

Download Submit
C:\Windows\SysWOW64\Nnhfee32.exe

Filesize
80KB

MD5
d01fb3642d86c29b2f45c70524b7d210

SHA1
843ca7e2e65b103372239565f466317b8fe42216

SHA256
8740a47a6e1d2eb667e8727e65b0affdec82100ea16795628ebfc6e72fd13e73

SHA512
33c7dddf2bac4418297b141d412a89b0ec206f5fa97e07d47d03678b6c3451a9dac637385c8b4c5e3a8cc8cdbde334d4eca0d79075566654b398cca629fe1587

Download Submit
C:\Windows\SysWOW64\Nnjbke32.exe

Filesize
80KB

MD5
d0d2f0c493aa9bfb5e1a36f01439fc65

SHA1
7b81f85213d5a517f973ad28a8806f652d333c1d

SHA256
d6bacce39f101216563b90d5659be3a64b00d1e118dbad93d0fd23ffa3bf0a4c

SHA512
e2250af38a8db28b559813f6acf233e88d2a07a43c06036b5ce866551a9f943124e9a2a0596a14d0aa086f15d93148f82e484fa124001ce6e30a3490d35a1c9b

Download Submit
C:\Windows\SysWOW64\Nqfbaq32.exe

Filesize
80KB

MD5
6c474fe138db6a31433a665b8e813a79

SHA1
1fe114b725ef2b4f827201113f9d430fb266b495

SHA256
0497cebdfb35201e90bfb7b32e1f00b53f74c58294bc71c76141d452f4843cd8

SHA512
016fb1ff0000deeca537270c7c5323485702b383d3e6ad0335154ff558a25e0c1319200812c362fd2fb10408cd8fe912d067ae6ef40514c5716dc958f661d4ff

Download Submit
C:\Windows\SysWOW64\Nqklmpdd.exe

Filesize
80KB

MD5
7aa5089bfbeed13c502d29c213a440ec

SHA1
58e937ec557920df1899e7fe39fce1a7af7ae0e8

SHA256
2f56e723320cee62bf5e187c003fadf33b42c0b5fc9e14d1e999244214128bf3

SHA512
53a31a62fbd94969b5df65e75f120e2d0c1715de52c512f8e3aca9f38b478e5e2109ea9ac79e62844a27fbe1c9cf0d071453964f8724c935fee87274c0c65dd7

Download Submit
C:\Windows\SysWOW64\Nqmhbpba.exe

Filesize
80KB

MD5
73a9aa024b2e447d48ef19e5cc6f9dbb

SHA1
2d2fce81b84e6dc88e30e054d9efadf3434700b1

SHA256
3a61ec53540e42951bc5138b4dd7ef082dbc1d4149e9809c072f5e929a946e4f

SHA512
b5b506cde68526cb45b6f0e047463cbfaf9a3f1d8b0a3d8820695b7089271c3b5ed07ecbdab0df4e8045b928d75d8679e6db20933ae0fab194c190a86b72a941

Download Submit
C:\Windows\SysWOW64\Nqpego32.exe

Filesize
80KB

MD5
4d7d3f11900b3ffd2b1c958539c5651a

SHA1
a01d6cda5de5fa277ad42ebc1d8b8c12416cdc07

SHA256
c0871c97ffea29bd708649b53d71195ec1c517615f06b3177727a62faac67207

SHA512
c824bdc1c92d224303a2aa3a50821afa21dd84b96f26120ccec201d8c3aef70de5439a08fc87b0b5e560d6c2ccf36a72d71967d73e022665180033251055d573

Download Submit
C:\Windows\SysWOW64\Obangb32.exe

Filesize
80KB

MD5
5feef6293b1073a65c09a4a5c6a7e707

SHA1
b645f6599606c243e8f315499dd0bf89d7c53775

SHA256
3d7453f3979adbba0d1e0e2a7c361f9d93cd4ddf728b657282b91fb36363f055

SHA512
8b7fa49a512333f50c9163c4543de5358839c2ca98035d48efb7a6e7eca4b7afbc2421766fb206631514412adf6782a0b039169f8ce7f36dc00b691527edd976

Download Submit
C:\Windows\SysWOW64\Ogjmdigk.exe

Filesize
80KB

MD5
ef34c1c07ff49bb5afe8bb5aff1a831d

SHA1
2d3016cd50bfa5c09eea240aa67e14225369cc05

SHA256
95689eedf02272df4a39b0a72494d592a2b0e71c122d9fa7fbbb8bbe4379c403

SHA512
4422eb2da04653288d9a2b7efc2a479d281d12eda85f32255148fb415d686e53be055ee494212d083e408bb68f15733b41b8dfa1194c7e438663724dd44fb653

Download Submit
C:\Windows\SysWOW64\Ojhiqefo.exe

Filesize
80KB

MD5
2c8f7457d1da7dccd9726fe53a2a2076

SHA1
b25269eabc798b7c6664add0142df238b634587f

SHA256
40c432d3b19716d8115a1261ab0fdd3920a12a048e018bc222c0ec82d9ea1d24

SHA512
303168975d7c2aa2dbf276509a37add2332ca5415fd2072ad92e3b1a9fc717c62a1026f82f13b1c7dac778ab9937a31aa74b631fdc827ae1ac80be17d4b0e0d2

Download Submit
C:\Windows\SysWOW64\Ojmcld32.exe

Filesize
80KB

MD5
a9e32d6946d20191a565de1f46e02dd7

SHA1
f967585959afed2aefbf5dcd4708e95a92cbe206

SHA256
3108c93dedaf465535dbc2d5b58df05a8f584f2739fcb2799dadefc49587b2b7

SHA512
804a3673d8633c8a0d7be1bf5bf9480e9658e8f4612b3b96a50d5e3d8b89bea766f9f1e5b3020195e499c053a9a5b9ba9706873d844e606b51e6229a4cfb87b2

Download Submit
C:\Windows\SysWOW64\Okhfjh32.exe

Filesize
80KB

MD5
870f620cc491db9948a6a80c9d54ab56

SHA1
5e59d252db964b9a407ade879f1137a41d63b610

SHA256
86ebc96a077d934513a1f7a1064665497d70565e770961077023a2c0f7b754cb

SHA512
757af25d5193d77b198908787096d0e8f3254ef4ca7b10556f96a20dc5759694ceaf5674ed6c46aa6cbc88ce0467207df173e59a076508691e2c732b888d8872

Download Submit
C:\Windows\SysWOW64\Ondeac32.exe

Filesize
80KB

MD5
e085cf603045b0ebda773d0aedc3c42a

SHA1
c5b527b2b94fae92c40e8cb91820a892bd269989

SHA256
50c19cf081f30a5197aee69cbfe9a3c3c89042c2b0e6141fd0b2c6b70b39a5e2

SHA512
cab2bec51a21032f8e7239bc146625f899ef7ba5033704c80f78953cefeac0c14d90875ad09f55eaefae5f4f1580ed06289f8577343a8f56d1f72d135ad52274

Download Submit
C:\Windows\SysWOW64\Oqbamo32.exe

Filesize
80KB

MD5
237b122bd6b637feb17324ab32c55ac1

SHA1
939d9fef6b59599ed5057d51a3aec387f7f693e6

SHA256
046568d703dd29501bb23a6cd0dba3cd9269a41a330f90f1c9766fad4e304530

SHA512
230c20e164b34694d92471f3e2b0919e91f80c6595716eabf48695e9a159c11dfaea5586137d759db8003ba0fb358b09a304d888d007913f38150bfe9c2bfd4e

Download Submit
C:\Windows\SysWOW64\Pagdol32.exe

Filesize
80KB

MD5
13a3afd104be83dea306e43049d1af72

SHA1
25599f0bf12e7349e0ccaf22210ffbb0cb77ca03

SHA256
b110454d234d4f1aa9be5402aa1923bff3ecdd00481d0ec627d8118f201ad231

SHA512
1ff17d0e5209fa201069e8cc27966fe50bfdbe37f006099483503f62b5cd204c6a11ba6220d32018655212bdc0417a84f14b124d3fd6103a6406e51734e0e76c

Download Submit
C:\Windows\SysWOW64\Pkhoae32.exe

Filesize
80KB

MD5
fe50048e1088d3ec533fa9744f93e27e

SHA1
40841bfd19090823366fa220c950a1333ea082ba

SHA256
371a90a0979d82107a00cc62d2f705c0677eb9fabf105f6471c0e8c9fb82879e

SHA512
30f21b806720bc28c3c4a0276edf75ebc3f84fdc7acb670394c1075485c85acf4e3e74f3b83c3d0c56c3ff9180043ee615f4389930b9f00a7e99fe654ddc1ca0

Download Submit
C:\Windows\SysWOW64\Pqpnombl.exe

Filesize
80KB

MD5
f8fb3e81812f703f497462781fb1c47d

SHA1
258e0462304a00a14179184fbdfda8c28c4737de

SHA256
c4b3dab865dd1d08680bff747fa833ecc69d0f2c4be12aa0a1802bf82c026994

SHA512
54f70c42c29309da2ff2357a196974333c74032136fd981afac44c42b5a9c98e3dfe29375186155e0f8c5d02e7b4d877cb504e2e564d2594d86fe494eb24361b

Download Submit
memory/64-370-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/376-352-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/604-322-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1004-364-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1180-84-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1232-424-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1360-44-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1468-72-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1488-229-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1500-64-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1892-56-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1912-183-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2104-313-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2116-262-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2176-346-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2204-284-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2296-304-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2372-292-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2580-398-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2584-388-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2660-32-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2708-406-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2820-412-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2940-316-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3052-192-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3060-340-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3104-291-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3224-216-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3244-208-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3256-436-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3272-176-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3276-255-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3300-144-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3304-400-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3456-52-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3536-24-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3540-328-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3552-272-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3604-376-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3616-160-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3636-204-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3744-418-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3812-382-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3884-279-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3932-152-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3944-167-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3984-298-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4060-15-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4160-11-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4392-362-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4488-442-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4512-334-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4544-96-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4552-112-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4576-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4648-120-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4652-232-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4868-247-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4900-108-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5008-240-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5048-88-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5056-434-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5096-136-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5100-128-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads