17933a7b18ee3a47ff3c61f1f286c576ef1e1a0517ca940f0bbb8815d0e4afed

Analysis

max time kernel
93s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

17933a7b18ee3a47ff3c61f1f286c576ef1e1a0517ca940f0bbb8815d0e4afed.exe
Size

226KB
MD5

3072c635f7307091edfc7de3d4c306f4
SHA1

cf6f5b617c87d855ad22abe5a2f6a8dcc9fdd90f
SHA256

17933a7b18ee3a47ff3c61f1f286c576ef1e1a0517ca940f0bbb8815d0e4afed
SHA512

15dd6364cf159e7b5e9813d37bf23139187d5b6506512d2c63a358ebd1afc012bfc9b108f47e67f0e8f53e6964a66c58b40eda91470fca1428a8f3da034d9fa4
SSDEEP

6144:7kuMA2DfbqyohXfxqySSKpRmSKeTk7eT5ABrnL8MdYg:712aV5IKrEAlnLAg

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbhoqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jcllonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlampmdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olhlhjpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgopffec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qalnjkgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eefhjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ipnjab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbhfjljd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aqppkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqihnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Clbceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jcefno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qgcbgo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckedalaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ekjfcipa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdhdajea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pqknig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jedeph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npfkgjdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clbceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mmlpoqpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnebeogl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acmflf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ekcpbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gokdeeec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cklaknjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfbibnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdjjckag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgnilpah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfmepi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmppcbjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fooeif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcjapi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Edihepnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Glebhjlg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhaebcen.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfaedkdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdehlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmhale32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcllonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fllpbldb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hobkfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipbdmaah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jmhale32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcbihpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Olmeci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qajadlja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bobcpmfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dafbne32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpgfooop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndokbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Becifhfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgimcebb.exe

Executes dropped EXE 64 IoCs

pid	Process
348	Nddkgonp.exe
3196	Njacpf32.exe
1244	Ngedij32.exe
4048	Nqmhbpba.exe
4436	Nbmelbid.exe
3244	Ndkahnhh.exe
4980	Ojhiqefo.exe
2156	Oqbamo32.exe
3812	Oqdoboli.exe
4068	Obdkma32.exe
2664	Ocegdjij.exe
416	Onklabip.exe
5100	Oqihnn32.exe
2540	Obidhaog.exe
4484	Pcjapi32.exe
1796	Pqnaim32.exe
692	Pkceffcd.exe
4140	Pcojkhap.exe
2888	Pndohaqe.exe
3124	Pabkdmpi.exe
1672	Pkhoae32.exe
420	Pgopffec.exe
3936	Pbddcoei.exe
1692	Qjpiha32.exe
60	Qajadlja.exe
3380	Qnnanphk.exe
4232	Qalnjkgo.exe
456	Aanjpk32.exe
1740	Acmflf32.exe
3768	Aaqgek32.exe
1292	Alfkbc32.exe
2548	Adapgfqj.exe
2324	Ajkhdp32.exe
5040	Adcmmeog.exe
2060	Alkdnboj.exe
1336	Aniajnnn.exe
228	Becifhfj.exe
4000	Bhaebcen.exe
4076	Beeflhdh.exe
2400	Bjbndobo.exe
4248	Balfaiil.exe
892	Blbknaib.exe
3440	Bopgjmhe.exe
1968	Baocghgi.exe
4168	Bdmpcdfm.exe
1436	Bldgdago.exe
3040	Bobcpmfc.exe
4084	Baaplhef.exe
1332	Bdolhc32.exe
4468	Bkidenlg.exe
2024	Cbqlfkmi.exe
4728	Cdainc32.exe
4360	Cklaknjd.exe
3964	Cbcilkjg.exe
812	Cddecc32.exe
5108	Cojjqlpk.exe
2384	Cahfmgoo.exe
2440	Cdfbibnb.exe
1192	Ckpjfm32.exe
3612	Cajcbgml.exe
4736	Cdiooblp.exe
4508	Ckcgkldl.exe
3372	Cbjoljdo.exe
2152	Cdkldb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Oggacefk.dll	Fdialn32.exe
File created	C:\Windows\SysWOW64\Bkblkg32.dll	Icnpmp32.exe
File opened for modification	C:\Windows\SysWOW64\Jlednamo.exe	Jmbdbd32.exe
File created	C:\Windows\SysWOW64\Lmppcbjd.exe	Lffhfh32.exe
File created	C:\Windows\SysWOW64\Pkejdahi.dll	Ambgef32.exe
File created	C:\Windows\SysWOW64\Mgbpghdn.dll	Aepefb32.exe
File created	C:\Windows\SysWOW64\Ekcpbj32.exe	Elppfmoo.exe
File created	C:\Windows\SysWOW64\Eapedd32.exe	Ekemhj32.exe
File created	C:\Windows\SysWOW64\Ihidlk32.dll	Baicac32.exe
File created	C:\Windows\SysWOW64\Idodkeom.dll	Npcoakfp.exe
File created	C:\Windows\SysWOW64\Ofcmfodb.exe	Ocdqjceo.exe
File created	C:\Windows\SysWOW64\Cahfmgoo.exe	Cojjqlpk.exe
File created	C:\Windows\SysWOW64\Dlncan32.exe	Ddgkpp32.exe
File opened for modification	C:\Windows\SysWOW64\Lmgfda32.exe	Likjcbkc.exe
File opened for modification	C:\Windows\SysWOW64\Pnakhkol.exe	Pjeoglgc.exe
File created	C:\Windows\SysWOW64\Bnkgeg32.exe	Bjokdipf.exe
File opened for modification	C:\Windows\SysWOW64\Daconoae.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Bopgjmhe.exe	Blbknaib.exe
File created	C:\Windows\SysWOW64\Fllpbldb.exe	Fdegandp.exe
File created	C:\Windows\SysWOW64\Odocigqg.exe	Olhlhjpd.exe
File created	C:\Windows\SysWOW64\Kgldjcmk.dll	Qqfmde32.exe
File created	C:\Windows\SysWOW64\Aeiofcji.exe	Aqncedbp.exe
File opened for modification	C:\Windows\SysWOW64\Fllpbldb.exe	Fdegandp.exe
File opened for modification	C:\Windows\SysWOW64\Ogifjcdp.exe	Odkjng32.exe
File opened for modification	C:\Windows\SysWOW64\Gbdgfa32.exe	Gcagkdba.exe
File created	C:\Windows\SysWOW64\Hcmgfbhd.exe	Hobkfd32.exe
File created	C:\Windows\SysWOW64\Ciglpe32.dll	Hobkfd32.exe
File opened for modification	C:\Windows\SysWOW64\Nckndeni.exe	Ndhmhh32.exe
File opened for modification	C:\Windows\SysWOW64\Bjagjhnc.exe	Bgcknmop.exe
File created	C:\Windows\SysWOW64\Cdfkolkf.exe	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Cbqlfkmi.exe	Bkidenlg.exe
File opened for modification	C:\Windows\SysWOW64\Fohoigfh.exe	Fljcmlfd.exe
File created	C:\Windows\SysWOW64\Hbnjmp32.exe	Hckjacjg.exe
File created	C:\Windows\SysWOW64\Fkgoikdb.dll	Ipbdmaah.exe
File created	C:\Windows\SysWOW64\Cklaknjd.exe	Cdainc32.exe
File created	C:\Windows\SysWOW64\Hafgeo32.dll	Gokdeeec.exe
File opened for modification	C:\Windows\SysWOW64\Alfkbc32.exe	Aaqgek32.exe
File created	C:\Windows\SysWOW64\Cdcoim32.exe	Caebma32.exe
File opened for modification	C:\Windows\SysWOW64\Kbfbkj32.exe	Kpgfooop.exe
File opened for modification	C:\Windows\SysWOW64\Pnlaml32.exe	Ofeilobp.exe
File opened for modification	C:\Windows\SysWOW64\Pgefeajb.exe	Pqknig32.exe
File created	C:\Windows\SysWOW64\Hjfhhm32.dll	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Oqbamo32.exe	Ojhiqefo.exe
File created	C:\Windows\SysWOW64\Ckcgkldl.exe	Cdiooblp.exe
File created	C:\Windows\SysWOW64\Jfaedkdp.exe	Jcbihpel.exe
File created	C:\Windows\SysWOW64\Oncofm32.exe	Ojgbfocc.exe
File created	C:\Windows\SysWOW64\Ohbkfake.dll	Olfobjbg.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Edbklofb.exe	Ekjfcipa.exe
File opened for modification	C:\Windows\SysWOW64\Ieolehop.exe	Icnpmp32.exe
File opened for modification	C:\Windows\SysWOW64\Icplcpgo.exe	Ilidbbgl.exe
File created	C:\Windows\SysWOW64\Knfoif32.dll	Ojgbfocc.exe
File created	C:\Windows\SysWOW64\Ajkaii32.exe	Afoeiklb.exe
File created	C:\Windows\SysWOW64\Deokon32.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Aneonqmj.dll	Blbknaib.exe
File created	C:\Windows\SysWOW64\Gcddpdpo.exe	Gkmlofol.exe
File opened for modification	C:\Windows\SysWOW64\Ambgef32.exe	Ajckij32.exe
File created	C:\Windows\SysWOW64\Ajfhnjhq.exe	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Eifbkgjd.dll	Jimekgff.exe
File created	C:\Windows\SysWOW64\Ehmdjdgk.dll	Ajanck32.exe
File opened for modification	C:\Windows\SysWOW64\Oqdoboli.exe	Oqbamo32.exe
File created	C:\Windows\SysWOW64\Dajbcgdm.dll	Baocghgi.exe
File opened for modification	C:\Windows\SysWOW64\Dejacond.exe	Dmcibama.exe
File created	C:\Windows\SysWOW64\Nmpmkplp.dll	Jcefno32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10260	11160	WerFault.exe	534

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dadeieea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjkolmml.dll"	Ffgqqaip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jlpkba32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pmidog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Baocghgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mmnldp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndfqbhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehfnmfki.dll"	Ampkof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pkceffcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cibifp32.dll"	Hcdmga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghngib32.dll"	Pqpgdfnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebooppnl.dll"	Oqdoboli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ibnccmbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmidog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjlena32.dll"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cklaknjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clkooklb.dll"	Gdqgmmjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmenjlfh.dll"	Hcmgfbhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Debdld32.dll"	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Habmmpbg.dll"	Alkdnboj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kbhoqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jocbigff.dll"	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mlopkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndcdmikd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Olcbmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fchddejl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Flqimk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hobkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfaklh32.dll"	Kiidgeki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	17933a7b18ee3a47ff3c61f1f286c576ef1e1a0517ca940f0bbb8815d0e4afed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oqihnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Edihepnm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hijooifk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kmkfhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Klqcioba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lmbmibhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbdhjm32.dll"	Neeqea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ndkahnhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pabkdmpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ecjhcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hcmgfbhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Caebma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgmngglp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlcadgkl.dll"	Dboigi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fdegandp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hfqlnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fplmmdoj.dll"	Lbabgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Obdkma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lekehdgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Migjoaaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ilidbbgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ffddka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kiidgeki.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 348	2504	17933a7b18ee3a47ff3c61f1f286c576ef1e1a0517ca940f0bbb8815d0e4afed.exe	86
PID 2504 wrote to memory of 348	2504	17933a7b18ee3a47ff3c61f1f286c576ef1e1a0517ca940f0bbb8815d0e4afed.exe	86
PID 2504 wrote to memory of 348	2504	17933a7b18ee3a47ff3c61f1f286c576ef1e1a0517ca940f0bbb8815d0e4afed.exe	86
PID 348 wrote to memory of 3196	348	Nddkgonp.exe	87
PID 348 wrote to memory of 3196	348	Nddkgonp.exe	87
PID 348 wrote to memory of 3196	348	Nddkgonp.exe	87
PID 3196 wrote to memory of 1244	3196	Njacpf32.exe	88
PID 3196 wrote to memory of 1244	3196	Njacpf32.exe	88
PID 3196 wrote to memory of 1244	3196	Njacpf32.exe	88
PID 1244 wrote to memory of 4048	1244	Ngedij32.exe	89
PID 1244 wrote to memory of 4048	1244	Ngedij32.exe	89
PID 1244 wrote to memory of 4048	1244	Ngedij32.exe	89
PID 4048 wrote to memory of 4436	4048	Nqmhbpba.exe	90
PID 4048 wrote to memory of 4436	4048	Nqmhbpba.exe	90
PID 4048 wrote to memory of 4436	4048	Nqmhbpba.exe	90
PID 4436 wrote to memory of 3244	4436	Nbmelbid.exe	91
PID 4436 wrote to memory of 3244	4436	Nbmelbid.exe	91
PID 4436 wrote to memory of 3244	4436	Nbmelbid.exe	91
PID 3244 wrote to memory of 4980	3244	Ndkahnhh.exe	92
PID 3244 wrote to memory of 4980	3244	Ndkahnhh.exe	92
PID 3244 wrote to memory of 4980	3244	Ndkahnhh.exe	92
PID 4980 wrote to memory of 2156	4980	Ojhiqefo.exe	93
PID 4980 wrote to memory of 2156	4980	Ojhiqefo.exe	93
PID 4980 wrote to memory of 2156	4980	Ojhiqefo.exe	93
PID 2156 wrote to memory of 3812	2156	Oqbamo32.exe	94
PID 2156 wrote to memory of 3812	2156	Oqbamo32.exe	94
PID 2156 wrote to memory of 3812	2156	Oqbamo32.exe	94
PID 3812 wrote to memory of 4068	3812	Oqdoboli.exe	95
PID 3812 wrote to memory of 4068	3812	Oqdoboli.exe	95
PID 3812 wrote to memory of 4068	3812	Oqdoboli.exe	95
PID 4068 wrote to memory of 2664	4068	Obdkma32.exe	96
PID 4068 wrote to memory of 2664	4068	Obdkma32.exe	96
PID 4068 wrote to memory of 2664	4068	Obdkma32.exe	96
PID 2664 wrote to memory of 416	2664	Ocegdjij.exe	97
PID 2664 wrote to memory of 416	2664	Ocegdjij.exe	97
PID 2664 wrote to memory of 416	2664	Ocegdjij.exe	97
PID 416 wrote to memory of 5100	416	Onklabip.exe	98
PID 416 wrote to memory of 5100	416	Onklabip.exe	98
PID 416 wrote to memory of 5100	416	Onklabip.exe	98
PID 5100 wrote to memory of 2540	5100	Oqihnn32.exe	99
PID 5100 wrote to memory of 2540	5100	Oqihnn32.exe	99
PID 5100 wrote to memory of 2540	5100	Oqihnn32.exe	99
PID 2540 wrote to memory of 4484	2540	Obidhaog.exe	100
PID 2540 wrote to memory of 4484	2540	Obidhaog.exe	100
PID 2540 wrote to memory of 4484	2540	Obidhaog.exe	100
PID 4484 wrote to memory of 1796	4484	Pcjapi32.exe	102
PID 4484 wrote to memory of 1796	4484	Pcjapi32.exe	102
PID 4484 wrote to memory of 1796	4484	Pcjapi32.exe	102
PID 1796 wrote to memory of 692	1796	Pqnaim32.exe	103
PID 1796 wrote to memory of 692	1796	Pqnaim32.exe	103
PID 1796 wrote to memory of 692	1796	Pqnaim32.exe	103
PID 692 wrote to memory of 4140	692	Pkceffcd.exe	105
PID 692 wrote to memory of 4140	692	Pkceffcd.exe	105
PID 692 wrote to memory of 4140	692	Pkceffcd.exe	105
PID 4140 wrote to memory of 2888	4140	Pcojkhap.exe	106
PID 4140 wrote to memory of 2888	4140	Pcojkhap.exe	106
PID 4140 wrote to memory of 2888	4140	Pcojkhap.exe	106
PID 2888 wrote to memory of 3124	2888	Pndohaqe.exe	107
PID 2888 wrote to memory of 3124	2888	Pndohaqe.exe	107
PID 2888 wrote to memory of 3124	2888	Pndohaqe.exe	107
PID 3124 wrote to memory of 1672	3124	Pabkdmpi.exe	109
PID 3124 wrote to memory of 1672	3124	Pabkdmpi.exe	109
PID 3124 wrote to memory of 1672	3124	Pabkdmpi.exe	109
PID 1672 wrote to memory of 420	1672	Pkhoae32.exe	110

C:\Users\Admin\AppData\Local\Temp\17933a7b18ee3a47ff3c61f1f286c576ef1e1a0517ca940f0bbb8815d0e4afed.exe
"C:\Users\Admin\AppData\Local\Temp\17933a7b18ee3a47ff3c61f1f286c576ef1e1a0517ca940f0bbb8815d0e4afed.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\Nddkgonp.exe
  C:\Windows\system32\Nddkgonp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:348
- - C:\Windows\SysWOW64\Njacpf32.exe
    C:\Windows\system32\Njacpf32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Windows\SysWOW64\Ngedij32.exe
      C:\Windows\system32\Ngedij32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1244
    - - C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4048
      - C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3244
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:416
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:692
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2888
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3124
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:420
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        24⤵
        Executes dropped EXE
        
        PID:3936
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        25⤵
        Executes dropped EXE
        
        PID:1692
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:60
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        27⤵
        Executes dropped EXE
        
        PID:3380
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4232
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        29⤵
        Executes dropped EXE
        
        PID:456
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1740
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        31⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3768
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        33⤵
        Executes dropped EXE
        
        PID:1292
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        34⤵
        Executes dropped EXE
        
        PID:2548
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        35⤵
        Executes dropped EXE
        
        PID:2324
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        36⤵
        Executes dropped EXE
        
        PID:5040
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2060
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        38⤵
        Executes dropped EXE
        
        PID:1336
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:228
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4000
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        41⤵
        Executes dropped EXE
        
        PID:4076
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        42⤵
        Executes dropped EXE
        
        PID:2400
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        43⤵
        Executes dropped EXE
        
        PID:4248
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:892
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        45⤵
        Executes dropped EXE
        
        PID:3440
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1968
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        47⤵
        Executes dropped EXE
        
        PID:4168
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        48⤵
        Executes dropped EXE
        
        PID:1436
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3040
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        50⤵
        Executes dropped EXE
        
        PID:4084
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        51⤵
        Executes dropped EXE
        
        PID:1332
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4468
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        53⤵
        Executes dropped EXE
        
        PID:2024
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4728
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4360
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        56⤵
        Executes dropped EXE
        
        PID:3964
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        57⤵
        Executes dropped EXE
        
        PID:812
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5108
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        59⤵
        Executes dropped EXE
        
        PID:2384
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2440
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        61⤵
        Executes dropped EXE
        
        PID:1192
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        62⤵
        Executes dropped EXE
        
        PID:3612
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4736
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        64⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        65⤵
        Executes dropped EXE
        
        PID:3372
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        66⤵
        Executes dropped EXE
        
        PID:2152
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2512
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4960
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        69⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        70⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        71⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        72⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        73⤵
        Modifies registry class
        
        PID:1452
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        74⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        75⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        76⤵
        Modifies registry class
        
        PID:4604
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        77⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        78⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        79⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3096
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        81⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        82⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        83⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        84⤵
        Drops file in System32 directory
        
        PID:3364
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        85⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        86⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        87⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5124
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5164
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        90⤵
        Drops file in System32 directory
        
        PID:5212
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5256
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        92⤵
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        93⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        94⤵
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        95⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        96⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        97⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        98⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        99⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        100⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5696
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        102⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        103⤵
        Drops file in System32 directory
        
        PID:5808
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        104⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        105⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        106⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5988
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        108⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        109⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        110⤵
        Modifies registry class
        
        PID:6132
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        111⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        112⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        113⤵
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        114⤵
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        115⤵
        Drops file in System32 directory
        
        PID:5428
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        116⤵
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5572
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        118⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        119⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        120⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        121⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        122⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        123⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6100
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        125⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        126⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        127⤵
        Modifies registry class
        
        PID:5336
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        128⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        129⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        130⤵
        Drops file in System32 directory
        
        PID:5704
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        131⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        132⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        133⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        134⤵
        Drops file in System32 directory
        
        PID:5208
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        135⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        136⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        137⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5980
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        139⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        140⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        141⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6072
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        143⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        144⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        145⤵
        Drops file in System32 directory
        
        PID:5468
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        146⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        147⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        148⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        150⤵
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        151⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        152⤵
        Modifies registry class
        
        PID:6360
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        153⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        154⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        155⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        156⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        157⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        158⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        159⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        160⤵
        Modifies registry class
        
        PID:6704
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        161⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        162⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        163⤵
        Modifies registry class
        
        PID:6824
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        164⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        165⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        166⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        167⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        168⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        169⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        170⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7164
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        172⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        173⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        174⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        175⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        176⤵
        Modifies registry class
        
        PID:6456
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        177⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        178⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6648
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        180⤵
        Drops file in System32 directory
        
        PID:6700
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        181⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        182⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        183⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        184⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        185⤵
        Drops file in System32 directory
        
        PID:7064
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7128
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        187⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6304
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6392
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6480
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        191⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        192⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6840
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6908
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        195⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        196⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        197⤵
        Modifies registry class
        
        PID:6340
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        198⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        199⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        200⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        201⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        202⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        203⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        204⤵
        Drops file in System32 directory
        
        PID:7044
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        205⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6864
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        207⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        208⤵
        Modifies registry class
        
        PID:6512
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        209⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        210⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        211⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7300
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        213⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        214⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        215⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        216⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        217⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        218⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7596
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        220⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        221⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        222⤵
        Modifies registry class
        
        PID:7728
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        223⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7804
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        225⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        226⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        227⤵
        Modifies registry class
        
        PID:7932
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        228⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        229⤵
        Drops file in System32 directory
        
        PID:8012
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8056
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        231⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        232⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        233⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        234⤵
        Modifies registry class
        
        PID:7188
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        235⤵
        Modifies registry class
        
        PID:7284
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        236⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        237⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        238⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        239⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        240⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        241⤵
        Modifies registry class
        
        PID:7692
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        242⤵
        Modifies registry class
        
        PID:7764
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        243⤵
        Drops file in System32 directory
        
        PID:7776
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        244⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        245⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        246⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        247⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        248⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        249⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        250⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7412
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        252⤵
        Modifies registry class
        
        PID:7524
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7620
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        254⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        255⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        256⤵
        Modifies registry class
        
        PID:7900
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8024
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8108
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        259⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        260⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        261⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        262⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7980
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        264⤵
        Modifies registry class
        
        PID:8040
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        265⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        266⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        267⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8096
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        269⤵
        Drops file in System32 directory
        
        PID:6972
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7464
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        271⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7348
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        273⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        274⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        275⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        276⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        277⤵
        Modifies registry class
        
        PID:8280
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        278⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        279⤵
        Modifies registry class
        
        PID:8372
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        280⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        281⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        282⤵
        Modifies registry class
        
        PID:8500
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        283⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        284⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        285⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        286⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        287⤵
        Drops file in System32 directory
        
        PID:8704
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        288⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        289⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        290⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        291⤵
        Modifies registry class
        
        PID:8884
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        292⤵
        Drops file in System32 directory
        
        PID:8924
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        293⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        294⤵
        Drops file in System32 directory
        
        PID:9000
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        295⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        296⤵
        Drops file in System32 directory
        
        PID:9084
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9132
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        298⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        299⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8248
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        301⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        302⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        303⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        304⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        305⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        306⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        307⤵
        Drops file in System32 directory
        
        PID:8692
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        308⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        309⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8876
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        311⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        312⤵
        Drops file in System32 directory
        
        PID:8996
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        313⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9164
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        315⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        316⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        317⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        318⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        319⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        320⤵
        Drops file in System32 directory
        
        PID:8648
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        321⤵
        Modifies registry class
        
        PID:8792
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        322⤵
        Modifies registry class
        
        PID:8868
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        323⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        324⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        325⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        326⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        327⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        328⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        329⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        330⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        331⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        332⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        333⤵
        Modifies registry class
        
        PID:8732
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        334⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        335⤵
        Modifies registry class
        
        PID:8272
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8612
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        337⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        338⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        339⤵
        Drops file in System32 directory
        
        PID:8604
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        340⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        341⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        342⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        343⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        344⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9416
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9460
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        347⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        348⤵
        Drops file in System32 directory
        
        PID:9548
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        349⤵
        Modifies registry class
        
        PID:9588
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        350⤵
        Modifies registry class
        
        PID:9632
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        351⤵
        Modifies registry class
        
        PID:9672
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        352⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        353⤵
        Drops file in System32 directory
        
        PID:9760
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        354⤵
        Drops file in System32 directory
        
        PID:9800
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        355⤵
        Drops file in System32 directory
        
        PID:9840
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        356⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        357⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        358⤵
        Drops file in System32 directory
        
        PID:9960
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10004
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        360⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10088
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        362⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        363⤵
        Modifies registry class
        
        PID:10168
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        364⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        365⤵
        Modifies registry class
        
        PID:9184
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        366⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        367⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        368⤵
        Drops file in System32 directory
        
        PID:9408
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        369⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        370⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        371⤵
        Drops file in System32 directory
        
        PID:9628
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        372⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        373⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        374⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        375⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        376⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        377⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        378⤵
        Drops file in System32 directory
        
        PID:10080
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10152
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        380⤵
        Drops file in System32 directory
        
        PID:10228
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        381⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        382⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        383⤵
        Drops file in System32 directory
        
        PID:9492
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        384⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        385⤵
        Modifies registry class
        
        PID:9740
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        386⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        387⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        388⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        389⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        390⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        391⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        392⤵
        Modifies registry class
        
        PID:9612
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        393⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        394⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        395⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        396⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        397⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        398⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        399⤵
        Drops file in System32 directory
        
        PID:9328
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        400⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        401⤵
        Modifies registry class
        
        PID:10192
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9928
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        403⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        404⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        405⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10292
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        406⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10372
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        408⤵
        Drops file in System32 directory
        
        PID:10416
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        409⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        410⤵
        Drops file in System32 directory
        
        PID:10496
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        411⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        412⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        413⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        414⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        415⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        416⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10780
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        418⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        419⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        420⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        421⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        422⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        423⤵
        Drops file in System32 directory
        
        PID:11028
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        424⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        425⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        426⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        427⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        428⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        429⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        430⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        431⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        432⤵
        Drops file in System32 directory
        
        PID:10464
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        433⤵
        Drops file in System32 directory
        
        PID:10544
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        434⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10612
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        435⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        436⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        437⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        438⤵
        Modifies registry class
        
        PID:10888
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        439⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        440⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        441⤵
        Modifies registry class
        
        PID:11100
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        442⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11160 -s 416
        443⤵
        Program crash
        
        PID:10260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 11160 -ip 11160
1⤵
PID:11216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aanjpk32.exe

Filesize
226KB

MD5
70ffb2198e564d52dfcda801f7de3e9b

SHA1
870f70e17f5bb82bdbd8ce19bc0958a694a3580c

SHA256
9573b0a7d32b94469e7cadd86a33edcad67d7dec95465ed6039b02d8941f618d

SHA512
ab025c256c0c1983edc9f53ba82f14788739b8eaed7dd47f72237e3a8cf0b2b565c009382aea1b570dce0da039afab3ea81f52972125b8090548d418cfd88ccb

Download Submit
C:\Windows\SysWOW64\Aaqgek32.exe

Filesize
226KB

MD5
dee322281a547a47d66dd41d4c03bcc8

SHA1
b0720240d58f16f4a13da37e0e41454282c7d0eb

SHA256
59f5af080c1d6b7b63381f2415f68f96da132dbd2415213214f373b268a9b476

SHA512
2aae86d5d46624e1ba6256326df7b03ea3a2fd5c64609b85300765d38984f68098fc00ef2db14b8862ef517a95679dc4a9359f0834f6dbf2a12d1bf86f324cfa

Download Submit
C:\Windows\SysWOW64\Acmflf32.exe

Filesize
226KB

MD5
0e1f21692bbae150ee0cf7bb75dd6172

SHA1
2bbe3fce66b2024f90669019dacce0ae05be45d8

SHA256
0b605e39e253d229592f3e4493e2595ec6461f3ba0fbf9f6c5212107c2cfaec0

SHA512
02b3ca516b8ddbebddab85eaea82ee68fd57a914a8ced015c02d4f9bd7216c165c1f338d50f68038e44501d3844de86d76f03f393ae5afe640084fea39c82a1f

Download Submit
C:\Windows\SysWOW64\Adapgfqj.exe

Filesize
226KB

MD5
37138a28f6768065d712554c3a9e8995

SHA1
e37c6efc834abb3c1b7402eceb2f3a9027849dcb

SHA256
9eb0e22d5bbaba5914bf9585fc3cda747a81494583f7d4884b8fb187a32bc622

SHA512
d2bdba1161f754555592db5e540ff2f5e6408cd5abda815f974c4b6d5c25f2a353a5761a803c86c285f9365629b6e44a5a5e55bb2e7fd54ae4dd75cf966c0bb4

Download Submit
C:\Windows\SysWOW64\Ajkhdp32.exe

Filesize
226KB

MD5
ad548157c45ee403a665ef4f5a8fbdd0

SHA1
f14ede0174e3b56032037c96df36a0cef2dc7f10

SHA256
283b4d61d1d8fd3cb0e32552faa06e2693e8d78d26c3e6cae66307434adc0cfd

SHA512
6572ad0aed480fe366447da8f210da3c7e86538250df4f27d8716e6a30fd2e1e3d87fefb357213ecdf62b616771c73f6deef5a713456d6ec89ea636e95f1bd5f

Download Submit
C:\Windows\SysWOW64\Alfkbc32.exe

Filesize
226KB

MD5
12bc086bb008da99525175c5291f6ecc

SHA1
a096edad23efb923ee868649c35704e367164971

SHA256
031e7186724d95ea7b557a56f7a1184d78e1c37ca3282022ed8abf02362b07f7

SHA512
403c474bbf525516c8a13b8320c6dbdff2e0a0545b1f86532091e7dcdd783edbaf2657997aee5625939eb5ebb86e1f37c9576fc28b8133dd8c9d9aceadcb2b8c

Download Submit
C:\Windows\SysWOW64\Dceohhja.exe

Filesize
226KB

MD5
d4904280fb6c38a2bbbe01778e393a64

SHA1
c3c54aa4956bd9c8d0bfea9d0a0db379057c7541

SHA256
c9a1b17123c672fd44f23674a22062346012bd03d2f64fe5542cbf827ec1d65c

SHA512
fc7d48b450ab9ed2f7c300cc0f2873e515375e9993a56bb60cc49a7c8b17060ddedcbe92d6e3c5bf81af554287ec981c01e83dbdbe0f120974432b1ed61384ae

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
226KB

MD5
a9717f078a8a7c228d441c17158fd20c

SHA1
2f1ae08bf8618455d42041390c7eb5c4a248730a

SHA256
24dea0952dc7fa84d516fb421c445bfb22a422f16ea406da70e44879d520f6db

SHA512
b3f783457ea12d085f2b2dd2c184fffc3d4c181b4039cef9138ed1bb2d95513fb9cb7ad32c8c920f7d4d0c7f53e1226d0737d1588b2974b52bfc1096c696c7a7

Download Submit
C:\Windows\SysWOW64\Eocenh32.exe

Filesize
226KB

MD5
8f2f00275d904e953642885af8b53158

SHA1
fcb90873f9d950a17bd3765e85a8254759de6c86

SHA256
ab7b662db269db75d16016730f13a1a87505e4e4bbdf52de77c9451d728e3e16

SHA512
5082c235a15a209b0b6d5d8c3c5df8a2c1a89860632a20c356e45a4ea1e6e577fab93426cd3856f98065d428c0c08b19b365fe5f23292183b16350eae8fccdfb

Download Submit
C:\Windows\SysWOW64\Gblngpbd.exe

Filesize
226KB

MD5
d4c0c1a0bac12b9529e3b226270202d6

SHA1
533c74c78a7a56438f172e7b6bfdc2095c1e18fe

SHA256
2ab23a6389c500f0699c8e328910b0f711ceb02a6b2902068e2f6c482a391c0f

SHA512
e4453afcbd7b3c1539531c98f007ff28735302559cc5e4093cc643b95a14e8e4fb8ec4f7b119cc2e3a874ecb714f486ccc2c39f22936adf20222d13d25390cf4

Download Submit
C:\Windows\SysWOW64\Gkniapgh.dll

Filesize
7KB

MD5
feef522404ba9e90a98dfdbb7d679e90

SHA1
ca41ebf3d51fa764077201c778642f89fb9d6155

SHA256
2e4f6cc3e42e1d1b2f195193934d18a089d92cfc89e83b0e20c26a331c875bac

SHA512
511443586c820b02d9825bfdbc18e463f6697f03990890461b1a0d66be835dbc68071040d1cb03a570cacefd64117b95449e28bcfe14c12a16539a135ffdeb17

Download Submit
C:\Windows\SysWOW64\Jcbihpel.exe

Filesize
226KB

MD5
4c7abc2e94809619078d13305b6de717

SHA1
e9d8ba6ec7ed16dae8fb1f2241209c27387515c8

SHA256
b5c8387fd0084d889702c391f2d366e09b3ef2cb86ce50261248e0101fb55a47

SHA512
564b720103a7b5ada1b804b1c6fa972434841f01f7eb34713a8b048ddbdb1eebee04096cf4269e977c1c918057f89216e71b9afed5883058734e824b02cd4601

Download Submit
C:\Windows\SysWOW64\Mpoefk32.exe

Filesize
226KB

MD5
366c637e79758b3215158ca944cd3fdd

SHA1
99bc60ef3512ea4549b0a6aa4c710330e3646da5

SHA256
227db5bc1f56ea5b8bd58d612cb064f401f23304c08c217e7f3b2426f525e367

SHA512
e85db60af30a22c266dffeee8230376c8ef22b785b756310424296243e5ee2a60cc01c43b2f236f3df72020ad9a5a3fec105d4a33ab0c5f9d7aa7bc33b064059

Download Submit
C:\Windows\SysWOW64\Nbmelbid.exe

Filesize
226KB

MD5
52d3d1b273dc818bd7f78bb446f4a15f

SHA1
286e6c807945fc7937f75ca65e2f4a04cb61291d

SHA256
9cc63c6dd0ffda99ee5983509cdc4087d14b41c25546785d150cecb3af585be7

SHA512
e9033b6ec89cc3518bbb876c96014ac42d31e8237c5cf242bfd4ed8404214344227ccc8b29757e33d3df565648f77f9e54dff3dffcce2b055cb1bb5f0c99a51b

Download Submit
C:\Windows\SysWOW64\Nddkgonp.exe

Filesize
226KB

MD5
99d34c6acfd47bde088e1c524564f935

SHA1
f9071be0b9dba44ebd3b908795c6e89dd784b764

SHA256
27e9485a92304337399b64db4a1db1f4ea760fb0eb6a309c84806baca632ae7f

SHA512
dd704e599d0fc0adee269c5ad6c9375a9e948676819b2457c40592fcae0f484f9000ce8ea343e6050bb89e88ee9f96d336d8138205a5b2525c6e60b2282a41e0

Download Submit
C:\Windows\SysWOW64\Ndkahnhh.exe

Filesize
226KB

MD5
a904a48fce11a73406af43cdd23c5434

SHA1
36be2add3cbbcecd152385ca0534347495ac6aa6

SHA256
1d5e4a7c3fcab2d39c74bcc0f03e42751a6377e8a0f1a5a41319f7d07e5fedd0

SHA512
6294600b2e53668c3a25fb136a2339889b7a99486b2d0346164b4904cc221a2c10a9dc3586c256b3efe7dfcf32051a890588017b4fc0e6e9260bab66e9cdd536

Download Submit
C:\Windows\SysWOW64\Ngedij32.exe

Filesize
226KB

MD5
9af3174c3ae926d55cd12467771ea073

SHA1
b895f1c237f87f842c17f29b5da8d4394bd46956

SHA256
11e3f1652398bb450d7ebe821d1921816dac308a135e1c0aa0c3ac7dc3e207aa

SHA512
3640d8835ea607a3e9b1186f8451510c657b6c10a182878ad996ad4cc4cbe0879753e6ac28e0a8a78e0e5ec772e9d4527ad7767e0ae12e0ea224b7449e4a789d

Download Submit
C:\Windows\SysWOW64\Njacpf32.exe

Filesize
226KB

MD5
044d99420cef42db6c75b601eae81022

SHA1
1120b26648d04aed868b026c348eb2efe8c18778

SHA256
048a8cda732e816e6c97c005bf982e4dbe0d0b7f2bbeb3acf913857f83c4c168

SHA512
b20c274600a514a1990c20d6a48cf64da6c295fc0529b7d4653d4ea13cecae3613276225602d355f8b688d684fc2a903521639be54a2d1623c534e8e2961406d

Download Submit
C:\Windows\SysWOW64\Nqmhbpba.exe

Filesize
226KB

MD5
c7214712ee5fbe0d8f335bb811179fcb

SHA1
5dc69851f89edf538b6965525b6f4b7abf9cad86

SHA256
c305cc551d1cd2d9209dffea500f2d39a02135ff96f59ff18dc3fe8e699fa927

SHA512
ba3fd35e41c660e3f6951c9f0a9138021f3c04e4800e9787b60b316d2a9d7291a4582fd1dc1dcc030c708291e7f17695f8585cca3c6c30bdfc0a2bada21a1d1f

Download Submit
C:\Windows\SysWOW64\Obdkma32.exe

Filesize
226KB

MD5
77db3e5c8bd986b92cdae28ac10ec40c

SHA1
25d61051a3fadde6239142db8e2f3c133eca0d54

SHA256
0f8ed02558767990ea6ce8a7f7232faf247d947fa83dfdd1dc32522a1e9f2dad

SHA512
52bce71e5b99bec1d1e186964f3f62537843bd0bb2eafe7c7003624f531a0f3bbc0002d992747e5bad95f2536c8262e85ed7f4a4cdd5b2c2334feed47bbbbb10

Download Submit
C:\Windows\SysWOW64\Obidhaog.exe

Filesize
226KB

MD5
ebe1fc409bf01117511617689817397d

SHA1
bc43deb67f7a8b70a5b908780571a2993db4804b

SHA256
e86b1d9179068fa7fca85520556d0447a1894800640ff87ae7197133ba0e976e

SHA512
920452172c1dd350e4b666b51586430859cc8fb49a28e07475f4941c46a4510f3be6e83bcdff5f6cdd10339bbc4711f51cf184e1e5c4022b248bbdaa6b345352

Download Submit
C:\Windows\SysWOW64\Ocegdjij.exe

Filesize
226KB

MD5
52b4fd534aa8e7e378021eabbaa89880

SHA1
cc65ea8ae31cf0b3c434f730256abb3b691a0f23

SHA256
6cdbc627a08a1b61e7786c9cee788ed62d25a3af702982718919b4f513de6405

SHA512
ff4616e3538bb193736bb74020d5b9a5c94c43d5a91cb9a674738ef39b1469beee70ed8127ad40e5aaa98eafbb2daabd51ada34acaccecdb3b0d28adcd2e718e

Download Submit
C:\Windows\SysWOW64\Ojhiqefo.exe

Filesize
226KB

MD5
cbdb9fdc17d83e2a1d84d8354bec6689

SHA1
b48eb4075b0f43a1b932aa81caba2cb336ba6f35

SHA256
9f811a2cd8daf580e1f393c35650aab9b6066a4b1a1ae236054ba5dd1406fb9d

SHA512
80b894efee2f679bbeeb889808910915e33e2d86850b883663153ae77cda2e2dd893cb1c0e64c8118fcaa12edfbc4f95dfb0a00b9665f98057467f2f9c43a605

Download Submit
C:\Windows\SysWOW64\Onklabip.exe

Filesize
226KB

MD5
ff5389747fabef3f3767334ec18f4fc5

SHA1
80fa62a07839f54874470f0f122cc06b8cb0b390

SHA256
9a29ecf2221fc66758b61f639b033fdbf201ba33d2740b8e18a66e5b8c944f50

SHA512
4cd293045b8e13830c669330c412564358d32f135ab5ed69c59b8f78820f073780429db6efa04afd76f9c0a6d1136600c877c30146f8811d5028e4e9a337c672

Download Submit
C:\Windows\SysWOW64\Oqbamo32.exe

Filesize
226KB

MD5
5bdbc99d7bda603efb172f045cf20fc3

SHA1
ce27235ae464ba4db1cf28c60e836a3093a30397

SHA256
418ceb2127a290c4bac1eea1aa58c33f8a898f2a150b4b794c038fd4edc604f3

SHA512
d17b27a79302296c6de661db22cbb3ae408ac808420fc8cd6160996cbc14147fccf7659f7fc43d50a0be9d978f3b17924c98a5d1d7328778ccb5ae7c20924f8d

Download Submit
C:\Windows\SysWOW64\Oqdoboli.exe

Filesize
226KB

MD5
c301d1f1495c0ece5c8eb00075161a71

SHA1
408e52b2370ef91d404397e5dde1187598be2320

SHA256
6028657d2dc4d4f61d8aa0dc4a06d75d9b6dac8c41e1ac142c159152affb03ef

SHA512
b384678c91e44c240e4af3a9fdc2377a094513635266fa4c4239d64bdbc96d49c756ca8beedf26f3b1449576fec360a56e365faba9c5575d5534fedf70e95394

Download Submit
C:\Windows\SysWOW64\Oqihnn32.exe

Filesize
226KB

MD5
1ac38df7dbeb942dcfe8402884c5c398

SHA1
b9e5bf5db040d136df2d589e31562ee7590968ca

SHA256
608aa3197cc3dbc92dded3595b43d2e8bd5a5246f726355e41c3454da33a3022

SHA512
d54d37b38f4bf5291b49fac892ed81ed56e027fc3085f6111fe80a3559caf19952246f3e4ae8aa4d8d87f5f22d41582796e2095528831df1891787130cdcba57

Download Submit
C:\Windows\SysWOW64\Pabkdmpi.exe

Filesize
226KB

MD5
e122cf3236c3a98f05cc430c33dfbbe4

SHA1
ac2293485c504abd3411633fd88cbbe2e9af272f

SHA256
61001ee54985cc42d12b6a6f672c40b40f8b5a9495d6e2f1f8bff186a3fc5837

SHA512
ea03d1cca2a49288d9b4fd601d375cc687e29b238be4336ac249bb9e4b609e8e5284907cb4aeed289802d231ceceb5fd00159dcc8f2398cadc9d4f15a611a19e

Download Submit
C:\Windows\SysWOW64\Pbddcoei.exe

Filesize
226KB

MD5
caac13467ac273b279b667a0aea8b2fb

SHA1
3a446364ace2f5465f0933554b6d45cb1c352705

SHA256
d283b840eafd6c075751ba418846f64d923ff7e2378f93c3dc14bb5f496612a0

SHA512
059c9c3680f61a7176e8be8551a36c1c21ca3a767617b571548867c606bf3b2b47a21ca860569da0d3b355f95230d76080d51ab0bb3518fcd76a406be97149d7

Download Submit
C:\Windows\SysWOW64\Pcjapi32.exe

Filesize
226KB

MD5
cecc27d9b51e2292ffc5aa389b666b06

SHA1
47ae96dd82ece5f7dad105772f050baf94a5791d

SHA256
9ceb4ba085e0ff2e96a79233bffc153e424832257a1512cf7e9c1bcda3e678a4

SHA512
bbc0101dd066d04ca4dcb8e5fe3ca83ee055712f8d9d24d253a273e15c49c6e785e8792665371873d3831de9daf61d88403aca5c0c204ab36dd1df612e1edd0f

Download Submit
C:\Windows\SysWOW64\Pcojkhap.exe

Filesize
226KB

MD5
547b6fcfc083fe0ebc940def15006881

SHA1
10ecbc828298e972ae014b46d3682c1e262cffb7

SHA256
6d4bd243bf78ab03b0910cd190859365748ff185b1a47ae0d0140165fdabdca4

SHA512
302b497dff6704016cd2b8d148c86bc4a2e9d8e87a7f625822f41075e30f56c84908a1bcf51b2b3c145e3f736a676c88012af3984cb3a534a124857bff2262ab

Download Submit
C:\Windows\SysWOW64\Pgopffec.exe

Filesize
226KB

MD5
0882e6183a86e98569723c17c9a080a2

SHA1
93d438f17cb49185410da9c9dcacd4fdbad65f9b

SHA256
4276a9c3228513886955b0fe2c3694c4fbbf0520648b5ea3177e83f70d96717c

SHA512
3c6de4f2d89751754e7a91bc1e9bfd728df8a91de2f1c8e50715d62bd93438b3f232c2fe934c9e2e052108b3036e7877810cb454f21f10be895b6e710f7e3a25

Download Submit
C:\Windows\SysWOW64\Pkceffcd.exe

Filesize
226KB

MD5
5aa5f51b6144071554a7bf526f58c144

SHA1
d97a4f3300f01873c7ed28ce903c61bde7683de9

SHA256
66ad6cbec41524fcd479cda3caf0d37b02f912e8a646287ba037967fc4fe12c2

SHA512
24b4f433552ee4a7ace0c724070d466dc2c3d89dbe46da4067efcf087713c5b19620f022387376a8ff78cf1953dfdcb2487d1abd164cea35b9799c6f6ddc0d19

Download Submit
C:\Windows\SysWOW64\Pkhoae32.exe

Filesize
226KB

MD5
984e588e534322195f9807752a79e08d

SHA1
ce67fbfff1686f304da4367a5948a6a8a1dc56ea

SHA256
8a5bd29e74431468d053250c8eb070d18b4348b7d8a8128218ede479aaa81101

SHA512
0d81586980fe22c9889775cff2f59f13b699a2ad65fa689db7fa9f17eed2ed56843a5e5b079cb98f43aef36c3b7e320e648a219d0d00ac7c03a6603f79f22fbf

Download Submit
C:\Windows\SysWOW64\Pndohaqe.exe

Filesize
226KB

MD5
ac6107f85e741d5cb443de1b6af25ddc

SHA1
20a0f20e6d8f5cb04b585e7e7e9c99dc3ec047fe

SHA256
2e03f6b9fec5fd3debda208d13e190b3bdbaf9d34a0e83806c80ab112f0b8f2f

SHA512
c83ce54093b13a4214dd8435bb8451f17fb7e0094746f1924e476058b4c2d597019ca4b3ec45ef2dc3ee302188abb50e15344b3a8717266aee99509a0edb00d3

Download Submit
C:\Windows\SysWOW64\Pqnaim32.exe

Filesize
226KB

MD5
4d92ec866e4f7846a3b42547d6410389

SHA1
bbab6d0ce8a331d890f27c2da6b99be57d842569

SHA256
39487828be35078ad95e72760e89678bb8137eaaa11c9717f672b1dcc514371c

SHA512
e490f78ff1e0d23d937eed9620d50bf652248f684f92d689ce024007c00a5f44b5409cb03896d2e4083be0555e22f8a9e62aa9b396640f91ef02766b060c5e9f

Download Submit
C:\Windows\SysWOW64\Qajadlja.exe

Filesize
226KB

MD5
f1cf5440ba13624e0ce882d367f64e8e

SHA1
6479da712ad40f82ffe1a638398ce684764742dc

SHA256
1c3e3b110fe7a826091cfe40fad4249cd5db61004caeacf716a4d011bbdecc4a

SHA512
42f826298a5257c0c6715a38ab1c19df1d5291d64e97e1b53e5dd34f185a735e9960b3a45f93f09b4ec54c8f01e630258598c385280e5528faccfb31d23b8e93

Download Submit
C:\Windows\SysWOW64\Qalnjkgo.exe

Filesize
226KB

MD5
c9229023914e6e133c2617c0e75ad8bd

SHA1
5c67658ddd8ad81355b0f4e20822c2744fa567f1

SHA256
fa57074ff0c1a6e134f56766981b1ed27a70b2346368c56afe4fb50cb16ed768

SHA512
e77fa876532d7c962f23d9343422c17efb82c6348cd1d972455318c1f74524402c17117c92c860a9eb02316ca66e33da24e5138c1672c3c1a7109914ad121f26

Download Submit
C:\Windows\SysWOW64\Qjpiha32.exe

Filesize
226KB

MD5
d8a271362cc2bda066f3b40b1dca974f

SHA1
8e01b1274f04ef125d7da8a19da54acaf281162e

SHA256
820e87eb9c8c1314ddce9a468a784bc7c8331643f301b72faff3de8beb357b5c

SHA512
36b07186fb101afc6b55154cf01bcf871f1599841e1813eb13347ab36de25dcb808e20e9db24cc37079a72c46b0123b62351b5d7d28fe11dd8fd793a477ced24

Download Submit
C:\Windows\SysWOW64\Qnnanphk.exe

Filesize
226KB

MD5
d38645ed845c2b90d50f823cf7b49356

SHA1
8ae378847a0b7b4326b542a1d6f59a4f2b4add88

SHA256
9b104f9fb180c12b8af6d8be3ea144039ba9c1821f22a2016c25140000d8eece

SHA512
3d431de4faae7dc034449382a7877b4e997f552c6f4bbdaccafc4c66c24474e9628151aaee9b2fb5b605c896ab022ebc71ccfc9f4f7887aec1117b6557222a46

Download Submit
memory/60-199-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/228-287-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/348-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/416-96-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/420-176-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/456-224-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/692-136-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/812-395-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/892-321-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1192-423-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1244-24-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1292-247-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1332-359-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1336-281-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1436-341-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1672-167-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1692-192-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1740-231-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1796-128-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1968-329-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2024-371-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2060-275-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2156-64-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2324-263-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2384-411-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2400-305-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2440-413-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2504-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2540-111-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2548-255-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2664-87-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2888-152-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3040-352-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3124-164-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3196-15-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3244-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3380-207-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3440-323-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3612-425-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3768-240-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3812-71-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3936-184-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3964-389-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4000-293-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4048-31-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4068-80-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4076-299-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4084-357-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4140-143-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4168-335-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4232-215-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4248-311-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4328-232-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4360-388-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4436-44-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4468-365-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4484-120-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4508-437-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4728-377-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4736-434-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4980-60-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5040-269-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5100-108-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5108-406-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads