5afed274472a15b85e4cd9885f6704095cc4641ba7b699f6569a8d977a8eb630

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5afed274472a15b85e4cd9885f6704095cc4641ba7b699f6569a8d977a8eb630.exe
Size

59KB
MD5

3fc3191d2fbc121440551f07d3360085
SHA1

c784abd0774db8c875411c96453d09a019f86b04
SHA256

5afed274472a15b85e4cd9885f6704095cc4641ba7b699f6569a8d977a8eb630
SHA512

ba89689a9d65d73249601e7bbcd349414357027e57abf22e8725244b03b8c9e12b092ac8ae92331344250907cf6fe395fe89a4595c1e99c1febdcb6354c4975c
SSDEEP

1536:NAIgIx5aN8OTCDR5cFmlCKCsyzToO2d9B0Y62L3O:NADIxCTCOmlFvyzMnH3O

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehgqln32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hihbijhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kimnbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbddcoei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeopki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkoiefmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeklag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okloegjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkjmlk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fljcmlfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gicinj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcmgfbhd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Heocnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkkhqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmfmmcbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdcdbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npmagine.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pncgmkmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfaigm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abngjnmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abemjmgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffgqqaip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhemmlhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iikhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlpkba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnfdcjkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oncofm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjmlbbdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkalchij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Likjcbkc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Likjcbkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkaiqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqpnombl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qbgqio32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aanjpk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Echknh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdcdbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldleel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cahfmgoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkopnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfngap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ildkgc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjkombfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acjjfggb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bopgjmhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njnpppkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfolbmje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pabkdmpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhkapp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iicbehnq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikbnacmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npjebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbllbibl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gohhpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kboljk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqpgdfnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npjebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abpcon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cliaoq32.exe

Executes dropped EXE 64 IoCs

pid	Process
1468	Occkojkm.exe
2308	Onholckc.exe
2876	Odbgim32.exe
4404	Okloegjl.exe
3696	Obfhba32.exe
2644	Ocgdji32.exe
2140	Onmhgb32.exe
740	Odgqdlnj.exe
4312	Pkaiqf32.exe
1584	Pnpemb32.exe
2312	Peimil32.exe
4680	Pkceffcd.exe
3440	Pqpnombl.exe
1940	Pkfblfab.exe
1424	Pabkdmpi.exe
3532	Pcagphom.exe
4428	Pjkombfj.exe
8	Pcccfh32.exe
3652	Pjmlbbdg.exe
3916	Pbddcoei.exe
3732	Qgallfcq.exe
3320	Qbgqio32.exe
4440	Qeemej32.exe
5076	Qloebdig.exe
1920	Qbimoo32.exe
3084	Acjjfggb.exe
3656	Ajdbcano.exe
780	Aanjpk32.exe
5024	Ahhblemi.exe
396	Abngjnmo.exe
3016	Acocaf32.exe
4504	Alfkbc32.exe
4608	Abpcon32.exe
3188	Aeopki32.exe
4456	Ahmlgd32.exe
4344	Angddopp.exe
4900	Aealah32.exe
5004	Ahoimd32.exe
4760	Aniajnnn.exe
4084	Abemjmgg.exe
404	Blmacb32.exe
2256	Bnlnon32.exe
1896	Beeflhdh.exe
1520	Bhdbhcck.exe
2732	Bnnjen32.exe
1028	Balfaiil.exe
1608	Bhfonc32.exe
4016	Bopgjmhe.exe
2464	Baocghgi.exe
4036	Bldgdago.exe
1800	Bbnpqk32.exe
2020	Bemlmgnp.exe
5048	Boepel32.exe
4480	Cacmah32.exe
3764	Cliaoq32.exe
400	Cbcilkjg.exe
5028	Cddecc32.exe
4912	Cknnpm32.exe
3052	Cahfmgoo.exe
5072	Chbnia32.exe
1232	Ckpjfm32.exe
3496	Cajcbgml.exe
964	Chdkoa32.exe
1724	Cbjoljdo.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ehjgecbe.dll	Pjkombfj.exe
File created	C:\Windows\SysWOW64\Paihpaak.dll	Ffgqqaip.exe
File created	C:\Windows\SysWOW64\Phfkqkek.dll	Acocaf32.exe
File created	C:\Windows\SysWOW64\Lcnhho32.dll	Odmgcgbi.exe
File created	C:\Windows\SysWOW64\Gnchkk32.dll	Ibnccmbo.exe
File opened for modification	C:\Windows\SysWOW64\Likjcbkc.exe	Ldoaklml.exe
File opened for modification	C:\Windows\SysWOW64\Bhhdil32.exe	Beihma32.exe
File created	C:\Windows\SysWOW64\Agocgbni.dll	Mnebeogl.exe
File opened for modification	C:\Windows\SysWOW64\Jmpgldhg.exe	Jcgbco32.exe
File created	C:\Windows\SysWOW64\Ccdlci32.dll	Pdpmpdbd.exe
File created	C:\Windows\SysWOW64\Ainpbi32.dll	Gicinj32.exe
File created	C:\Windows\SysWOW64\Flnakb32.dll	Echknh32.exe
File created	C:\Windows\SysWOW64\Pclgkb32.exe	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Eeanii32.dll	Jmhale32.exe
File opened for modification	C:\Windows\SysWOW64\Ofqpqo32.exe	Olhlhjpd.exe
File created	C:\Windows\SysWOW64\Bopgjmhe.exe	Bhfonc32.exe
File created	C:\Windows\SysWOW64\Flioncbc.dll	Dkjmlk32.exe
File created	C:\Windows\SysWOW64\Chjaol32.exe	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Jfenmm32.dll	Mmpijp32.exe
File opened for modification	C:\Windows\SysWOW64\Pbddcoei.exe	Pjmlbbdg.exe
File opened for modification	C:\Windows\SysWOW64\Pkaiqf32.exe	Odgqdlnj.exe
File created	C:\Windows\SysWOW64\Gofkje32.exe	Ghlcnk32.exe
File created	C:\Windows\SysWOW64\Hfnphn32.exe	Hcpclbfa.exe
File created	C:\Windows\SysWOW64\Njnpppkn.exe	Ncdgcf32.exe
File created	C:\Windows\SysWOW64\Eohipl32.dll	Njnpppkn.exe
File created	C:\Windows\SysWOW64\Hbnjmp32.exe	Hopnqdan.exe
File opened for modification	C:\Windows\SysWOW64\Ikbnacmd.exe	Iicbehnq.exe
File created	C:\Windows\SysWOW64\Ohfjnoma.dll	Ildkgc32.exe
File opened for modification	C:\Windows\SysWOW64\Mckemg32.exe	Mplhql32.exe
File opened for modification	C:\Windows\SysWOW64\Peimil32.exe	Pnpemb32.exe
File created	C:\Windows\SysWOW64\Jfoiokfb.exe	Icplcpgo.exe
File created	C:\Windows\SysWOW64\Oendmdab.dll	Jeklag32.exe
File created	C:\Windows\SysWOW64\Balfaiil.exe	Bnnjen32.exe
File opened for modification	C:\Windows\SysWOW64\Cddecc32.exe	Cbcilkjg.exe
File created	C:\Windows\SysWOW64\Fdegandp.exe	Fafkecel.exe
File opened for modification	C:\Windows\SysWOW64\Bcebhoii.exe	Bagflcje.exe
File created	C:\Windows\SysWOW64\Qgmbjkdp.dll	5afed274472a15b85e4cd9885f6704095cc4641ba7b699f6569a8d977a8eb630.exe
File created	C:\Windows\SysWOW64\Qeemej32.exe	Qbgqio32.exe
File created	C:\Windows\SysWOW64\Higbhjml.dll	Qbgqio32.exe
File opened for modification	C:\Windows\SysWOW64\Chdkoa32.exe	Cajcbgml.exe
File opened for modification	C:\Windows\SysWOW64\Gdcdbl32.exe	Gbdgfa32.exe
File created	C:\Windows\SysWOW64\Hcmgfbhd.exe	Hkfoeega.exe
File opened for modification	C:\Windows\SysWOW64\Abemjmgg.exe	Aniajnnn.exe
File created	C:\Windows\SysWOW64\Cdkldb32.exe	Cbjoljdo.exe
File created	C:\Windows\SysWOW64\Gpiaib32.dll	Ghlcnk32.exe
File created	C:\Windows\SysWOW64\Ahmlgd32.exe	Aeopki32.exe
File created	C:\Windows\SysWOW64\Olpppj32.dll	Hopnqdan.exe
File created	C:\Windows\SysWOW64\Ncbhll32.dll	Hmfkoh32.exe
File opened for modification	C:\Windows\SysWOW64\Dkkcge32.exe	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Pcijeb32.exe	Ocgmpccl.exe
File opened for modification	C:\Windows\SysWOW64\Agglboim.exe	Afhohlbj.exe
File created	C:\Windows\SysWOW64\Iqjikg32.dll	Beihma32.exe
File opened for modification	C:\Windows\SysWOW64\Njnpppkn.exe	Ncdgcf32.exe
File created	C:\Windows\SysWOW64\Mgjpndjd.dll	Acjjfggb.exe
File opened for modification	C:\Windows\SysWOW64\Aeopki32.exe	Abpcon32.exe
File created	C:\Windows\SysWOW64\Hkfoeega.exe	Hihbijhn.exe
File opened for modification	C:\Windows\SysWOW64\Aepefb32.exe	Anfmjhmd.exe
File opened for modification	C:\Windows\SysWOW64\Alfkbc32.exe	Acocaf32.exe
File opened for modification	C:\Windows\SysWOW64\Dkjmlk32.exe	Dhkapp32.exe
File opened for modification	C:\Windows\SysWOW64\Bagflcje.exe	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Pkceffcd.exe	Peimil32.exe
File created	C:\Windows\SysWOW64\Dkjmlk32.exe	Dhkapp32.exe
File opened for modification	C:\Windows\SysWOW64\Dhnnep32.exe	Dadeieea.exe
File created	C:\Windows\SysWOW64\Jcbdhp32.dll	Dodbbdbb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8288	8204	WerFault.exe	360

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Madnnmem.dll"	Lbjlfi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qbimoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgifdn32.dll"	Cdkldb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecandfpd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Glebhjlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ildkgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqhacgdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcfhgi32.dll"	Pabkdmpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkciihgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgkjhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmcibama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcccfh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcbpab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmjdjgjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjknl32.dll"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciglpe32.dll"	Hkfoeega.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpmdoo32.dll"	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Heocnk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kboljk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncdgcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdeqhl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klqcioba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nokpao32.dll"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lfkaag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chdkoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dldpkoil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Melnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cliaoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgbcdnbb.dll"	Gdhmnlcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibnccmbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfhkicbi.dll"	Mplhql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Boepel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjpqmmkb.dll"	Dadeieea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qhbepcmd.dll"	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Choehhlk.dll"	Hbeqmoji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ifgbnlmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdeahgnm.dll"	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcmgfbhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdpmpdbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmjapi32.dll"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klohnjkj.dll"	Qloebdig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcmabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgpjhl32.dll"	Beeflhdh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fljcmlfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nekfmb32.dll"	Heocnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qeobam32.dll"	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pqpgdfnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eepjpb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmlhii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njnpppkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oncofm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocgdji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbjiol32.dll"	Mpjlklok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgehcmmm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 1468	4536	5afed274472a15b85e4cd9885f6704095cc4641ba7b699f6569a8d977a8eb630.exe	82
PID 4536 wrote to memory of 1468	4536	5afed274472a15b85e4cd9885f6704095cc4641ba7b699f6569a8d977a8eb630.exe	82
PID 4536 wrote to memory of 1468	4536	5afed274472a15b85e4cd9885f6704095cc4641ba7b699f6569a8d977a8eb630.exe	82
PID 1468 wrote to memory of 2308	1468	Occkojkm.exe	83
PID 1468 wrote to memory of 2308	1468	Occkojkm.exe	83
PID 1468 wrote to memory of 2308	1468	Occkojkm.exe	83
PID 2308 wrote to memory of 2876	2308	Onholckc.exe	84
PID 2308 wrote to memory of 2876	2308	Onholckc.exe	84
PID 2308 wrote to memory of 2876	2308	Onholckc.exe	84
PID 2876 wrote to memory of 4404	2876	Odbgim32.exe	85
PID 2876 wrote to memory of 4404	2876	Odbgim32.exe	85
PID 2876 wrote to memory of 4404	2876	Odbgim32.exe	85
PID 4404 wrote to memory of 3696	4404	Okloegjl.exe	86
PID 4404 wrote to memory of 3696	4404	Okloegjl.exe	86
PID 4404 wrote to memory of 3696	4404	Okloegjl.exe	86
PID 3696 wrote to memory of 2644	3696	Obfhba32.exe	87
PID 3696 wrote to memory of 2644	3696	Obfhba32.exe	87
PID 3696 wrote to memory of 2644	3696	Obfhba32.exe	87
PID 2644 wrote to memory of 2140	2644	Ocgdji32.exe	88
PID 2644 wrote to memory of 2140	2644	Ocgdji32.exe	88
PID 2644 wrote to memory of 2140	2644	Ocgdji32.exe	88
PID 2140 wrote to memory of 740	2140	Onmhgb32.exe	89
PID 2140 wrote to memory of 740	2140	Onmhgb32.exe	89
PID 2140 wrote to memory of 740	2140	Onmhgb32.exe	89
PID 740 wrote to memory of 4312	740	Odgqdlnj.exe	90
PID 740 wrote to memory of 4312	740	Odgqdlnj.exe	90
PID 740 wrote to memory of 4312	740	Odgqdlnj.exe	90
PID 4312 wrote to memory of 1584	4312	Pkaiqf32.exe	91
PID 4312 wrote to memory of 1584	4312	Pkaiqf32.exe	91
PID 4312 wrote to memory of 1584	4312	Pkaiqf32.exe	91
PID 1584 wrote to memory of 2312	1584	Pnpemb32.exe	92
PID 1584 wrote to memory of 2312	1584	Pnpemb32.exe	92
PID 1584 wrote to memory of 2312	1584	Pnpemb32.exe	92
PID 2312 wrote to memory of 4680	2312	Peimil32.exe	94
PID 2312 wrote to memory of 4680	2312	Peimil32.exe	94
PID 2312 wrote to memory of 4680	2312	Peimil32.exe	94
PID 4680 wrote to memory of 3440	4680	Pkceffcd.exe	95
PID 4680 wrote to memory of 3440	4680	Pkceffcd.exe	95
PID 4680 wrote to memory of 3440	4680	Pkceffcd.exe	95
PID 3440 wrote to memory of 1940	3440	Pqpnombl.exe	97
PID 3440 wrote to memory of 1940	3440	Pqpnombl.exe	97
PID 3440 wrote to memory of 1940	3440	Pqpnombl.exe	97
PID 1940 wrote to memory of 1424	1940	Pkfblfab.exe	98
PID 1940 wrote to memory of 1424	1940	Pkfblfab.exe	98
PID 1940 wrote to memory of 1424	1940	Pkfblfab.exe	98
PID 1424 wrote to memory of 3532	1424	Pabkdmpi.exe	99
PID 1424 wrote to memory of 3532	1424	Pabkdmpi.exe	99
PID 1424 wrote to memory of 3532	1424	Pabkdmpi.exe	99
PID 3532 wrote to memory of 4428	3532	Pcagphom.exe	100
PID 3532 wrote to memory of 4428	3532	Pcagphom.exe	100
PID 3532 wrote to memory of 4428	3532	Pcagphom.exe	100
PID 4428 wrote to memory of 8	4428	Pjkombfj.exe	101
PID 4428 wrote to memory of 8	4428	Pjkombfj.exe	101
PID 4428 wrote to memory of 8	4428	Pjkombfj.exe	101
PID 8 wrote to memory of 3652	8	Pcccfh32.exe	103
PID 8 wrote to memory of 3652	8	Pcccfh32.exe	103
PID 8 wrote to memory of 3652	8	Pcccfh32.exe	103
PID 3652 wrote to memory of 3916	3652	Pjmlbbdg.exe	104
PID 3652 wrote to memory of 3916	3652	Pjmlbbdg.exe	104
PID 3652 wrote to memory of 3916	3652	Pjmlbbdg.exe	104
PID 3916 wrote to memory of 3732	3916	Pbddcoei.exe	105
PID 3916 wrote to memory of 3732	3916	Pbddcoei.exe	105
PID 3916 wrote to memory of 3732	3916	Pbddcoei.exe	105
PID 3732 wrote to memory of 3320	3732	Qgallfcq.exe	106

C:\Users\Admin\AppData\Local\Temp\5afed274472a15b85e4cd9885f6704095cc4641ba7b699f6569a8d977a8eb630.exe
"C:\Users\Admin\AppData\Local\Temp\5afed274472a15b85e4cd9885f6704095cc4641ba7b699f6569a8d977a8eb630.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\SysWOW64\Occkojkm.exe
  C:\Windows\system32\Occkojkm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\Onholckc.exe
    C:\Windows\system32\Onholckc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\Windows\SysWOW64\Odbgim32.exe
      C:\Windows\system32\Odbgim32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2876
    - - C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4404
      - C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3696
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2140
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2312
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3440
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3532
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3652
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3320
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        24⤵
        Executes dropped EXE
        
        PID:4440
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5076
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1920
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3084
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        28⤵
        Executes dropped EXE
        
        PID:3656
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:780
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        30⤵
        Executes dropped EXE
        
        PID:5024
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3016
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        33⤵
        Executes dropped EXE
        
        PID:4504
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4608
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3188
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        36⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        37⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        38⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        39⤵
        Executes dropped EXE
        
        PID:5004
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4760
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4084
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        42⤵
        Executes dropped EXE
        
        PID:404
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        43⤵
        Executes dropped EXE
        
        PID:2256
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1896
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        45⤵
        Executes dropped EXE
        
        PID:1520
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2732
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        47⤵
        Executes dropped EXE
        
        PID:1028
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1608
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4016
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        50⤵
        Executes dropped EXE
        
        PID:2464
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        51⤵
        Executes dropped EXE
        
        PID:4036
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        52⤵
        Executes dropped EXE
        
        PID:1800
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        53⤵
        Executes dropped EXE
        
        PID:2020
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5048
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        55⤵
        Executes dropped EXE
        
        PID:4480
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3764
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:400
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        58⤵
        Executes dropped EXE
        
        PID:5028
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        59⤵
        Executes dropped EXE
        
        PID:4912
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3052
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        61⤵
        Executes dropped EXE
        
        PID:5072
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        62⤵
        Executes dropped EXE
        
        PID:1232
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3496
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:964
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1724
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        66⤵
        Modifies registry class
        
        PID:1540
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        67⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2376
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        69⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        70⤵
        Modifies registry class
        
        PID:4916
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        71⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2432
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:932
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        74⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1864
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        75⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        76⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        77⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        78⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        79⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1100
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        81⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        82⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        83⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1408
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        85⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        86⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        87⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        88⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        89⤵
        Modifies registry class
        
        PID:4976
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        90⤵
        Modifies registry class
        
        PID:2304
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2776
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        92⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        93⤵
        Drops file in System32 directory
        
        PID:848
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        94⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5040
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        96⤵
        
        PID:856
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        97⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        98⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5240
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        100⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5364
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5432
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        103⤵
        Modifies registry class
        
        PID:5476
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        104⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        105⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        106⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        107⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        108⤵
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        109⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        110⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5888
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        112⤵
        Drops file in System32 directory
        
        PID:5948
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        113⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        114⤵
        Drops file in System32 directory
        
        PID:6032
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6072
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        116⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5184
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        118⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        119⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        120⤵
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        121⤵
        Modifies registry class
        
        PID:5520
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5572
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        123⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        124⤵
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5856
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        126⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        127⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        128⤵
        Drops file in System32 directory
        
        PID:6088
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        129⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5288
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        131⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5544
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        134⤵
        Drops file in System32 directory
        
        PID:5844
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        135⤵
        Drops file in System32 directory
        
        PID:5932
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        136⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5228
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        138⤵
        Modifies registry class
        
        PID:5420
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        139⤵
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        140⤵
        Modifies registry class
        
        PID:5836
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        141⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5336
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5648
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        144⤵
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        146⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        147⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        148⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        149⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6224
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        151⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        152⤵
        Drops file in System32 directory
        
        PID:6312
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        153⤵
        Modifies registry class
        
        PID:6356
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        154⤵
        Drops file in System32 directory
        
        PID:6400
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        155⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        156⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        157⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6576
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        159⤵
        Drops file in System32 directory
        
        PID:6624
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        160⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        161⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        162⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6800
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6844
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        165⤵
        Modifies registry class
        
        PID:6888
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6936
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        167⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        168⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7072
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        170⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        171⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        172⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        173⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        174⤵
        Modifies registry class
        
        PID:6376
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        175⤵
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        176⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        177⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6604
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        179⤵
        Modifies registry class
        
        PID:6700
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        180⤵
        Drops file in System32 directory
        
        PID:6768
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6832
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        182⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        183⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        184⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        185⤵
        Modifies registry class
        
        PID:7104
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        186⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6016
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        187⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        188⤵
        Drops file in System32 directory
        
        PID:244
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        189⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        190⤵
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        191⤵
        Modifies registry class
        
        PID:6520
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        192⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        193⤵
        Modifies registry class
        
        PID:6748
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        194⤵
        Drops file in System32 directory
        
        PID:6876
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        195⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        196⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        197⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6220
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:336
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6428
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        200⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6792
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        202⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        204⤵
        Drops file in System32 directory
        
        PID:540
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        205⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        206⤵
        Drops file in System32 directory
        
        PID:6812
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        207⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        208⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        209⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        210⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        211⤵
        Modifies registry class
        
        PID:6352
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        212⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6752
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        213⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        214⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        215⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7240
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7288
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        217⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7384
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        219⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        220⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7588
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        222⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        223⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        224⤵
        Modifies registry class
        
        PID:7756
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7796
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7856
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        227⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        228⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7936
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        229⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8036
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        231⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        232⤵
        Modifies registry class
        
        PID:8144
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        233⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        234⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        235⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7324
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        236⤵
        Modifies registry class
        
        PID:7432
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        237⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        238⤵
        Modifies registry class
        
        PID:7644
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        239⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        240⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7780
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        241⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        242⤵
        Drops file in System32 directory
        
        PID:7944
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        243⤵
        Drops file in System32 directory
        
        PID:7968
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        244⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        245⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        246⤵
        Modifies registry class
        
        PID:6724
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7268
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        248⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        249⤵
        Modifies registry class
        
        PID:7524
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        250⤵
        Drops file in System32 directory
        
        PID:7680
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        251⤵
        Drops file in System32 directory
        
        PID:7776
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        252⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        253⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        254⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        255⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7356
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        257⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        258⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        259⤵
        Modifies registry class
        
        PID:7932
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8116
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        261⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        262⤵
        Modifies registry class
        
        PID:7648
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        263⤵
        Modifies registry class
        
        PID:7872
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        264⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        265⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        266⤵
        Drops file in System32 directory
        
        PID:8084
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7768
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        268⤵
        Modifies registry class
        
        PID:7488
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        269⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        270⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8204 -s 404
        271⤵
        Program crash
        
        PID:8288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 8204 -ip 8204
1⤵
PID:8260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aanjpk32.exe

Filesize
59KB

MD5
43055f714dd8c925a2b9cc5c5d9ad75b

SHA1
1c1e1f19a4437c7d1d4fb4cc91b157dfd3036e21

SHA256
2273ccaccece09370a9bf3b1f788bf42452fc6823fa8149858c1bc8e4f9611b6

SHA512
0b1b5af25068805f111ab7899b33862387ebc5fe21e4b181b947287fab55e5db55b449e7ab844522c83888e131a54b8800f2ba27063b97b7c09db04563aeb7a7

Download Submit
C:\Windows\SysWOW64\Abngjnmo.exe

Filesize
59KB

MD5
5c2a4047c12f63aae832160b2927c1e6

SHA1
d682daf2d1a3f7d7fe0e87f660dd7ef073a35aee

SHA256
bf3a6f89c7bcc7d981cad48d93614efa7f834266f08e554d8106dcfea81e413e

SHA512
7e063947351e96d4945cd79fe7d360cab6dd260df3d56c1e5561c00fe9711709b307b89fc3a2a202c145b51575ee4b327986713f2528771eb1abc5b788901414

Download Submit
C:\Windows\SysWOW64\Acjjfggb.exe

Filesize
59KB

MD5
115fbd7e59b5b024ae4b75230029d891

SHA1
ec39e2e9903b0fad8eaa0864aa98488c61be1f82

SHA256
f5d858e0f34e54a7f3beeb9ac40f613f738fc9c509f4d09b8375bb04814ddc90

SHA512
76b2323fd45b77dc2c300550d44b13603f6485c7c7eacec2829e2d56b3359d04e0bf43d10768840458b7f3f64c1767037a78c939ac3fc241c21754b358435b72

Download Submit
C:\Windows\SysWOW64\Acocaf32.exe

Filesize
59KB

MD5
edac41ac97d9d70ed9a0e706d1f2a075

SHA1
8daa5fd892269fdfd6fb4af7026f5a25bae92b5d

SHA256
c895acb464d129b1219257d529dc702506f14283415c9b9df07a07191a3d49e6

SHA512
c32c76effd598c2688947a670b835aae98532e8a68de33fcda6194bbabe23e42d753eb08c93d6366325e46fd1419b3d49716657fc54f7b25101ecb1e5a283f37

Download Submit
C:\Windows\SysWOW64\Agglboim.exe

Filesize
59KB

MD5
b5def65e076564f27e4a4e8a66d69bc5

SHA1
e20ad8458f7a89615ccdafdfaa768d3f8e5ea552

SHA256
53eb36f2c8c0cd35cce342de845cc7efad7bbee36e34495366245fee502558d9

SHA512
a1ecb0e3356d71a340e7c5dbac028c62a8df813f0d654acca81ff2832eb4a1e9fdceaf01c09c7108da1ac62b419c74ba175f2c45b484d0354a3948e5f7a92f0a

Download Submit
C:\Windows\SysWOW64\Ahhblemi.exe

Filesize
59KB

MD5
dd01e212b792381732329008f8b0ad12

SHA1
bbe74ab906fda024eb0f4726292bded54c67fa95

SHA256
7da5d9ca425d7baa666bf0f9cc14fbc496aff1bbbd9900b98c6b7c7fb320e3ad

SHA512
1d8fb6978765df20be3a3d60b3bcf87fa7e3a1ec2d45415b9eecc000fedab78e2594861a0b67e5d1dad7c62bc12bd4d359ab026bcab6563b42f983266cfa2e30

Download Submit
C:\Windows\SysWOW64\Ajdbcano.exe

Filesize
59KB

MD5
07c112a4b6b0111d217ef1def7ee7a4d

SHA1
ace92903337af595ed20545274013d6a9de44371

SHA256
19749fa3bb96a2132a9d56612869b587cb9dfe6cb9477bdab4837727c777f254

SHA512
a354a3427a89263a30821bfd36d2ba9188a2fa67a73e2685a7d066cfe90192d0eba371e57a255e6e01cdb1dc784aba21fb5f719276f097c5ce4c674685ce308e

Download Submit
C:\Windows\SysWOW64\Alfkbc32.exe

Filesize
59KB

MD5
16a213ba504531fd25e11227c9c73fbd

SHA1
acfb6b439846d199cea7a26cc32bdc78708d2974

SHA256
432af04db9c713005ff801a30eb874dfd761edd461b8036684467bbc73134dc9

SHA512
3f4a4ff06335a7470de11aeac8e9ffbdaedf33eef964947dbab1acf4e6d7c3e49d017ffbae82294ca5d649520fc627a21b0512c764eb7cf7b17bdf5653e66ddc

Download Submit
C:\Windows\SysWOW64\Andqdh32.exe

Filesize
59KB

MD5
51bf4091909f0fa748b3046abb33b8ab

SHA1
12dd51fc02deabd489e2b73a3c0814516860a837

SHA256
327a5240d5f39812518e5aed83faa800ec899ad3b93cb846a6de869a715281f9

SHA512
cd162012397b76a464738746e5980b07dfec3ef3532e6d6d163ea26abb22fa6bf279120ee0a927f180dd4a4a7b81559009fad62ba8dd353950c95684105cb623

Download Submit
C:\Windows\SysWOW64\Bgehcmmm.exe

Filesize
59KB

MD5
6d076d6bbc6159b982f122a4bd7ab9d2

SHA1
044fdd56446c36a9c1eff7d16487a9ee75533bbb

SHA256
db5c9929205a29d59706c80195037c70d0069a0f9e9593ba434fceb656f87ae0

SHA512
3f53394e14d18e9a5b4c8ef009828f94481c114ab452a9c8e962961734589cd6e110c79ed2f3da233126c4b955f382f8ece0d25875cfbc45d67483a514978b4c

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
59KB

MD5
396020bdf1718e8b01111a669691f790

SHA1
bc10138d1a7d831c42b2d6d8f9eec99333f49632

SHA256
8c5391795ff73c91690d4a47fbaa85f3e5978b1ae0a3de49c6623dfc471a8959

SHA512
7c0a35970163a34184f9e49ca17fe8691ed2f47c5d18a499d6a64871c0e697ba09b51e42e989e5e2e45d0960591dbe2502215adf016323178ea9438398fd7a7d

Download Submit
C:\Windows\SysWOW64\Bldgdago.exe

Filesize
59KB

MD5
16d5eaa3e036cb2e3706d490a0ad41ac

SHA1
178523a7ff819fd26fd568d82368acba20a2566c

SHA256
94f3bc209e81f1de996093db58c0ca277669f1278376243aa89539fb38d0595b

SHA512
deedddc6abc553ed48a16010d8c680b5fea1e4b72a7e922a55e562e92fed58ed67f95d5bbff03014db3174cbc2d808aaaf0d99b1c12980d80beb997efd0edde1

Download Submit
C:\Windows\SysWOW64\Bnmcjg32.exe

Filesize
59KB

MD5
8f0c1ddf1e693fe68454ad8e03c79bf9

SHA1
c99424cb34ab833d0cfc7c2784fda7c27c3958ac

SHA256
6eadf9a10fc3b20faeccda0aeef21e7ed9601365ae9926c675ee2daeb5c7ffcf

SHA512
38725fcc8e8dfddab365c74b5e318f0fe2fd2e6edfc25b5ac74da59c0e02b0a52d835e902bc5f0cc911a2fb4bcf5d31757b10db92b658a761bbd49eff0eff0c2

Download Submit
C:\Windows\SysWOW64\Cmlcbbcj.exe

Filesize
59KB

MD5
b5c3897082f089a56396da27532c88ff

SHA1
12dedd55a60c42dd280dac8752eb6f1d6b3f8941

SHA256
8ded6ab4867ffa3b7076961cbee04b0f964fe48e0195bac34d4f6eeee8623cf4

SHA512
3811a00de1f9727345840e96294db9201bb7608fde59383f53ca3717d2e8e70cd1c604e7c685ca8f974b898fb395b5a17591ef13418243f63627e90082fe0e3c

Download Submit
C:\Windows\SysWOW64\Dceohhja.exe

Filesize
59KB

MD5
8fc39b8477e2800d666599823abbab58

SHA1
5847450c8e7c53c400719b57f50f37e080721893

SHA256
07b106dc003998281c6e1e7ad0a3c5d86b1607e9d44233139451ba33514aae19

SHA512
45de0d85cf8cd79cc5deea8eb3b4ce6e231831f4209b5c5badeb50891788a33e8861f6a5e842e181d8035908345792fc916893940cf78d9637e00c15887978b4

Download Submit
C:\Windows\SysWOW64\Dhkapp32.exe

Filesize
59KB

MD5
852c1d94494669767cfd8a63fd38ee82

SHA1
0cc0f2440c5949ccd7627c92e8b3f608be861b3d

SHA256
7ad0b24f7a3df541bfb9d0ce46fc0125bae7b0e61dc0be75e3d7ed848458ae00

SHA512
281a31ea5adff1a05b247d5d48741f066078fec798cbd38ce5e774e8f11667f2156fdf43ec3bd8bb3e14f3ca24013a449f411a2587d5626993617e2ea3eb5137

Download Submit
C:\Windows\SysWOW64\Dkkcge32.exe

Filesize
59KB

MD5
31a5f97386058666cbdfe0caed568f4d

SHA1
49cfe54ed5dc52945dae31373bde22209141d0e8

SHA256
f523c59f64dffb2ffb370233671b2c18d61593d5facfab3ce21b34b0496b1f59

SHA512
84f7cfcd237ec1292ae19aeafd4cfc50e7fe744ae759a9de4f3e0fe19dcebda822ebd82cd634ffedfcb1a0d14e45a386f5356ab74bfb71396cead0034fbcd0cb

Download Submit
C:\Windows\SysWOW64\Fafkecel.exe

Filesize
59KB

MD5
def6237f90e54c8c2fce9f6c4c4d64c1

SHA1
973cd76eafd8b11112e908a62d3f99ec8e37424c

SHA256
914e4f725b4cd8940115eb24b5d6f5a4abc089a34ba1090d6ac335a17b664681

SHA512
4d0c0e029505228036d25b6381e1bbfa149fa49540447bc606ea80ef2d1406b8b993fa8b5781687e83f8272fbd62aaed10153ba18c90ac7a6762bc1d6f337605

Download Submit
C:\Windows\SysWOW64\Ghlcnk32.exe

Filesize
59KB

MD5
082aa708da4dda78e57b4c8698960d91

SHA1
75383417d4296438571005a5bb8a41c42eca2e87

SHA256
616ac40cc89266c0e386ad89068638f630f3f84b5a2b83e652c4a58fc889be07

SHA512
3a2a60b62b9d7005574ece50718c7515abf241288a57ce51dc4ad61872ea4b16037007fff271a15a0e97a7b9896d6ac64d645a407028c9510be9ad8564fee878

Download Submit
C:\Windows\SysWOW64\Hfcicmqp.exe

Filesize
59KB

MD5
2e67397d5a28b1136aa0960bcd126d89

SHA1
973e863b30fa8092cb6c644906bf54b006edf45e

SHA256
59652fd909b87fbc20f60cc8d4e2041afa6fb9d0eb22b10733c240a9949037d2

SHA512
08c1d4c7c6ee22a207b93ac2377055c2869e96f5afb18c80374432a4cbcf4bf1cd8f7e832b1f2390f42a8c9174f0a13acffff34463a9d22054366dea78ef8011

Download Submit
C:\Windows\SysWOW64\Hfnphn32.exe

Filesize
59KB

MD5
b87b5c1236eec8fcd1f0d868f036a9f7

SHA1
e7e0d656e5cbf268458f8dad62cf831fe45c5b5f

SHA256
2a7d8352e3259b2d608b44cad885405c30d352fe2bcc5d8a42fbc68e66782644

SHA512
db527ed70ca5cc465c6375d25b12caefc66d1eef07e1a9ca1460ef5138fa5b4f0f72d9a5dd204b14525ff90a3217a58bf291d77aa6baeb5251628a084ed1134a

Download Submit
C:\Windows\SysWOW64\Ibnccmbo.exe

Filesize
59KB

MD5
558002f6e984356cb6123948076a423f

SHA1
9dab8037a600fe3cbd9cd8eb55c660c9b1e04fa8

SHA256
ea472be09cdcf0dfda82a58623092e278a8c7512ad18db3909ef7246f98c022b

SHA512
3fd7e9d00a7e3dc66a4ecc8500c19adbfd3e371a5930eac65b9342a78b0d3fb634dbe4ee6409ede66ebb2915c62075c0e80650240817215ba851c3e2740cfb0f

Download Submit
C:\Windows\SysWOW64\Jcefno32.exe

Filesize
59KB

MD5
fc14700ed17430c68fe759a3668d7886

SHA1
a556677b6ea040afb44de759c321662a57dc906c

SHA256
81953ab90381e12cc76c3b7a7f4ce63637fcc343abce4c4b38e331bfc2c48c7c

SHA512
91ca4b5eb0c8e24e3ce248341257a31048cb89f3ea96de3f520cb9b154b25fa423bcdbbc89c8846a656cefcc055836185c43c1319e7f4a1829d0a5a6e4d3505f

Download Submit
C:\Windows\SysWOW64\Jeklag32.exe

Filesize
59KB

MD5
86563c5c9745f47cc909399c071a006a

SHA1
8de7de245d9bdd684594b044ee3b4f3b5c0a4c75

SHA256
ec3645090d7d7d714a3d4f68f97ca072a8983e36a26e7bc98d4742eb532e199a

SHA512
9e159980113657b1d107b759c0258878980208e6e2680179b14c9ddc178bc5ed7d5df9f54e4534339d7c2ff91b8f11b7ad105ca556a255068a4c35bf794200d9

Download Submit
C:\Windows\SysWOW64\Jmhale32.exe

Filesize
59KB

MD5
2cbb8bdbc29d61cb2db0f5514d6e5763

SHA1
50e373e1f0ef9f243f1adb37c014547a7c0a3e2e

SHA256
436053ee2627801de9e38df4ecd2373ff1183c1b8a4f3e14f13412889ee06ee3

SHA512
164d38b95f1a5c50bddb3af4dca6a51e4bd761cec56bff12e046ffe10a162f515b66577d3c8f67e2c72b9d4678468364e16857dfef712efaf1bcc07324ff2bd4

Download Submit
C:\Windows\SysWOW64\Kdcbom32.exe

Filesize
59KB

MD5
8f1e7d017982fa130c0564caa1d9c51a

SHA1
6280a9379ce786d6f76ca0249164ebab3056c832

SHA256
e268ab07a749189fb7ba9b90ffce92850dc0bf685172cd50315a6c4df68e3281

SHA512
702dc3a219e17f508882d3fc8fd4220c020839531fe9ecc2e46ca81a437117fcc956508b3a1a43b909f3af75dc96132e4e902d998bd851e889f76a55721e79ea

Download Submit
C:\Windows\SysWOW64\Kmfmmcbo.exe

Filesize
59KB

MD5
ad0823f5d2200909c25e63ef8babb329

SHA1
4714358db0e24e74c4c14b2d95c9905fafac716c

SHA256
6259fe9d4c6ffc8e54c6b2b3aa6bbdfa4855a244685bb5e1392300381e461776

SHA512
8c2c697bd69eb882a7489188755b96dfa2387af272902e8af4f9b824befda26215b1fbb136303884492c27ec9307aa93505c0c27f28dc543e4c4a4ae90625d0b

Download Submit
C:\Windows\SysWOW64\Lfkaag32.exe

Filesize
59KB

MD5
ee1aafd2b8b5abcecc626b5548410e96

SHA1
b6d3ec065b98eb31023920593006a0865273f372

SHA256
59c2a805174ecc730cfa0b3eaee95c8614f76c0a08c8b6b153604097648d9695

SHA512
5e3b8a32c4eaa61e7f4417edea081cad52a0d0417a5ed3eaa96a5267a3ba05aa8a900eed9d36ec8d1cf2d2b68877f6d1448ee4c3192b96f5052ebef642142c45

Download Submit
C:\Windows\SysWOW64\Lingibiq.exe

Filesize
59KB

MD5
73c9f16747a3054d190458639eac1644

SHA1
42030ad479bc60e5447cef982102f9eda46ea499

SHA256
ecdf0e152c633a7ba366e817a65bcb386cca1168a5d875faf0a3c6dbf4f34573

SHA512
c3dabf0fb993f73d2e7aa4afa41a2d09b7d29164ca539dd77373d39050cab0277a877c3e08385ee798c2862259d8fff6b46316a9b4f45a4899be90a55f500abc

Download Submit
C:\Windows\SysWOW64\Melnob32.exe

Filesize
59KB

MD5
86133204eaec574cb4b15cbc111e2c9e

SHA1
13a2af030eeea2b824ec0b7b85ca4dc04f00d7bc

SHA256
22086988efcc52af2d407dae90c49a1e910aa9a545bf160a1116d50d36580459

SHA512
716c4d9f4ec2f23b6e3f5f2414a27fa9024610d6911e2a0a33d32ed5a3964e81466c39b5fd9bcfc33ca415468bc5da605d8425dea18a7598a201ec7c8c6d6e95

Download Submit
C:\Windows\SysWOW64\Mnebeogl.exe

Filesize
59KB

MD5
296d97ee922f113638882aa79016809d

SHA1
f0fb7ee98cdce2479597663a3b1b1066315b38b0

SHA256
746f52f0504164798f283a6e4c76588bc7ac40b7c5804f32cfdfa2a2fc7c446f

SHA512
6156650b1bff608e52c1abbaaa219918e477b8812464acc3991fe2610c4e9446924974d63c3e565acf35e88e7b877287f1e43c8bb49787cfce9229856e643b00

Download Submit
C:\Windows\SysWOW64\Mpjlklok.exe

Filesize
59KB

MD5
52bbb6b877f70692ba29eeb1865de551

SHA1
3c14575d9deffad01e9a6025ae09afef8b2a6629

SHA256
336398959d43cf53f3cdd150bce7e81a6ad21279496f6a45956a0a1a3c958b6b

SHA512
870821bb8939974b347641ad938569bf24a8d31869e101b8ac21fe4679929c8e59147037c86e9f4398a208b9bc01c3865e91c99d639d37d935536d3edaf190be

Download Submit
C:\Windows\SysWOW64\Npmagine.exe

Filesize
59KB

MD5
7f194bf4fbeac71e21bbb7bf6d26d326

SHA1
d8fbbad0415a13595c5b2aaec1fb8ce0e113dc40

SHA256
221e7b65f53a8182f84c6736a6dcbf8f11161beebd6f6dfc35d0220c295f2e34

SHA512
ff3c8234f32bf10f0d3e350c9a2b7691d0637e6ab44f85599e372b9023cffd825f165e15b2932942c9a81fa440c9dfb97069e098a383d42011a8e2ae787add62

Download Submit
C:\Windows\SysWOW64\Obfhba32.exe

Filesize
59KB

MD5
ea4b6b818d7b5e3827384ab8324c83c1

SHA1
470ce40eb7e0f029f0ad89c867c53e833e68a26c

SHA256
c532db793fc9d1dd74fc98bd5f85af96468aeecbae51b66df72bea269cfadb52

SHA512
467883a391c1f5d4b531aaaca645748ad149891f3193d9b515641372fc1b2dd44dd74127c2f19d7fbc0c3130a60fc77d52b9aa624a584c6149eda3282dfe298c

Download Submit
C:\Windows\SysWOW64\Occkojkm.exe

Filesize
59KB

MD5
de4e9e0b0bb04a2df400ebd8f28f96b0

SHA1
405b9119b4f9c71f0c1e6579abc01fe1874cabc9

SHA256
aec9ddbfc67e9f0158db746fc5318ff74f61f44ce5c488d3af69b5eb57da977d

SHA512
2c49f74986e7625ebcb28ebe0a23b4b1665fc1d445a4fb4410594f46d5a1c1bf5eed4fcfe351fb3db94078b734f4722dc11115b3602948e4b5d5d5653a128529

Download Submit
C:\Windows\SysWOW64\Ocgdji32.exe

Filesize
59KB

MD5
42df29bb108037b4048f14bb417f9665

SHA1
3b43ce6d84f1b59f16b2a8a85b605614462749be

SHA256
f90b9397bf470432415844393cfe40b6fec22a0a1717326378895b4fe5318e30

SHA512
78662b2a8e771de0e10d928c81193592a5f2a561f675d3bd8bdb5b6b543f8383bba467c544125e5188874f408cb915004f8db9eb016a4a09d8d22ba05b406c64

Download Submit
C:\Windows\SysWOW64\Odbgim32.exe

Filesize
59KB

MD5
21eb4eb48a6edc37182666c7fba4fdbb

SHA1
ca85f8c231a7373410d7745a1f89a199f4a641d0

SHA256
9619a5fd391e8dc0b493ee0499b8b5ebf34d355fd1c5e8e0de92a2892c026533

SHA512
64fd191cd8c1a4d9b8b7e39a0c9c4dd2ea6c241d4fea3860c505a4e25227c4a7f721e87259930b2042717ad971b84b5e8e705b2b65b22ba9c4f7e441fc9ab621

Download Submit
C:\Windows\SysWOW64\Odgqdlnj.exe

Filesize
59KB

MD5
5b9889638660169b55aefec2af77f291

SHA1
79edd9025866847c1170b5c9bef45707b7d30fb1

SHA256
63a8ed7deef99ad7f7bbdfdd66f4a31219d7917df6a9e21cd26ea93b46256896

SHA512
9113ab477a970b8913f4078e11267128e7a1db29d11f233661c311fe12dc49c49a69949b0e37f02c92ce964458fb0b35ba1f6a614591c4499c11fe6fdd4e6805

Download Submit
C:\Windows\SysWOW64\Okloegjl.exe

Filesize
59KB

MD5
571b0d965b6ecd3f207140ff1a528730

SHA1
9828d6e460759c7670fd342b0f8ec93773731471

SHA256
1dc88eb705fa16449c4dae6b0ff5e00df4e49865164ff6657bf6045009198992

SHA512
e4c78b552cc33365734281ee112373678f030ce02d9496dd4602a483cce00d4e69e6f703bcc630bc981572cdbef11cba06c03a4a4327b33df3348a300d3ae6e8

Download Submit
C:\Windows\SysWOW64\Olhlhjpd.exe

Filesize
59KB

MD5
4c7441bbd10eda0fd52b5213a631c3ca

SHA1
50f08dd91c1feee82733bb9a86430c3629ed880a

SHA256
6d45e43d8447533b051ee527e1d10c655dbf858b81006ea729161878f9252d80

SHA512
8e0a7f7e69168b6a093f22bf493f5fd69d4e8526cf8e18d6df8592ab549dbde6d66664ca57a7f6af5275f4fba660985683b9477b6c416f3e673141b09c6d4733

Download Submit
C:\Windows\SysWOW64\Olkhmi32.exe

Filesize
59KB

MD5
c9c1030ec4189f368a8cdec617c93350

SHA1
660ab362bec692182753e7313ba23836b7564195

SHA256
3fc66a73ac179df40d0b534eaaf65806500a32628caafdf11eba9116ed0bc614

SHA512
1b4c54b951db3213b953db560b6a1eb0be078f07c7058b167b2b2590939dbc527560479d20070cdc3415909776a349920eca7c3374e52e04cf0ccf4979eec832

Download Submit
C:\Windows\SysWOW64\Onholckc.exe

Filesize
59KB

MD5
2a332ff9e352f7ff2f7a884c6ead9fb9

SHA1
533173a5dd1f10db95db87451bcec02e41e08f8c

SHA256
b3763553969b35f2d6be161ba6636142fbb3d1d70c785f3938d7bf73a5ade6e1

SHA512
49185ed7f462ba92bdce12bdb744a31ba2b7f6de489d0ee0131408a9151a6b1150b9c480e354fccef0f9a3263bb96ef8476865daa4b42733bf8c041982f06ba5

Download Submit
C:\Windows\SysWOW64\Onmhgb32.exe

Filesize
59KB

MD5
1d37185352cdbd078b01bff5ac7dd75d

SHA1
f0be2a8bdef2f8fcf77cdb335c24bbe6d942c2c9

SHA256
2130579c5e332008b87dae785103d268d2a30eab45c5d9fee71907ddb56924d1

SHA512
759e10a30438fe051181444560303716f9917af7ad22cef947c96e3a81cf4e810721b213aef3692a440d1caa4a3bba50074b5f780ac1d57c144351c0c8df355c

Download Submit
C:\Windows\SysWOW64\Pabkdmpi.exe

Filesize
59KB

MD5
364b0f8e5109025a6141ab7767ac9d0d

SHA1
edbf38dd7f4d1464327f56509a3fa8224221f3ae

SHA256
b5591a4219ba4fd875662e0240e4b7269a9fcb2d37b4a9151f37695cc878eec6

SHA512
b7467c32af789e1ee0cb127bbddd0d55f8172d7667ce51862ccae9c30e2fbce233f868296115262206c42dab030c110386a33709232ff70ed7f6fb021a441691

Download Submit
C:\Windows\SysWOW64\Pbddcoei.exe

Filesize
59KB

MD5
915e81cc6cad3a5f73c22d802a13fb1e

SHA1
e97dbb11f8f0cab0294553455002c86e72e533ee

SHA256
b2fb2d388d1634b19d9c363b9230d0acedb93403c314b50d5f793638a4f6b2bc

SHA512
103652aa4ebf8efbda020bc3245c1ed0392e0e7d3521c699507106d6243038a434689f572a0382f55ae09dcede12045a6b8b1c91ac0a93602f199b7e54716cb0

Download Submit
C:\Windows\SysWOW64\Pcagphom.exe

Filesize
59KB

MD5
f8241e41d890c985972f1dae4754429d

SHA1
17a8c0238bb5288b069c00fef75a96ec7cc96d22

SHA256
37dc9454da7525fb86401c20ebf98eaac031b69fea1440e1567d00568fcd5ceb

SHA512
3155bc678f729d20128de3093e834ec16c0802e08dcb635bfa71c1fc7a1da32047687d03420829dada4dcc738709f718af8fac533d4483f165439111e920c0f5

Download Submit
C:\Windows\SysWOW64\Pcccfh32.exe

Filesize
59KB

MD5
0d13bf37c46012a3bd068f7e8acd5af3

SHA1
6c5320543079e12b6b3cf05246ceb60c939a2074

SHA256
ebb54a4ff6964d59fe2af6d42e9845a005f8076ba86adf2e403f871af7048f30

SHA512
2deb0766286518cf16a9ff93dbff91506988ce1d297a6c4cc45606e44b6f455c98941deaede02998672388d285995b001648e9c9653e625e9c2696ac857063ee

Download Submit
C:\Windows\SysWOW64\Pcijeb32.exe

Filesize
59KB

MD5
9db6f0ed52340ac3c740fed72d89bc02

SHA1
25fb289d6e4287ab6c2230aa8449f3998990a90d

SHA256
685f70557b049cecb0113f82dee2eb497cf70844a5d756c48963d0432855fb19

SHA512
b59d2b4f66e29981acfc0703b83feafbd3e4b235bd11c101a671cd251cc62fd755f0780073d75255e86689340de59408ae078e713812245de7f0b049e38264c7

Download Submit
C:\Windows\SysWOW64\Peimil32.exe

Filesize
59KB

MD5
b92697d9a9c2a9f6c56cd437ade10498

SHA1
62428c9381b640bb087fdaeda65f970959006d03

SHA256
329fc20c61da8c537f411b2d1fb15732d6593a4b0bd960123d2a0f6b00c1c56f

SHA512
d7caf795e694eaf3e4977f6f2e9e9fb361f7e70ccb61020ce1c0a9a9438454f428f227fc8884b93bb587ec5120c5742c9a803fdc9971100aa00ba114a0c02809

Download Submit
C:\Windows\SysWOW64\Pjkombfj.exe

Filesize
59KB

MD5
9f20e4f207d18f9618b457b45dcc687b

SHA1
9086d34bafe74488af175024173282c9b6a0213d

SHA256
1ce90c78bce75a2dacd337f8bbf2906867512745128c06873b70e7ea8d674050

SHA512
b68961b5b23c177514eab054de1d6c0841bf804c9477e35390efadc2a68a965cc27ab5e397b2993f96966d87c4b249124ea65f7a348b65a6831096aa9d94fc22

Download Submit
C:\Windows\SysWOW64\Pjmlbbdg.exe

Filesize
59KB

MD5
3b85d63bfff10c04a28d2143d708bfe6

SHA1
c391855136770676d0bd9b124557876b450d80c3

SHA256
a63ce04c5ba49886ea7c9334a3131ba7c7654c5a9cda9cbb374616e3e4af1652

SHA512
fb67a9a9b8f87cc49ce65b7ad96ee4734ae0acb4af08cb2914fa4e3b076fd266776d98e31c0299a18d4221afb462718b0d345e415d113003ce4b90d95d6c28c0

Download Submit
C:\Windows\SysWOW64\Pkaiqf32.exe

Filesize
59KB

MD5
60629335cf6a5208fda1641aa89d4bb3

SHA1
53de0757070a7ede47fde1cd37c5d4fc0dff500b

SHA256
a448ff88932b8ecfce263816efcb693d801a3b7b17533ce4074b1fb8441c473b

SHA512
fbc5ac66c0db541efd9d286de1381c780e81a40ded59d94cf059cc7919846ff8779f69c509dd90443b99b2c1aec47253c163fcf0b57c5fa3005f52a7e7b156bc

Download Submit
C:\Windows\SysWOW64\Pkceffcd.exe

Filesize
59KB

MD5
98417bf0b35c130bcc683c013556ba83

SHA1
96f8bd05f48aeb32e186815f0956599c996ea77a

SHA256
e584f0ac45822f6cf63d841ef4b43fdceaea9c8e308aa6b88c22a7fef3c2a969

SHA512
1041e496ae12a2acb72b41cbee9ef859b953527758bf290020d59bcc543f9fb8377b05c6bf1796fbf0585bfa1fe138da8bf5a652a5174bf0b2be7151a1fcc508

Download Submit
C:\Windows\SysWOW64\Pkfblfab.exe

Filesize
59KB

MD5
80b36633b44bdae4af5ff33f322a0b96

SHA1
bc56d1bb1db905ed4a1a02f1b6101b7e72994477

SHA256
ddbdc434a93dec78c55f52a108357c295b2ebecb52009cdb215035cc9f16e94c

SHA512
6c6615c9a330d30ef387c80b31337d9b37a0c689a36bf1a88717ae0f68a3b5f03f792740ba2ce5781706afdbe1009402f15f3b49b108ff352bafb29b3d5af9c9

Download Submit
C:\Windows\SysWOW64\Pnpemb32.exe

Filesize
59KB

MD5
85d941fceb3de93066e3a4f1d137d250

SHA1
2218451b58878a42ed4856b4b9935b999a88d2a1

SHA256
d475dd6c3ce0810aded010bceba9232e253560714204bcd7e2fb0d604804c719

SHA512
9ffb823cfee094ef1002f8614284283442f41e522a7cc74ed06abdc5d90110131a4f7c758ab5e9d1d5989ded2be8e3848654937bb9ddf711a3e3f2170ca9d92f

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
59KB

MD5
9422bfcfb9f30a314229c21f41c11bfc

SHA1
0492e9f6cdde015b603eb4e5c930dae2afe1365c

SHA256
58dfee431227b73c9c4e4c208f3fa4ffe474ff3e0c08cde918612592ccb150df

SHA512
18289ea8972974aba98016e346642534617489a560bd7e6797d71d47856444a0fbfafe77bc0a1e0c496c1b632198ddc795c9b24f6b2749876283f88e4ee545ff

Download Submit
C:\Windows\SysWOW64\Pqpnombl.exe

Filesize
59KB

MD5
eb502e3c1c40c23cf0e142cc1c1e95b3

SHA1
174f734496fbbf69e9b86ca2cb2dd8101e3a4cb4

SHA256
03842576d320e67338bbe348b86e16295e3523abc1fd09d00042d0b814f29eb8

SHA512
be50f3467358d3e61ece2b80645b6a4b878f2675c882a0ba0aadd20df99b2e0b8105182dba820347686aef36b2f5e4f0a4b2706d8f5ac707221af6e71c128fc7

Download Submit
C:\Windows\SysWOW64\Qbgqio32.exe

Filesize
59KB

MD5
8b4dc10d42db349fcc33b919aca7edaf

SHA1
c1bcb178a61e7fadb31a01e9d301999394f866a6

SHA256
62675b61ae4898f7923cadf67682d5ed45bcf0e6ae1c19402a75e969604959dc

SHA512
55db37c7d67ad3e536b01ffe4b3b14826a75f6430dbbe98fd21d79aea6ef5e42b442bb0afd114f0c4ed9b8ce1022ea766732cb5f211f438c3c050449d03970e7

Download Submit
C:\Windows\SysWOW64\Qbimoo32.exe

Filesize
59KB

MD5
7d08a02596eb987e32869787e4b03c78

SHA1
7fc9c3f6922883627540ef3d9a3d306937b470e0

SHA256
b3d782094adaf8547c01be83dd3cf591f39e7f4a2ffa874dc0fd40c757db9d03

SHA512
00f191f1b64957f69a9b9af359e2e4651d24f8fe59819e13102808dea9e370cbb7ea46a1e25639b25d2b1e615b1299bea255dd31aa29d5a9005974c8c79dd024

Download Submit
C:\Windows\SysWOW64\Qeemej32.exe

Filesize
59KB

MD5
30e6cb77693e45dfd138393bf6c0e4f6

SHA1
65bfefa6c519e04f9a078bd02289509627eea218

SHA256
f9bdfc7c75716cfc4bac7b42b84f82f132d2dded76b6a9b695b8bd1bcf07b2d7

SHA512
ec23713193924e3e90b23a6651d2f83938c3cdedf7de78612f300f714924753202cbd110ac16a09b9426e79d4750278b22fd84671d3364a79eb69980c59eb0a9

Download Submit
C:\Windows\SysWOW64\Qgallfcq.exe

Filesize
59KB

MD5
8f684a784c87270462b1fc0768286469

SHA1
fc7457dc555c5ec4a8806051ab1d029453641ccd

SHA256
cd5c1b4ff0cfc4991981af6c99dffb816b39f2c86533c91971a1b37aaff0ce68

SHA512
be365f1b4fd9b22bfa4f7dffc7ec61cd0c0356c909d37b9ca55eaad2a03994ceb00bb45984bf378571c92e33fd2b272709ad3ab0ca263e96b45a177c8dc81ef2

Download Submit
C:\Windows\SysWOW64\Qloebdig.exe

Filesize
59KB

MD5
c94427cbf269880245b8b38e8f28ba45

SHA1
978b886e50d8de84327139d50ab7932150893383

SHA256
34611fa0adc9e2179138af9849c8949dc13781ac9f55703a9e30694025936510

SHA512
e0fae3dda167c34a97d57d5dad4176778fc0416b464e72bb6fa85dd6cd9f30a0b137515ede7cecafe38fc8560af1cf8be6dd5d1a64bef953bf90312cdc66448c

Download Submit
C:\Windows\SysWOW64\Qqijje32.exe

Filesize
59KB

MD5
a30e3001875a9ccef835fefbb6e4268c

SHA1
becb32eab5989904b6ccc47f246c26719f8355cd

SHA256
e14fd6be989ac3426b0aa2b1e1b83c66c2c65908cc50247228f026205ea042ff

SHA512
640269cc9384ed2ba3c55e0c07541e3be6dc99c8a7b6ef552df08942630741b172b98133df79e8d3b143f3335f82e7743af7fec751b49312ad3aab53e67c2235

Download Submit
memory/8-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/396-240-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/400-401-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/404-311-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/740-65-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/780-224-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/932-497-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/964-443-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1028-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1100-540-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1192-560-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1232-431-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1236-485-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1292-515-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1328-533-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1408-567-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1424-120-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1468-552-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1468-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1520-332-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1540-459-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1584-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1608-347-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1712-548-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1724-449-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1800-371-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1864-503-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1880-574-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1896-323-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1920-201-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1940-112-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2020-377-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2108-585-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2140-57-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2140-594-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2232-527-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2256-317-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2308-559-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2308-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2312-89-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2376-471-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2432-491-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2464-359-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2644-49-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2644-587-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2716-509-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2732-337-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2876-25-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2876-566-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3016-253-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3052-419-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3084-213-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3188-273-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3320-180-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3440-105-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3496-441-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3532-129-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3584-553-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3652-153-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3656-216-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3696-45-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3696-580-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3732-169-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3764-395-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3916-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4016-353-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4036-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4084-305-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4100-478-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4312-73-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4344-285-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4404-573-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4404-36-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4428-136-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4440-185-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4456-275-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4480-389-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4504-257-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4536-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4536-1-0x0000000000433000-0x0000000000434000-memory.dmp

Filesize
4KB

Download
memory/4536-539-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4608-263-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4636-590-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4680-97-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4760-302-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4900-291-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4912-413-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4916-479-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4920-461-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5004-293-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5024-232-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5028-407-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5048-383-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5072-425-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5076-193-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5096-521-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/8116-1884-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads