fa1e0d8bf7314dede60ff4d52f537938219c3997dc8a5e332bdc2488b88d9df6

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 18:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e56ad6cf9c7dbf4d8278654f7dd46f07.exe
Size

62KB
MD5

e56ad6cf9c7dbf4d8278654f7dd46f07
SHA1

7a546f2e0108808056a3e03d47c9a10fd31c0f56
SHA256

fa1e0d8bf7314dede60ff4d52f537938219c3997dc8a5e332bdc2488b88d9df6
SHA512

a1e369eafbded3051a4137f949e92e427efede055d8678fa7466ab066dc44e77b720224fce5927cabb4b39edd1e83477879d284d76d45406bf968b564f7292c8
SSDEEP

1536:scNPV65KnILdPEHslgYQeDCNn3HPGTPFyCve8Cy:HPV656ILSMlgY73ve8

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cponen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkofdbkj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knhakh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldgccb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Koaagkcb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdickcpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmahknh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbqmiinl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Papfgbmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijcjmmil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cceddf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daediilg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Allpejfe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilafiihp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdbfab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llodgnja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doccpcja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdebfago.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qlmgopjq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbbnpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpmdfonj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dglkoeio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjhcjq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcgnbaeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmfhkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgloefco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kilpmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjpbam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lekmnajj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbhlikpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikndgg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbajbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmfhkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebdlangb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdickcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npepkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qodeajbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amodep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdpbon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mldhfpib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpcfmkff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmalne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oghghb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdbpgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Miofjepg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajggomog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebhglj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbcfhibj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpggamqc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfjkjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgbloglj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edbiniff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaajed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdjibj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pccahbmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qdaniq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjfnedho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmnbfhal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akpoaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajjjocap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fggocmhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjpbam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fibhpbea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkcndeen.exe

Executes dropped EXE 64 IoCs

pid	Process
4872	Phlacbfm.exe
3280	Qfpbmfdf.exe
4868	Qgpogili.exe
4648	Qlmgopjq.exe
4084	Agbkmijg.exe
1528	Amodep32.exe
3104	Ajcdnd32.exe
3480	Ackigjmh.exe
1704	Amcmpodi.exe
756	Aijnep32.exe
3876	Acpbbi32.exe
3008	Ajjjocap.exe
3668	Bogcgj32.exe
3128	Bjlgdc32.exe
8	Bgpgng32.exe
1048	Biadeoce.exe
1084	Bcghch32.exe
804	Bidqko32.exe
1144	Bgeaifia.exe
4924	Bmbiamhi.exe
2480	Bclang32.exe
448	Bihjfnmm.exe
3740	Ccnncgmc.exe
3064	Cabomkll.exe
1708	Cglgjeci.exe
2004	Cfadkb32.exe
640	Cceddf32.exe
4244	Cmniml32.exe
2700	Cjaifp32.exe
3684	Dgejpd32.exe
3332	Diffglam.exe
4508	Dpqodfij.exe
3896	Djfcaohp.exe
3472	Dcogje32.exe
5020	Djklmo32.exe
1128	Daediilg.exe
4076	Dfamapjo.exe
4824	Eipinkib.exe
4632	Ehailbaa.exe
5016	Emnbdioi.exe
2872	Edhjqc32.exe
4392	Fggocmhf.exe
4500	Fmqgpgoc.exe
2212	Fpodlbng.exe
556	Fhflnpoi.exe
664	Gkdhjknm.exe
3996	Gaopfe32.exe
2096	Ghhhcomg.exe
2640	Gijekg32.exe
4764	Gaamlecg.exe
1876	Gdoihpbk.exe
4528	Gkiaej32.exe
3476	Gpfjma32.exe
2428	Ghmbno32.exe
4884	Gnjjfegi.exe
2900	Gddbcp32.exe
2196	Giqkkf32.exe
4880	Gahcmd32.exe
2760	Hhbkinel.exe
3776	Hkpheidp.exe
4944	Hajpbckl.exe
668	Hkbdki32.exe
3848	Hnaqgd32.exe
3004	Hgiepjga.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Caojpaij.exe	Ckebcg32.exe
File created	C:\Windows\SysWOW64\Dfamapjo.exe	Daediilg.exe
File opened for modification	C:\Windows\SysWOW64\Icknfcol.exe	Ilafiihp.exe
File opened for modification	C:\Windows\SysWOW64\Qkipkani.exe	Mnkggfkb.exe
File created	C:\Windows\SysWOW64\Adkgje32.exe	Anaomkdb.exe
File created	C:\Windows\SysWOW64\Jcgmgn32.dll	Pmnbfhal.exe
File opened for modification	C:\Windows\SysWOW64\Conanfli.exe	Cdimqm32.exe
File created	C:\Windows\SysWOW64\Okhbek32.dll	Cponen32.exe
File created	C:\Windows\SysWOW64\Bpajnp32.dll	Jnhpoamf.exe
File opened for modification	C:\Windows\SysWOW64\Emdajb32.exe	Ejfeng32.exe
File opened for modification	C:\Windows\SysWOW64\Ilafiihp.exe	Ijcjmmil.exe
File created	C:\Windows\SysWOW64\Dfpcgbim.dll	Kqphfe32.exe
File created	C:\Windows\SysWOW64\Bcflijmh.dll	Ldgccb32.exe
File created	C:\Windows\SysWOW64\Eecphp32.exe	Eofgpikj.exe
File created	C:\Windows\SysWOW64\Boihcf32.exe	Bgbpaipl.exe
File opened for modification	C:\Windows\SysWOW64\Kbmoen32.exe	Kkcfid32.exe
File opened for modification	C:\Windows\SysWOW64\Mbighjdd.exe	Mlpokp32.exe
File created	C:\Windows\SysWOW64\Igigla32.exe	Ikbfgppo.exe
File created	C:\Windows\SysWOW64\Jklinohd.exe	Jnelok32.exe
File created	C:\Windows\SysWOW64\Mnkggfkb.exe	Mnhkbfme.exe
File created	C:\Windows\SysWOW64\Hkpheidp.exe	Hhbkinel.exe
File created	C:\Windows\SysWOW64\Bfjkjgbh.dll	Efepbi32.exe
File created	C:\Windows\SysWOW64\Dkhkgplb.dll	Mkjnfkma.exe
File opened for modification	C:\Windows\SysWOW64\Ekajec32.exe	Ehbnigjj.exe
File opened for modification	C:\Windows\SysWOW64\Foapaa32.exe	Fgjhpcmo.exe
File opened for modification	C:\Windows\SysWOW64\Diffglam.exe	Dgejpd32.exe
File created	C:\Windows\SysWOW64\Kggcnoic.exe	Kqmkae32.exe
File created	C:\Windows\SysWOW64\Aednci32.exe	Aojefobm.exe
File created	C:\Windows\SysWOW64\Kckqbj32.exe	Kpmdfonj.exe
File created	C:\Windows\SysWOW64\Oanokhdb.exe	Oaifpi32.exe
File created	C:\Windows\SysWOW64\Nmdgikhi.exe	Njfkmphe.exe
File created	C:\Windows\SysWOW64\Mjfkgg32.dll	Gaebef32.exe
File created	C:\Windows\SysWOW64\Daediilg.exe	Djklmo32.exe
File opened for modification	C:\Windows\SysWOW64\Gaopfe32.exe	Gkdhjknm.exe
File opened for modification	C:\Windows\SysWOW64\Afinioip.exe	Afgacokc.exe
File created	C:\Windows\SysWOW64\Igbcbhgq.dll	Fmqgpgoc.exe
File created	C:\Windows\SysWOW64\Ghmbno32.exe	Gpfjma32.exe
File created	C:\Windows\SysWOW64\Inomhbeq.exe	Igedlh32.exe
File created	C:\Windows\SysWOW64\Leopnglc.exe	Lbpdblmo.exe
File created	C:\Windows\SysWOW64\Jmpjlk32.dll	Mnegbp32.exe
File created	C:\Windows\SysWOW64\Ginacp32.dll	Adikdfna.exe
File opened for modification	C:\Windows\SysWOW64\Nadleilm.exe	Nnfpinmi.exe
File created	C:\Windows\SysWOW64\Eoepebho.exe	Edplhjhi.exe
File opened for modification	C:\Windows\SysWOW64\Qfpbmfdf.exe	Phlacbfm.exe
File created	C:\Windows\SysWOW64\Ejlacgdj.dll	Jbfheo32.exe
File created	C:\Windows\SysWOW64\Gaocia32.dll	Ikbfgppo.exe
File created	C:\Windows\SysWOW64\Ajfmkfhq.dll	Jcgnbaeo.exe
File created	C:\Windows\SysWOW64\Mkjnfkma.exe	Mepfiq32.exe
File opened for modification	C:\Windows\SysWOW64\Eoepebho.exe	Edplhjhi.exe
File opened for modification	C:\Windows\SysWOW64\Nhpbfpka.exe	Nafjjf32.exe
File created	C:\Windows\SysWOW64\Bjpjel32.exe	Bcfahbpo.exe
File opened for modification	C:\Windows\SysWOW64\Dmennnni.exe	Dflfac32.exe
File created	C:\Windows\SysWOW64\Nmbjcljl.exe	Mjcngpjh.exe
File opened for modification	C:\Windows\SysWOW64\Fniihmpf.exe	Filapfbo.exe
File created	C:\Windows\SysWOW64\Egneae32.dll	Bihjfnmm.exe
File created	C:\Windows\SysWOW64\Cmmdfp32.dll	Dndgfpbo.exe
File created	C:\Windows\SysWOW64\Badjai32.dll	Foapaa32.exe
File created	C:\Windows\SysWOW64\Coffgmig.dll	Gicgpelg.exe
File created	C:\Windows\SysWOW64\Inmabofh.dll	Kjepjkhf.exe
File opened for modification	C:\Windows\SysWOW64\Mcqjon32.exe	Lqbncb32.exe
File created	C:\Windows\SysWOW64\Dgfpihkg.dll	Oghghb32.exe
File opened for modification	C:\Windows\SysWOW64\Qobhkjdi.exe	Qfkqjmdg.exe
File opened for modification	C:\Windows\SysWOW64\Ebaplnie.exe	Doccpcja.exe
File created	C:\Windows\SysWOW64\Pnifekmd.exe	Pfandnla.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4520	3508	WerFault.exe	565

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmqgpgoc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkhkjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oghghb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjcngpjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aggamk32.dll"	Bgeaifia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkkgmlcm.dll"	Gddbcp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjpjel32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jnelok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enjgeopm.dll"	Npepkf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bemlhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khblgpag.dll"	Dkokcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Appfnncn.dll"	Kpmdfonj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qpcecb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbfoclai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hglaej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oemnpgle.dll"	Nlnkmnah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Flqdlnde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgagmm32.dll"	Qgpogili.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebaplnie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhndljll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljgpkonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogakfe32.dll"	Pffgom32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fgcjfbed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hodlgn32.dll"	Gokbgpeg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qgpogili.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ghmbno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iggaah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnmopk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cggkemhh.dll"	Qobhkjdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehbnigjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dcogje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Codhnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dngjff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dempqa32.dll"	Nagiji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Papfgbmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qkipkani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqpdko32.dll"	Cofnik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijilflah.dll"	Caageq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cidgdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qknhhh32.dll"	Caghhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgfnagdi.dll"	Njmqnobn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgnddp32.dll"	Caojpaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Emdajb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fikbocki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkjefc32.dll"	Aafemk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cidgdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gigmlgok.dll"	Ikndgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bionkjfo.dll"	Mbenmk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjdiliki.dll"	Afinioip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmabggdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikfhji32.dll"	Fpggamqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgkdbacp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pffgom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajjjocap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egneae32.dll"	Bihjfnmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kinmcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcjdoc32.dll"	Knhakh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdbfab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgplk32.dll"	Apjkcadp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mejcig32.dll"	Jehfcl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oohkai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naqbda32.dll"	Bgpgng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgklej32.dll"	Hncmmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjpijpdg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 4872	964	e56ad6cf9c7dbf4d8278654f7dd46f07.exe	88
PID 964 wrote to memory of 4872	964	e56ad6cf9c7dbf4d8278654f7dd46f07.exe	88
PID 964 wrote to memory of 4872	964	e56ad6cf9c7dbf4d8278654f7dd46f07.exe	88
PID 4872 wrote to memory of 3280	4872	Phlacbfm.exe	89
PID 4872 wrote to memory of 3280	4872	Phlacbfm.exe	89
PID 4872 wrote to memory of 3280	4872	Phlacbfm.exe	89
PID 3280 wrote to memory of 4868	3280	Qfpbmfdf.exe	90
PID 3280 wrote to memory of 4868	3280	Qfpbmfdf.exe	90
PID 3280 wrote to memory of 4868	3280	Qfpbmfdf.exe	90
PID 4868 wrote to memory of 4648	4868	Qgpogili.exe	91
PID 4868 wrote to memory of 4648	4868	Qgpogili.exe	91
PID 4868 wrote to memory of 4648	4868	Qgpogili.exe	91
PID 4648 wrote to memory of 4084	4648	Qlmgopjq.exe	92
PID 4648 wrote to memory of 4084	4648	Qlmgopjq.exe	92
PID 4648 wrote to memory of 4084	4648	Qlmgopjq.exe	92
PID 4084 wrote to memory of 1528	4084	Agbkmijg.exe	93
PID 4084 wrote to memory of 1528	4084	Agbkmijg.exe	93
PID 4084 wrote to memory of 1528	4084	Agbkmijg.exe	93
PID 1528 wrote to memory of 3104	1528	Amodep32.exe	94
PID 1528 wrote to memory of 3104	1528	Amodep32.exe	94
PID 1528 wrote to memory of 3104	1528	Amodep32.exe	94
PID 3104 wrote to memory of 3480	3104	Ajcdnd32.exe	95
PID 3104 wrote to memory of 3480	3104	Ajcdnd32.exe	95
PID 3104 wrote to memory of 3480	3104	Ajcdnd32.exe	95
PID 3480 wrote to memory of 1704	3480	Ackigjmh.exe	96
PID 3480 wrote to memory of 1704	3480	Ackigjmh.exe	96
PID 3480 wrote to memory of 1704	3480	Ackigjmh.exe	96
PID 1704 wrote to memory of 756	1704	Amcmpodi.exe	97
PID 1704 wrote to memory of 756	1704	Amcmpodi.exe	97
PID 1704 wrote to memory of 756	1704	Amcmpodi.exe	97
PID 756 wrote to memory of 3876	756	Aijnep32.exe	98
PID 756 wrote to memory of 3876	756	Aijnep32.exe	98
PID 756 wrote to memory of 3876	756	Aijnep32.exe	98
PID 3876 wrote to memory of 3008	3876	Acpbbi32.exe	99
PID 3876 wrote to memory of 3008	3876	Acpbbi32.exe	99
PID 3876 wrote to memory of 3008	3876	Acpbbi32.exe	99
PID 3008 wrote to memory of 3668	3008	Ajjjocap.exe	100
PID 3008 wrote to memory of 3668	3008	Ajjjocap.exe	100
PID 3008 wrote to memory of 3668	3008	Ajjjocap.exe	100
PID 3668 wrote to memory of 3128	3668	Bogcgj32.exe	101
PID 3668 wrote to memory of 3128	3668	Bogcgj32.exe	101
PID 3668 wrote to memory of 3128	3668	Bogcgj32.exe	101
PID 3128 wrote to memory of 8	3128	Bjlgdc32.exe	103
PID 3128 wrote to memory of 8	3128	Bjlgdc32.exe	103
PID 3128 wrote to memory of 8	3128	Bjlgdc32.exe	103
PID 8 wrote to memory of 1048	8	Bgpgng32.exe	104
PID 8 wrote to memory of 1048	8	Bgpgng32.exe	104
PID 8 wrote to memory of 1048	8	Bgpgng32.exe	104
PID 1048 wrote to memory of 1084	1048	Biadeoce.exe	105
PID 1048 wrote to memory of 1084	1048	Biadeoce.exe	105
PID 1048 wrote to memory of 1084	1048	Biadeoce.exe	105
PID 1084 wrote to memory of 804	1084	Bcghch32.exe	106
PID 1084 wrote to memory of 804	1084	Bcghch32.exe	106
PID 1084 wrote to memory of 804	1084	Bcghch32.exe	106
PID 804 wrote to memory of 1144	804	Bidqko32.exe	107
PID 804 wrote to memory of 1144	804	Bidqko32.exe	107
PID 804 wrote to memory of 1144	804	Bidqko32.exe	107
PID 1144 wrote to memory of 4924	1144	Bgeaifia.exe	108
PID 1144 wrote to memory of 4924	1144	Bgeaifia.exe	108
PID 1144 wrote to memory of 4924	1144	Bgeaifia.exe	108
PID 4924 wrote to memory of 2480	4924	Bmbiamhi.exe	109
PID 4924 wrote to memory of 2480	4924	Bmbiamhi.exe	109
PID 4924 wrote to memory of 2480	4924	Bmbiamhi.exe	109
PID 2480 wrote to memory of 448	2480	Bclang32.exe	110

C:\Users\Admin\AppData\Local\Temp\e56ad6cf9c7dbf4d8278654f7dd46f07.exe
"C:\Users\Admin\AppData\Local\Temp\e56ad6cf9c7dbf4d8278654f7dd46f07.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\Phlacbfm.exe
  C:\Windows\system32\Phlacbfm.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\Qfpbmfdf.exe
    C:\Windows\system32\Qfpbmfdf.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - C:\Windows\SysWOW64\Qgpogili.exe
      C:\Windows\system32\Qgpogili.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4868
    - - C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4648
      - C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1528
        
        C:\Windows\SysWOW64\Ajcdnd32.exe
        
        C:\Windows\system32\Ajcdnd32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\SysWOW64\Ackigjmh.exe
        
        C:\Windows\system32\Ackigjmh.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\Windows\SysWOW64\Amcmpodi.exe
        
        C:\Windows\system32\Amcmpodi.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\SysWOW64\Acpbbi32.exe
        
        C:\Windows\system32\Acpbbi32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\SysWOW64\Ajjjocap.exe
        
        C:\Windows\system32\Ajjjocap.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Windows\SysWOW64\Bogcgj32.exe
        
        C:\Windows\system32\Bogcgj32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\SysWOW64\Bjlgdc32.exe
        
        C:\Windows\system32\Bjlgdc32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\SysWOW64\Bgpgng32.exe
        
        C:\Windows\system32\Bgpgng32.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1048
        
        C:\Windows\SysWOW64\Bcghch32.exe
        
        C:\Windows\system32\Bcghch32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Windows\SysWOW64\Bidqko32.exe
        
        C:\Windows\system32\Bidqko32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:804
        
        C:\Windows\SysWOW64\Bgeaifia.exe
        
        C:\Windows\system32\Bgeaifia.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Windows\SysWOW64\Bmbiamhi.exe
        
        C:\Windows\system32\Bmbiamhi.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\Bclang32.exe
        
        C:\Windows\system32\Bclang32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\SysWOW64\Bihjfnmm.exe
        
        C:\Windows\system32\Bihjfnmm.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:448
        
        C:\Windows\SysWOW64\Ccnncgmc.exe
        
        C:\Windows\system32\Ccnncgmc.exe
        24⤵
        Executes dropped EXE
        
        PID:3740
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        25⤵
        Executes dropped EXE
        
        PID:3064
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        26⤵
        Executes dropped EXE
        
        PID:1708
        
        C:\Windows\SysWOW64\Cfadkb32.exe
        
        C:\Windows\system32\Cfadkb32.exe
        27⤵
        Executes dropped EXE
        
        PID:2004
        
        C:\Windows\SysWOW64\Caghhk32.exe
        
        C:\Windows\system32\Caghhk32.exe
        28⤵
        Modifies registry class
        
        PID:4808
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:640
        
        C:\Windows\SysWOW64\Cmniml32.exe
        
        C:\Windows\system32\Cmniml32.exe
        30⤵
        Executes dropped EXE
        
        PID:4244
        
        C:\Windows\SysWOW64\Cjaifp32.exe
        
        C:\Windows\system32\Cjaifp32.exe
        31⤵
        Executes dropped EXE
        
        PID:2700
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3684
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        33⤵
        Executes dropped EXE
        
        PID:3332
        
        C:\Windows\SysWOW64\Dpqodfij.exe
        
        C:\Windows\system32\Dpqodfij.exe
        34⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Djfcaohp.exe
        
        C:\Windows\system32\Djfcaohp.exe
        35⤵
        Executes dropped EXE
        
        PID:3896
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3472
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5020
        
        C:\Windows\SysWOW64\Daediilg.exe
        
        C:\Windows\system32\Daediilg.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1128
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        39⤵
        Executes dropped EXE
        
        PID:4076
        
        C:\Windows\SysWOW64\Eipinkib.exe
        
        C:\Windows\system32\Eipinkib.exe
        40⤵
        Executes dropped EXE
        
        PID:4824
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        41⤵
        Executes dropped EXE
        
        PID:4632
        
        C:\Windows\SysWOW64\Emnbdioi.exe
        
        C:\Windows\system32\Emnbdioi.exe
        42⤵
        Executes dropped EXE
        
        PID:5016
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        43⤵
        Executes dropped EXE
        
        PID:2872
        
        C:\Windows\SysWOW64\Fggocmhf.exe
        
        C:\Windows\system32\Fggocmhf.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4392
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4500
        
        C:\Windows\SysWOW64\Fpodlbng.exe
        
        C:\Windows\system32\Fpodlbng.exe
        46⤵
        Executes dropped EXE
        
        PID:2212
        
        C:\Windows\SysWOW64\Fhflnpoi.exe
        
        C:\Windows\system32\Fhflnpoi.exe
        47⤵
        Executes dropped EXE
        
        PID:556
        
        C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:664
        
        C:\Windows\SysWOW64\Gaopfe32.exe
        
        C:\Windows\system32\Gaopfe32.exe
        49⤵
        Executes dropped EXE
        
        PID:3996
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        50⤵
        Executes dropped EXE
        
        PID:2096
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        51⤵
        Executes dropped EXE
        
        PID:2640
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        52⤵
        Executes dropped EXE
        
        PID:4764
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        53⤵
        Executes dropped EXE
        
        PID:1876
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        54⤵
        Executes dropped EXE
        
        PID:4528
        
        C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3476
        
        C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2428
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        57⤵
        Executes dropped EXE
        
        PID:4884
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2900
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        59⤵
        Executes dropped EXE
        
        PID:2196
        
        C:\Windows\SysWOW64\Gahcmd32.exe
        
        C:\Windows\system32\Gahcmd32.exe
        60⤵
        Executes dropped EXE
        
        PID:4880
        
        C:\Windows\SysWOW64\Hhbkinel.exe
        
        C:\Windows\system32\Hhbkinel.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2760
        
        C:\Windows\SysWOW64\Hkpheidp.exe
        
        C:\Windows\system32\Hkpheidp.exe
        62⤵
        Executes dropped EXE
        
        PID:3776
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        63⤵
        Executes dropped EXE
        
        PID:4944
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        64⤵
        Executes dropped EXE
        
        PID:668
        
        C:\Windows\SysWOW64\Hnaqgd32.exe
        
        C:\Windows\system32\Hnaqgd32.exe
        65⤵
        Executes dropped EXE
        
        PID:3848
        
        C:\Windows\SysWOW64\Hgiepjga.exe
        
        C:\Windows\system32\Hgiepjga.exe
        66⤵
        Executes dropped EXE
        
        PID:3004
        
        C:\Windows\SysWOW64\Hncmmd32.exe
        
        C:\Windows\system32\Hncmmd32.exe
        67⤵
        Modifies registry class
        
        PID:1648
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        68⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\Hglaej32.exe
        
        C:\Windows\system32\Hglaej32.exe
        69⤵
        Modifies registry class
        
        PID:2800
        
        C:\Windows\SysWOW64\Hjjnae32.exe
        
        C:\Windows\system32\Hjjnae32.exe
        70⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\Hdpbon32.exe
        
        C:\Windows\system32\Hdpbon32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4644
        
        C:\Windows\SysWOW64\Hkjjlhle.exe
        
        C:\Windows\system32\Hkjjlhle.exe
        72⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        73⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Idbodn32.exe
        
        C:\Windows\system32\Idbodn32.exe
        74⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\Ijogmdqm.exe
        
        C:\Windows\system32\Ijogmdqm.exe
        75⤵
        
        PID:3124
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        76⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4312
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        78⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\Igedlh32.exe
        
        C:\Windows\system32\Igedlh32.exe
        79⤵
        Drops file in System32 directory
        
        PID:5128
        
        C:\Windows\SysWOW64\Inomhbeq.exe
        
        C:\Windows\system32\Inomhbeq.exe
        80⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        81⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Iggaah32.exe
        
        C:\Windows\system32\Iggaah32.exe
        82⤵
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        83⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        84⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Ikejgf32.exe
        
        C:\Windows\system32\Ikejgf32.exe
        85⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        86⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        87⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Jglklggl.exe
        
        C:\Windows\system32\Jglklggl.exe
        88⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Jjjghcfp.exe
        
        C:\Windows\system32\Jjjghcfp.exe
        89⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Jbaojpgb.exe
        
        C:\Windows\system32\Jbaojpgb.exe
        90⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        91⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        92⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        93⤵
        Modifies registry class
        
        PID:5764
        
        C:\Windows\SysWOW64\Jjopcb32.exe
        
        C:\Windows\system32\Jjopcb32.exe
        94⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        95⤵
        Drops file in System32 directory
        
        PID:5848
        
        C:\Windows\SysWOW64\Jdedak32.exe
        
        C:\Windows\system32\Jdedak32.exe
        96⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        97⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        98⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Jdgafjpn.exe
        
        C:\Windows\system32\Jdgafjpn.exe
        99⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        100⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        101⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        102⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        103⤵
        Drops file in System32 directory
        
        PID:5176
        
        C:\Windows\SysWOW64\Kbmoen32.exe
        
        C:\Windows\system32\Kbmoen32.exe
        104⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Kiggbhda.exe
        
        C:\Windows\system32\Kiggbhda.exe
        105⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5384
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        107⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Kgmcce32.exe
        
        C:\Windows\system32\Kgmcce32.exe
        108⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        109⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5692
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        111⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        112⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        113⤵
        Modifies registry class
        
        PID:5924
        
        C:\Windows\SysWOW64\Kjpijpdg.exe
        
        C:\Windows\system32\Kjpijpdg.exe
        114⤵
        Modifies registry class
        
        PID:5992
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        115⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        116⤵
        
        PID:376
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5156
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        118⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        119⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Lbkkgl32.exe
        
        C:\Windows\system32\Lbkkgl32.exe
        120⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        121⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        122⤵
        Modifies registry class
        
        PID:5752
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        123⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        124⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        125⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        126⤵
        Drops file in System32 directory
        
        PID:5244
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        127⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        128⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        129⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        130⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Mjneln32.exe
        
        C:\Windows\system32\Mjneln32.exe
        131⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        132⤵
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5928
        
        C:\Windows\SysWOW64\Mjpbam32.exe
        
        C:\Windows\system32\Mjpbam32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5196
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        135⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        136⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        137⤵
        Drops file in System32 directory
        
        PID:5872
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        138⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        139⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6260
        
        C:\Windows\SysWOW64\Nhkikq32.exe
        
        C:\Windows\system32\Nhkikq32.exe
        141⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Noeahkfc.exe
        
        C:\Windows\system32\Noeahkfc.exe
        142⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6388
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        144⤵
        Drops file in System32 directory
        
        PID:6424
        
        C:\Windows\SysWOW64\Nhpbfpka.exe
        
        C:\Windows\system32\Nhpbfpka.exe
        145⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        146⤵
        Modifies registry class
        
        PID:6516
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        147⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6596
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        149⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        150⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Ohpkmn32.exe
        
        C:\Windows\system32\Ohpkmn32.exe
        151⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Pchlpfjb.exe
        
        C:\Windows\system32\Pchlpfjb.exe
        152⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        153⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6860
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        155⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        156⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6984
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        158⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Aaiimadl.exe
        
        C:\Windows\system32\Aaiimadl.exe
        159⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        160⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        161⤵
        Drops file in System32 directory
        
        PID:7164
        
        C:\Windows\SysWOW64\Afinioip.exe
        
        C:\Windows\system32\Afinioip.exe
        162⤵
        Modifies registry class
        
        PID:6184
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6280
        
        C:\Windows\SysWOW64\Acokhc32.exe
        
        C:\Windows\system32\Acokhc32.exe
        164⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        165⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        166⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        167⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        168⤵
        Drops file in System32 directory
        
        PID:6660
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        169⤵
        Modifies registry class
        
        PID:6732
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        170⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        171⤵
        Modifies registry class
        
        PID:6888
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        172⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        173⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Cmcolgbj.exe
        
        C:\Windows\system32\Cmcolgbj.exe
        174⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        175⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        176⤵
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        177⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        178⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Cbeapmll.exe
        
        C:\Windows\system32\Cbeapmll.exe
        179⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        180⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        181⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        182⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6168
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        184⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        185⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        186⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7008
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        188⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        189⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        190⤵
        Drops file in System32 directory
        
        PID:6632
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        191⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        192⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        193⤵
        Drops file in System32 directory
        
        PID:6900
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        194⤵
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        195⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7216
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        197⤵
        Modifies registry class
        
        PID:7256
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        198⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7348
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        200⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        201⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7480
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        203⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        204⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        205⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7676
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        207⤵
        Modifies registry class
        
        PID:7716
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        208⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        209⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        210⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        211⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7924
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        213⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8016
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        215⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8108
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        217⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        218⤵
        Modifies registry class
        
        PID:6960
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        219⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        220⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        221⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7432
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7504
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        224⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        225⤵
        Drops file in System32 directory
        
        PID:7724
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        226⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        227⤵
        Modifies registry class
        
        PID:7832
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        228⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7908
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        229⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        230⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8160
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        232⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        233⤵
        Drops file in System32 directory
        
        PID:7292
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        234⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        235⤵
        Drops file in System32 directory
        
        PID:7564
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        236⤵
        Drops file in System32 directory
        
        PID:7668
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        237⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7936
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        239⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8172
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        241⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        242⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        243⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7852
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        245⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        246⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        247⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7892
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        249⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        250⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        251⤵
        Drops file in System32 directory
        
        PID:8188
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        252⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        253⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        254⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        255⤵
        Drops file in System32 directory
        
        PID:8316
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        256⤵
        Drops file in System32 directory
        
        PID:8364
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        257⤵
        Drops file in System32 directory
        
        PID:8452
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        258⤵
        Drops file in System32 directory
        
        PID:8508
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        259⤵
        Modifies registry class
        
        PID:8556
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        260⤵
        Modifies registry class
        
        PID:8600
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        261⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        262⤵
        Drops file in System32 directory
        
        PID:8684
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        263⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        264⤵
        Drops file in System32 directory
        
        PID:8788
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        265⤵
        Drops file in System32 directory
        
        PID:8828
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        266⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        267⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        268⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        269⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        270⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        271⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        272⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        273⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7508
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        275⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        276⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8432
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        278⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        279⤵
        Modifies registry class
        
        PID:8552
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8624
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        281⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        282⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        283⤵
        Modifies registry class
        
        PID:8812
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        284⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        285⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        286⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        287⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        288⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        289⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        290⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        291⤵
        Drops file in System32 directory
        
        PID:8460
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        292⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        293⤵
        Modifies registry class
        
        PID:4912
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        294⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        295⤵
        Drops file in System32 directory
        
        PID:8932
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        296⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        297⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8360
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        299⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        300⤵
        
        PID:852
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        301⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        302⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9032
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        304⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        305⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        306⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8916
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        308⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        309⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        310⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9076
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:400
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        313⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        314⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        315⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        316⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        317⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9312
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        319⤵
        Drops file in System32 directory
        
        PID:9360
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        320⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        321⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        322⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        323⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        324⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        325⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        326⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9668
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        327⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        328⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        329⤵
        Drops file in System32 directory
        
        PID:9824
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        330⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        331⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        332⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10000
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        334⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        335⤵
        Drops file in System32 directory
        
        PID:10088
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        336⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        337⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        338⤵
        Modifies registry class
        
        PID:10216
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        339⤵
        Modifies registry class
        
        PID:992
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        340⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        341⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        342⤵
        Drops file in System32 directory
        
        PID:9424
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        343⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9568
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        345⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        346⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        347⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        348⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        349⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9980
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        351⤵
        Drops file in System32 directory
        
        PID:10096
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        352⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        353⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        354⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9636
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        356⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        357⤵
        Modifies registry class
        
        PID:9868
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        358⤵
        Modifies registry class
        
        PID:10012
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        359⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        360⤵
        Drops file in System32 directory
        
        PID:9192
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        361⤵
        Modifies registry class
        
        PID:9336
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        362⤵
        Modifies registry class
        
        PID:9708
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2628
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9952
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        365⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        366⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        367⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        368⤵
        Modifies registry class
        
        PID:5036
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        369⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3816
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        370⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        371⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        372⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        373⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        374⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        375⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        376⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        377⤵
        Drops file in System32 directory
        
        PID:3104
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        378⤵
        
        PID:772
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        379⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        380⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        381⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        382⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        383⤵
        Drops file in System32 directory
        
        PID:756
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        384⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        385⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3084
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        386⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        387⤵
        Drops file in System32 directory
        
        PID:1748
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        388⤵
        Modifies registry class
        
        PID:1808
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        389⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        390⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        391⤵
        Modifies registry class
        
        PID:8
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        392⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        393⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4268
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        394⤵
        
        PID:448
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        395⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        396⤵
        
        PID:540
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        397⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        398⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        399⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2064
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        401⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        402⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        403⤵
        
        PID:232
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        404⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        405⤵
        Drops file in System32 directory
        
        PID:10248
        
        C:\Windows\SysWOW64\Dqbcbkab.exe
        
        C:\Windows\system32\Dqbcbkab.exe
        406⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10340
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10376
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        409⤵
        Modifies registry class
        
        PID:10420
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        410⤵
        Drops file in System32 directory
        
        PID:10472
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        411⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        412⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10548
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        413⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10596
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        414⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        415⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        416⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        417⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        418⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        419⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10848
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        420⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        421⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        422⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        423⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        424⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        425⤵
        Drops file in System32 directory
        
        PID:11104
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        426⤵
        Drops file in System32 directory
        
        PID:11144
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        427⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        428⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        429⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        430⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        431⤵
        Drops file in System32 directory
        
        PID:10368
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        432⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        433⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        434⤵
        Modifies registry class
        
        PID:4876
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        435⤵
        Modifies registry class
        
        PID:10556
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        436⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        437⤵
        Drops file in System32 directory
        
        PID:10688
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        438⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        439⤵
        
        PID:948
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        440⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        441⤵
        Drops file in System32 directory
        
        PID:10956
        
        C:\Windows\SysWOW64\Jehfcl32.exe
        
        C:\Windows\system32\Jehfcl32.exe
        442⤵
        Modifies registry class
        
        PID:11004
        
        C:\Windows\SysWOW64\Nhlfoodc.exe
        
        C:\Windows\system32\Nhlfoodc.exe
        443⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Oohkai32.exe
        
        C:\Windows\system32\Oohkai32.exe
        444⤵
        Modifies registry class
        
        PID:11160
        
        C:\Windows\SysWOW64\Aeopfl32.exe
        
        C:\Windows\system32\Aeopfl32.exe
        445⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Bemlhj32.exe
        
        C:\Windows\system32\Bemlhj32.exe
        446⤵
        Modifies registry class
        
        PID:10264
        
        C:\Windows\SysWOW64\Bflham32.exe
        
        C:\Windows\system32\Bflham32.exe
        447⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Blknpdho.exe
        
        C:\Windows\system32\Blknpdho.exe
        448⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\Cdebfago.exe
        
        C:\Windows\system32\Cdebfago.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4560
        
        C:\Windows\SysWOW64\Cmmgof32.exe
        
        C:\Windows\system32\Cmmgof32.exe
        450⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Cidgdg32.exe
        
        C:\Windows\system32\Cidgdg32.exe
        451⤵
        Modifies registry class
        
        PID:10536
        
        C:\Windows\SysWOW64\Cbmlmmjd.exe
        
        C:\Windows\system32\Cbmlmmjd.exe
        452⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\Cifdjg32.exe
        
        C:\Windows\system32\Cifdjg32.exe
        453⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Cleqfb32.exe
        
        C:\Windows\system32\Cleqfb32.exe
        454⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\Cdlhgpag.exe
        
        C:\Windows\system32\Cdlhgpag.exe
        455⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Cfjeckpj.exe
        
        C:\Windows\system32\Cfjeckpj.exe
        456⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\Cfmahknh.exe
        
        C:\Windows\system32\Cfmahknh.exe
        457⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10760
        
        C:\Windows\SysWOW64\Cmgjee32.exe
        
        C:\Windows\system32\Cmgjee32.exe
        458⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\Dbcbnlcl.exe
        
        C:\Windows\system32\Dbcbnlcl.exe
        459⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\Dinjjf32.exe
        
        C:\Windows\system32\Dinjjf32.exe
        460⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\Dbfoclai.exe
        
        C:\Windows\system32\Dbfoclai.exe
        461⤵
        Modifies registry class
        
        PID:1272
        
        C:\Windows\SysWOW64\Dpjompqc.exe
        
        C:\Windows\system32\Dpjompqc.exe
        462⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Dbhlikpf.exe
        
        C:\Windows\system32\Dbhlikpf.exe
        463⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1964
        
        C:\Windows\SysWOW64\Defheg32.exe
        
        C:\Windows\system32\Defheg32.exe
        464⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Dpllbp32.exe
        
        C:\Windows\system32\Dpllbp32.exe
        465⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        466⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 400
        467⤵
        Program crash
        
        PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 3508 -ip 3508
1⤵
PID:5188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ackigjmh.exe

Filesize
62KB

MD5
86ecb33e1c6431d962e47032c583fde2

SHA1
d23d231c18216bddb112ff547b4da1526d8be074

SHA256
345421f6e69393c63200e971e773fcb3ce5ad36682c5364fb6f5fc7e2356df2d

SHA512
e079f442b9e8b2b2d6d57bbe82941f258e40392d3e9edc4a6a561e02912efdab94ac472ae69877754f0ab7d972532aa0c1aa311dd2ab1e3788a23a64366b661f

Download Submit
C:\Windows\SysWOW64\Acpbbi32.exe

Filesize
62KB

MD5
36e00cb75bef2b6e6d25c0582b0c7ced

SHA1
cb0ef7135073531f0297a3a752f7a09eb56dbd56

SHA256
223913df8f85ffd73f36b469edfe3deec7be0be6b900fb07683af7d0a5f8ca1b

SHA512
95f1a807c1b2ed83690443c1afec9e9d8f4d5b64de307b554f7c21614cf60fa60333abba18876636da2a7f7f2b44424702d9dd4172117b6a35c6294d0b94c640

Download Submit
C:\Windows\SysWOW64\Afbgkl32.exe

Filesize
62KB

MD5
f0fce05a4c09e4b2d13638a2648364d3

SHA1
35975173cb7c9ec17786eeb03709e6a1295aed87

SHA256
e65c98f221e4152200dceb54d0969adaa1a4258c11286b148004db30993c655a

SHA512
2d45cbff1160e79f2cd5ea60b5fcf3bad0b50f96ac41da7bbcad930bafc5eca95f39e926bef06d876da44abf63714281508e2bf7b06d9b2151020f2b578e3892

Download Submit
C:\Windows\SysWOW64\Agbkmijg.exe

Filesize
62KB

MD5
ab7e003460c3aaf87c3367d9742e66f6

SHA1
9e591b62882cccf4be47b36852c55fabce0f7c32

SHA256
5cf0633b75a3d7793e2c19ac6fd0b2bb2039478121ee984e2b1f1e93e4987093

SHA512
1a6335b28d089346cfc992dc992c7785f4d7f3291fb47feca14dd5d7160da6ed9686e61d1996e47cedefc3c82743641123b1c94a045685fc57b2bf3bb2f4e39b

Download Submit
C:\Windows\SysWOW64\Aijnep32.exe

Filesize
62KB

MD5
187b32f821987b650c5bb9790bb931df

SHA1
c6b5c1bf9bb5f1b3bde8e05d4f4087d7a3a68f67

SHA256
d94403cdf7d0c3666b64fe27a54f6a4f0f2cfa2a7aaf4c0af8e35f499df776c7

SHA512
2f71eadb68aafc855b07621cb6634a13167fde7fe851ccd3c5d908f651439ee70792d68531d4014c847470b8ba5ba5edf5f2fd574aa5d134433bfe3c08fa50d3

Download Submit
C:\Windows\SysWOW64\Ajcdnd32.exe

Filesize
62KB

MD5
8d44a8abe76f6541ea703b51f2d4db03

SHA1
24eeea36bd2e69739da752190a243f669446564f

SHA256
bf19f1adc5f4a218babf8442e630cdbc52f75a15207ecc6b6df3fd6239dd046a

SHA512
abc24ab2893e91793ceb1f4fb4a81d205b7b7a62737e76adc152063f8f350f2371bfde638f4d687ee823da8086bf478be81fb4353aef952458ace781c4decd3d

Download Submit
C:\Windows\SysWOW64\Ajjjocap.exe

Filesize
62KB

MD5
421ce1bce7f7c3cfc761ab334a4485c6

SHA1
2b4ab89eb9cba543c4aeb56cc4fb30f218374f61

SHA256
e4150ce5eb899d442b01d567dba7027748f2f981131fea4a6de45c2b03d8ef64

SHA512
ea862e452b8cb2a3a7e5d68c480eff1d9fe97f602dd5af7814e5bd9cd5918a371cc5b338c8e279f6d4627425d6f272d2ce31874da87b8a43d9db0b2157fb3e18

Download Submit
C:\Windows\SysWOW64\Amcmpodi.exe

Filesize
62KB

MD5
33d5acf62147f6c4a9baf142438b86b4

SHA1
316fbc3c156b33530e4b5911e7344026108b8fe7

SHA256
75089f1e01d00c8fb680cb7f38cc81726c620a6c1ec3814e1fa9a0f167d7ce6c

SHA512
a4c6847a095c357b85bfc5874c9d79a91de7ade51c93ceeea9101d976ba758758d0c41c28b762e941980a85fb567e0e11fde680f9d83897eb34a550e0009d37b

Download Submit
C:\Windows\SysWOW64\Amodep32.exe

Filesize
62KB

MD5
9d0cf2e66c785f042098f70bdcebb51d

SHA1
bb959d8a1d7a858701a949c9ec44ff0322740554

SHA256
5156a9c501afac30944770ce211f6e27f89cb5239d1c96d1f0453b28e5431877

SHA512
42a981100dba20e87100ab7afaee8cc3b5c00935cc4db1b98d68e7d2578dbeddd7951f391fbdfc704a1817f9bcee4b0593fa70244ac4bcd266353578970caf72

Download Submit
C:\Windows\SysWOW64\Bcghch32.exe

Filesize
62KB

MD5
c1389af60243502b84236b947e4c78d2

SHA1
80e3d683173700e0e8cc2a6dba64a0582d5a2c4b

SHA256
f12aedd8410c35be8ad7a19e6dc21d5c66bffd062c70390f04db5861e5aa94c1

SHA512
6f527ea3cf05444c9534e4eb053b9ade0f6b560317a3f89257e30f3e64f7be9ef783a2155ae8c4cb9b637973a02c1d21a9f94de1b96037599b5520e30a802fff

Download Submit
C:\Windows\SysWOW64\Bclang32.exe

Filesize
62KB

MD5
d6e93c342ac1a2cebfaba5765f1d1686

SHA1
6d8e8fd52016d3fb6cb12a40b524bbcd44d074a9

SHA256
0c3a9df2ab263b416a45f4b709d38c69a6dac2e3de44d3bb4b841e55679dcac8

SHA512
3caf1ca217ee21e889025c843cd9282f2beebf478fd6fcc8670de596cb1f425ab66af990fa22a22486b3d8df64893ef4c91bcc25f44286414084cd171fbe4e81

Download Submit
C:\Windows\SysWOW64\Bgeaifia.exe

Filesize
62KB

MD5
ced22b25abafa7827cf5b0169ad77d9c

SHA1
818836644c890eda8df4e3b46ee182c28fc1e0c8

SHA256
5896c5702afe3fcdcf501ff5846e79c039981ae38cb5c0b002d4cd233b3fa9d6

SHA512
ecd3d4ef535e8f83519e5e7a5dbb74d5f22b3d636b5d4a6eb3e72e4895ec921b2c4c138352b9629ced55d14cea8ea2b2ecca5bff20b296b35da011fe4cc90ac4

Download Submit
C:\Windows\SysWOW64\Bgpgng32.exe

Filesize
62KB

MD5
21db41fc7eb025916744d499b2acd3dd

SHA1
71386708432c0aea192d26e457cbd45b4d51bff9

SHA256
05d564d1ed5172735c89e48d8e29c54d12a8a1af7ff0a730cc31411833969659

SHA512
11e899e19bf0829b048307f7a9ee94a2a20ed4abf6678f8810e52bf018bc5c7254fd608d16fc66c8246822686d7dbfbdd78b1c8948b03db24aaa46ee9f72be3f

Download Submit
C:\Windows\SysWOW64\Biadeoce.exe

Filesize
62KB

MD5
4aebc221f58fb05f2b79c3d2ad35d12d

SHA1
99ac4e0089dcabc927cc28d5ced340166c6785e0

SHA256
f675e5335f073cf5f059c19a74784cf0b59e892a576936de1980f8f855c9c1c1

SHA512
14875306b6c1b9143405a753a308e1c2a2453d42d39c30e5eb646fbbba1d805c4860a4553f4a9138358e5c0055b54c016998d8c96b315e09f50ddbacf7d43d14

Download Submit
C:\Windows\SysWOW64\Bidqko32.exe

Filesize
62KB

MD5
4fd6a8308ccaddce3ff9b3720a6a50ff

SHA1
a4853824388ff733930bb6782fca9c898a3fdf68

SHA256
89d70b66f1eceffe9132f743fadb2302062cdbd3dfc415068a3f9764d6ecf09e

SHA512
59143236408dcff5e388d1c5b225d1c1d214fd028881472a5d4b8bf96afa82d46ca6879480a91f87a59506228614c63eb5021a38aea51464c29a82e39d949c49

Download Submit
C:\Windows\SysWOW64\Bihjfnmm.exe

Filesize
62KB

MD5
c91d7b28976315d16081e288f0681759

SHA1
d8ad358c932be2e233870003e6db481c62340032

SHA256
3ee186c729ff609b39bcd5c601896bf21f7435d9546920486946b2851fd32892

SHA512
64422eedf4037f690321b536bb1bb11485b135fe04ed94530b1dcf3e051e3053e5e466cb39a1544cf055dc7103dd9a604ab69e5cc400fdeb093bfc910ce18e3b

Download Submit
C:\Windows\SysWOW64\Bjlgdc32.exe

Filesize
62KB

MD5
15793f8bd931cc0b6b9cb1772f9d3e95

SHA1
578b78529aa0e127ed78320cf563b9c6423aab49

SHA256
15ef7f018d782e6e1310bd648c4ffece0888d953366d53b4530cc70011db5647

SHA512
53f4e166b47fc909766bcbd866b997ae4b4fe3a86ad4800a5522c482789193e9520ccb83b2b0b7073aae29a84cad987a3359417876cc15d00259a6e8de2a7439

Download Submit
C:\Windows\SysWOW64\Bkafmd32.exe

Filesize
62KB

MD5
c016c164a58f3ae1599dd101256e7203

SHA1
294ca8d4521e839d2fdf4ccb720847452476cf52

SHA256
ac8debc0306f356da5718141619a4d548451ba7a14655e5e023216d1ae105fcc

SHA512
0856b9b5a2bc419e37ea1912d9066957fec146f97e5b7bf4977bfcbaaa256a5ef38b4db806b2dac8d130f1c9d1e66d4f75e3584d568d696021128072b3fd692a

Download Submit
C:\Windows\SysWOW64\Bmbiamhi.exe

Filesize
62KB

MD5
12eb98f0d96ee9811f1335d05dd363b6

SHA1
bc81aec2f9868bc93f1cec5c06b5756e88fec74b

SHA256
8f02555fedc1f4fbc052fed0ba4d4c0fd39a212636bb2c44094df698282d8e2d

SHA512
19baf0b6f7e7c71ff3a793d4260d518ed619262aff0d14945615c097197452b3dd9cd68dbf5bb3168296106a35deecff9990e2d79be2c6a1c9f7cd5eb8eed015

Download Submit
C:\Windows\SysWOW64\Bogcgj32.exe

Filesize
62KB

MD5
db2824dd62e4863b6a1f8b9e78b1eaf4

SHA1
1b4589e417e526c88d0e15b8981f19e7fc8fd59a

SHA256
ad1e0c144b7cb41a18e9765a1bd626fe805c168ce225fde679608cc3616ffde9

SHA512
e59ba0f48142518c0529d235e731a284086c6c8c630c985eab3977087f0372d1b403be26e53e7f366da0b3aacce2ad6880f5b841d190a8335ba80a9529df9051

Download Submit
C:\Windows\SysWOW64\Cabomkll.exe

Filesize
62KB

MD5
2e53773e588da36840ac493be9e135c5

SHA1
86d79bda5535ef0c5790fc9ce06c46f0b782ef83

SHA256
5f2237f449f381a01ee78f31841f79481f28e17314716849299e5d40bbe5995f

SHA512
6230e40a731463052ee406c624e0ac2660caac6ecd001441e262e4383eb826d5716bc30a5d12df262c0ab9902cb91c1bd0fe5f61e6f788a740cb65439f8f2b12

Download Submit
C:\Windows\SysWOW64\Cceddf32.exe

Filesize
62KB

MD5
4c0456df9f8ac09bf3fd14a1572fcc0b

SHA1
a461d6a6e0819df6d2f033508b22a93430322edb

SHA256
6c4fdba315c59c30391c4de994d39288a9aaa4a35ac9e070737abcb6d2ca8a34

SHA512
4eaa8364b80d72cf60687c47c8145231fbafdcfcf1a5044bfa3a8a1e8d41df06d4739c8842f822fc17a74a20df05b65122c11e57025b2d2e010e48b14018984e

Download Submit
C:\Windows\SysWOW64\Ccnncgmc.exe

Filesize
62KB

MD5
74059e777585bb908a1e418861f2a6f6

SHA1
6fb7c019fcd71f93351d8c34780889263b5ae1c5

SHA256
3dc3752f6a1eaba81d2b0141d13d38d1a0e24b85fecebd930980201fa2d86a81

SHA512
2f9e34837ac03b5ad87bc4a89338a91d82dcd6959681315311eaf7db9bad66a58203470ab54db4241c63b952107b24d95c015134f469a5c93e9bd073c7f303f2

Download Submit
C:\Windows\SysWOW64\Cfadkb32.exe

Filesize
62KB

MD5
fdcefd72397d2f6c037395f9761bfe29

SHA1
9d32fc1b18ffd7d6f5ee298f9ff026e578fa494d

SHA256
83fac2173337b9be82c5b25b958eadba2e53e67ddf06e9cd7a58599107e1700a

SHA512
918edc5667deefbd6b3da59a73ee71ecc92443916fb404c67c06e72b8cb36cba7def1200d3953626549f11ef0df1db7aa76460563463f9c0f7a83a489ac24c35

Download Submit
C:\Windows\SysWOW64\Cglgjeci.exe

Filesize
62KB

MD5
1dae3d02406ada8d07f150d72f818780

SHA1
c830dd102991755c4df43b3cbb9281f8306d81b1

SHA256
8bd3185d1d4d15d70bd77d19c46ed7ee78c0cc3fb40eab1adb84744a67c2ddb1

SHA512
0918db47048ad23b8408fc6b2458b56e7bbcfa88b0432c976ac6b8f3c71a678448e178474aedc0cf236f8997bd749ffa46117804e7285daff02a293fe6e9fa88

Download Submit
C:\Windows\SysWOW64\Cjaifp32.exe

Filesize
62KB

MD5
df29aa54d8b7eaa12d17b65c0477b1dc

SHA1
72b6e1ab180ed8097b679cb3496fa50f25f25f45

SHA256
d5fc95c89cc7c67eb9368c1196fb7c7cc45dec5fad1d4016bdb8549e35d90cef

SHA512
01f62fd9d917b196c03838526c8ebab87ccd88f94be514fecee0a553652cfe03fa3933df2827577005e976443161177d421e519cfda72001c9084153b41b6a45

Download Submit
C:\Windows\SysWOW64\Cmmgof32.exe

Filesize
62KB

MD5
2fb211990f7b4442c3a2818018d646e0

SHA1
68d275de3dbb218668537f65499c3aafe7d5639c

SHA256
7c53be74369510ba3f5ee008f0346866f05b60298d7dd855beec4955cb5934cf

SHA512
6ece28622fe7248def8ddf916378acfa623fda7090b1d03c8f306afac2e016144ad55d2f97b2f0c8936b832fe7492f88f15d3843fd9c7a8838be4f32cf219ce7

Download Submit
C:\Windows\SysWOW64\Cmniml32.exe

Filesize
62KB

MD5
d790cfbad1a83e62f588dec32ef192c6

SHA1
9f0831d4d87a5f78c187f71dbcde8887e31058d3

SHA256
cd5029ae69be02e48aea6d6b80068a1120c645e8b25713bfc966f5c8cc89dd58

SHA512
35e1db71730455a4afa4c7791887781a8355101eb8eb8ecb1b891620b50a95468942d2de39c242510449013768b28e83fa1a2799bc4046d9338b34b61f5a9f94

Download Submit
C:\Windows\SysWOW64\Dgeenfog.exe

Filesize
62KB

MD5
299d91ef399a874369272456f6b826d6

SHA1
f28c3eaea5f0492905eea092739652f936a65712

SHA256
2ae34d13e4ea3bbc35c92e3cbe813a3a61bbde71100e3c292f95ae8a469bf73d

SHA512
f25d183ea8dc47475329a164bbd14faf74ea91af7e9a462983c878fa0973c3804499f874b477cd7ae1cea70ccbf433e60c2bd21adc562a47619ff056187d9a65

Download Submit
C:\Windows\SysWOW64\Dgejpd32.exe

Filesize
62KB

MD5
234a1d51658b5d6c9e2cab4bc08d6234

SHA1
eb9037e12715986dc78f2482414ac3658a25d1e4

SHA256
2484903c8e1a8cde1f3e405e15f7c50497e747ca4b35c00f06d40098b691506b

SHA512
f8e2f220b7be22fa9e29f141eccb3089a4e0ebfa902d0e1452c5e5ae3af90d01e9c4df2887860bb80fb6c851f9c0be27d166a5e919b6c3e3d0ba496e74030d25

Download Submit
C:\Windows\SysWOW64\Dhphmj32.exe

Filesize
62KB

MD5
1dfc866b6f45b2df22b27769b7863c6b

SHA1
40b02c62662fd76710507156d80bc2bb86815580

SHA256
d45ba2781076b1ceec492733ec70a7393f5371ce4d9019291c1af12a637d942f

SHA512
ea555de2baf42bfe5f1d300f319e9d5f0129ed642471a1e04f01b517d061827fbb9be8eac0a8b62b85f4c467c2412e6bba3c20c78fa75129bc2e93192c6d4ee0

Download Submit
C:\Windows\SysWOW64\Diffglam.exe

Filesize
62KB

MD5
22adedd5d9a476316cf93c7addb1085a

SHA1
26515dbb6b0ab6527db2b1643bfca0547872b787

SHA256
530926233aed044e6cd810ef10b6d16c661c92987039b5e4bcd2fd369a5f64d9

SHA512
8126b60bd685da12aa84cd8e4738e7454c4d751548064e82b00dab764b16e9a0dc5faddbb9384e48fd266216a546a9d2a19c0f4b16511a73406c478235fcb73b

Download Submit
C:\Windows\SysWOW64\Djfcaohp.exe

Filesize
62KB

MD5
1f1e28210281ed45f29338632b8b26af

SHA1
0139324aba50606eb04e310699695836038b32d8

SHA256
271bcfbb6168157e65e8a53ad03b4f8f048cee75c8e1186437c955ffc8f74b50

SHA512
88802cdea92190e33b49e944377215bbbbb6683a060e0f06488adafa7d62a12ec2da1cc43417c1c70d21961c1389afb194a08570c5b87b025baf1da75892af2e

Download Submit
C:\Windows\SysWOW64\Djhimica.exe

Filesize
62KB

MD5
721e5041699769ca9814355c81662414

SHA1
8b00780c8937408578621759e6c5537d8966a692

SHA256
145264efa7a5f28bb630c0a83ee3681b70daaa1e587ce593ef45e641ae476489

SHA512
0142f4ec75332e45120a0a510c69062e1687724563b07921e7bc88fb10e45c075dd747a11cf11cd7a285881da913189d981075a2949d0c044ce8a9b3ffb9cb31

Download Submit
C:\Windows\SysWOW64\Dkokcl32.exe

Filesize
62KB

MD5
37b780a9bef3897400083888701e7610

SHA1
6529abc1383978ae906973c7638e168d4dcc200a

SHA256
fa27f57607d0a149d55052f7b03524cd1f7cd0ff164818d7893c15f474a3dd06

SHA512
808b5288bb0817f56440ae3ea6f2b1864793ffa9cde3137432f9364e32c57ced625677ac3ee282f13afcb8bcdee61fbfa41044c58007c76fcaa0a042bce75d02

Download Submit
C:\Windows\SysWOW64\Dpllbp32.exe

Filesize
62KB

MD5
543708239948604c36fe36aa93349d0e

SHA1
88c447ef130b0534ecc71d4d6fbec030d249e257

SHA256
0d3cf39b9dd80504915680b17bacbac66f00030809da89f9b3d5343dc56b8697

SHA512
b2da0e8ead2731dad78f71e083bc6f0eb1b33e2bee1d1098f02a86cd3ec2f79516df99749b525f6d1ae83331a5f80736b9bcbf0f0fec8309c27f432e4a4cefee

Download Submit
C:\Windows\SysWOW64\Dpqodfij.exe

Filesize
62KB

MD5
be14ba361762fc859594b1e13b58b48a

SHA1
73af9eba0809c2f141c731daad0cbed2c45c0a8a

SHA256
5f47d1f174fc77a3c0cc498427ced2c7aae6ccaa8c54563c265d8eaf4cef6d7e

SHA512
8e84560d236ecdb4d0001356115a63eb4c78d582818320ff4a3a2df4ad858f95f6f8aa9625da305392ab6cda43d57173b2598f313242f4c087b7e4d0d26491fe

Download Submit
C:\Windows\SysWOW64\Ekcgkb32.exe

Filesize
62KB

MD5
c2d9e686db3ad0736427a298e12b7ce7

SHA1
fd578f86fa20245e606cfce185d754d8bc8dc80c

SHA256
89f4387af21d8cc390ba16c59b3fcefb387f05a0e56b43352656b613cc4aaeb4

SHA512
383baee114a34dcad99c77eb514e24379768113f42bc2a33f282cd4262ef3dbfe2f3df6524624c1a751e603f3d05e66cf1d5b6653643e387bccd004d97aea76b

Download Submit
C:\Windows\SysWOW64\Filapfbo.exe

Filesize
62KB

MD5
9ba2c936e48abb7d28b53d3cb83fdc33

SHA1
7bdf8805f175a1cd05537d83f871bd19afc1ea71

SHA256
0fa97f7eaf03d08b0a59454385705c84e0fc163c6d6cddc1ac9f18d9912a4ac5

SHA512
a8a3d565534c14fa39cea934b115a2ad0f363cff65957a492d8dcdadfdfb38c477a2b2464f72db780754f306a49c6b23d8f1ac4a437ff6cb4dfff3a7ef6844dc

Download Submit
C:\Windows\SysWOW64\Idahjg32.exe

Filesize
62KB

MD5
749769aa547761f6589b7d8ac8a7fbb3

SHA1
2d9450a158d951017ce5488bbce7e728d32f2497

SHA256
64d01b1ae742fb0c311b24603489ed2ba0548d171f1c67a82da7d5d946393877

SHA512
68cbc76aadf845b37bbd485f2699a5fe6afd14902e3abd04fabc9ec9e3450cfffd82eaddac0e0e339aed41461442dded8410ebe5ceb55e5332f4ad1cca4c2c0e

Download Submit
C:\Windows\SysWOW64\Idbodn32.exe

Filesize
62KB

MD5
d85cbb7959bcea47deb38d982d2924b3

SHA1
5080b972d095929ccf0018564c5bcb6b5fbb7bee

SHA256
2ae00b503f2c108ba181bae6eefcc6c666c08e1b1386bbe933d364bcba8d6520

SHA512
7877924b7f12a5615965d8b8193dfc63b35ecd8d79e9348d22252756436fd2301310390b91a83a41af39648187e2818cc0d8b3a1debb1e932166f87daca180c3

Download Submit
C:\Windows\SysWOW64\Jgkdbacp.exe

Filesize
62KB

MD5
9c044724a93cd9a9fe16c5b6fe9e6db9

SHA1
02eb836b9c170549e2849ae26f16fae18221d588

SHA256
4901edee7282a78ca5f9a3e6dae5a07203d4ec2bb5fe2ad8c36e065dff22ee68

SHA512
4f43e1a49c8a0744f93a136b64986c13b3f9c6c4acfaf9df140a6d3c224c889f5e2f05048a3dded36e778db9190eba339996c5ea75eb764b7dd521cd01dbcf4a

Download Submit
C:\Windows\SysWOW64\Jklinohd.exe

Filesize
62KB

MD5
aad2722ec8b2acabf853b544e7cd15ae

SHA1
793ff46ed2d7ee2ece9d9c519cd368bb7a28f3d2

SHA256
53af532b17745cef45dccb0726e548dbd97e2802d52f7c16e01ffd654de28944

SHA512
8e648166dd15e92d60cfd5907db8229f3abc6a6112511c48943d8101dd06d10d321c9bae692d0c4513f856bdade29e5923781756e2c828db07c4edc2672548b2

Download Submit
C:\Windows\SysWOW64\Lckiihok.exe

Filesize
62KB

MD5
e743462755abd349f585f588c41951e1

SHA1
59b060b3b33032f694bfdea58c727424dd15ab3b

SHA256
e07eae47aad5423138a05b5bf2e0cd84d41857668d5de9a54b6441ab260b2dd5

SHA512
509e27c7d29e4938197b160e26046dd00057bcf5a87de0985f50802b4ff08d236897d89d808306b9db97f2ea7f5e701d9c757b08ca992c339eda2b458f21ed2a

Download Submit
C:\Windows\SysWOW64\Lqhdbm32.exe

Filesize
62KB

MD5
eeaa057567bdc8b7bacf04df772d200c

SHA1
4664c5582898bbc9d16ec47a79879166614a55ec

SHA256
91609cb0a38e113b1d7fac52a292dfb082fe31cbd9906f0489368c3996bf4931

SHA512
fa5e0822e36d71ee13a2dfa002c20ae237ca679d019bf561092e230d05cd6f1a4d538340082b8c2b0d8baa60ea6259a3ee279d868f75fec057543ebce5783055

Download Submit
C:\Windows\SysWOW64\Nhlfoodc.exe

Filesize
62KB

MD5
1d23ace7d2e1f4c199e405a0c343a447

SHA1
0d3b7054a06da214cd4f50dfc75d9aaa5cd41429

SHA256
7c7fdead51a582f5d0ace4855c5f4692f8407564b64274917d079a9623b991cd

SHA512
f323ba27ac2aabdeca87d300b2b9bd9f951f886f90ac9381222437a8d9280fe6c0d3f693f82827f8b0eb8aa11094cbbece010086ab6e1e2dfe0780c2690f5765

Download Submit
C:\Windows\SysWOW64\Oghghb32.exe

Filesize
62KB

MD5
34499b57a0c62e68dcee4d34b46ac2ab

SHA1
d4c236a70fc7dfe3f1d421988beaa77ce7b88649

SHA256
65d97f3e73e44561e6f6efac2a8b87c7cc1729fa7a4a33852b686f00488bd571

SHA512
8145dbc34d549faabef73f4ce48020b1b46572547f5c3d508b07f4faae94ec880d6a1ea1470ececf0b6ebc5ca99ba9b725cde9488df1f49bf9e512687437f2c3

Download Submit
C:\Windows\SysWOW64\Phedhmhi.exe

Filesize
62KB

MD5
60d927f077ce8d02db33b327437f8dd9

SHA1
b22555ea38c83aa0096c312c9b4b899d987eed89

SHA256
4c71b28a2603cfaf1745676c45ef1e525af5ee53e9162c9efee0226523401c74

SHA512
5af22051ba6490d9ab53efa86265334e5d285b352f1492783baa6ab1a14db80e77104304b08d1e85cba74c5882ff34cf3b1e794db94cd57482df9207f7990381

Download Submit
C:\Windows\SysWOW64\Phlacbfm.exe

Filesize
62KB

MD5
8914be9abc093b8d6109593fe98e5da6

SHA1
20891a835d453a2b1a25eb509501620f7f802d55

SHA256
2277b9ae2b05ae822a47817064169f42305ac1c39fbe198a07c128e4209188a6

SHA512
ac0f33be270302be40c4664fc6dc4abc3b15eb5f2fbca286aea58ccc9f547307149eaf89dfdd187d6391f2dad407572fce939750b3ca3443c2c490480a026f70

Download Submit
C:\Windows\SysWOW64\Qdaniq32.exe

Filesize
62KB

MD5
ad0c61519a873012b4c77f4a92a69ed7

SHA1
7d8d4ce72b67d82d2db25bdafda3050a6b6cd143

SHA256
0a11b6be3217ec98c378bf82d016aa6364c6cf662e6df61bd7f54df2e2a93833

SHA512
7d0ddb8d0d76ce484221edf80ae4d3ac5c07bed27b364f08d03f1991a308a61dc11aef27b80bd2d0092f1b5531131b0c6beba73b00027eb42e305b0c7318d39e

Download Submit
C:\Windows\SysWOW64\Qfpbmfdf.exe

Filesize
62KB

MD5
cf7d69113f27ba79c325c187d0ca2a42

SHA1
062cec1fdb7b76a20462def7191e2d7ae20c2ce8

SHA256
1641d867ee39e3184677268477181cf0917ea1ff92c4835210322ef92de3ff73

SHA512
a91f837db4ade8823fb8282a61fc8e9ee817a1f5d3e99f9c4eea866fe4101e47303f51fea41b8b137b69fa4b8fef7fb7eb9add29e16b08b4367aded36779d90d

Download Submit
C:\Windows\SysWOW64\Qgpogili.exe

Filesize
62KB

MD5
23ca8c02608e6e8fb056e9ed84925a22

SHA1
f3d58486a98c5625eef99850568387961060797a

SHA256
4fb5aa404d652b34ccb922404dcddcda82c8ce05abc7736c273527b904e1a7bd

SHA512
f8d16ea71e917ba4807cf86e8fcdc9f61ca9871ad367e541d0357265916e8a68a07eeaf8c4435ea938a6436f52380e3c6a68721c7d26d355a68a094ff15366c2

Download Submit
C:\Windows\SysWOW64\Qlmgopjq.exe

Filesize
62KB

MD5
e77bfda6e77d9338ac259004e1eb3dc2

SHA1
423c3a611d64506ca4ebc105ec5995e116241c9c

SHA256
a7811cbf0cd26f5098281efc2d2e48e8499814cbcb80fbecbd9bdad207b2936d

SHA512
2195f225dcd5c95a9beb2ff2531e490873840a629c0267fb4b4514f6900dda827f05f393d3b4dc273f4f6a599fb1dbe880fe52a5e1350a7de6a9f38978dfec8d

Download Submit
memory/8-131-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/448-266-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/448-189-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/640-309-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/640-232-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/756-171-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/756-81-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/804-230-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/804-154-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/964-72-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/964-1-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/964-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1048-140-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1048-212-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1084-145-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1084-222-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1128-303-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1144-168-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1528-135-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1528-48-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1704-162-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1704-73-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1708-218-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2004-296-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2004-221-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2480-180-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2480-256-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2700-248-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3008-187-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3008-100-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3064-283-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3064-204-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3104-56-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3104-143-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3128-125-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3280-16-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3280-98-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3332-267-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3472-290-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3480-65-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3480-152-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3668-113-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3684-257-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3740-274-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3740-196-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3876-95-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3896-288-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4076-314-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4084-126-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4084-40-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4244-241-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4244-316-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4508-276-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4648-117-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4648-32-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4808-227-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4824-319-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4868-25-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4868-108-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4872-9-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4872-90-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4924-176-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4924-239-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/5020-297-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads