18217b4b445a3af93e9e2af5bdcb85a74cda0efe52056de2f8014541c8c285c6

Analysis

max time kernel
164s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dced71d68ffe28cbb42e1119efb221de.exe
Size

79KB
MD5

dced71d68ffe28cbb42e1119efb221de
SHA1

3ff1cc42bca5dc9aa66e9285bc23f93585481039
SHA256

18217b4b445a3af93e9e2af5bdcb85a74cda0efe52056de2f8014541c8c285c6
SHA512

43c8fcea9c7860da4b67b53a9a35fe06c8b6438a7455303ce4205cf927f0f6c8f00b5f7b2761d0fa34fbc5b1a50313b40ef9f2302d2fd25e8002537f8e8f3f4f
SSDEEP

1536:CG3C+G/YOnBgdeXvhSUEeiFkSIgiItKq9v6DK:CGSRgfWpSUEeixtBtKq9vV

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcfimheb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfoflj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enoddi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkggfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aiapjecl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfbkijdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pacojc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncekjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edonmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdlbpldg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Einckibc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jeanfkob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chphhn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gddigk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgimepmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndnnbgcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omnqhbap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obgccn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oejijiip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlipal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcdbmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlnbqjjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfedfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnfiia32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgboiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fghkdjdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gogjflhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbqlhfgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofdpmi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgomjc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkepbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Loaafnah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Didnmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lacihleo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Injcginc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inmplh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmbamdkm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgnekcei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjmgomjc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiaomkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ponfdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmnmbbgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okcmingd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nifldj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abedil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmlekq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbiooolb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilafcomm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alkdbllo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nemcca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kikafjoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmccecfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqnbgpmb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdogcqhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfaglf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdlbpldg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cffcilob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pagbklae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abemof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iiokacgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogcfncjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cabofaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmipkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pidaleei.exe

Executes dropped EXE 64 IoCs

pid	Process
1832	Onhhmpoo.exe
1544	Bgfhnpde.exe
4264	Bpfcelml.exe
3056	Cnpibh32.exe
3016	Dfngcdhi.exe
4500	Eldbbjof.exe
4068	Efampahd.exe
2624	Foonjd32.exe
3696	Fljedg32.exe
5060	Hodqlq32.exe
2688	Hhaope32.exe
1812	Iiokacgp.exe
4144	Jginej32.exe
4348	Kfaglf32.exe
4976	Kidmcqeg.exe
940	Lmfodn32.exe
4304	Mdodbf32.exe
2968	Nplkhf32.exe
4044	Ndomiddc.exe
4248	Okbhlm32.exe
4808	Pahpee32.exe
888	Bkamdi32.exe
2568	Bdiamnpc.exe
4692	Bilcol32.exe
5032	Cqghcn32.exe
3532	Cicjokll.exe
5052	Cigcjj32.exe
1348	Dajnol32.exe
1992	Ebpqjmpd.exe
4600	Flpkcbqm.exe
3708	Gogjflhf.exe
3720	Gekeie32.exe
1040	Ijgjpaao.exe
3356	Jomeoggk.exe
2148	Nmbamdkm.exe
208	Ojmgggdo.exe
4420	Omnqhbap.exe
4416	Pdlbpldg.exe
656	Pmipdq32.exe
3244	Cgecpa32.exe
3456	Dmiaig32.exe
2916	Enoddi32.exe
2856	Eglbhnkp.exe
4368	Emikpeig.exe
432	Fjfnphpf.exe
4316	Fhjoilop.exe
1188	Gmnmbbgp.exe
264	Hkggfe32.exe
4612	Hmjmnpmb.exe
4880	Hoiihcde.exe
3732	Ikechced.exe
1616	Jeanfkob.exe
4520	Jojboa32.exe
1564	Jamhflqq.exe
4220	Kohnpoib.exe
216	Loaafnah.exe
1844	Qefkcl32.exe
4364	Djgbmffn.exe
3936	Gjagapbn.exe
2304	Hfmqapcl.exe
4540	Iplkje32.exe
3052	Jkplilgk.exe
1192	Lkgkqh32.exe
4472	Nocphd32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Clknii32.exe	Beaelofp.exe
File created	C:\Windows\SysWOW64\Dcknnglh.dll	Ijgjpaao.exe
File created	C:\Windows\SysWOW64\Lgnekcei.exe	Laqlclga.exe
File created	C:\Windows\SysWOW64\Neafdjak.exe	Nifldj32.exe
File opened for modification	C:\Windows\SysWOW64\Bcahgh32.exe	Blhpjnbe.exe
File created	C:\Windows\SysWOW64\Hedaoa32.exe	Hpgigj32.exe
File created	C:\Windows\SysWOW64\Nhokeolc.exe	Naecieef.exe
File opened for modification	C:\Windows\SysWOW64\Ndidgg32.exe	Ndghahib.exe
File opened for modification	C:\Windows\SysWOW64\Pmlekq32.exe	Pbgqnhpl.exe
File created	C:\Windows\SysWOW64\Nplkhf32.exe	Mdodbf32.exe
File created	C:\Windows\SysWOW64\Ebpqjmpd.exe	Dajnol32.exe
File created	C:\Windows\SysWOW64\Pfacfmlb.dll	Chphhn32.exe
File created	C:\Windows\SysWOW64\Iiehjgnp.exe	Idbfhiko.exe
File opened for modification	C:\Windows\SysWOW64\Nknolaob.exe	Neafdjak.exe
File opened for modification	C:\Windows\SysWOW64\Jebfgl32.exe	Jljbogaf.exe
File opened for modification	C:\Windows\SysWOW64\Qjjhla32.exe	Pqbdclak.exe
File created	C:\Windows\SysWOW64\Ebihiaml.dll	Bqkifb32.exe
File opened for modification	C:\Windows\SysWOW64\Oiakpheo.exe	Obgccn32.exe
File created	C:\Windows\SysWOW64\Gedqcjbo.dll	Ipjenn32.exe
File opened for modification	C:\Windows\SysWOW64\Gmojep32.exe	Ennqpkcm.exe
File opened for modification	C:\Windows\SysWOW64\Bmfqhmid.exe	Bmokgnol.exe
File opened for modification	C:\Windows\SysWOW64\Cnpibh32.exe	Bpfcelml.exe
File created	C:\Windows\SysWOW64\Bdiamnpc.exe	Bkamdi32.exe
File created	C:\Windows\SysWOW64\Aonhblad.exe	Aiapjecl.exe
File created	C:\Windows\SysWOW64\Kmgdaokh.exe	Kkfkod32.exe
File opened for modification	C:\Windows\SysWOW64\Fncilm32.exe	Fjccpo32.exe
File created	C:\Windows\SysWOW64\Pbnngi32.exe	Ofdpmi32.exe
File created	C:\Windows\SysWOW64\Mndonl32.dll	Jkplilgk.exe
File opened for modification	C:\Windows\SysWOW64\Pcncjh32.exe	Njploeoi.exe
File opened for modification	C:\Windows\SysWOW64\Bcghlnih.exe	Biadoeib.exe
File opened for modification	C:\Windows\SysWOW64\Cipppc32.exe	Cgndikgd.exe
File created	C:\Windows\SysWOW64\Jebfgl32.exe	Jljbogaf.exe
File created	C:\Windows\SysWOW64\Hmegdjkj.dll	Emikpeig.exe
File opened for modification	C:\Windows\SysWOW64\Klfjbpmn.exe	Jfbkijdo.exe
File created	C:\Windows\SysWOW64\Nbjndimm.dll	Knaldo32.exe
File created	C:\Windows\SysWOW64\Edcghbbi.exe	Einckibc.exe
File created	C:\Windows\SysWOW64\Ggdiqkah.exe	Gqjada32.exe
File created	C:\Windows\SysWOW64\Honohb32.dll	Jmnakqcc.exe
File created	C:\Windows\SysWOW64\Bcahgh32.exe	Blhpjnbe.exe
File opened for modification	C:\Windows\SysWOW64\Fqpomo32.exe	Fghkdjdo.exe
File opened for modification	C:\Windows\SysWOW64\Nmbamdkm.exe	Jomeoggk.exe
File created	C:\Windows\SysWOW64\Cmnncb32.exe	Ckpagg32.exe
File created	C:\Windows\SysWOW64\Naomha32.dll	Pbnngi32.exe
File opened for modification	C:\Windows\SysWOW64\Einckibc.exe	Ecdkno32.exe
File created	C:\Windows\SysWOW64\Afghgkdl.exe	Acdbpq32.exe
File created	C:\Windows\SysWOW64\Bqkifb32.exe	Bjaqih32.exe
File created	C:\Windows\SysWOW64\Gkpmbm32.dll	Inhgaipf.exe
File created	C:\Windows\SysWOW64\Nkeodibl.dll	Eoccii32.exe
File opened for modification	C:\Windows\SysWOW64\Mgdklb32.exe	Mnlfclip.exe
File created	C:\Windows\SysWOW64\Cgijnk32.exe	Cmdfpbkc.exe
File created	C:\Windows\SysWOW64\Gqjada32.exe	Gfemfhje.exe
File opened for modification	C:\Windows\SysWOW64\Dmdhmj32.exe	Dfjpppbh.exe
File opened for modification	C:\Windows\SysWOW64\Omegdebp.exe	Oejbpb32.exe
File created	C:\Windows\SysWOW64\Hfggoh32.dll	Pacojc32.exe
File created	C:\Windows\SysWOW64\Kfaglf32.exe	Jginej32.exe
File created	C:\Windows\SysWOW64\Bghifmbc.dll	Ejegdngb.exe
File opened for modification	C:\Windows\SysWOW64\Fcdbmb32.exe	Fmjjqhpn.exe
File created	C:\Windows\SysWOW64\Mgbnfb32.exe	Mgpaqbcf.exe
File created	C:\Windows\SysWOW64\Poomom32.exe	Pibdff32.exe
File created	C:\Windows\SysWOW64\Pagbklae.exe	Pnfiia32.exe
File created	C:\Windows\SysWOW64\Jfcbcp32.exe	Jpijgf32.exe
File created	C:\Windows\SysWOW64\Eeacgp32.dll	Cdhfpm32.exe
File opened for modification	C:\Windows\SysWOW64\Gmnmbbgp.exe	Fhjoilop.exe
File created	C:\Windows\SysWOW64\Fkanbk32.dll	Fcdbmb32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhpgmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gekeie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oejbpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eoilfidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnjbbemd.dll"	Okbhgq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ooqqmoac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flohdkpg.dll"	Oejijiip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncekjp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lhjnpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Okbhlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cepdodie.dll"	Omnqhbap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ilafcomm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpcppm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hojndd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogcfncjf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hdnlmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnpfje32.dll"	Jpdhdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldakbepc.dll"	Oejbpb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jljbogaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgfidb32.dll"	Pmipdq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enoddi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqhfgqob.dll"	Dalhgfmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oocdme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmicee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Doojni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jhdlncnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amanfpkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmmjpjpg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqbdclak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jqbbicel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnmdkk32.dll"	Bdndik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdndik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clmicmbn.dll"	Jojboa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hdnlmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aijlqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cedbbo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgfhnpde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcbkgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkajoiok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oblhlpne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acppniod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcqeng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qefkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjjnen32.dll"	Gmojep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Flpkcbqm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fqnbgpmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkhkfnak.dll"	Ajeami32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcdoqgfq.dll"	Fckhnaab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odgohi32.dll"	Hojndd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhbaaa32.dll"	Pdkolm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akpbae32.dll"	Kgdpgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gljlhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhhhma32.dll"	Nlnbqjjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfcqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfiaomkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdkdqinj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdpcap32.dll"	Dpcppm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbnngi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgiojp32.dll"	Bmfqhmid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icgjfgef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emjomf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndnnbgcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Noglik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Caioglje.dll"	Ondleo32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 1832	5116	dced71d68ffe28cbb42e1119efb221de.exe	93
PID 5116 wrote to memory of 1832	5116	dced71d68ffe28cbb42e1119efb221de.exe	93
PID 5116 wrote to memory of 1832	5116	dced71d68ffe28cbb42e1119efb221de.exe	93
PID 1832 wrote to memory of 1544	1832	Onhhmpoo.exe	94
PID 1832 wrote to memory of 1544	1832	Onhhmpoo.exe	94
PID 1832 wrote to memory of 1544	1832	Onhhmpoo.exe	94
PID 1544 wrote to memory of 4264	1544	Bgfhnpde.exe	95
PID 1544 wrote to memory of 4264	1544	Bgfhnpde.exe	95
PID 1544 wrote to memory of 4264	1544	Bgfhnpde.exe	95
PID 4264 wrote to memory of 3056	4264	Bpfcelml.exe	96
PID 4264 wrote to memory of 3056	4264	Bpfcelml.exe	96
PID 4264 wrote to memory of 3056	4264	Bpfcelml.exe	96
PID 3056 wrote to memory of 3016	3056	Cnpibh32.exe	97
PID 3056 wrote to memory of 3016	3056	Cnpibh32.exe	97
PID 3056 wrote to memory of 3016	3056	Cnpibh32.exe	97
PID 3016 wrote to memory of 4500	3016	Dfngcdhi.exe	98
PID 3016 wrote to memory of 4500	3016	Dfngcdhi.exe	98
PID 3016 wrote to memory of 4500	3016	Dfngcdhi.exe	98
PID 4500 wrote to memory of 4068	4500	Eldbbjof.exe	99
PID 4500 wrote to memory of 4068	4500	Eldbbjof.exe	99
PID 4500 wrote to memory of 4068	4500	Eldbbjof.exe	99
PID 4068 wrote to memory of 2624	4068	Efampahd.exe	101
PID 4068 wrote to memory of 2624	4068	Efampahd.exe	101
PID 4068 wrote to memory of 2624	4068	Efampahd.exe	101
PID 2624 wrote to memory of 3696	2624	Foonjd32.exe	102
PID 2624 wrote to memory of 3696	2624	Foonjd32.exe	102
PID 2624 wrote to memory of 3696	2624	Foonjd32.exe	102
PID 3696 wrote to memory of 5060	3696	Fljedg32.exe	103
PID 3696 wrote to memory of 5060	3696	Fljedg32.exe	103
PID 3696 wrote to memory of 5060	3696	Fljedg32.exe	103
PID 5060 wrote to memory of 2688	5060	Hodqlq32.exe	104
PID 5060 wrote to memory of 2688	5060	Hodqlq32.exe	104
PID 5060 wrote to memory of 2688	5060	Hodqlq32.exe	104
PID 2688 wrote to memory of 1812	2688	Hhaope32.exe	105
PID 2688 wrote to memory of 1812	2688	Hhaope32.exe	105
PID 2688 wrote to memory of 1812	2688	Hhaope32.exe	105
PID 1812 wrote to memory of 4144	1812	Iiokacgp.exe	106
PID 1812 wrote to memory of 4144	1812	Iiokacgp.exe	106
PID 1812 wrote to memory of 4144	1812	Iiokacgp.exe	106
PID 4144 wrote to memory of 4348	4144	Jginej32.exe	107
PID 4144 wrote to memory of 4348	4144	Jginej32.exe	107
PID 4144 wrote to memory of 4348	4144	Jginej32.exe	107
PID 4348 wrote to memory of 4976	4348	Kfaglf32.exe	108
PID 4348 wrote to memory of 4976	4348	Kfaglf32.exe	108
PID 4348 wrote to memory of 4976	4348	Kfaglf32.exe	108
PID 4976 wrote to memory of 940	4976	Kidmcqeg.exe	109
PID 4976 wrote to memory of 940	4976	Kidmcqeg.exe	109
PID 4976 wrote to memory of 940	4976	Kidmcqeg.exe	109
PID 940 wrote to memory of 4304	940	Lmfodn32.exe	110
PID 940 wrote to memory of 4304	940	Lmfodn32.exe	110
PID 940 wrote to memory of 4304	940	Lmfodn32.exe	110
PID 4304 wrote to memory of 2968	4304	Mdodbf32.exe	111
PID 4304 wrote to memory of 2968	4304	Mdodbf32.exe	111
PID 4304 wrote to memory of 2968	4304	Mdodbf32.exe	111
PID 2968 wrote to memory of 4044	2968	Nplkhf32.exe	112
PID 2968 wrote to memory of 4044	2968	Nplkhf32.exe	112
PID 2968 wrote to memory of 4044	2968	Nplkhf32.exe	112
PID 4044 wrote to memory of 4248	4044	Ndomiddc.exe	113
PID 4044 wrote to memory of 4248	4044	Ndomiddc.exe	113
PID 4044 wrote to memory of 4248	4044	Ndomiddc.exe	113
PID 4248 wrote to memory of 4808	4248	Okbhlm32.exe	114
PID 4248 wrote to memory of 4808	4248	Okbhlm32.exe	114
PID 4248 wrote to memory of 4808	4248	Okbhlm32.exe	114
PID 4808 wrote to memory of 888	4808	Pahpee32.exe	115

C:\Users\Admin\AppData\Local\Temp\dced71d68ffe28cbb42e1119efb221de.exe
"C:\Users\Admin\AppData\Local\Temp\dced71d68ffe28cbb42e1119efb221de.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\SysWOW64\Onhhmpoo.exe
  C:\Windows\system32\Onhhmpoo.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\SysWOW64\Bgfhnpde.exe
    C:\Windows\system32\Bgfhnpde.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Windows\SysWOW64\Bpfcelml.exe
      C:\Windows\system32\Bpfcelml.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4264
    - - C:\Windows\SysWOW64\Cnpibh32.exe
        
        C:\Windows\system32\Cnpibh32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3056
      - C:\Windows\SysWOW64\Dfngcdhi.exe
        
        C:\Windows\system32\Dfngcdhi.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\SysWOW64\Eldbbjof.exe
        
        C:\Windows\system32\Eldbbjof.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\SysWOW64\Efampahd.exe
        
        C:\Windows\system32\Efampahd.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\SysWOW64\Foonjd32.exe
        
        C:\Windows\system32\Foonjd32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\SysWOW64\Fljedg32.exe
        
        C:\Windows\system32\Fljedg32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3696
        
        C:\Windows\SysWOW64\Hodqlq32.exe
        
        C:\Windows\system32\Hodqlq32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\SysWOW64\Hhaope32.exe
        
        C:\Windows\system32\Hhaope32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        C:\Windows\SysWOW64\Iiokacgp.exe
        
        C:\Windows\system32\Iiokacgp.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Windows\SysWOW64\Jginej32.exe
        
        C:\Windows\system32\Jginej32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4144
        
        C:\Windows\SysWOW64\Kfaglf32.exe
        
        C:\Windows\system32\Kfaglf32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\SysWOW64\Kidmcqeg.exe
        
        C:\Windows\system32\Kidmcqeg.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Windows\SysWOW64\Lmfodn32.exe
        
        C:\Windows\system32\Lmfodn32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:940
        
        C:\Windows\SysWOW64\Mdodbf32.exe
        
        C:\Windows\system32\Mdodbf32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Windows\SysWOW64\Nplkhf32.exe
        
        C:\Windows\system32\Nplkhf32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2968
        
        C:\Windows\SysWOW64\Ndomiddc.exe
        
        C:\Windows\system32\Ndomiddc.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\SysWOW64\Okbhlm32.exe
        
        C:\Windows\system32\Okbhlm32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4248
        
        C:\Windows\SysWOW64\Pahpee32.exe
        
        C:\Windows\system32\Pahpee32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Bkamdi32.exe
        
        C:\Windows\system32\Bkamdi32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:888
        
        C:\Windows\SysWOW64\Bdiamnpc.exe
        
        C:\Windows\system32\Bdiamnpc.exe
        24⤵
        Executes dropped EXE
        
        PID:2568
        
        C:\Windows\SysWOW64\Bilcol32.exe
        
        C:\Windows\system32\Bilcol32.exe
        25⤵
        Executes dropped EXE
        
        PID:4692
        
        C:\Windows\SysWOW64\Cqghcn32.exe
        
        C:\Windows\system32\Cqghcn32.exe
        26⤵
        Executes dropped EXE
        
        PID:5032
        
        C:\Windows\SysWOW64\Cicjokll.exe
        
        C:\Windows\system32\Cicjokll.exe
        27⤵
        Executes dropped EXE
        
        PID:3532
        
        C:\Windows\SysWOW64\Cigcjj32.exe
        
        C:\Windows\system32\Cigcjj32.exe
        28⤵
        Executes dropped EXE
        
        PID:5052
        
        C:\Windows\SysWOW64\Dajnol32.exe
        
        C:\Windows\system32\Dajnol32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1348
        
        C:\Windows\SysWOW64\Ebpqjmpd.exe
        
        C:\Windows\system32\Ebpqjmpd.exe
        30⤵
        Executes dropped EXE
        
        PID:1992
        
        C:\Windows\SysWOW64\Flpkcbqm.exe
        
        C:\Windows\system32\Flpkcbqm.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4600
        
        C:\Windows\SysWOW64\Gogjflhf.exe
        
        C:\Windows\system32\Gogjflhf.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3708
        
        C:\Windows\SysWOW64\Gekeie32.exe
        
        C:\Windows\system32\Gekeie32.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3720
        
        C:\Windows\SysWOW64\Hedhoc32.exe
        
        C:\Windows\system32\Hedhoc32.exe
        34⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Ijgjpaao.exe
        
        C:\Windows\system32\Ijgjpaao.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1040
        
        C:\Windows\SysWOW64\Jomeoggk.exe
        
        C:\Windows\system32\Jomeoggk.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3356
        
        C:\Windows\SysWOW64\Nmbamdkm.exe
        
        C:\Windows\system32\Nmbamdkm.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2148
        
        C:\Windows\SysWOW64\Ojmgggdo.exe
        
        C:\Windows\system32\Ojmgggdo.exe
        38⤵
        Executes dropped EXE
        
        PID:208
        
        C:\Windows\SysWOW64\Omnqhbap.exe
        
        C:\Windows\system32\Omnqhbap.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\Pdlbpldg.exe
        
        C:\Windows\system32\Pdlbpldg.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4416
        
        C:\Windows\SysWOW64\Pmipdq32.exe
        
        C:\Windows\system32\Pmipdq32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:656
        
        C:\Windows\SysWOW64\Cgecpa32.exe
        
        C:\Windows\system32\Cgecpa32.exe
        42⤵
        Executes dropped EXE
        
        PID:3244
        
        C:\Windows\SysWOW64\Dmiaig32.exe
        
        C:\Windows\system32\Dmiaig32.exe
        43⤵
        Executes dropped EXE
        
        PID:3456
        
        C:\Windows\SysWOW64\Enoddi32.exe
        
        C:\Windows\system32\Enoddi32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2916
        
        C:\Windows\SysWOW64\Eglbhnkp.exe
        
        C:\Windows\system32\Eglbhnkp.exe
        45⤵
        Executes dropped EXE
        
        PID:2856
        
        C:\Windows\SysWOW64\Emikpeig.exe
        
        C:\Windows\system32\Emikpeig.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4368
        
        C:\Windows\SysWOW64\Fjfnphpf.exe
        
        C:\Windows\system32\Fjfnphpf.exe
        47⤵
        Executes dropped EXE
        
        PID:432
        
        C:\Windows\SysWOW64\Fhjoilop.exe
        
        C:\Windows\system32\Fhjoilop.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4316
        
        C:\Windows\SysWOW64\Gmnmbbgp.exe
        
        C:\Windows\system32\Gmnmbbgp.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1188
        
        C:\Windows\SysWOW64\Hkggfe32.exe
        
        C:\Windows\system32\Hkggfe32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:264
        
        C:\Windows\SysWOW64\Hmjmnpmb.exe
        
        C:\Windows\system32\Hmjmnpmb.exe
        51⤵
        Executes dropped EXE
        
        PID:4612
        
        C:\Windows\SysWOW64\Hoiihcde.exe
        
        C:\Windows\system32\Hoiihcde.exe
        52⤵
        Executes dropped EXE
        
        PID:4880
        
        C:\Windows\SysWOW64\Ikechced.exe
        
        C:\Windows\system32\Ikechced.exe
        53⤵
        Executes dropped EXE
        
        PID:3732
        
        C:\Windows\SysWOW64\Jeanfkob.exe
        
        C:\Windows\system32\Jeanfkob.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1616
        
        C:\Windows\SysWOW64\Jojboa32.exe
        
        C:\Windows\system32\Jojboa32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4520
        
        C:\Windows\SysWOW64\Jamhflqq.exe
        
        C:\Windows\system32\Jamhflqq.exe
        56⤵
        Executes dropped EXE
        
        PID:1564
        
        C:\Windows\SysWOW64\Kohnpoib.exe
        
        C:\Windows\system32\Kohnpoib.exe
        57⤵
        Executes dropped EXE
        
        PID:4220
        
        C:\Windows\SysWOW64\Loaafnah.exe
        
        C:\Windows\system32\Loaafnah.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:216
        
        C:\Windows\SysWOW64\Qefkcl32.exe
        
        C:\Windows\system32\Qefkcl32.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1844
        
        C:\Windows\SysWOW64\Djgbmffn.exe
        
        C:\Windows\system32\Djgbmffn.exe
        60⤵
        Executes dropped EXE
        
        PID:4364
        
        C:\Windows\SysWOW64\Gjagapbn.exe
        
        C:\Windows\system32\Gjagapbn.exe
        61⤵
        Executes dropped EXE
        
        PID:3936
        
        C:\Windows\SysWOW64\Hfmqapcl.exe
        
        C:\Windows\system32\Hfmqapcl.exe
        62⤵
        Executes dropped EXE
        
        PID:2304
        
        C:\Windows\SysWOW64\Iplkje32.exe
        
        C:\Windows\system32\Iplkje32.exe
        63⤵
        Executes dropped EXE
        
        PID:4540
        
        C:\Windows\SysWOW64\Jkplilgk.exe
        
        C:\Windows\system32\Jkplilgk.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3052
        
        C:\Windows\SysWOW64\Lkgkqh32.exe
        
        C:\Windows\system32\Lkgkqh32.exe
        65⤵
        Executes dropped EXE
        
        PID:1192
        
        C:\Windows\SysWOW64\Nocphd32.exe
        
        C:\Windows\system32\Nocphd32.exe
        66⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Ondleo32.exe
        
        C:\Windows\system32\Ondleo32.exe
        67⤵
        Modifies registry class
        
        PID:4212
        
        C:\Windows\SysWOW64\Onkbenbi.exe
        
        C:\Windows\system32\Onkbenbi.exe
        68⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\Phfcdcfg.exe
        
        C:\Windows\system32\Phfcdcfg.exe
        69⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Plfipakk.exe
        
        C:\Windows\system32\Plfipakk.exe
        70⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\Qiocde32.exe
        
        C:\Windows\system32\Qiocde32.exe
        71⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Qnlkllcf.exe
        
        C:\Windows\system32\Qnlkllcf.exe
        72⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Aiapjecl.exe
        
        C:\Windows\system32\Aiapjecl.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3852
        
        C:\Windows\SysWOW64\Aonhblad.exe
        
        C:\Windows\system32\Aonhblad.exe
        74⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\Aiclodaj.exe
        
        C:\Windows\system32\Aiclodaj.exe
        75⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\Aejmdegn.exe
        
        C:\Windows\system32\Aejmdegn.exe
        76⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\Abcgii32.exe
        
        C:\Windows\system32\Abcgii32.exe
        77⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Bajqpe32.exe
        
        C:\Windows\system32\Bajqpe32.exe
        78⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Cbofdg32.exe
        
        C:\Windows\system32\Cbofdg32.exe
        79⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\Chphhn32.exe
        
        C:\Windows\system32\Chphhn32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4392
        
        C:\Windows\SysWOW64\Ccfmef32.exe
        
        C:\Windows\system32\Ccfmef32.exe
        81⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Didnmp32.exe
        
        C:\Windows\system32\Didnmp32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2396
        
        C:\Windows\SysWOW64\Dhndil32.exe
        
        C:\Windows\system32\Dhndil32.exe
        83⤵
        
        PID:816
        
        C:\Windows\SysWOW64\Ejegdngb.exe
        
        C:\Windows\system32\Ejegdngb.exe
        84⤵
        Drops file in System32 directory
        
        PID:4280
        
        C:\Windows\SysWOW64\Ebplhp32.exe
        
        C:\Windows\system32\Ebplhp32.exe
        85⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\Fmjjqhpn.exe
        
        C:\Windows\system32\Fmjjqhpn.exe
        86⤵
        Drops file in System32 directory
        
        PID:3764
        
        C:\Windows\SysWOW64\Fcdbmb32.exe
        
        C:\Windows\system32\Fcdbmb32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2996
        
        C:\Windows\SysWOW64\Fbiooolb.exe
        
        C:\Windows\system32\Fbiooolb.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2132
        
        C:\Windows\SysWOW64\Fckhnaab.exe
        
        C:\Windows\system32\Fckhnaab.exe
        89⤵
        Modifies registry class
        
        PID:4808
        
        C:\Windows\SysWOW64\Gpgbna32.exe
        
        C:\Windows\system32\Gpgbna32.exe
        90⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\Gfedfk32.exe
        
        C:\Windows\system32\Gfedfk32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4332
        
        C:\Windows\SysWOW64\Hfoflj32.exe
        
        C:\Windows\system32\Hfoflj32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4024
        
        C:\Windows\SysWOW64\Hadkib32.exe
        
        C:\Windows\system32\Hadkib32.exe
        93⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Hbegakcb.exe
        
        C:\Windows\system32\Hbegakcb.exe
        94⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\Ijaimg32.exe
        
        C:\Windows\system32\Ijaimg32.exe
        95⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\Jdqcglqh.exe
        
        C:\Windows\system32\Jdqcglqh.exe
        96⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Jinloboo.exe
        
        C:\Windows\system32\Jinloboo.exe
        97⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Jmnakqcc.exe
        
        C:\Windows\system32\Jmnakqcc.exe
        98⤵
        Drops file in System32 directory
        
        PID:5004
        
        C:\Windows\SysWOW64\Kpagbk32.exe
        
        C:\Windows\system32\Kpagbk32.exe
        99⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\Kkfkod32.exe
        
        C:\Windows\system32\Kkfkod32.exe
        100⤵
        Drops file in System32 directory
        
        PID:2324
        
        C:\Windows\SysWOW64\Kmgdaokh.exe
        
        C:\Windows\system32\Kmgdaokh.exe
        101⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Kgphje32.exe
        
        C:\Windows\system32\Kgphje32.exe
        102⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Lajfbmmi.exe
        
        C:\Windows\system32\Lajfbmmi.exe
        103⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\Lgfojd32.exe
        
        C:\Windows\system32\Lgfojd32.exe
        104⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Laqlclga.exe
        
        C:\Windows\system32\Laqlclga.exe
        105⤵
        Drops file in System32 directory
        
        PID:4508
        
        C:\Windows\SysWOW64\Lgnekcei.exe
        
        C:\Windows\system32\Lgnekcei.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1176
        
        C:\Windows\SysWOW64\Lacihleo.exe
        
        C:\Windows\system32\Lacihleo.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2332
        
        C:\Windows\SysWOW64\Mgpaqbcf.exe
        
        C:\Windows\system32\Mgpaqbcf.exe
        108⤵
        Drops file in System32 directory
        
        PID:548
        
        C:\Windows\SysWOW64\Mgbnfb32.exe
        
        C:\Windows\system32\Mgbnfb32.exe
        109⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\Mnlfclip.exe
        
        C:\Windows\system32\Mnlfclip.exe
        110⤵
        Drops file in System32 directory
        
        PID:1476
        
        C:\Windows\SysWOW64\Mgdklb32.exe
        
        C:\Windows\system32\Mgdklb32.exe
        111⤵
        
        PID:980
        
        C:\Windows\SysWOW64\Njjmil32.exe
        
        C:\Windows\system32\Njjmil32.exe
        112⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Nbjhph32.exe
        
        C:\Windows\system32\Nbjhph32.exe
        113⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\Okcmingd.exe
        
        C:\Windows\system32\Okcmingd.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2920
        
        C:\Windows\SysWOW64\Oqdnld32.exe
        
        C:\Windows\system32\Oqdnld32.exe
        115⤵
        
        PID:484
        
        C:\Windows\SysWOW64\Ognginic.exe
        
        C:\Windows\system32\Ognginic.exe
        116⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Fhbpqb32.exe
        
        C:\Windows\system32\Fhbpqb32.exe
        117⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Hbknqeha.exe
        
        C:\Windows\system32\Hbknqeha.exe
        118⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\Helfbqeb.exe
        
        C:\Windows\system32\Helfbqeb.exe
        119⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\Icgjfgef.exe
        
        C:\Windows\system32\Icgjfgef.exe
        120⤵
        Modifies registry class
        
        PID:4116
        
        C:\Windows\SysWOW64\Jpdqlgdc.exe
        
        C:\Windows\system32\Jpdqlgdc.exe
        121⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\Jbcmhb32.exe
        
        C:\Windows\system32\Jbcmhb32.exe
        122⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Jmhaek32.exe
        
        C:\Windows\system32\Jmhaek32.exe
        123⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\Jbeinb32.exe
        
        C:\Windows\system32\Jbeinb32.exe
        124⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\Jioajliq.exe
        
        C:\Windows\system32\Jioajliq.exe
        125⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\Jpijgf32.exe
        
        C:\Windows\system32\Jpijgf32.exe
        126⤵
        Drops file in System32 directory
        
        PID:1700
        
        C:\Windows\SysWOW64\Jfcbcp32.exe
        
        C:\Windows\system32\Jfcbcp32.exe
        127⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\Jmmjpjpg.exe
        
        C:\Windows\system32\Jmmjpjpg.exe
        128⤵
        Modifies registry class
        
        PID:4984
        
        C:\Windows\SysWOW64\Kikafjoc.exe
        
        C:\Windows\system32\Kikafjoc.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3380
        
        C:\Windows\SysWOW64\Llbphdfl.exe
        
        C:\Windows\system32\Llbphdfl.exe
        130⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Lbmheomi.exe
        
        C:\Windows\system32\Lbmheomi.exe
        131⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Lmbmbgmo.exe
        
        C:\Windows\system32\Lmbmbgmo.exe
        132⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\Mpoepa32.exe
        
        C:\Windows\system32\Mpoepa32.exe
        133⤵
        
        PID:640
        
        C:\Windows\SysWOW64\Njploeoi.exe
        
        C:\Windows\system32\Njploeoi.exe
        134⤵
        Drops file in System32 directory
        
        PID:2624
        
        C:\Windows\SysWOW64\Pcncjh32.exe
        
        C:\Windows\system32\Pcncjh32.exe
        135⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\Pqbdclak.exe
        
        C:\Windows\system32\Pqbdclak.exe
        136⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\Qjjhla32.exe
        
        C:\Windows\system32\Qjjhla32.exe
        137⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\Qgnief32.exe
        
        C:\Windows\system32\Qgnief32.exe
        138⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\Qmkanmel.exe
        
        C:\Windows\system32\Qmkanmel.exe
        139⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\Agcbqecp.exe
        
        C:\Windows\system32\Agcbqecp.exe
        140⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Anmjmojl.exe
        
        C:\Windows\system32\Anmjmojl.exe
        141⤵
        
        PID:432
        
        C:\Windows\SysWOW64\Aappdj32.exe
        
        C:\Windows\system32\Aappdj32.exe
        142⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Acnlqe32.exe
        
        C:\Windows\system32\Acnlqe32.exe
        143⤵
        
        PID:436
        
        C:\Windows\SysWOW64\Ajhdmplk.exe
        
        C:\Windows\system32\Ajhdmplk.exe
        144⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Bfcompnj.exe
        
        C:\Windows\system32\Bfcompnj.exe
        145⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Cjmgomjc.exe
        
        C:\Windows\system32\Cjmgomjc.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5296
        
        C:\Windows\SysWOW64\Cokpekpj.exe
        
        C:\Windows\system32\Cokpekpj.exe
        147⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Deehbe32.exe
        
        C:\Windows\system32\Deehbe32.exe
        148⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Dffdjmme.exe
        
        C:\Windows\system32\Dffdjmme.exe
        149⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Dalhgfmk.exe
        
        C:\Windows\system32\Dalhgfmk.exe
        150⤵
        Modifies registry class
        
        PID:5468
        
        C:\Windows\SysWOW64\Dfiaomkb.exe
        
        C:\Windows\system32\Dfiaomkb.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Emjomf32.exe
        
        C:\Windows\system32\Emjomf32.exe
        152⤵
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Eoilfidj.exe
        
        C:\Windows\system32\Eoilfidj.exe
        153⤵
        Modifies registry class
        
        PID:5676
        
        C:\Windows\SysWOW64\Gonnhf32.exe
        
        C:\Windows\system32\Gonnhf32.exe
        154⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Gddigk32.exe
        
        C:\Windows\system32\Gddigk32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Hojndd32.exe
        
        C:\Windows\system32\Hojndd32.exe
        156⤵
        Modifies registry class
        
        PID:5828
        
        C:\Windows\SysWOW64\Hfdfanoa.exe
        
        C:\Windows\system32\Hfdfanoa.exe
        157⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Hnddqp32.exe
        
        C:\Windows\system32\Hnddqp32.exe
        158⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Hdnlmj32.exe
        
        C:\Windows\system32\Hdnlmj32.exe
        159⤵
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Hkhdjdgq.exe
        
        C:\Windows\system32\Hkhdjdgq.exe
        160⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Ihlechfj.exe
        
        C:\Windows\system32\Ihlechfj.exe
        161⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Idbfhiko.exe
        
        C:\Windows\system32\Idbfhiko.exe
        162⤵
        Drops file in System32 directory
        
        PID:6120
        
        C:\Windows\SysWOW64\Iiehjgnp.exe
        
        C:\Windows\system32\Iiehjgnp.exe
        163⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Jphcmp32.exe
        
        C:\Windows\system32\Jphcmp32.exe
        164⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Jfbkijdo.exe
        
        C:\Windows\system32\Jfbkijdo.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Klfjbpmn.exe
        
        C:\Windows\system32\Klfjbpmn.exe
        166⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Nboggf32.exe
        
        C:\Windows\system32\Nboggf32.exe
        167⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Nemcca32.exe
        
        C:\Windows\system32\Nemcca32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4660
        
        C:\Windows\SysWOW64\Npbhqj32.exe
        
        C:\Windows\system32\Npbhqj32.exe
        169⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Ngmpmd32.exe
        
        C:\Windows\system32\Ngmpmd32.exe
        170⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Nhnlelfm.exe
        
        C:\Windows\system32\Nhnlelfm.exe
        171⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Nedjdp32.exe
        
        C:\Windows\system32\Nedjdp32.exe
        172⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Nlnbqjjq.exe
        
        C:\Windows\system32\Nlnbqjjq.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5964
        
        C:\Windows\SysWOW64\Ogcfncjf.exe
        
        C:\Windows\system32\Ogcfncjf.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6024
        
        C:\Windows\SysWOW64\Oocdme32.exe
        
        C:\Windows\system32\Oocdme32.exe
        175⤵
        Modifies registry class
        
        PID:5024
        
        C:\Windows\SysWOW64\Oenljoji.exe
        
        C:\Windows\system32\Oenljoji.exe
        176⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Opcqgh32.exe
        
        C:\Windows\system32\Opcqgh32.exe
        177⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Phhhbi32.exe
        
        C:\Windows\system32\Phhhbi32.exe
        178⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Acdbpq32.exe
        
        C:\Windows\system32\Acdbpq32.exe
        179⤵
        Drops file in System32 directory
        
        PID:5428
        
        C:\Windows\SysWOW64\Afghgkdl.exe
        
        C:\Windows\system32\Afghgkdl.exe
        180⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\Aqmldddb.exe
        
        C:\Windows\system32\Aqmldddb.exe
        181⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\Ajeami32.exe
        
        C:\Windows\system32\Ajeami32.exe
        182⤵
        Modifies registry class
        
        PID:5808
        
        C:\Windows\SysWOW64\Aobieq32.exe
        
        C:\Windows\system32\Aobieq32.exe
        183⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\Bcdlgnkk.exe
        
        C:\Windows\system32\Bcdlgnkk.exe
        184⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\Biadoeib.exe
        
        C:\Windows\system32\Biadoeib.exe
        185⤵
        Drops file in System32 directory
        
        PID:5992
        
        C:\Windows\SysWOW64\Bcghlnih.exe
        
        C:\Windows\system32\Bcghlnih.exe
        186⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Bjaqih32.exe
        
        C:\Windows\system32\Bjaqih32.exe
        187⤵
        Drops file in System32 directory
        
        PID:6088
        
        C:\Windows\SysWOW64\Bqkifb32.exe
        
        C:\Windows\system32\Bqkifb32.exe
        188⤵
        Drops file in System32 directory
        
        PID:1380
        
        C:\Windows\SysWOW64\Cmdfpbkc.exe
        
        C:\Windows\system32\Cmdfpbkc.exe
        189⤵
        Drops file in System32 directory
        
        PID:2364
        
        C:\Windows\SysWOW64\Cgijnk32.exe
        
        C:\Windows\system32\Cgijnk32.exe
        190⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\Cikgecag.exe
        
        C:\Windows\system32\Cikgecag.exe
        191⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Cabofaaj.exe
        
        C:\Windows\system32\Cabofaaj.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3068
        
        C:\Windows\SysWOW64\Cfogohpa.exe
        
        C:\Windows\system32\Cfogohpa.exe
        193⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Cmipkb32.exe
        
        C:\Windows\system32\Cmipkb32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5716
        
        C:\Windows\SysWOW64\Cgndikgd.exe
        
        C:\Windows\system32\Cgndikgd.exe
        195⤵
        Drops file in System32 directory
        
        PID:4568
        
        C:\Windows\SysWOW64\Cipppc32.exe
        
        C:\Windows\system32\Cipppc32.exe
        196⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Cpihmmdo.exe
        
        C:\Windows\system32\Cpihmmdo.exe
        197⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Dfcqjg32.exe
        
        C:\Windows\system32\Dfcqjg32.exe
        198⤵
        Modifies registry class
        
        PID:3236
        
        C:\Windows\SysWOW64\Dmmifaci.exe
        
        C:\Windows\system32\Dmmifaci.exe
        199⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Dclknkfp.exe
        
        C:\Windows\system32\Dclknkfp.exe
        200⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Hgboiq32.exe
        
        C:\Windows\system32\Hgboiq32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2976
        
        C:\Windows\SysWOW64\Hdkimdnk.exe
        
        C:\Windows\system32\Hdkimdnk.exe
        202⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\Hjhaeklb.exe
        
        C:\Windows\system32\Hjhaeklb.exe
        203⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\Hdmecdlh.exe
        
        C:\Windows\system32\Hdmecdlh.exe
        204⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Ignndo32.exe
        
        C:\Windows\system32\Ignndo32.exe
        205⤵
        
        PID:644
        
        C:\Windows\SysWOW64\Inhgaipf.exe
        
        C:\Windows\system32\Inhgaipf.exe
        206⤵
        Drops file in System32 directory
        
        PID:5972
        
        C:\Windows\SysWOW64\Idbonc32.exe
        
        C:\Windows\system32\Idbonc32.exe
        207⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Injcginc.exe
        
        C:\Windows\system32\Injcginc.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6060
        
        C:\Windows\SysWOW64\Igbhpned.exe
        
        C:\Windows\system32\Igbhpned.exe
        209⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\Inmplh32.exe
        
        C:\Windows\system32\Inmplh32.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2728
        
        C:\Windows\SysWOW64\Ihbdja32.exe
        
        C:\Windows\system32\Ihbdja32.exe
        211⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Jkejalge.exe
        
        C:\Windows\system32\Jkejalge.exe
        212⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Jqbbicel.exe
        
        C:\Windows\system32\Jqbbicel.exe
        213⤵
        Modifies registry class
        
        PID:4524
        
        C:\Windows\SysWOW64\Llabchoe.exe
        
        C:\Windows\system32\Llabchoe.exe
        214⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Lankloml.exe
        
        C:\Windows\system32\Lankloml.exe
        215⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Lihpbl32.exe
        
        C:\Windows\system32\Lihpbl32.exe
        216⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Mbgjlq32.exe
        
        C:\Windows\system32\Mbgjlq32.exe
        217⤵
        
        PID:3496
        
        C:\Windows\SysWOW64\Mhdbdgjl.exe
        
        C:\Windows\system32\Mhdbdgjl.exe
        218⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Mehcnlie.exe
        
        C:\Windows\system32\Mehcnlie.exe
        219⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Nhfpjghi.exe
        
        C:\Windows\system32\Nhfpjghi.exe
        220⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Nblcgpho.exe
        
        C:\Windows\system32\Nblcgpho.exe
        221⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Nifldj32.exe
        
        C:\Windows\system32\Nifldj32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1016
        
        C:\Windows\SysWOW64\Neafdjak.exe
        
        C:\Windows\system32\Neafdjak.exe
        223⤵
        Drops file in System32 directory
        
        PID:2796
        
        C:\Windows\SysWOW64\Nknolaob.exe
        
        C:\Windows\system32\Nknolaob.exe
        224⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\Oeccijoh.exe
        
        C:\Windows\system32\Oeccijoh.exe
        225⤵
        
        PID:776
        
        C:\Windows\SysWOW64\Okpkaqmp.exe
        
        C:\Windows\system32\Okpkaqmp.exe
        226⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Obgccn32.exe
        
        C:\Windows\system32\Obgccn32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5624
        
        C:\Windows\SysWOW64\Oiakpheo.exe
        
        C:\Windows\system32\Oiakpheo.exe
        228⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Okbhgq32.exe
        
        C:\Windows\system32\Okbhgq32.exe
        229⤵
        Modifies registry class
        
        PID:4508
        
        C:\Windows\SysWOW64\Oampdkbj.exe
        
        C:\Windows\system32\Oampdkbj.exe
        230⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\Ohfhqd32.exe
        
        C:\Windows\system32\Ohfhqd32.exe
        231⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\Ooqqmoac.exe
        
        C:\Windows\system32\Ooqqmoac.exe
        232⤵
        Modifies registry class
        
        PID:4716
        
        C:\Windows\SysWOW64\Oejijiip.exe
        
        C:\Windows\system32\Oejijiip.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5060
        
        C:\Windows\SysWOW64\Pibdff32.exe
        
        C:\Windows\system32\Pibdff32.exe
        234⤵
        Drops file in System32 directory
        
        PID:3532
        
        C:\Windows\SysWOW64\Poomom32.exe
        
        C:\Windows\system32\Poomom32.exe
        235⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Pidaleei.exe
        
        C:\Windows\system32\Pidaleei.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1028
        
        C:\Windows\SysWOW64\Qaofphbd.exe
        
        C:\Windows\system32\Qaofphbd.exe
        237⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\Afgame32.exe
        
        C:\Windows\system32\Afgame32.exe
        238⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Akcjel32.exe
        
        C:\Windows\system32\Akcjel32.exe
        239⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Afinbdon.exe
        
        C:\Windows\system32\Afinbdon.exe
        240⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\Alcfoo32.exe
        
        C:\Windows\system32\Alcfoo32.exe
        241⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\Blhpjnbe.exe
        
        C:\Windows\system32\Blhpjnbe.exe
        242⤵
        Drops file in System32 directory
        
        PID:2548
        
        C:\Windows\SysWOW64\Bcahgh32.exe
        
        C:\Windows\system32\Bcahgh32.exe
        243⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\Cbphncfo.exe
        
        C:\Windows\system32\Cbphncfo.exe
        244⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Cijpkmml.exe
        
        C:\Windows\system32\Cijpkmml.exe
        245⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\Dkmebh32.exe
        
        C:\Windows\system32\Dkmebh32.exe
        246⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\Dfcjoa32.exe
        
        C:\Windows\system32\Dfcjoa32.exe
        247⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Dfjpppbh.exe
        
        C:\Windows\system32\Dfjpppbh.exe
        248⤵
        Drops file in System32 directory
        
        PID:2792
        
        C:\Windows\SysWOW64\Dmdhmj32.exe
        
        C:\Windows\system32\Dmdhmj32.exe
        249⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Dcnqid32.exe
        
        C:\Windows\system32\Dcnqid32.exe
        250⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\Djhifnho.exe
        
        C:\Windows\system32\Djhifnho.exe
        251⤵
        
        PID:940
        
        C:\Windows\SysWOW64\Efhlan32.exe
        
        C:\Windows\system32\Efhlan32.exe
        252⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\Hmicee32.exe
        
        C:\Windows\system32\Hmicee32.exe
        253⤵
        Modifies registry class
        
        PID:3488
        
        C:\Windows\SysWOW64\Ipjenn32.exe
        
        C:\Windows\system32\Ipjenn32.exe
        254⤵
        Drops file in System32 directory
        
        PID:1464
        
        C:\Windows\SysWOW64\Ijcjgcni.exe
        
        C:\Windows\system32\Ijcjgcni.exe
        255⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\Ilafcomm.exe
        
        C:\Windows\system32\Ilafcomm.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6184
        
        C:\Windows\SysWOW64\Jcknpi32.exe
        
        C:\Windows\system32\Jcknpi32.exe
        257⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Jdkkjl32.exe
        
        C:\Windows\system32\Jdkkjl32.exe
        258⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Jlfpnn32.exe
        
        C:\Windows\system32\Jlfpnn32.exe
        259⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Jkgpleaf.exe
        
        C:\Windows\system32\Jkgpleaf.exe
        260⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Jpdhdl32.exe
        
        C:\Windows\system32\Jpdhdl32.exe
        261⤵
        Modifies registry class
        
        PID:6428
        
        C:\Windows\SysWOW64\Jgnqafgk.exe
        
        C:\Windows\system32\Jgnqafgk.exe
        262⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Jljiimeb.exe
        
        C:\Windows\system32\Jljiimeb.exe
        263⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Jkligd32.exe
        
        C:\Windows\system32\Jkligd32.exe
        264⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Kddnpj32.exe
        
        C:\Windows\system32\Kddnpj32.exe
        265⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Knaldo32.exe
        
        C:\Windows\system32\Knaldo32.exe
        266⤵
        Drops file in System32 directory
        
        PID:6644
        
        C:\Windows\SysWOW64\Kdkdqinj.exe
        
        C:\Windows\system32\Kdkdqinj.exe
        267⤵
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Lcjchd32.exe
        
        C:\Windows\system32\Lcjchd32.exe
        268⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Ljcldo32.exe
        
        C:\Windows\system32\Ljcldo32.exe
        269⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Maicmgoc.exe
        
        C:\Windows\system32\Maicmgoc.exe
        270⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Mgclja32.exe
        
        C:\Windows\system32\Mgclja32.exe
        271⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Ndaboafl.exe
        
        C:\Windows\system32\Ndaboafl.exe
        272⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Njkklk32.exe
        
        C:\Windows\system32\Njkklk32.exe
        273⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Naecieef.exe
        
        C:\Windows\system32\Naecieef.exe
        274⤵
        Drops file in System32 directory
        
        PID:7008
        
        C:\Windows\SysWOW64\Nhokeolc.exe
        
        C:\Windows\system32\Nhokeolc.exe
        275⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Ojdnbj32.exe
        
        C:\Windows\system32\Ojdnbj32.exe
        276⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Oejbpb32.exe
        
        C:\Windows\system32\Oejbpb32.exe
        277⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7128
        
        C:\Windows\SysWOW64\Omegdebp.exe
        
        C:\Windows\system32\Omegdebp.exe
        278⤵
        
        PID:484
        
        C:\Windows\SysWOW64\Odooqo32.exe
        
        C:\Windows\system32\Odooqo32.exe
        279⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Pkigmiai.exe
        
        C:\Windows\system32\Pkigmiai.exe
        280⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Pacojc32.exe
        
        C:\Windows\system32\Pacojc32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6288
        
        C:\Windows\SysWOW64\Plhcglil.exe
        
        C:\Windows\system32\Plhcglil.exe
        282⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Pmjpod32.exe
        
        C:\Windows\system32\Pmjpod32.exe
        283⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Poimigfm.exe
        
        C:\Windows\system32\Poimigfm.exe
        284⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Pecefa32.exe
        
        C:\Windows\system32\Pecefa32.exe
        285⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Plmmbkdf.exe
        
        C:\Windows\system32\Plmmbkdf.exe
        286⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\Pajekb32.exe
        
        C:\Windows\system32\Pajekb32.exe
        287⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Plpjhk32.exe
        
        C:\Windows\system32\Plpjhk32.exe
        288⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Ponfdf32.exe
        
        C:\Windows\system32\Ponfdf32.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6684
        
        C:\Windows\SysWOW64\Pdkolm32.exe
        
        C:\Windows\system32\Pdkolm32.exe
        290⤵
        Modifies registry class
        
        PID:1640
        
        C:\Windows\SysWOW64\Qmccecfp.exe
        
        C:\Windows\system32\Qmccecfp.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6744
        
        C:\Windows\SysWOW64\Qhigbl32.exe
        
        C:\Windows\system32\Qhigbl32.exe
        292⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\Qoboofnb.exe
        
        C:\Windows\system32\Qoboofnb.exe
        293⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Qemhlp32.exe
        
        C:\Windows\system32\Qemhlp32.exe
        294⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\Ahbjij32.exe
        
        C:\Windows\system32\Ahbjij32.exe
        295⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Bdndik32.exe
        
        C:\Windows\system32\Bdndik32.exe
        296⤵
        Modifies registry class
        
        PID:3364
        
        C:\Windows\SysWOW64\Bnhegp32.exe
        
        C:\Windows\system32\Bnhegp32.exe
        297⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Cffcilob.exe
        
        C:\Windows\system32\Cffcilob.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7160
        
        C:\Windows\SysWOW64\Ddgpfgil.exe
        
        C:\Windows\system32\Ddgpfgil.exe
        299⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Dmnhgdjo.exe
        
        C:\Windows\system32\Dmnhgdjo.exe
        300⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Ddjmkg32.exe
        
        C:\Windows\system32\Ddjmkg32.exe
        301⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Eohcon32.exe
        
        C:\Windows\system32\Eohcon32.exe
        302⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Ennqpkcm.exe
        
        C:\Windows\system32\Ennqpkcm.exe
        303⤵
        Drops file in System32 directory
        
        PID:492
        
        C:\Windows\SysWOW64\Gmojep32.exe
        
        C:\Windows\system32\Gmojep32.exe
        304⤵
        Modifies registry class
        
        PID:6620
        
        C:\Windows\SysWOW64\Gfjkce32.exe
        
        C:\Windows\system32\Gfjkce32.exe
        305⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\Gbqlhfgk.exe
        
        C:\Windows\system32\Gbqlhfgk.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3844
        
        C:\Windows\SysWOW64\Hlipal32.exe
        
        C:\Windows\system32\Hlipal32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3464
        
        C:\Windows\SysWOW64\Hpgigj32.exe
        
        C:\Windows\system32\Hpgigj32.exe
        308⤵
        Drops file in System32 directory
        
        PID:2432
        
        C:\Windows\SysWOW64\Hedaoa32.exe
        
        C:\Windows\system32\Hedaoa32.exe
        309⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\Jleicg32.exe
        
        C:\Windows\system32\Jleicg32.exe
        310⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Jiiiml32.exe
        
        C:\Windows\system32\Jiiiml32.exe
        311⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Jcanfakf.exe
        
        C:\Windows\system32\Jcanfakf.exe
        312⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Jepjbm32.exe
        
        C:\Windows\system32\Jepjbm32.exe
        313⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\Jljbogaf.exe
        
        C:\Windows\system32\Jljbogaf.exe
        314⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Jebfgl32.exe
        
        C:\Windows\system32\Jebfgl32.exe
        315⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Kgdpgo32.exe
        
        C:\Windows\system32\Kgdpgo32.exe
        316⤵
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Knbaoh32.exe
        
        C:\Windows\system32\Knbaoh32.exe
        317⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Lgblhmag.exe
        
        C:\Windows\system32\Lgblhmag.exe
        318⤵
        
        PID:888
        
        C:\Windows\SysWOW64\Mmcnlc32.exe
        
        C:\Windows\system32\Mmcnlc32.exe
        319⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Mmhggbgd.exe
        
        C:\Windows\system32\Mmhggbgd.exe
        320⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Nadlnoaj.exe
        
        C:\Windows\system32\Nadlnoaj.exe
        321⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Ojajbdde.exe
        
        C:\Windows\system32\Ojajbdde.exe
        322⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Ombcdo32.exe
        
        C:\Windows\system32\Ombcdo32.exe
        323⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Pnfiia32.exe
        
        C:\Windows\system32\Pnfiia32.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:684
        
        C:\Windows\SysWOW64\Pagbklae.exe
        
        C:\Windows\system32\Pagbklae.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5616
        
        C:\Windows\SysWOW64\Phajgf32.exe
        
        C:\Windows\system32\Phajgf32.exe
        326⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\Pjaciafc.exe
        
        C:\Windows\system32\Pjaciafc.exe
        327⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Bpodhf32.exe
        
        C:\Windows\system32\Bpodhf32.exe
        328⤵
        
        PID:740
        
        C:\Windows\SysWOW64\Bgimepmd.exe
        
        C:\Windows\system32\Bgimepmd.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5904
        
        C:\Windows\SysWOW64\Doojni32.exe
        
        C:\Windows\system32\Doojni32.exe
        330⤵
        Modifies registry class
        
        PID:6048
        
        C:\Windows\SysWOW64\Eoccii32.exe
        
        C:\Windows\system32\Eoccii32.exe
        331⤵
        Drops file in System32 directory
        
        PID:4420
        
        C:\Windows\SysWOW64\Ehndhn32.exe
        
        C:\Windows\system32\Ehndhn32.exe
        332⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\Eqkfapoe.exe
        
        C:\Windows\system32\Eqkfapoe.exe
        333⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Fkajoiok.exe
        
        C:\Windows\system32\Fkajoiok.exe
        334⤵
        Modifies registry class
        
        PID:728
        
        C:\Windows\SysWOW64\Fqnbgpmb.exe
        
        C:\Windows\system32\Fqnbgpmb.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5144
        
        C:\Windows\SysWOW64\Fghkdjdo.exe
        
        C:\Windows\system32\Fghkdjdo.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1476
        
        C:\Windows\SysWOW64\Fqpomo32.exe
        
        C:\Windows\system32\Fqpomo32.exe
        337⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Fgjhiibl.exe
        
        C:\Windows\system32\Fgjhiibl.exe
        338⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Fenhcnaf.exe
        
        C:\Windows\system32\Fenhcnaf.exe
        339⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Hbihdn32.exe
        
        C:\Windows\system32\Hbihdn32.exe
        340⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Jhdlncnl.exe
        
        C:\Windows\system32\Jhdlncnl.exe
        341⤵
        Modifies registry class
        
        PID:5640
        
        C:\Windows\SysWOW64\Kafcmglb.exe
        
        C:\Windows\system32\Kafcmglb.exe
        342⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Khplia32.exe
        
        C:\Windows\system32\Khplia32.exe
        343⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Kchmljab.exe
        
        C:\Windows\system32\Kchmljab.exe
        344⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Lcfimheb.exe
        
        C:\Windows\system32\Lcfimheb.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5564
        
        C:\Windows\SysWOW64\Mhgkqn32.exe
        
        C:\Windows\system32\Mhgkqn32.exe
        346⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Mcmongoj.exe
        
        C:\Windows\system32\Mcmongoj.exe
        347⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\Mjidpa32.exe
        
        C:\Windows\system32\Mjidpa32.exe
        348⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Mhnaam32.exe
        
        C:\Windows\system32\Mhnaam32.exe
        349⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Mohingqi.exe
        
        C:\Windows\system32\Mohingqi.exe
        350⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Mhqngm32.exe
        
        C:\Windows\system32\Mhqngm32.exe
        351⤵
        
        PID:212
        
        C:\Windows\SysWOW64\Nfenpafc.exe
        
        C:\Windows\system32\Nfenpafc.exe
        352⤵
        
        PID:768
        
        C:\Windows\SysWOW64\Nqjbnjfi.exe
        
        C:\Windows\system32\Nqjbnjfi.exe
        353⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Nfgkfadq.exe
        
        C:\Windows\system32\Nfgkfadq.exe
        354⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\Nmacbk32.exe
        
        C:\Windows\system32\Nmacbk32.exe
        355⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\Nfihkq32.exe
        
        C:\Windows\system32\Nfihkq32.exe
        356⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Ncmhee32.exe
        
        C:\Windows\system32\Ncmhee32.exe
        357⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\Nmfmnjgh.exe
        
        C:\Windows\system32\Nmfmnjgh.exe
        358⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Obikgppg.exe
        
        C:\Windows\system32\Obikgppg.exe
        359⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Oblhlpne.exe
        
        C:\Windows\system32\Oblhlpne.exe
        360⤵
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Ofjqbndk.exe
        
        C:\Windows\system32\Ofjqbndk.exe
        361⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Pmhbjhgc.exe
        
        C:\Windows\system32\Pmhbjhgc.exe
        362⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\Pcbkgb32.exe
        
        C:\Windows\system32\Pcbkgb32.exe
        363⤵
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Pafkpfni.exe
        
        C:\Windows\system32\Pafkpfni.exe
        364⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Piapehkd.exe
        
        C:\Windows\system32\Piapehkd.exe
        365⤵
        
        PID:568
        
        C:\Windows\SysWOW64\Pplhab32.exe
        
        C:\Windows\system32\Pplhab32.exe
        366⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\Abedil32.exe
        
        C:\Windows\system32\Abedil32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3500
        
        C:\Windows\SysWOW64\Aagdgd32.exe
        
        C:\Windows\system32\Aagdgd32.exe
        368⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Bdlfdnhb.exe
        
        C:\Windows\system32\Bdlfdnhb.exe
        369⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\Ckpagg32.exe
        
        C:\Windows\system32\Ckpagg32.exe
        370⤵
        Drops file in System32 directory
        
        PID:1060
        
        C:\Windows\SysWOW64\Cmnncb32.exe
        
        C:\Windows\system32\Cmnncb32.exe
        371⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Cdhfpm32.exe
        
        C:\Windows\system32\Cdhfpm32.exe
        372⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Dpcppm32.exe
        
        C:\Windows\system32\Dpcppm32.exe
        373⤵
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Dknnhekd.exe
        
        C:\Windows\system32\Dknnhekd.exe
        374⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Dckobg32.exe
        
        C:\Windows\system32\Dckobg32.exe
        375⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Djegoanj.exe
        
        C:\Windows\system32\Djegoanj.exe
        376⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Epoplk32.exe
        
        C:\Windows\system32\Epoplk32.exe
        377⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Egihhe32.exe
        
        C:\Windows\system32\Egihhe32.exe
        378⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Fcikcekm.exe
        
        C:\Windows\system32\Fcikcekm.exe
        379⤵
        
        PID:544
        
        C:\Windows\SysWOW64\Fjccpo32.exe
        
        C:\Windows\system32\Fjccpo32.exe
        380⤵
        Drops file in System32 directory
        
        PID:4176
        
        C:\Windows\SysWOW64\Fncilm32.exe
        
        C:\Windows\system32\Fncilm32.exe
        381⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\Fdmahgnj.exe
        
        C:\Windows\system32\Fdmahgnj.exe
        382⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Gcjdjb32.exe
        
        C:\Windows\system32\Gcjdjb32.exe
        383⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\Jaljlb32.exe
        
        C:\Windows\system32\Jaljlb32.exe
        384⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Mcjlna32.exe
        
        C:\Windows\system32\Mcjlna32.exe
        385⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\Mkepbc32.exe
        
        C:\Windows\system32\Mkepbc32.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5980
        
        C:\Windows\SysWOW64\Mdneki32.exe
        
        C:\Windows\system32\Mdneki32.exe
        387⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Mlgibf32.exe
        
        C:\Windows\system32\Mlgibf32.exe
        388⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Madbjm32.exe
        
        C:\Windows\system32\Madbjm32.exe
        389⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Mhnjgg32.exe
        
        C:\Windows\system32\Mhnjgg32.exe
        390⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Mohbcamn.exe
        
        C:\Windows\system32\Mohbcamn.exe
        391⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Nhpgmg32.exe
        
        C:\Windows\system32\Nhpgmg32.exe
        392⤵
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Ncekjp32.exe
        
        C:\Windows\system32\Ncekjp32.exe
        393⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6108
        
        C:\Windows\SysWOW64\Ndghahib.exe
        
        C:\Windows\system32\Ndghahib.exe
        394⤵
        Drops file in System32 directory
        
        PID:5060
        
        C:\Windows\SysWOW64\Ndidgg32.exe
        
        C:\Windows\system32\Ndidgg32.exe
        395⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Nameql32.exe
        
        C:\Windows\system32\Nameql32.exe
        396⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Nhgmmfnf.exe
        
        C:\Windows\system32\Nhgmmfnf.exe
        397⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Noaejpec.exe
        
        C:\Windows\system32\Noaejpec.exe
        398⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Ndnnbgcj.exe
        
        C:\Windows\system32\Ndnnbgcj.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1332
        
        C:\Windows\SysWOW64\Oconpn32.exe
        
        C:\Windows\system32\Oconpn32.exe
        400⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Ofpgaihj.exe
        
        C:\Windows\system32\Ofpgaihj.exe
        401⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Oohkko32.exe
        
        C:\Windows\system32\Oohkko32.exe
        402⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\Ofdpmi32.exe
        
        C:\Windows\system32\Ofdpmi32.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5984
        
        C:\Windows\SysWOW64\Pbnngi32.exe
        
        C:\Windows\system32\Pbnngi32.exe
        404⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4308
        
        C:\Windows\SysWOW64\Pkfbpoog.exe
        
        C:\Windows\system32\Pkfbpoog.exe
        405⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\Pkklkn32.exe
        
        C:\Windows\system32\Pkklkn32.exe
        406⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Pcacll32.exe
        
        C:\Windows\system32\Pcacll32.exe
        407⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Pmjheaad.exe
        
        C:\Windows\system32\Pmjheaad.exe
        408⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Pbgqnhpl.exe
        
        C:\Windows\system32\Pbgqnhpl.exe
        409⤵
        Drops file in System32 directory
        
        PID:5928
        
        C:\Windows\SysWOW64\Pmlekq32.exe
        
        C:\Windows\system32\Pmlekq32.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2684
        
        C:\Windows\SysWOW64\Qbimch32.exe
        
        C:\Windows\system32\Qbimch32.exe
        411⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\Qkablmdj.exe
        
        C:\Windows\system32\Qkablmdj.exe
        412⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\Amanfpkl.exe
        
        C:\Windows\system32\Amanfpkl.exe
        413⤵
        Modifies registry class
        
        PID:6084
        
        C:\Windows\SysWOW64\Aijlqq32.exe
        
        C:\Windows\system32\Aijlqq32.exe
        414⤵
        Modifies registry class
        
        PID:6164
        
        C:\Windows\SysWOW64\Acppniod.exe
        
        C:\Windows\system32\Acppniod.exe
        415⤵
        Modifies registry class
        
        PID:6204
        
        C:\Windows\SysWOW64\Alkdbllo.exe
        
        C:\Windows\system32\Alkdbllo.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6376
        
        C:\Windows\SysWOW64\Abemof32.exe
        
        C:\Windows\system32\Abemof32.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6564
        
        C:\Windows\SysWOW64\Bfebjd32.exe
        
        C:\Windows\system32\Bfebjd32.exe
        418⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Bmokgnol.exe
        
        C:\Windows\system32\Bmokgnol.exe
        419⤵
        Drops file in System32 directory
        
        PID:4568
        
        C:\Windows\SysWOW64\Bmfqhmid.exe
        
        C:\Windows\system32\Bmfqhmid.exe
        420⤵
        Modifies registry class
        
        PID:1080
        
        C:\Windows\SysWOW64\Beaelofp.exe
        
        C:\Windows\system32\Beaelofp.exe
        421⤵
        Drops file in System32 directory
        
        PID:4800
        
        C:\Windows\SysWOW64\Clknii32.exe
        
        C:\Windows\system32\Clknii32.exe
        422⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Cedbbo32.exe
        
        C:\Windows\system32\Cedbbo32.exe
        423⤵
        Modifies registry class
        
        PID:5748
        
        C:\Windows\SysWOW64\Eekail32.exe
        
        C:\Windows\system32\Eekail32.exe
        424⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\Edonmc32.exe
        
        C:\Windows\system32\Edonmc32.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5412
        
        C:\Windows\SysWOW64\Eikfej32.exe
        
        C:\Windows\system32\Eikfej32.exe
        426⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Ecdkno32.exe
        
        C:\Windows\system32\Ecdkno32.exe
        427⤵
        Drops file in System32 directory
        
        PID:4784
        
        C:\Windows\SysWOW64\Einckibc.exe
        
        C:\Windows\system32\Einckibc.exe
        428⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1052
        
        C:\Windows\SysWOW64\Edcghbbi.exe
        
        C:\Windows\system32\Edcghbbi.exe
        429⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Feddpj32.exe
        
        C:\Windows\system32\Feddpj32.exe
        430⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\Fgdqjm32.exe
        
        C:\Windows\system32\Fgdqjm32.exe
        431⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Fnnifggg.exe
        
        C:\Windows\system32\Fnnifggg.exe
        432⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Fckaoneo.exe
        
        C:\Windows\system32\Fckaoneo.exe
        433⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Fgijdm32.exe
        
        C:\Windows\system32\Fgijdm32.exe
        434⤵
        
        PID:524
        
        C:\Windows\SysWOW64\Flebmcil.exe
        
        C:\Windows\system32\Flebmcil.exe
        435⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Fgkfjlib.exe
        
        C:\Windows\system32\Fgkfjlib.exe
        436⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Fneogf32.exe
        
        C:\Windows\system32\Fneogf32.exe
        437⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\Fdogcqhl.exe
        
        C:\Windows\system32\Fdogcqhl.exe
        438⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1188
        
        C:\Windows\SysWOW64\Gfpcki32.exe
        
        C:\Windows\system32\Gfpcki32.exe
        439⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Gljlhc32.exe
        
        C:\Windows\system32\Gljlhc32.exe
        440⤵
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Gqhdnaln.exe
        
        C:\Windows\system32\Gqhdnaln.exe
        441⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\Gfemfhje.exe
        
        C:\Windows\system32\Gfemfhje.exe
        442⤵
        Drops file in System32 directory
        
        PID:5404
        
        C:\Windows\SysWOW64\Gqjada32.exe
        
        C:\Windows\system32\Gqjada32.exe
        443⤵
        Drops file in System32 directory
        
        PID:2396
        
        C:\Windows\SysWOW64\Ggdiqkah.exe
        
        C:\Windows\system32\Ggdiqkah.exe
        444⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\Kcqeng32.exe
        
        C:\Windows\system32\Kcqeng32.exe
        445⤵
        Modifies registry class
        
        PID:1864
        
        C:\Windows\SysWOW64\Lhjnpc32.exe
        
        C:\Windows\system32\Lhjnpc32.exe
        446⤵
        Modifies registry class
        
        PID:6600
        
        C:\Windows\SysWOW64\Mgkjmnme.exe
        
        C:\Windows\system32\Mgkjmnme.exe
        447⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Mdokfb32.exe
        
        C:\Windows\system32\Mdokfb32.exe
        448⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Mkiccmck.exe
        
        C:\Windows\system32\Mkiccmck.exe
        449⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Mdaglb32.exe
        
        C:\Windows\system32\Mdaglb32.exe
        450⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Noglik32.exe
        
        C:\Windows\system32\Noglik32.exe
        451⤵
        Modifies registry class
        
        PID:3388
        
        C:\Windows\SysWOW64\Noihojgo.exe
        
        C:\Windows\system32\Noihojgo.exe
        452⤵
        
        PID:5408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aagdgd32.exe

Filesize
79KB

MD5
f22af52dc577536c5c9308f7146e4490

SHA1
428fbfbfb671b0223527ad0b77d8e95827f18f06

SHA256
e349286ee2e6f06ddda7631c8393afe4d42323361cce83582517f2c8fc24d705

SHA512
b971096e73ca731ef738d525557c44526b4dd0d1c0ee0985bd440ad932ee1c5b8e4249af42550ee9902addbda030d2ee35bce87387cb37b005fb18193643cc3d

Download Submit
C:\Windows\SysWOW64\Aejmdegn.exe

Filesize
79KB

MD5
6ccd0acf2a65a3bf0c622df7fa76567c

SHA1
6581180926a17d0a42a0a742f105dc06cc9c67d6

SHA256
6457e5f73db3e1a8b8cae22b05e6828d5a2f6c6cd049b07b26f056bba92a1b63

SHA512
5b37b86818ab964b5601d84d7c7bbfeb9937603e62a6f0024a6c4767f5dfddd08210f4d275d8ec6e4b4b9b6109fcd237a01622f67c5e3d1f7eff1276296bfb6b

Download Submit
C:\Windows\SysWOW64\Bajqpe32.exe

Filesize
79KB

MD5
553f1e2c19499dd42228b9412034fcbe

SHA1
069262a40a9e5516408867cdc907edadac5ed46d

SHA256
59263599ded3ff57282569ec7f1c80f7fd14f77706b718d376398aa0a21023c6

SHA512
09e3db513274c4ce35a4ef42af1788a2904367cf12e4d1742f844227b7617cdd6cfa2ccd6d6c9fd505a2738dbd7f6a9837102032c30eca3fbca271cf12ce911b

Download Submit
C:\Windows\SysWOW64\Bdiamnpc.exe

Filesize
79KB

MD5
760ce51d10e831cc7003296b69da7e14

SHA1
63d819613c2dc123f0f38a42297ba7c2de632e16

SHA256
26f377e82e2dd09df829c79b6e553bec9d322a6ec31c86394ad640ab16abd655

SHA512
2a12ce139645b8580fb129803c660fc03dac7228a9f38fd9008bbacef850329acf6e6f2f7d01c95bb5c70a5d08ef512b87dcf3f8ec3ee841cf8b588c2537015a

Download Submit
C:\Windows\SysWOW64\Bgfhnpde.exe

Filesize
79KB

MD5
6deae353f5bd66acc9e5020ee17a9156

SHA1
9de386211c7b875d775b28c95029c4b2f1e41be3

SHA256
b55bfe96a23c3eb2fc90f2b043d13bc59feb12cba7cc72723723e52167db938a

SHA512
2a8bb43db6cd57a0223fe6d6d7badb3ab21fb638ec520b57d4077129551c9a1daad6bcb63433b715b5844102cc85473ab718878a956517e2dd3c7691d109902c

Download Submit
C:\Windows\SysWOW64\Bilcol32.exe

Filesize
79KB

MD5
9227cbc61840910057c7c8278344f338

SHA1
3044bedab0b9c42f42d0454717e433cfef899e9a

SHA256
60e2000bd9b98b0ceb964cfcb5d39edfabfd778859e761ce2abf3ff0d7b9710c

SHA512
1f8842e895f2fe76d159abe63cf436682e98addf5c23a0f3726a5b9a884303ad7b8aeeb55de2311e01cafb784cf18c37c43cbdc04f7fe65dfec6b020330734ff

Download Submit
C:\Windows\SysWOW64\Bkamdi32.exe

Filesize
79KB

MD5
37fdb150e3b68042a403337e0511995c

SHA1
4c3d08c3a6b152856b9b0a2813e0cb128b7973a7

SHA256
6ac5e2481403929c4c68ff050770bd3cad430d787cff7ce490a5003a4a33062c

SHA512
d40efc331aa504971b878061427da513ba25a648281813fa4ac204a49e47c511195530ab47c13b5d3c152b5f42cda433ef9141837886007832d36c7cdd0a7dc2

Download Submit
C:\Windows\SysWOW64\Bpfcelml.exe

Filesize
79KB

MD5
73a218df7dd2dcfadb4262b79bf028d0

SHA1
3217c7b4def3a89457926108fb3c1e94ed4f93de

SHA256
df46c4934e60f157446c7c28c931da9f9ff27adafc6dd594fb033cb378a68898

SHA512
9fc122b0dc32d7a40c3fdea641810387a8b37550e9855f7745ae4bdd8b358fb9482731ccf7d2041301cb9a13e94d0923f07786f43ab563190238d486b551cef1

Download Submit
C:\Windows\SysWOW64\Cdhfpm32.exe

Filesize
79KB

MD5
da771bc99d8dfdcc424ed18b2ab095ff

SHA1
b346f3a78ea2d6ee00ddf11d2a9d5bbc2e1613a5

SHA256
42a8d29ad338ab0e0799ea33489c47cc677e9cb431d47fecd27d14475179c2b3

SHA512
cacc46b65fbdc3156bb679429b4fb519dc11854ca6e790530567d732a2a8780d5053055893f881da1c2bda1b53a885dad33f21fd471fbb6de857320e77f9e720

Download Submit
C:\Windows\SysWOW64\Cicjokll.exe

Filesize
79KB

MD5
52a142b463beb595f7f4614df187b497

SHA1
d74b95cbd4b4d2b603e4eed8d224aeac4f032fda

SHA256
aef4a02862abf26bebe00cc0bd20b5aad4eee8148c97ad197825cb863827820f

SHA512
2304ebd613abd1defdb55d68720e3a59a300eaa84661c68ea15d591b39d157f9ef5122d582c9e9b408eb6c2998ae539febf4abf2a61fbf3ba5eb3e77ae5dfff0

Download Submit
C:\Windows\SysWOW64\Cigcjj32.exe

Filesize
79KB

MD5
3887de591c9f783314829eb846caaa3b

SHA1
0a5bf0c181e1828c0841b9f168753f29167e639c

SHA256
bd2e3b7c3db526b066181e260436470fbd3262044500ad02e512aec01befc7b0

SHA512
561c9143d68753437795405111b1a5e41dcfd03eebcb3060e127cfb5b2cecee05275f8952bd07659151aba92db0ae69da727e2380c120737de1f42bcc3f2aa4b

Download Submit
C:\Windows\SysWOW64\Cnpibh32.exe

Filesize
79KB

MD5
e404c7dcb7473fe4120de23576a18407

SHA1
4aca92d186a6cc96c36e8faf4318ef029e48b77a

SHA256
cbd3f820e3704a437891a89f501c67b906647731a2ff1d6aadc9c6712d7a8fc2

SHA512
df8d045aa406bbcc7beceb77f03e51f194d73ebb66e86d0a09d3db6d1ff84e900849f9b3936a49c4ae8b022ff4ced2537ee1399ee62d06e32f2acf1d459188c7

Download Submit
C:\Windows\SysWOW64\Cqghcn32.exe

Filesize
79KB

MD5
34632feaa9a02a0722ced87618d7ac35

SHA1
30f7028f3abccb444583ad0414b701a5920b238b

SHA256
829b12fd45cc2ebb6c52ad5e6c8b829c4750d5755ec23fdd6c70aadd041da937

SHA512
c3abad7dbc51ad773c4652dda2a6b499276f19aa9b277349f629ada1a169f3020063a0c6c66f41bcf9ffd198800604d866b2a8e395269419a1a98fbdaadcf4be

Download Submit
C:\Windows\SysWOW64\Dajnol32.exe

Filesize
79KB

MD5
6541b4e899f3b93dca94873c66b97c15

SHA1
a14bf8d2681734c0c531203aec9b76309ce09159

SHA256
e58249308661abb05e9abe3c2b739ed4df382f951a169bd12559fedb82a06494

SHA512
6a3ca09d7d211c103295255e53eb6a5e3b900322ab59968a5ed6cb17cd275f88608c6ed14b61a948495c5324980fb9a20ba0d49d02ec1963e1775c5e277c3c11

Download Submit
C:\Windows\SysWOW64\Dfngcdhi.exe

Filesize
79KB

MD5
49ab43387fada377e30d732915fb7617

SHA1
c767f9c6eb1da840b48d56b92b5f6d27481d9335

SHA256
c07176a1ebfb9c76bb513fea474d58342cadef3929056b725abc2e11ae11986f

SHA512
4af6d200bf7d752aa76cf99765c9305770cc202b2f10af8920496e03a8d8f9ca3253399a224b0e7cfe34fd9c0b3d871d7601f827a699351a2b8354c1e9082d39

Download Submit
C:\Windows\SysWOW64\Djgbmffn.exe

Filesize
79KB

MD5
1175a16967b05527705063a76d96bbe5

SHA1
8899aa83c394c3390eba38cd898d0ab7c2965069

SHA256
9c404e421c11ab89790513e12a44fb1e1522a38d1c35f30b580d707e3507a95a

SHA512
d4339979f757746060ea7cc4de1d9dbbda587bcccfbe9b9610a5894a4cb84f2f362e23097993cfc6eff4825bec41a738ec3dcc4774effd8f12965173b2ebab5f

Download Submit
C:\Windows\SysWOW64\Ebpqjmpd.exe

Filesize
79KB

MD5
c6ab7d11200278af73ca51ac3028ae5f

SHA1
f8efa18a71c3bb6a4f6bb2ceab8d1cedac63d306

SHA256
a45f2e2fcd03844d5b57762354f29f041d6e4ba0c948d5af3630733da00cb201

SHA512
0dbf89fbaea3582d7a86a297ef3c0ebe2a267a98e8c86bbfc931eb5132763208871324d436820b3a4c6d6985eb6b49fa2427706b9f5530af011088fab22be4d9

Download Submit
C:\Windows\SysWOW64\Efampahd.exe

Filesize
79KB

MD5
8df5cf5db24f14b3e42d86e3c8309b1d

SHA1
05ed497b3a68ee0e48b959c1b336085d3d00466c

SHA256
f04e5a1982ad7b54a2ff77e9fd1be59b28a7db3873366247ed03a82938cb3daa

SHA512
a211750093f79e3be1e755e44b473bcd1aaf0a2449ebea00821c8e7d3c93d1846a8ee041442ce05a7e555fd7a8f56c49e78515438f1b9a87f43c10b2e75dc970

Download Submit
C:\Windows\SysWOW64\Egihhe32.exe

Filesize
79KB

MD5
cf476705f37cf7d11ba9458157293713

SHA1
8a0802b0b1ac2e273a0e94bcc23ab366f36c1662

SHA256
a985e53e291d1e7ee65809c32260c29c2a53c41c1700d8cbbbb50b34b8aa6aca

SHA512
a54674b972b0c58368721855e4dd6bbe2146eb59a4332c127eb971b3c90ae8ffc894387387b09f8f6ecc96cf1641c8ec12d6434a3f98bbd452eae42988b36eed

Download Submit
C:\Windows\SysWOW64\Eldbbjof.exe

Filesize
79KB

MD5
dd285d82567f14d6ca6a50f05cd0f4e7

SHA1
23791d8d7ef8f39d16bfe5f075cabbbb93891d4b

SHA256
42f61a1c9ee8d78be58f828162d0d008eee1575e80b0cc8961f4fd837f8d3cef

SHA512
5d2fad6c4b32ec1353724c9de361aac465cf98e9d8bfb953209d2cab688e2515c5d170450db45bf3e20f1c10374ecf2a0b3370321575b1fc32d4be8e59d1092b

Download Submit
C:\Windows\SysWOW64\Fljedg32.exe

Filesize
79KB

MD5
fa4754546591c645a043ecbba9ee013f

SHA1
1c9ad3f9879da20b9a8eafaeac0d205cf91b62c0

SHA256
a598d052dae3f0f1ae855022488a4d1efa81f8b6be34bb0909291993b1e23cc3

SHA512
0c480da2e844a9c3c9ee393cd7bb59488fead56d9ced5176df2f1cb99a3508202037a17378a9d70a2a55dfd9f6c6c86cfed1461d19a0ed6e2e9fbb26c6bd33a3

Download Submit
C:\Windows\SysWOW64\Flpkcbqm.exe

Filesize
79KB

MD5
f449351a0a81c5dd04969fb89a5e1a3b

SHA1
289bef795146b26ff5b18cd1b327af7dbc4bf035

SHA256
afd80e1783e5e3d38dcf58ee9b5d5a6ee7e1614928aa0f267cef9a17852a01c2

SHA512
74b9b8ebd2b7d43661b35e025a1705b3916ffbd750cac65d6f324487b7f6eb1f16cf4480d1de64c8052c809c8304c64b6ca671e9cc80dfaf60599e71186e665c

Download Submit
C:\Windows\SysWOW64\Foonjd32.exe

Filesize
79KB

MD5
8324dd76e43be2a7665a22ff2c019991

SHA1
2ebfd6251b657f1d1139f8ddf667150fdccde62a

SHA256
22eb644403538c74c25414714c79b4372f3285348d258d635a2cbf4e7f9f158f

SHA512
588b3da363e79a9e9980e17d207a231731efad9c38314235b9f000f933569a3451fd9216ed2bced9f3c7a8c6d6a60aba040776309be1f5cc1a1c7bf577496439

Download Submit
C:\Windows\SysWOW64\Gekeie32.exe

Filesize
79KB

MD5
c4865526e141db41921354581159da73

SHA1
63405350e0f2f455e5d7f112809ff9ee69814bb3

SHA256
c201fe36de9a6eb82c4044646021aa3ae187c05916dcfed7326f83cea07283da

SHA512
ad918ff9c2df4e07dfc61e02fade3714104d67d7ef05774d14809936d1fdc092da83632158578b08eb8096ba4df717e61fe255bfa191f0bfc177f82feebf9869

Download Submit
C:\Windows\SysWOW64\Ggdiqkah.exe

Filesize
79KB

MD5
6887d706f24426b94fc3557a8e7e4f5f

SHA1
47ce65105caa6aa6a1d536aec93738d8848708c8

SHA256
486cc4c3af34df82b58b87ecc94a1e509463dcb36af8aac62cff4e5e6c21c096

SHA512
fa1f69aab656565a1972e78fc0a51a0818a476981cfa204e7c2b53f8273fb058c83aa75b924ac63d8017b2814e1b6f0899fe9d2c3a0ff9d446cd55a7b512031b

Download Submit
C:\Windows\SysWOW64\Gogjflhf.exe

Filesize
79KB

MD5
5684734ae5d6191a1a12045832217ff1

SHA1
2d2dae0d950e06f0a74a8aad5ea29dcf6fd2abbe

SHA256
a0aa4737e4b64bca30768cdd015e3d0a4cf0b14eae3bfa2173b9a648f4d4138c

SHA512
4061d64076f2be35acb8e44170631f7aded89f4ea1cf06c6fd9752173972106395535b8d1a6396395d7c10caef94aa1923c19c662a81c9224c6af9da109c5e53

Download Submit
C:\Windows\SysWOW64\Hbegakcb.exe

Filesize
79KB

MD5
f12c2d4901d62183d3b6c4bdca1b5624

SHA1
e8b79bcea2b768cb954eb2ec100063e47a52781a

SHA256
8b19a4a753eedc3fe86a459cac942701199a9a25173b713d9d68d704246d262f

SHA512
c5ef086ea12f1db9e7118a284de8a85cf78aa6939a6b25a2a0a1a87318cc383476c775087cfff9833de238442509026d82311bd89c9642e2d5b90fefe3c99559

Download Submit
C:\Windows\SysWOW64\Hhaope32.exe

Filesize
79KB

MD5
4f3f83a2e56b312624b230570ffbf39d

SHA1
cb710607b53a6803464703240a021ff130e11b64

SHA256
0748dd50b34161ff36fd575e3bd6b7ed339ba49c389241a4664014d3325033fe

SHA512
1d86cba0ffb3af5278c1528b8d1b07455bce4b93bbdfff49effd92b6fb13bef51c40b91d66d019c16b07e680a5fd04f134418d890ef38bc555628097637e516e

Download Submit
C:\Windows\SysWOW64\Hodqlq32.exe

Filesize
79KB

MD5
ba7ecab5275e71cf909f17d787a88f50

SHA1
db95732779551f1d1e20e4a672195231c84c6243

SHA256
7806b0fa0886b01813359e2afeead4527769aa2717ac76fc9c450a75b4526a00

SHA512
ef5ce41d387ae533d32a7dcc353c08eddce664ef4dcc3f66028bd91602d9b38d2e9f936e91601aef9a6fb9bf5a42c14c6911af1b1d56894d313751c1de7ad5ab

Download Submit
C:\Windows\SysWOW64\Hpgigj32.exe

Filesize
79KB

MD5
5a0dbd3e018823d3d4fa80cd9233ba22

SHA1
38f85d891f8eb50e2bd031b5e41bdbcd290ba5ad

SHA256
0ca0767fb44c156b3b69d5b71849e62c3c49811168f7ddb5fb2369fc6acad498

SHA512
9ae777bd597f3ec6e6262dc6067fe4070193c0f904974d2b535c0819113e1ca53c68bb01da2f5ce1cae8b6020c594ae4bdef3774ccf56af13dddee48dee45ea1

Download Submit
C:\Windows\SysWOW64\Icgjfgef.exe

Filesize
79KB

MD5
f87bafdbd3223fa05a91913f8654057a

SHA1
8e2ca3d78a4d1d4a74373ec2e53ed8d2c0798807

SHA256
c5d313a529d1904e3778ee6ee44f17ddf38310b621ab1bedfacc2472fc044c13

SHA512
6a3f3ee0de2c246a93d29695f1b3b55182fb1cf871d5e7e5ec30b63a1d8fe1a80432ea9905e5eeaf7ea5f20975ec0d6187e0a4602b26b9757534d94162062d01

Download Submit
C:\Windows\SysWOW64\Iiokacgp.exe

Filesize
79KB

MD5
5901576e1896385a21b40de21ba7f34d

SHA1
29c96d6932ceb5fbef60762819726e86000eacc3

SHA256
70ff970af95c7f83264ce59a3a00b27e34f9520e7b7c173a1325eb2540f2edff

SHA512
019b5282ecd03881ef9eb5a6e3196e336c27b4472a817d72da0324d3b3f2795f4425ec35be37217e5de19828c6ec444d17d9bebdb32111f6e3a7186f30355eb9

Download Submit
C:\Windows\SysWOW64\Ijgjpaao.exe

Filesize
79KB

MD5
4a6d94609d39e044a544b02852654b0a

SHA1
4c424bb67b89bf38ed4c835e440cbd044fe0672e

SHA256
81acba213b4f32772f64b3fa363745be0d7500dbe665a07d084f038e563c8cce

SHA512
58d8a29ce64ab1fd2aa9f319e58c78b7175e398c1f06224a1a03ecd1a1cf7263b1537bd8a912678d781a23d1b1611a616512141d8deee9bc234508416a168df2

Download Submit
C:\Windows\SysWOW64\Jginej32.exe

Filesize
79KB

MD5
a14e1f08d0382cb8b3f8cfe0c78d5748

SHA1
41e3d56130496882226bc03c74860fc073941b13

SHA256
0a5b8ea94da338b5bdd14f8e93766795deedebdf76233377d9d3c93702583647

SHA512
fc3dee7beb6e18f7c2fc852f578024a8a22771b7f2e2867a3de456df2c22b944038a1be91c6fcecbe22ba7154ee25fd5a4c4af8f87078a5035e095e8db318bda

Download Submit
C:\Windows\SysWOW64\Jomeoggk.exe

Filesize
64KB

MD5
35e9b43c0cdf6158fb209a2f5159eb3e

SHA1
86001ead379c629811e2a617714f8d3847495973

SHA256
8e4a197bd140de65745cfe010f3e8f1b29fc285ec4d242d55316ef6456a5153e

SHA512
525e372a6c2749c2f882ddf55a9c1ade8c15af74ed5f9818af9dd2423d25b1c553be9e354f9d9d667b2880c51109a3736298150a8e381430fdb462cac8f75387

Download Submit
C:\Windows\SysWOW64\Kfaglf32.exe

Filesize
79KB

MD5
66331ae782bf93f08dfc9ca52d1f5877

SHA1
299d1c26567843e4a395ac2c3ee4b638996764b5

SHA256
82317a9c97ada93502483d5b30ed047fba4122aec7822c782e775300bd48706b

SHA512
399b2996ba8de4fdcb31d90437a446b284f081f503029319f13e60db01ed11babceea34987c1cc518123f10d7b7e733d97961678a5de56bd30ab5edb1df0a267

Download Submit
C:\Windows\SysWOW64\Kidmcqeg.exe

Filesize
79KB

MD5
c19394f167dbcb55db70779b172fffc0

SHA1
b2d2b0a76dab1ceb8f9aa6861f8bbe023851969b

SHA256
b179b428adb75f45a264a1c944233d048d679f97b8036257393c1150937055ff

SHA512
f859dd68ae51f89a1701fd761b200586b42c61c16fc90d92f741b23080aaf8325b0d7720200050303c92ce490482ff1e341c49f9b303757feacdc444c27e16c8

Download Submit
C:\Windows\SysWOW64\Kkfkod32.exe

Filesize
79KB

MD5
6bc563fd29c4390efde4b55a100c5e9e

SHA1
020d034da7ef2586bca40e36bcd7f37b496be7e3

SHA256
18a3feb11abfffa25e11475ea233df95956ca250d6892978a9ee449a89f2c921

SHA512
abc8d1f818d5c019c77c927c47ac0395984c681b6ae02afa6667c22a2716c105dd8c29ac521eb0b546057d8d6a06e7f4283f147a823106ef446e158d4b7377f5

Download Submit
C:\Windows\SysWOW64\Lmfodn32.exe

Filesize
79KB

MD5
b6608500601e5817724e65577608754c

SHA1
a1ad304d4e1bbebbeccf20e2261c19fbe0c3c100

SHA256
fb0bf630e7044e6512e7796827976ebd4406f5ddc6ec7a639a358d76f6c265c5

SHA512
65e8b62fddeccf87c6fc67945da9ca461c7d1d34c71ea8adb3258615cbc917344d717580adfe10ae7753bdd6a00fcc26625b66f8238e8b717f13fb9f3ce595c5

Download Submit
C:\Windows\SysWOW64\Loaafnah.exe

Filesize
79KB

MD5
7a9cd05823cc78ad2e18dd393928564a

SHA1
ed05f6e925a9f62d8aa61e7c6dc14ae66d91033b

SHA256
59640e9a5be722b25c20e354a6be5d35b1c672af532f21a7fbf50e7a82bf6904

SHA512
eec74fb73a297ea64105fcadf24f9b4e799ed520a1bc6529204079b55c11379113805da56f775b86ec033802e23bd5991d30c4761a520add561ced1a1cf1599d

Download Submit
C:\Windows\SysWOW64\Mdodbf32.exe

Filesize
79KB

MD5
b9c8855586fa5bbe878ddbae33ad4aec

SHA1
2d9ca047b012748848ea4855d481573ad5d0dbb3

SHA256
37697bafa7e9f6028f445e2fdfbdbe59d6e5bd6ee648aa6d235ccb657aa72e16

SHA512
da7354c7b51d183d05c1c25e54aed7d392c9533f672d9e5cd44073e736187218c441336d5c2e74925c98971475cc4696d5d63c1e1db46c15ec9d7114d3b86cf7

Download Submit
C:\Windows\SysWOW64\Mgpaqbcf.exe

Filesize
79KB

MD5
f8cf7ec12251dd6e1fa06797de225e81

SHA1
bac16b71968cdb7b419d60dc35bcc392a7213d11

SHA256
921bb46b14ee9c13889a01dab7b566b9fd9324071366a1a68644cda5d89cb29e

SHA512
ad93c73d86b75151e7c13cf43caf70a385cfefbfec258ad194b1fd86038804a75c36730e64edf2700a8ff8b96befb3ff98454551382223bbe44b26245ee63b78

Download Submit
C:\Windows\SysWOW64\Ndidgg32.exe

Filesize
64KB

MD5
8954d94c04eecd5dbf44fcab838874a4

SHA1
0ee895006b2eca9fed30b8ecec5fe00030c3f7a0

SHA256
ee9409bdc51709127aabe8249743c95bca214fc19982acb729a2454bc10196bd

SHA512
487756a2ecc3a4a0540ffe3704603e565cc2eb9881e1563970caf6d20eee2eab84ea0f63af33f6c185a734a5c75f025eb246f34ade543f016164387c7e4326c9

Download Submit
C:\Windows\SysWOW64\Ndomiddc.exe

Filesize
79KB

MD5
cf3610f255f8dde975aeabf3564dddaa

SHA1
1464ec7363380bf8fb6c46c19917dbbf9c77f2ff

SHA256
d3315fda6214a2768fd7bf6bb8f6a9c01842843c646c71a24e0ad99307e47036

SHA512
50b857c02105c05b7ac6101321eba18f408069597cc242357b7cd9c881c7ac4864086d24f5672ac0ed34f88abe6e4fb2ea9a98d3b5f728083f54f33b4f50c534

Download Submit
C:\Windows\SysWOW64\Nhnlelfm.exe

Filesize
79KB

MD5
762d13a9d733e7484703558f258a4986

SHA1
4a6553004254e93e4f1e4c5474304a537408bb01

SHA256
b2422c75d592746b55cdde719eb199565dc629892c75f8cd711e6b1973b0bf46

SHA512
05dd9ef08a6587f98abc2f97b9e27e6480a1ab790dd0e6ff0a1cb1f0ffc455247143a36cccb738b5d7d23b1d2d85522f2778816599a611b7e75cf8b8fb96bba4

Download Submit
C:\Windows\SysWOW64\Njploeoi.exe

Filesize
79KB

MD5
f519f8e5975fd9b3fa7104d231a363d8

SHA1
c2cb8b202ff9dbe85d02ba418f748d3397c003c7

SHA256
8b44b2d6aa68788e671e408865596dcfdbc9e146e4ecfcf81daafec626d3232b

SHA512
b47b5e0ff512c772ea372b3585c1ba1cf2dc98a6203e97f1b2c8a82da3a45fa75cf62d9bc1ae922e2913579671b8ac112ca94e183c8f10a0f70d1e0fe0a338a6

Download Submit
C:\Windows\SysWOW64\Nplkhf32.exe

Filesize
79KB

MD5
bf0082f5815c6d9dbf91b5e15887b62f

SHA1
953a327af87d39efc3e07c50c381632bfbe5cb34

SHA256
1e75a30f69dc6958a5b92bfeb3c999765f7115452807a6372c25c065426ad4a6

SHA512
63454c78e1e133c78c7219b3b2a137d7cf93523faaf3b7ca6e3b87d8c973e461ced4572a04a787a077bbdac23f196c32c6ba18599bbfe47a7b62ff376e591370

Download Submit
C:\Windows\SysWOW64\Ofpgaihj.exe

Filesize
79KB

MD5
b0b2e139de5a9a342bf7a839e32e9b33

SHA1
f10d6cde34950248a08fa50445be8d8aafaeb520

SHA256
99148354317d3a819ecaac71098d385242f90e01570128e452730b27e32bbc06

SHA512
bfcd822c8787eeb4e675035a1d413c930af16af7ba2df7e40ab29478e750d364a24444ad4b5f5a2457c78257534932eb9dba70ec2699ea34b95078a7a6614eb2

Download Submit
C:\Windows\SysWOW64\Okbhlm32.exe

Filesize
79KB

MD5
cec50412896b4ffeec9db10a148fd6b0

SHA1
6f15638cf41c67c3d906db103473f10167d21f35

SHA256
0a6035d5942b3c7cd133244743efc9c56a76490efe23d926fb2310f87ad9afbe

SHA512
3bc28d02d547bdcd4f6b204e713c02aa8b421eb30be3ad13cb566e40e86cfaf335948cd2f152a629462fb402a80245d24e0ac3adef8eb9d012b3dcc4c41e91ca

Download Submit
C:\Windows\SysWOW64\Onhhmpoo.exe

Filesize
79KB

MD5
b0ba26463c0aefb2c8884eb67014cee4

SHA1
06922df9907211dc2e72488169bed5516671fe21

SHA256
7ee459fa751f7bc3b793fb93617513bde96a177f2d61a22609d234ed6e1bf4b3

SHA512
f50e3a0213b6b8764530069beb7be544d7b70081d9ada9bed1edf52691592e4faedba6492ba228a9e1041150d2fb8fcf7786dc29619f0f71cab1c065caf9d2e0

Download Submit
C:\Windows\SysWOW64\Onkbenbi.exe

Filesize
79KB

MD5
808b75b818e87f0f7c59740436c1ba6a

SHA1
d30088bcca2e55d0b7ca1fd1c27b669b918d4759

SHA256
8aeff3e4c244e66a37d06c3036cdcfa1e9c3b2f4e1cf080ad22f5b1e732e31f0

SHA512
eeed668b95eaf84129bb5bf908aae68250547bf3f127466feea2ab6690fc630c363878bd1f091f2ea014455549e49b96addb7922209b4c0c56707316b45873fa

Download Submit
C:\Windows\SysWOW64\Pahpee32.exe

Filesize
79KB

MD5
edfb3e7f8b8e918d46d52d591e937ef1

SHA1
38ee14ecdb9a5f59ca019c93c81f1863b019b71f

SHA256
25ce9b54285a81489df9e1ef9d746e2237e90f05ab506539712960b79a45a8e2

SHA512
492e46fa279f3c31f937b261dd5c94cd7ae954aff61752640228ea34cdda5f63c5f02539fc7008fe749d77d59456dd6b4664146076c73e8b94699801b5912a5c

Download Submit
C:\Windows\SysWOW64\Pidaleei.exe

Filesize
79KB

MD5
28fcf2f893e1a30e69e86fc23bfcbca9

SHA1
affeeedf7a973711859ab4b5ff6f0e4a431ef771

SHA256
72fbcfe142830c46100a8cedc37f55dab7542fb54b197a540fbb05041374043b

SHA512
dcc653b3636578863c241bf32babe6a957f47e86815c80718f9a7986b1ee93e34fdf8372dfc69b087784e9eabf7050a8eebc3ca98b2d17fecdf7e7139fb7d75d

Download Submit
C:\Windows\SysWOW64\Pqbdclak.exe

Filesize
79KB

MD5
bcca21bf3566a71aa48b33df7ff78433

SHA1
3acc4ba4218941ed8c2fa20ae1962277d51a69e1

SHA256
d7b39289132c2d862a896d4dea9f6b0793f82d57307362a8e990de948c824b55

SHA512
a02194ca0f46cb518b7492ade4409a58020defeba8ead27825e91f8cec3dbb7edaa4e04fbb17003a12059794bddb2762e2af3a80c92315ee7091489cf9dd6730

Download Submit
C:\Windows\SysWOW64\Qgnief32.exe

Filesize
79KB

MD5
cbece1fc7a6e5dc1485f9adfb50368ce

SHA1
dd8009caa6e418aca6aad5a11039f8b3ffba3b7c

SHA256
b889b23258cdae3beee8be4e62020e5ed79ddad2245b3474f8d30cd1c3b74995

SHA512
568c788002723d3e87870ff608b6f2966eb2ca921abd65a89f57bd332e1263ba4f7f36799a69045165b2930e505dcfac7f39e990ca0ba0ef435c295a3870fc0d

Download Submit
C:\Windows\SysWOW64\Qnlkllcf.exe

Filesize
79KB

MD5
9afce6d356e3edda22f4a230930d209c

SHA1
e8ac4a02b1ce406680bb4e16f308cf6c3f5e7e68

SHA256
1125164cc71bcbdb67c8d4722552b118fed64570616c64f5afb200bae70e87b4

SHA512
1c0fd99a2f0d415248e9a193a44d83643f876f9b3f79892ef46c2f6bc615cb3ec0a635358f0c6523be4b3daf3f0ec328a7d42c1d70667aa13871473ecd59958f

Download Submit
memory/208-283-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/216-403-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/264-355-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/432-337-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/656-305-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/888-177-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/940-130-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1040-265-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1188-349-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1348-226-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1544-420-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1544-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1564-391-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1616-379-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1812-97-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1832-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1844-409-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1992-234-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2148-277-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2568-186-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2624-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2688-89-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2856-325-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2916-319-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2968-146-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3016-41-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3056-419-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3056-33-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3244-307-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3356-271-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3456-313-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3532-210-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3696-72-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3708-249-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3720-257-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3732-373-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4044-153-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4068-57-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4068-421-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4144-105-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4220-397-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4248-161-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4264-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4304-137-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4316-343-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4348-114-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4368-331-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4416-295-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4420-289-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4500-49-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4520-385-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4600-242-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4612-361-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4692-194-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4808-174-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4880-367-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4976-121-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5028-258-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5032-201-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5052-218-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5060-82-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5116-80-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5116-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5116-1-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads