0c0cfb5c634e37298dc7eaec594eb5c889dbe507934585586a23a5f3f848796c

Analysis

max time kernel
160s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa063711227ba9b2af05971bc179503d.exe
Size

60KB
MD5

aa063711227ba9b2af05971bc179503d
SHA1

bde70adfb96f7c64e0f0d487ca4e8fc7faf1e161
SHA256

0c0cfb5c634e37298dc7eaec594eb5c889dbe507934585586a23a5f3f848796c
SHA512

4ddda47f586e5c4a933c9e348e40c8b60be6c6d38bc456aeed947f20e6b448151e4246801a75b7400b447c92c70a21c728efcb5a13c373437469adb77f972590
SSDEEP

768:Dov6vsf62l2ruB1sembHjErjpGMlNdZEJliWLPiY4pWdk/iGA9oIhhpR/1H5VDtz:DMusf6O2riP/ZO/ziFLNWZb5B86l1r

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emikpeig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppclej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijhhenhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpenpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilnbch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cadcfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilnbch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjfdfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbppjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcifmdeo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfpfokfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbgghn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Leoejh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iehfno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Halmaiog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkeloa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accnco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpkllo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkagndmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qodmdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbgibgpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hihibbjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lefkkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Docckfai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmaihekc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfacai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgkegn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnnmogae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Damflb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjnipc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpqjaanf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bojogb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfhdnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkgeao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpdgbkab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oigdmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjocaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbldkllm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Elnoifjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbadmege.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kqkeoama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elnoifjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aamkgpbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	aa063711227ba9b2af05971bc179503d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnojcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilfhfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lajhpbme.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okkalnjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfcae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qpmfklbq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnnidjcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obpkcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcijce32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjlpbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kimlnemd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llbinnbq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efccfojn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbjlbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kiomnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Incpdodg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdnmphag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcpblo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmkgdgej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdjqienq.exe

Executes dropped EXE 64 IoCs

pid	Process
3524	Fqppci32.exe
4536	Giecfejd.exe
548	Gngeik32.exe
4008	Hajkqfoe.exe
3456	Hnphoj32.exe
2796	Hihibbjo.exe
3004	Ieccbbkn.exe
3384	Joekag32.exe
5028	Kpnjah32.exe
1860	Mjlalkmd.exe
788	Nckkfp32.exe
3224	Ojnfihmo.exe
4216	Ofgdcipq.exe
4508	Pcpnhl32.exe
3504	Piapkbeg.exe
2328	Qppaclio.exe
4048	Abhqefpg.exe
1052	Bdapehop.exe
920	Cpogkhnl.exe
4816	Dkbgjo32.exe
4552	Dgihop32.exe
2692	Eafbmgad.exe
1728	Fnhbmgmk.exe
4936	Gnohnffc.exe
4660	Icogcjde.exe
3720	Iabglnco.exe
1976	Jnpjlajn.exe
4320	Jlidpe32.exe
2508	Lkiamp32.exe
4248	Leoejh32.exe
1364	Leabphmp.exe
1828	Lefkkg32.exe
3064	Nfnjbdep.exe
3108	Obpkcc32.exe
3564	Pcijce32.exe
4960	Alkeifga.exe
4968	Afqifo32.exe
4524	Cefoni32.exe
4256	Egpgehnb.exe
4452	Eegqldqg.exe
2260	Feimadoe.exe
1012	Fdogjk32.exe
1996	Fjlpbb32.exe
3236	Gqkajk32.exe
1092	Hnehdo32.exe
3908	Hcifmdeo.exe
1600	Ijhhenhf.exe
2564	Imnjbhaa.exe
2516	Jjfdfl32.exe
3924	Jepbodhg.exe
4976	Kaioidkh.exe
372	Knbinhfl.exe
1720	Lkppchfi.exe
3484	Lajhpbme.exe
5016	Mhkgnkoj.exe
2700	Nnabladg.exe
1876	Noehac32.exe
3228	Bkadoo32.exe
1436	Cgagjo32.exe
4948	Cejaobel.exe
3368	Eekjep32.exe
4164	Epehnhbj.exe
1992	Fgffka32.exe
420	Fcmgpbjc.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Aikbkgcj.exe	Apbnbali.exe
File created	C:\Windows\SysWOW64\Pimcpf32.dll	Gpkliaol.exe
File created	C:\Windows\SysWOW64\Gdbphinj.dll	Hcmgphma.exe
File created	C:\Windows\SysWOW64\Ipkneh32.exe	Hfnpacjb.exe
File created	C:\Windows\SysWOW64\Idfilp32.dll	Iifodmak.exe
File created	C:\Windows\SysWOW64\Diccal32.exe	Dpknhfoq.exe
File created	C:\Windows\SysWOW64\Nnefpdco.dll	Igpdph32.exe
File created	C:\Windows\SysWOW64\Dcegdd32.dll	Akccje32.exe
File created	C:\Windows\SysWOW64\Iabglnco.exe	Icogcjde.exe
File opened for modification	C:\Windows\SysWOW64\Egpgehnb.exe	Cefoni32.exe
File opened for modification	C:\Windows\SysWOW64\Gqkajk32.exe	Fjlpbb32.exe
File created	C:\Windows\SysWOW64\Djmbbk32.exe	Dqdnjfpc.exe
File created	C:\Windows\SysWOW64\Mflbjejb.exe	Moajmk32.exe
File opened for modification	C:\Windows\SysWOW64\Icalij32.exe	Hibape32.exe
File created	C:\Windows\SysWOW64\Dpeefhck.dll	Imnjbhaa.exe
File created	C:\Windows\SysWOW64\Bkadoo32.exe	Noehac32.exe
File created	C:\Windows\SysWOW64\Pjfffd32.dll	Kiomnk32.exe
File created	C:\Windows\SysWOW64\Fgfqmlko.dll	Qkpmcddi.exe
File created	C:\Windows\SysWOW64\Nhhljfmp.dll	Efepln32.exe
File opened for modification	C:\Windows\SysWOW64\Eafbmgad.exe	Dgihop32.exe
File created	C:\Windows\SysWOW64\Bgafin32.exe	Bllble32.exe
File created	C:\Windows\SysWOW64\Kpihpm32.dll	Ppkopail.exe
File created	C:\Windows\SysWOW64\Chebcmna.exe	Cadcfd32.exe
File opened for modification	C:\Windows\SysWOW64\Llbinnbq.exe	Lehaad32.exe
File opened for modification	C:\Windows\SysWOW64\Dpknhfoq.exe	Diafkl32.exe
File created	C:\Windows\SysWOW64\Elpknehe.exe	Efccfojn.exe
File created	C:\Windows\SysWOW64\Ipomlcnc.dll	Ldqfddml.exe
File created	C:\Windows\SysWOW64\Cmkjpd32.dll	Iohjebkd.exe
File opened for modification	C:\Windows\SysWOW64\Pgdodq32.exe	Pokjnd32.exe
File opened for modification	C:\Windows\SysWOW64\Obgccn32.exe	Kkechjib.exe
File opened for modification	C:\Windows\SysWOW64\Alkeifga.exe	Pcijce32.exe
File created	C:\Windows\SysWOW64\Eegqldqg.exe	Egpgehnb.exe
File created	C:\Windows\SysWOW64\Bcllmi32.dll	Npjnbg32.exe
File opened for modification	C:\Windows\SysWOW64\Liabjh32.exe	Ljjicl32.exe
File created	C:\Windows\SysWOW64\Clgkmm32.exe	Bhgeao32.exe
File created	C:\Windows\SysWOW64\Enmencke.dll	Qcbmegol.exe
File created	C:\Windows\SysWOW64\Gppdnj32.dll	Injmlbkh.exe
File created	C:\Windows\SysWOW64\Acmomgoa.exe	Alcfpm32.exe
File opened for modification	C:\Windows\SysWOW64\Gkdhcqcj.exe	Gdjpff32.exe
File created	C:\Windows\SysWOW64\Ffjbpe32.dll	Pbqago32.exe
File created	C:\Windows\SysWOW64\Hajkqfoe.exe	Gngeik32.exe
File created	C:\Windows\SysWOW64\Bgodjiio.exe	Bbkeacqo.exe
File created	C:\Windows\SysWOW64\Mpenmadn.exe	Mpbaga32.exe
File created	C:\Windows\SysWOW64\Olcklj32.exe	Oplkgi32.exe
File created	C:\Windows\SysWOW64\Klmomihj.dll	Dfgcjpdk.exe
File opened for modification	C:\Windows\SysWOW64\Elnoifjg.exe	Efafqolp.exe
File created	C:\Windows\SysWOW64\Nfjhpi32.dll	Gbjlbm32.exe
File created	C:\Windows\SysWOW64\Apckeggh.dll	Cefoni32.exe
File created	C:\Windows\SysWOW64\Pelacg32.exe	Ppkopail.exe
File opened for modification	C:\Windows\SysWOW64\Hfioln32.exe	Gdbmalja.exe
File created	C:\Windows\SysWOW64\Oplkgi32.exe	Niklip32.exe
File created	C:\Windows\SysWOW64\Aimoqgqg.exe	Aikbkgcj.exe
File created	C:\Windows\SysWOW64\Mhppcn32.exe	Mlipomli.exe
File opened for modification	C:\Windows\SysWOW64\Fhalcm32.exe	Emikpeig.exe
File created	C:\Windows\SysWOW64\Qkfbab32.dll	Oendaipn.exe
File created	C:\Windows\SysWOW64\Kmiqfoie.exe	Kbocng32.exe
File opened for modification	C:\Windows\SysWOW64\Lgfojd32.exe	Lpmfnj32.exe
File created	C:\Windows\SysWOW64\Hijohoki.exe	Hcmgphma.exe
File opened for modification	C:\Windows\SysWOW64\Pjnipc32.exe	Oqfdgn32.exe
File created	C:\Windows\SysWOW64\Bofojign.dll	Fhpmql32.exe
File opened for modification	C:\Windows\SysWOW64\Alnfiifd.exe	Amhlpb32.exe
File created	C:\Windows\SysWOW64\Gnohnffc.exe	Fnhbmgmk.exe
File created	C:\Windows\SysWOW64\Nnabladg.exe	Mhkgnkoj.exe
File created	C:\Windows\SysWOW64\Lniphngj.dll	Njceqili.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Loodqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cegibblj.dll"	Fcnlng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbldkllm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dffdjmme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieebmf32.dll"	Eoneah32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkppchfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjlpbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnidhk32.dll"	Bgggockk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhgoimlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nolbfo32.dll"	Olcklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipbahb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Egpgehnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkgeao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aikbpckb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncgiolkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jggocdgo.dll"	Hajkqfoe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfnpacjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enmencke.dll"	Qcbmegol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Elpknehe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jblmpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pndalh32.dll"	Fnmjkahi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmjkka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgbepdpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kihdqkaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnnidjcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfpmglkb.dll"	Ilnbch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bkadoo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bpkllo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Allchp32.dll"	Ffhnocfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Alkeifga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgagjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbgcpb32.dll"	Ficlmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbiapehp.dll"	Hcofbifb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eckfaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cedidk32.dll"	Olhlaoea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgmlehnj.dll"	Mbedag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iabglnco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbocng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hijohoki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmlckhig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnphid32.dll"	Mgclja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qhdaik32.dll"	Biaiqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbedaand.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enomic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acpbkiog.dll"	Aogkhjii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Docckfai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Meembc32.dll"	Lbnnphhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ongamagn.dll"	Gdjpff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofqnlplf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojnfihmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifihdi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Knfepldb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Accnco32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eoneah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pecefa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eafbmgad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnoalehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Doageg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaicpdqi.dll"	Niklip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkechjib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enljfc32.dll"	Eimegk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfagcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnkdpgnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcllmi32.dll"	Npjnbg32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 3524	1148	aa063711227ba9b2af05971bc179503d.exe	90
PID 1148 wrote to memory of 3524	1148	aa063711227ba9b2af05971bc179503d.exe	90
PID 1148 wrote to memory of 3524	1148	aa063711227ba9b2af05971bc179503d.exe	90
PID 3524 wrote to memory of 4536	3524	Fqppci32.exe	91
PID 3524 wrote to memory of 4536	3524	Fqppci32.exe	91
PID 3524 wrote to memory of 4536	3524	Fqppci32.exe	91
PID 4536 wrote to memory of 548	4536	Giecfejd.exe	92
PID 4536 wrote to memory of 548	4536	Giecfejd.exe	92
PID 4536 wrote to memory of 548	4536	Giecfejd.exe	92
PID 548 wrote to memory of 4008	548	Gngeik32.exe	93
PID 548 wrote to memory of 4008	548	Gngeik32.exe	93
PID 548 wrote to memory of 4008	548	Gngeik32.exe	93
PID 4008 wrote to memory of 3456	4008	Hajkqfoe.exe	94
PID 4008 wrote to memory of 3456	4008	Hajkqfoe.exe	94
PID 4008 wrote to memory of 3456	4008	Hajkqfoe.exe	94
PID 3456 wrote to memory of 2796	3456	Hnphoj32.exe	95
PID 3456 wrote to memory of 2796	3456	Hnphoj32.exe	95
PID 3456 wrote to memory of 2796	3456	Hnphoj32.exe	95
PID 2796 wrote to memory of 3004	2796	Hihibbjo.exe	96
PID 2796 wrote to memory of 3004	2796	Hihibbjo.exe	96
PID 2796 wrote to memory of 3004	2796	Hihibbjo.exe	96
PID 3004 wrote to memory of 3384	3004	Ieccbbkn.exe	97
PID 3004 wrote to memory of 3384	3004	Ieccbbkn.exe	97
PID 3004 wrote to memory of 3384	3004	Ieccbbkn.exe	97
PID 3384 wrote to memory of 5028	3384	Joekag32.exe	98
PID 3384 wrote to memory of 5028	3384	Joekag32.exe	98
PID 3384 wrote to memory of 5028	3384	Joekag32.exe	98
PID 5028 wrote to memory of 1860	5028	Kpnjah32.exe	99
PID 5028 wrote to memory of 1860	5028	Kpnjah32.exe	99
PID 5028 wrote to memory of 1860	5028	Kpnjah32.exe	99
PID 1860 wrote to memory of 788	1860	Mjlalkmd.exe	100
PID 1860 wrote to memory of 788	1860	Mjlalkmd.exe	100
PID 1860 wrote to memory of 788	1860	Mjlalkmd.exe	100
PID 788 wrote to memory of 3224	788	Nckkfp32.exe	101
PID 788 wrote to memory of 3224	788	Nckkfp32.exe	101
PID 788 wrote to memory of 3224	788	Nckkfp32.exe	101
PID 3224 wrote to memory of 4216	3224	Ojnfihmo.exe	102
PID 3224 wrote to memory of 4216	3224	Ojnfihmo.exe	102
PID 3224 wrote to memory of 4216	3224	Ojnfihmo.exe	102
PID 4216 wrote to memory of 4508	4216	Ofgdcipq.exe	103
PID 4216 wrote to memory of 4508	4216	Ofgdcipq.exe	103
PID 4216 wrote to memory of 4508	4216	Ofgdcipq.exe	103
PID 4508 wrote to memory of 3504	4508	Pcpnhl32.exe	104
PID 4508 wrote to memory of 3504	4508	Pcpnhl32.exe	104
PID 4508 wrote to memory of 3504	4508	Pcpnhl32.exe	104
PID 3504 wrote to memory of 2328	3504	Piapkbeg.exe	105
PID 3504 wrote to memory of 2328	3504	Piapkbeg.exe	105
PID 3504 wrote to memory of 2328	3504	Piapkbeg.exe	105
PID 2328 wrote to memory of 4048	2328	Qppaclio.exe	106
PID 2328 wrote to memory of 4048	2328	Qppaclio.exe	106
PID 2328 wrote to memory of 4048	2328	Qppaclio.exe	106
PID 4048 wrote to memory of 1052	4048	Abhqefpg.exe	107
PID 4048 wrote to memory of 1052	4048	Abhqefpg.exe	107
PID 4048 wrote to memory of 1052	4048	Abhqefpg.exe	107
PID 1052 wrote to memory of 920	1052	Bdapehop.exe	108
PID 1052 wrote to memory of 920	1052	Bdapehop.exe	108
PID 1052 wrote to memory of 920	1052	Bdapehop.exe	108
PID 920 wrote to memory of 4816	920	Cpogkhnl.exe	109
PID 920 wrote to memory of 4816	920	Cpogkhnl.exe	109
PID 920 wrote to memory of 4816	920	Cpogkhnl.exe	109
PID 4816 wrote to memory of 4552	4816	Dkbgjo32.exe	110
PID 4816 wrote to memory of 4552	4816	Dkbgjo32.exe	110
PID 4816 wrote to memory of 4552	4816	Dkbgjo32.exe	110
PID 4552 wrote to memory of 2692	4552	Dgihop32.exe	111

C:\Users\Admin\AppData\Local\Temp\aa063711227ba9b2af05971bc179503d.exe
"C:\Users\Admin\AppData\Local\Temp\aa063711227ba9b2af05971bc179503d.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\Fqppci32.exe
  C:\Windows\system32\Fqppci32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\SysWOW64\Giecfejd.exe
    C:\Windows\system32\Giecfejd.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Windows\SysWOW64\Gngeik32.exe
      C:\Windows\system32\Gngeik32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:548
    - - C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4008
      - C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2796
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:788
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3224
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4216
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SysWOW64\Qppaclio.exe
        
        C:\Windows\system32\Qppaclio.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2328
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4048
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\SysWOW64\Cpogkhnl.exe
        
        C:\Windows\system32\Cpogkhnl.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Windows\SysWOW64\Dkbgjo32.exe
        
        C:\Windows\system32\Dkbgjo32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Windows\SysWOW64\Dgihop32.exe
        
        C:\Windows\system32\Dgihop32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Eafbmgad.exe
        
        C:\Windows\system32\Eafbmgad.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2692
        
        C:\Windows\SysWOW64\Fnhbmgmk.exe
        
        C:\Windows\system32\Fnhbmgmk.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1728
        
        C:\Windows\SysWOW64\Gnohnffc.exe
        
        C:\Windows\system32\Gnohnffc.exe
        25⤵
        Executes dropped EXE
        
        PID:4936
        
        C:\Windows\SysWOW64\Icogcjde.exe
        
        C:\Windows\system32\Icogcjde.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4660
        
        C:\Windows\SysWOW64\Iabglnco.exe
        
        C:\Windows\system32\Iabglnco.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3720
        
        C:\Windows\SysWOW64\Jnpjlajn.exe
        
        C:\Windows\system32\Jnpjlajn.exe
        28⤵
        Executes dropped EXE
        
        PID:1976
        
        C:\Windows\SysWOW64\Jlidpe32.exe
        
        C:\Windows\system32\Jlidpe32.exe
        29⤵
        Executes dropped EXE
        
        PID:4320
        
        C:\Windows\SysWOW64\Lkiamp32.exe
        
        C:\Windows\system32\Lkiamp32.exe
        30⤵
        Executes dropped EXE
        
        PID:2508
        
        C:\Windows\SysWOW64\Leoejh32.exe
        
        C:\Windows\system32\Leoejh32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4248
        
        C:\Windows\SysWOW64\Leabphmp.exe
        
        C:\Windows\system32\Leabphmp.exe
        32⤵
        Executes dropped EXE
        
        PID:1364
        
        C:\Windows\SysWOW64\Lefkkg32.exe
        
        C:\Windows\system32\Lefkkg32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1828
        
        C:\Windows\SysWOW64\Nfnjbdep.exe
        
        C:\Windows\system32\Nfnjbdep.exe
        34⤵
        Executes dropped EXE
        
        PID:3064
        
        C:\Windows\SysWOW64\Obpkcc32.exe
        
        C:\Windows\system32\Obpkcc32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3108
        
        C:\Windows\SysWOW64\Pcijce32.exe
        
        C:\Windows\system32\Pcijce32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3564
        
        C:\Windows\SysWOW64\Alkeifga.exe
        
        C:\Windows\system32\Alkeifga.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4960
        
        C:\Windows\SysWOW64\Afqifo32.exe
        
        C:\Windows\system32\Afqifo32.exe
        38⤵
        Executes dropped EXE
        
        PID:4968
        
        C:\Windows\SysWOW64\Cefoni32.exe
        
        C:\Windows\system32\Cefoni32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4524
        
        C:\Windows\SysWOW64\Egpgehnb.exe
        
        C:\Windows\system32\Egpgehnb.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4256
        
        C:\Windows\SysWOW64\Eegqldqg.exe
        
        C:\Windows\system32\Eegqldqg.exe
        41⤵
        Executes dropped EXE
        
        PID:4452
        
        C:\Windows\SysWOW64\Feimadoe.exe
        
        C:\Windows\system32\Feimadoe.exe
        42⤵
        Executes dropped EXE
        
        PID:2260
        
        C:\Windows\SysWOW64\Fdogjk32.exe
        
        C:\Windows\system32\Fdogjk32.exe
        43⤵
        Executes dropped EXE
        
        PID:1012
        
        C:\Windows\SysWOW64\Fjlpbb32.exe
        
        C:\Windows\system32\Fjlpbb32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1996
        
        C:\Windows\SysWOW64\Gqkajk32.exe
        
        C:\Windows\system32\Gqkajk32.exe
        45⤵
        Executes dropped EXE
        
        PID:3236
        
        C:\Windows\SysWOW64\Hnehdo32.exe
        
        C:\Windows\system32\Hnehdo32.exe
        46⤵
        Executes dropped EXE
        
        PID:1092
        
        C:\Windows\SysWOW64\Hcifmdeo.exe
        
        C:\Windows\system32\Hcifmdeo.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3908
        
        C:\Windows\SysWOW64\Ijhhenhf.exe
        
        C:\Windows\system32\Ijhhenhf.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1600
        
        C:\Windows\SysWOW64\Imnjbhaa.exe
        
        C:\Windows\system32\Imnjbhaa.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2564
        
        C:\Windows\SysWOW64\Jjfdfl32.exe
        
        C:\Windows\system32\Jjfdfl32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2516
        
        C:\Windows\SysWOW64\Jepbodhg.exe
        
        C:\Windows\system32\Jepbodhg.exe
        51⤵
        Executes dropped EXE
        
        PID:3924
        
        C:\Windows\SysWOW64\Kaioidkh.exe
        
        C:\Windows\system32\Kaioidkh.exe
        52⤵
        Executes dropped EXE
        
        PID:4976
        
        C:\Windows\SysWOW64\Knbinhfl.exe
        
        C:\Windows\system32\Knbinhfl.exe
        53⤵
        Executes dropped EXE
        
        PID:372
        
        C:\Windows\SysWOW64\Lkppchfi.exe
        
        C:\Windows\system32\Lkppchfi.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1720
        
        C:\Windows\SysWOW64\Lajhpbme.exe
        
        C:\Windows\system32\Lajhpbme.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3484
        
        C:\Windows\SysWOW64\Mhkgnkoj.exe
        
        C:\Windows\system32\Mhkgnkoj.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5016
        
        C:\Windows\SysWOW64\Nnabladg.exe
        
        C:\Windows\system32\Nnabladg.exe
        57⤵
        Executes dropped EXE
        
        PID:2700
        
        C:\Windows\SysWOW64\Noehac32.exe
        
        C:\Windows\system32\Noehac32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1876
        
        C:\Windows\SysWOW64\Bkadoo32.exe
        
        C:\Windows\system32\Bkadoo32.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3228
        
        C:\Windows\SysWOW64\Cgagjo32.exe
        
        C:\Windows\system32\Cgagjo32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1436
        
        C:\Windows\SysWOW64\Cejaobel.exe
        
        C:\Windows\system32\Cejaobel.exe
        61⤵
        Executes dropped EXE
        
        PID:4948
        
        C:\Windows\SysWOW64\Eekjep32.exe
        
        C:\Windows\system32\Eekjep32.exe
        62⤵
        Executes dropped EXE
        
        PID:3368
        
        C:\Windows\SysWOW64\Epehnhbj.exe
        
        C:\Windows\system32\Epehnhbj.exe
        63⤵
        Executes dropped EXE
        
        PID:4164
        
        C:\Windows\SysWOW64\Fgffka32.exe
        
        C:\Windows\system32\Fgffka32.exe
        64⤵
        Executes dropped EXE
        
        PID:1992
        
        C:\Windows\SysWOW64\Fcmgpbjc.exe
        
        C:\Windows\system32\Fcmgpbjc.exe
        65⤵
        Executes dropped EXE
        
        PID:420
        
        C:\Windows\SysWOW64\Gpjjpe32.exe
        
        C:\Windows\system32\Gpjjpe32.exe
        66⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Giboijgb.exe
        
        C:\Windows\system32\Giboijgb.exe
        67⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\Ifihdi32.exe
        
        C:\Windows\system32\Ifihdi32.exe
        68⤵
        Modifies registry class
        
        PID:2344
        
        C:\Windows\SysWOW64\Jmopmalc.exe
        
        C:\Windows\system32\Jmopmalc.exe
        69⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\Lpelqj32.exe
        
        C:\Windows\system32\Lpelqj32.exe
        70⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\Migcpneb.exe
        
        C:\Windows\system32\Migcpneb.exe
        71⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Mhhcne32.exe
        
        C:\Windows\system32\Mhhcne32.exe
        72⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\Mjiloqjb.exe
        
        C:\Windows\system32\Mjiloqjb.exe
        73⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\Mabdlk32.exe
        
        C:\Windows\system32\Mabdlk32.exe
        74⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\Npjnbg32.exe
        
        C:\Windows\system32\Npjnbg32.exe
        75⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4440
        
        C:\Windows\SysWOW64\Omgabj32.exe
        
        C:\Windows\system32\Omgabj32.exe
        76⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Okkalnjm.exe
        
        C:\Windows\system32\Okkalnjm.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1960
        
        C:\Windows\SysWOW64\Omlkmign.exe
        
        C:\Windows\system32\Omlkmign.exe
        78⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Okbhlm32.exe
        
        C:\Windows\system32\Okbhlm32.exe
        79⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\Pgihanii.exe
        
        C:\Windows\system32\Pgihanii.exe
        80⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Pgkegn32.exe
        
        C:\Windows\system32\Pgkegn32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4104
        
        C:\Windows\SysWOW64\Pjoknhbe.exe
        
        C:\Windows\system32\Pjoknhbe.exe
        82⤵
        
        PID:776
        
        C:\Windows\SysWOW64\Qpmmfbfl.exe
        
        C:\Windows\system32\Qpmmfbfl.exe
        83⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Bqkigp32.exe
        
        C:\Windows\system32\Bqkigp32.exe
        84⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Bbkeacqo.exe
        
        C:\Windows\system32\Bbkeacqo.exe
        85⤵
        Drops file in System32 directory
        
        PID:4396
        
        C:\Windows\SysWOW64\Bgodjiio.exe
        
        C:\Windows\system32\Bgodjiio.exe
        86⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\Ckcbaf32.exe
        
        C:\Windows\system32\Ckcbaf32.exe
        87⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\Dhfcae32.exe
        
        C:\Windows\system32\Dhfcae32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4220
        
        C:\Windows\SysWOW64\Enpknplq.exe
        
        C:\Windows\system32\Enpknplq.exe
        89⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Eihlahjd.exe
        
        C:\Windows\system32\Eihlahjd.exe
        90⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\Ejnbdp32.exe
        
        C:\Windows\system32\Ejnbdp32.exe
        91⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\Ficlmf32.exe
        
        C:\Windows\system32\Ficlmf32.exe
        92⤵
        Modifies registry class
        
        PID:4128
        
        C:\Windows\SysWOW64\Fiheheka.exe
        
        C:\Windows\system32\Fiheheka.exe
        93⤵
        
        PID:696
        
        C:\Windows\SysWOW64\Fkiapn32.exe
        
        C:\Windows\system32\Fkiapn32.exe
        94⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Glpdjpbj.exe
        
        C:\Windows\system32\Glpdjpbj.exe
        95⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Hhiaepfl.exe
        
        C:\Windows\system32\Hhiaepfl.exe
        96⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Hcofbifb.exe
        
        C:\Windows\system32\Hcofbifb.exe
        97⤵
        Modifies registry class
        
        PID:1276
        
        C:\Windows\SysWOW64\Ioafchai.exe
        
        C:\Windows\system32\Ioafchai.exe
        98⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Iadljc32.exe
        
        C:\Windows\system32\Iadljc32.exe
        99⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\Jflgfpkc.exe
        
        C:\Windows\system32\Jflgfpkc.exe
        100⤵
        
        PID:680
        
        C:\Windows\SysWOW64\Kbedaand.exe
        
        C:\Windows\system32\Kbedaand.exe
        101⤵
        Modifies registry class
        
        PID:2140
        
        C:\Windows\SysWOW64\Kiomnk32.exe
        
        C:\Windows\system32\Kiomnk32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4672
        
        C:\Windows\SysWOW64\Ljjicl32.exe
        
        C:\Windows\system32\Ljjicl32.exe
        103⤵
        Drops file in System32 directory
        
        PID:2756
        
        C:\Windows\SysWOW64\Liabjh32.exe
        
        C:\Windows\system32\Liabjh32.exe
        104⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Mpbaga32.exe
        
        C:\Windows\system32\Mpbaga32.exe
        105⤵
        Drops file in System32 directory
        
        PID:2972
        
        C:\Windows\SysWOW64\Mpenmadn.exe
        
        C:\Windows\system32\Mpenmadn.exe
        106⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\Njceqili.exe
        
        C:\Windows\system32\Njceqili.exe
        107⤵
        Drops file in System32 directory
        
        PID:4724
        
        C:\Windows\SysWOW64\Npqmipjq.exe
        
        C:\Windows\system32\Npqmipjq.exe
        108⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Nfjeej32.exe
        
        C:\Windows\system32\Nfjeej32.exe
        109⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Oikngeoo.exe
        
        C:\Windows\system32\Oikngeoo.exe
        110⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\Odelpm32.exe
        
        C:\Windows\system32\Odelpm32.exe
        111⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\Pghaghfn.exe
        
        C:\Windows\system32\Pghaghfn.exe
        112⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\Pmbjcb32.exe
        
        C:\Windows\system32\Pmbjcb32.exe
        113⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Qkpmcddi.exe
        
        C:\Windows\system32\Qkpmcddi.exe
        114⤵
        Drops file in System32 directory
        
        PID:1540
        
        C:\Windows\SysWOW64\Qpmfklbq.exe
        
        C:\Windows\system32\Qpmfklbq.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1828
        
        C:\Windows\SysWOW64\Agfnhf32.exe
        
        C:\Windows\system32\Agfnhf32.exe
        116⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\Alcfpm32.exe
        
        C:\Windows\system32\Alcfpm32.exe
        117⤵
        Drops file in System32 directory
        
        PID:5148
        
        C:\Windows\SysWOW64\Acmomgoa.exe
        
        C:\Windows\system32\Acmomgoa.exe
        118⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Aneppo32.exe
        
        C:\Windows\system32\Aneppo32.exe
        119⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Bpkbmi32.exe
        
        C:\Windows\system32\Bpkbmi32.exe
        120⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Bgggockk.exe
        
        C:\Windows\system32\Bgggockk.exe
        121⤵
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Bkglkapo.exe
        
        C:\Windows\system32\Bkglkapo.exe
        122⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Dkgeao32.exe
        
        C:\Windows\system32\Dkgeao32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Dqdnjfpc.exe
        
        C:\Windows\system32\Dqdnjfpc.exe
        124⤵
        Drops file in System32 directory
        
        PID:5512
        
        C:\Windows\SysWOW64\Djmbbk32.exe
        
        C:\Windows\system32\Djmbbk32.exe
        125⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Embdofop.exe
        
        C:\Windows\system32\Embdofop.exe
        126⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Emikpeig.exe
        
        C:\Windows\system32\Emikpeig.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5652

C:\Windows\SysWOW64\Fhalcm32.exe
C:\Windows\system32\Fhalcm32.exe
1⤵
PID:5696
- C:\Windows\SysWOW64\Fnkdpgnh.exe
  C:\Windows\system32\Fnkdpgnh.exe
  2⤵
  - Modifies registry class
  PID:5780
- - C:\Windows\SysWOW64\Gmggac32.exe
    C:\Windows\system32\Gmggac32.exe
    3⤵
    PID:5884
  - - C:\Windows\SysWOW64\Incpdodg.exe
      C:\Windows\system32\Incpdodg.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:5980
    - - C:\Windows\SysWOW64\Jlkfbe32.exe
        
        C:\Windows\system32\Jlkfbe32.exe
        5⤵
        
        PID:6040
      - C:\Windows\SysWOW64\Jkeloa32.exe
        
        C:\Windows\system32\Jkeloa32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6092
        
        C:\Windows\SysWOW64\Knfepldb.exe
        
        C:\Windows\system32\Knfepldb.exe
        7⤵
        Modifies registry class
        
        PID:6136
        
        C:\Windows\SysWOW64\Kkaljpmd.exe
        
        C:\Windows\system32\Kkaljpmd.exe
        8⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Loodqn32.exe
        
        C:\Windows\system32\Loodqn32.exe
        9⤵
        Modifies registry class
        
        PID:5228
        
        C:\Windows\SysWOW64\Ldlmieaa.exe
        
        C:\Windows\system32\Ldlmieaa.exe
        10⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Loaafnah.exe
        
        C:\Windows\system32\Loaafnah.exe
        11⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Ldqfddml.exe
        
        C:\Windows\system32\Ldqfddml.exe
        12⤵
        Drops file in System32 directory
        
        PID:5416
        
        C:\Windows\SysWOW64\Lkjoqnei.exe
        
        C:\Windows\system32\Lkjoqnei.exe
        13⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Lbdgmh32.exe
        
        C:\Windows\system32\Lbdgmh32.exe
        14⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Lmjkka32.exe
        
        C:\Windows\system32\Lmjkka32.exe
        15⤵
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Moajmk32.exe
        
        C:\Windows\system32\Moajmk32.exe
        16⤵
        Drops file in System32 directory
        
        PID:5676
        
        C:\Windows\SysWOW64\Mflbjejb.exe
        
        C:\Windows\system32\Mflbjejb.exe
        17⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Mpdgbkab.exe
        
        C:\Windows\system32\Mpdgbkab.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5724
        
        C:\Windows\SysWOW64\Nnnmogae.exe
        
        C:\Windows\system32\Nnnmogae.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5844
        
        C:\Windows\SysWOW64\Ppnbpg32.exe
        
        C:\Windows\system32\Ppnbpg32.exe
        20⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Qfanbpjg.exe
        
        C:\Windows\system32\Qfanbpjg.exe
        21⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Apqhldjp.exe
        
        C:\Windows\system32\Apqhldjp.exe
        22⤵
        
        PID:640
        
        C:\Windows\SysWOW64\Accnco32.exe
        
        C:\Windows\system32\Accnco32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3004
        
        C:\Windows\SysWOW64\Bllble32.exe
        
        C:\Windows\system32\Bllble32.exe
        24⤵
        Drops file in System32 directory
        
        PID:5908
        
        C:\Windows\SysWOW64\Bgafin32.exe
        
        C:\Windows\system32\Bgafin32.exe
        25⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Cjlbag32.exe
        
        C:\Windows\system32\Cjlbag32.exe
        26⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\Cpjdiadb.exe
        
        C:\Windows\system32\Cpjdiadb.exe
        27⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\Copajm32.exe
        
        C:\Windows\system32\Copajm32.exe
        28⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\Dfnbbg32.exe
        
        C:\Windows\system32\Dfnbbg32.exe
        29⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\Dnhgidka.exe
        
        C:\Windows\system32\Dnhgidka.exe
        30⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Djnhne32.exe
        
        C:\Windows\system32\Djnhne32.exe
        31⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Dcglfjgf.exe
        
        C:\Windows\system32\Dcglfjgf.exe
        32⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Ejaecdnc.exe
        
        C:\Windows\system32\Ejaecdnc.exe
        33⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\Egeemiml.exe
        
        C:\Windows\system32\Egeemiml.exe
        34⤵
        
        PID:372
        
        C:\Windows\SysWOW64\Enomic32.exe
        
        C:\Windows\system32\Enomic32.exe
        35⤵
        Modifies registry class
        
        PID:4268
        
        C:\Windows\SysWOW64\Eckfaj32.exe
        
        C:\Windows\system32\Eckfaj32.exe
        36⤵
        Modifies registry class
        
        PID:4524
        
        C:\Windows\SysWOW64\Ejennd32.exe
        
        C:\Windows\system32\Ejennd32.exe
        37⤵
        
        PID:348
        
        C:\Windows\SysWOW64\Eobffk32.exe
        
        C:\Windows\system32\Eobffk32.exe
        38⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Ecblbi32.exe
        
        C:\Windows\system32\Ecblbi32.exe
        39⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Fqfmlm32.exe
        
        C:\Windows\system32\Fqfmlm32.exe
        40⤵
        
        PID:684
        
        C:\Windows\SysWOW64\Fgcang32.exe
        
        C:\Windows\system32\Fgcang32.exe
        41⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Fnmjkahi.exe
        
        C:\Windows\system32\Fnmjkahi.exe
        42⤵
        Modifies registry class
        
        PID:1336
        
        C:\Windows\SysWOW64\Fpnfbi32.exe
        
        C:\Windows\system32\Fpnfbi32.exe
        43⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\Ffhnocfd.exe
        
        C:\Windows\system32\Ffhnocfd.exe
        44⤵
        Modifies registry class
        
        PID:2168
        
        C:\Windows\SysWOW64\Fmdcamko.exe
        
        C:\Windows\system32\Fmdcamko.exe
        45⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Fcnlng32.exe
        
        C:\Windows\system32\Fcnlng32.exe
        46⤵
        Modifies registry class
        
        PID:4744
        
        C:\Windows\SysWOW64\Gndpkp32.exe
        
        C:\Windows\system32\Gndpkp32.exe
        47⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Gmkibl32.exe
        
        C:\Windows\system32\Gmkibl32.exe
        48⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Gceaofmc.exe
        
        C:\Windows\system32\Gceaofmc.exe
        49⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Hfhgfaha.exe
        
        C:\Windows\system32\Hfhgfaha.exe
        50⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Hmlbij32.exe
        
        C:\Windows\system32\Hmlbij32.exe
        51⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Iophnl32.exe
        
        C:\Windows\system32\Iophnl32.exe
        52⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\Jgdphm32.exe
        
        C:\Windows\system32\Jgdphm32.exe
        53⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Kgkfil32.exe
        
        C:\Windows\system32\Kgkfil32.exe
        54⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\Kklkej32.exe
        
        C:\Windows\system32\Kklkej32.exe
        55⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Khplnn32.exe
        
        C:\Windows\system32\Khplnn32.exe
        56⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Knldfe32.exe
        
        C:\Windows\system32\Knldfe32.exe
        57⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\Lnoalehl.exe
        
        C:\Windows\system32\Lnoalehl.exe
        58⤵
        Modifies registry class
        
        PID:3104
        
        C:\Windows\SysWOW64\Loqjlg32.exe
        
        C:\Windows\system32\Loqjlg32.exe
        59⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Lkjhfh32.exe
        
        C:\Windows\system32\Lkjhfh32.exe
        60⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\Mnmmmbll.exe
        
        C:\Windows\system32\Mnmmmbll.exe
        61⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\Mgebfhcl.exe
        
        C:\Windows\system32\Mgebfhcl.exe
        62⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Mnojcb32.exe
        
        C:\Windows\system32\Mnojcb32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4764
        
        C:\Windows\SysWOW64\Mhenpk32.exe
        
        C:\Windows\system32\Mhenpk32.exe
        64⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Nnfpcada.exe
        
        C:\Windows\system32\Nnfpcada.exe
        65⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Nnimia32.exe
        
        C:\Windows\system32\Nnimia32.exe
        66⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Nkmmbe32.exe
        
        C:\Windows\system32\Nkmmbe32.exe
        67⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\Nbibeo32.exe
        
        C:\Windows\system32\Nbibeo32.exe
        68⤵
        
        PID:824
        
        C:\Windows\SysWOW64\Nkagndmc.exe
        
        C:\Windows\system32\Nkagndmc.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5072
        
        C:\Windows\SysWOW64\Oigdmh32.exe
        
        C:\Windows\system32\Oigdmh32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1348
        
        C:\Windows\SysWOW64\Oendaipn.exe
        
        C:\Windows\system32\Oendaipn.exe
        71⤵
        Drops file in System32 directory
        
        PID:5232
        
        C:\Windows\SysWOW64\Obdbqm32.exe
        
        C:\Windows\system32\Obdbqm32.exe
        72⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Ppkopail.exe
        
        C:\Windows\system32\Ppkopail.exe
        73⤵
        Drops file in System32 directory
        
        PID:4256
        
        C:\Windows\SysWOW64\Pelacg32.exe
        
        C:\Windows\system32\Pelacg32.exe
        74⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Alplfpbp.exe
        
        C:\Windows\system32\Alplfpbp.exe
        75⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\Ahkffqdo.exe
        
        C:\Windows\system32\Ahkffqdo.exe
        76⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Aikbpckb.exe
        
        C:\Windows\system32\Aikbpckb.exe
        77⤵
        Modifies registry class
        
        PID:6080
        
        C:\Windows\SysWOW64\Aogkhjii.exe
        
        C:\Windows\system32\Aogkhjii.exe
        78⤵
        Modifies registry class
        
        PID:4916
        
        C:\Windows\SysWOW64\Biolkc32.exe
        
        C:\Windows\system32\Biolkc32.exe
        79⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\Biaiqb32.exe
        
        C:\Windows\system32\Biaiqb32.exe
        80⤵
        Modifies registry class
        
        PID:4440
        
        C:\Windows\SysWOW64\Bhgeao32.exe
        
        C:\Windows\system32\Bhgeao32.exe
        81⤵
        Drops file in System32 directory
        
        PID:1504
        
        C:\Windows\SysWOW64\Clgkmm32.exe
        
        C:\Windows\system32\Clgkmm32.exe
        82⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\Cadcfd32.exe
        
        C:\Windows\system32\Cadcfd32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4080
        
        C:\Windows\SysWOW64\Chebcmna.exe
        
        C:\Windows\system32\Chebcmna.exe
        84⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Damflb32.exe
        
        C:\Windows\system32\Damflb32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4144
        
        C:\Windows\SysWOW64\Dhgoimlo.exe
        
        C:\Windows\system32\Dhgoimlo.exe
        86⤵
        Modifies registry class
        
        PID:1440
        
        C:\Windows\SysWOW64\Doageg32.exe
        
        C:\Windows\system32\Doageg32.exe
        87⤵
        Modifies registry class
        
        PID:3332
        
        C:\Windows\SysWOW64\Docckfai.exe
        
        C:\Windows\system32\Docckfai.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5168
        
        C:\Windows\SysWOW64\Dhlhcl32.exe
        
        C:\Windows\system32\Dhlhcl32.exe
        89⤵
        
        PID:668
        
        C:\Windows\SysWOW64\Dfphmp32.exe
        
        C:\Windows\system32\Dfphmp32.exe
        90⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\Dohmff32.exe
        
        C:\Windows\system32\Dohmff32.exe
        91⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\Gqfohdjd.exe
        
        C:\Windows\system32\Gqfohdjd.exe
        92⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\Gjocaj32.exe
        
        C:\Windows\system32\Gjocaj32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3680
        
        C:\Windows\SysWOW64\Gpkliaol.exe
        
        C:\Windows\system32\Gpkliaol.exe
        94⤵
        Drops file in System32 directory
        
        PID:6024
        
        C:\Windows\SysWOW64\Gjapfjnb.exe
        
        C:\Windows\system32\Gjapfjnb.exe
        95⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Hakhcd32.exe
        
        C:\Windows\system32\Hakhcd32.exe
        96⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\Hbldkllm.exe
        
        C:\Windows\system32\Hbldkllm.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1860
        
        C:\Windows\SysWOW64\Hmaihekc.exe
        
        C:\Windows\system32\Hmaihekc.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3656
        
        C:\Windows\SysWOW64\Hboaql32.exe
        
        C:\Windows\system32\Hboaql32.exe
        99⤵
        
        PID:260
        
        C:\Windows\SysWOW64\Hbanfk32.exe
        
        C:\Windows\system32\Hbanfk32.exe
        100⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\Hpenpp32.exe
        
        C:\Windows\system32\Hpenpp32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5128
        
        C:\Windows\SysWOW64\Hfacai32.exe
        
        C:\Windows\system32\Hfacai32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:776
        
        C:\Windows\SysWOW64\Ipihkobl.exe
        
        C:\Windows\system32\Ipihkobl.exe
        103⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Iiblcdil.exe
        
        C:\Windows\system32\Iiblcdil.exe
        104⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Ipldpo32.exe
        
        C:\Windows\system32\Ipldpo32.exe
        105⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\Ijaimg32.exe
        
        C:\Windows\system32\Ijaimg32.exe
        106⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\Ipckqnja.exe
        
        C:\Windows\system32\Ipckqnja.exe
        107⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Jpegfm32.exe
        
        C:\Windows\system32\Jpegfm32.exe
        108⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\Jmihpa32.exe
        
        C:\Windows\system32\Jmihpa32.exe
        109⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Jaimko32.exe
        
        C:\Windows\system32\Jaimko32.exe
        110⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\Jfffcf32.exe
        
        C:\Windows\system32\Jfffcf32.exe
        111⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\Jmpnppap.exe
        
        C:\Windows\system32\Jmpnppap.exe
        112⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Kbocng32.exe
        
        C:\Windows\system32\Kbocng32.exe
        113⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4836
        
        C:\Windows\SysWOW64\Kmiqfoie.exe
        
        C:\Windows\system32\Kmiqfoie.exe
        114⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\Kgbepdpf.exe
        
        C:\Windows\system32\Kgbepdpf.exe
        115⤵
        Modifies registry class
        
        PID:2796
        
        C:\Windows\SysWOW64\Lpmfnj32.exe
        
        C:\Windows\system32\Lpmfnj32.exe
        116⤵
        Drops file in System32 directory
        
        PID:3132
        
        C:\Windows\SysWOW64\Lgfojd32.exe
        
        C:\Windows\system32\Lgfojd32.exe
        117⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Lalchm32.exe
        
        C:\Windows\system32\Lalchm32.exe
        118⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\Lcmopeae.exe
        
        C:\Windows\system32\Lcmopeae.exe
        119⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\Ligglo32.exe
        
        C:\Windows\system32\Ligglo32.exe
        120⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\Mallojmd.exe
        
        C:\Windows\system32\Mallojmd.exe
        121⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\Mncmck32.exe
        
        C:\Windows\system32\Mncmck32.exe
        122⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\Caapfnkd.exe
        
        C:\Windows\system32\Caapfnkd.exe
        123⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\Hcmgphma.exe
        
        C:\Windows\system32\Hcmgphma.exe
        124⤵
        Drops file in System32 directory
        
        PID:5152
        
        C:\Windows\SysWOW64\Hijohoki.exe
        
        C:\Windows\system32\Hijohoki.exe
        125⤵
        Modifies registry class
        
        PID:2184
        
        C:\Windows\SysWOW64\Hodgei32.exe
        
        C:\Windows\system32\Hodgei32.exe
        126⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Hfnpacjb.exe
        
        C:\Windows\system32\Hfnpacjb.exe
        127⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:208
        
        C:\Windows\SysWOW64\Ipkneh32.exe
        
        C:\Windows\system32\Ipkneh32.exe
        128⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Iehfno32.exe
        
        C:\Windows\system32\Iehfno32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5420
        
        C:\Windows\SysWOW64\Ipmjkh32.exe
        
        C:\Windows\system32\Ipmjkh32.exe
        130⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Iifodmak.exe
        
        C:\Windows\system32\Iifodmak.exe
        131⤵
        Drops file in System32 directory
        
        PID:4672
        
        C:\Windows\SysWOW64\Ippgqg32.exe
        
        C:\Windows\system32\Ippgqg32.exe
        132⤵
        
        PID:524
        
        C:\Windows\SysWOW64\Iempingp.exe
        
        C:\Windows\system32\Iempingp.exe
        133⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\Ilfhfh32.exe
        
        C:\Windows\system32\Ilfhfh32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5208
        
        C:\Windows\SysWOW64\Jijhom32.exe
        
        C:\Windows\system32\Jijhom32.exe
        135⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\Jpgmaf32.exe
        
        C:\Windows\system32\Jpgmaf32.exe
        136⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Jfaenqjm.exe
        
        C:\Windows\system32\Jfaenqjm.exe
        137⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Jlnnfghd.exe
        
        C:\Windows\system32\Jlnnfghd.exe
        138⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Kihdqkaf.exe
        
        C:\Windows\system32\Kihdqkaf.exe
        139⤵
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Ldeonbkd.exe
        
        C:\Windows\system32\Ldeonbkd.exe
        140⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Lifqbi32.exe
        
        C:\Windows\system32\Lifqbi32.exe
        141⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Odmgmmhf.exe
        
        C:\Windows\system32\Odmgmmhf.exe
        142⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\Olhlaoea.exe
        
        C:\Windows\system32\Olhlaoea.exe
        143⤵
        Modifies registry class
        
        PID:6040
        
        C:\Windows\SysWOW64\Ocbdni32.exe
        
        C:\Windows\system32\Ocbdni32.exe
        144⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Ojllkcdk.exe
        
        C:\Windows\system32\Ojllkcdk.exe
        145⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Oqfdgn32.exe
        
        C:\Windows\system32\Oqfdgn32.exe
        146⤵
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Pjnipc32.exe
        
        C:\Windows\system32\Pjnipc32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6044
        
        C:\Windows\SysWOW64\Qcbmegol.exe
        
        C:\Windows\system32\Qcbmegol.exe
        148⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5236
        
        C:\Windows\SysWOW64\Cmlckhig.exe
        
        C:\Windows\system32\Cmlckhig.exe
        149⤵
        Modifies registry class
        
        PID:5484
        
        C:\Windows\SysWOW64\Cjpcel32.exe
        
        C:\Windows\system32\Cjpcel32.exe
        150⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Dffdjmme.exe
        
        C:\Windows\system32\Dffdjmme.exe
        151⤵
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Ddjecalo.exe
        
        C:\Windows\system32\Ddjecalo.exe
        152⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Daneme32.exe
        
        C:\Windows\system32\Daneme32.exe
        153⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Dhkjooqb.exe
        
        C:\Windows\system32\Dhkjooqb.exe
        154⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Eoneah32.exe
        
        C:\Windows\system32\Eoneah32.exe
        155⤵
        Modifies registry class
        
        PID:5196
        
        C:\Windows\SysWOW64\Ehfjkn32.exe
        
        C:\Windows\system32\Ehfjkn32.exe
        156⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Edmjpoli.exe
        
        C:\Windows\system32\Edmjpoli.exe
        157⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Faakickc.exe
        
        C:\Windows\system32\Faakickc.exe
        158⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Foekbg32.exe
        
        C:\Windows\system32\Foekbg32.exe
        159⤵
        
        PID:184
        
        C:\Windows\SysWOW64\Fhpmql32.exe
        
        C:\Windows\system32\Fhpmql32.exe
        160⤵
        Drops file in System32 directory
        
        PID:3564
        
        C:\Windows\SysWOW64\Fahajbek.exe
        
        C:\Windows\system32\Fahajbek.exe
        161⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\Folacfcd.exe
        
        C:\Windows\system32\Folacfcd.exe
        162⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\Gdkgam32.exe
        
        C:\Windows\system32\Gdkgam32.exe
        163⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Ghklmk32.exe
        
        C:\Windows\system32\Ghklmk32.exe
        164⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Goediekj.exe
        
        C:\Windows\system32\Goediekj.exe
        165⤵
        
        PID:348
        
        C:\Windows\SysWOW64\Gdbmalja.exe
        
        C:\Windows\system32\Gdbmalja.exe
        166⤵
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\Hfioln32.exe
        
        C:\Windows\system32\Hfioln32.exe
        167⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\Iohjebkd.exe
        
        C:\Windows\system32\Iohjebkd.exe
        168⤵
        Drops file in System32 directory
        
        PID:4588
        
        C:\Windows\SysWOW64\Idebniil.exe
        
        C:\Windows\system32\Idebniil.exe
        169⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Iojgkbib.exe
        
        C:\Windows\system32\Iojgkbib.exe
        170⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Idgocigi.exe
        
        C:\Windows\system32\Idgocigi.exe
        171⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Jgjekc32.exe
        
        C:\Windows\system32\Jgjekc32.exe
        172⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Kijjldkh.exe
        
        C:\Windows\system32\Kijjldkh.exe
        173⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\Lnnidjcg.exe
        
        C:\Windows\system32\Lnnidjcg.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2492
        
        C:\Windows\SysWOW64\Lehaad32.exe
        
        C:\Windows\system32\Lehaad32.exe
        175⤵
        Drops file in System32 directory
        
        PID:5660
        
        C:\Windows\SysWOW64\Llbinnbq.exe
        
        C:\Windows\system32\Llbinnbq.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4048
        
        C:\Windows\SysWOW64\Lifjgb32.exe
        
        C:\Windows\system32\Lifjgb32.exe
        177⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Lbnnphhk.exe
        
        C:\Windows\system32\Lbnnphhk.exe
        178⤵
        Modifies registry class
        
        PID:6016
        
        C:\Windows\SysWOW64\Lpbojlfd.exe
        
        C:\Windows\system32\Lpbojlfd.exe
        179⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Mflgff32.exe
        
        C:\Windows\system32\Mflgff32.exe
        180⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Mlipomli.exe
        
        C:\Windows\system32\Mlipomli.exe
        181⤵
        Drops file in System32 directory
        
        PID:5764
        
        C:\Windows\SysWOW64\Mhppcn32.exe
        
        C:\Windows\system32\Mhppcn32.exe
        182⤵
        
        PID:920
        
        C:\Windows\SysWOW64\Mbedag32.exe
        
        C:\Windows\system32\Mbedag32.exe
        183⤵
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Molefh32.exe
        
        C:\Windows\system32\Molefh32.exe
        184⤵
        
        PID:408
        
        C:\Windows\SysWOW64\Mefmbbod.exe
        
        C:\Windows\system32\Mefmbbod.exe
        185⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Mplapkoj.exe
        
        C:\Windows\system32\Mplapkoj.exe
        186⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Midfiq32.exe
        
        C:\Windows\system32\Midfiq32.exe
        187⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Nhlpom32.exe
        
        C:\Windows\system32\Nhlpom32.exe
        188⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Nbadmege.exe
        
        C:\Windows\system32\Nbadmege.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6036
        
        C:\Windows\SysWOW64\Niklip32.exe
        
        C:\Windows\system32\Niklip32.exe
        190⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2516
        
        C:\Windows\SysWOW64\Oplkgi32.exe
        
        C:\Windows\system32\Oplkgi32.exe
        191⤵
        Drops file in System32 directory
        
        PID:2712
        
        C:\Windows\SysWOW64\Olcklj32.exe
        
        C:\Windows\system32\Olcklj32.exe
        192⤵
        Modifies registry class
        
        PID:4628
        
        C:\Windows\SysWOW64\Oekpdoll.exe
        
        C:\Windows\system32\Oekpdoll.exe
        193⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Opqdbhlb.exe
        
        C:\Windows\system32\Opqdbhlb.exe
        194⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Oiihkncb.exe
        
        C:\Windows\system32\Oiihkncb.exe
        195⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\Oofacdaj.exe
        
        C:\Windows\system32\Oofacdaj.exe
        196⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Pgoejapi.exe
        
        C:\Windows\system32\Pgoejapi.exe
        197⤵
        
        PID:3268
        
        C:\Windows\SysWOW64\Pokjnd32.exe
        
        C:\Windows\system32\Pokjnd32.exe
        198⤵
        Drops file in System32 directory
        
        PID:3040
        
        C:\Windows\SysWOW64\Pgdodq32.exe
        
        C:\Windows\system32\Pgdodq32.exe
        199⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Plagmh32.exe
        
        C:\Windows\system32\Plagmh32.exe
        200⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Pckpja32.exe
        
        C:\Windows\system32\Pckpja32.exe
        201⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\Pgihppgo.exe
        
        C:\Windows\system32\Pgihppgo.exe
        202⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\Qhjegh32.exe
        
        C:\Windows\system32\Qhjegh32.exe
        203⤵
        
        PID:824
        
        C:\Windows\SysWOW64\Qodmdb32.exe
        
        C:\Windows\system32\Qodmdb32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:684
        
        C:\Windows\SysWOW64\Amaqde32.exe
        
        C:\Windows\system32\Amaqde32.exe
        205⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\Afjemkbi.exe
        
        C:\Windows\system32\Afjemkbi.exe
        206⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\Aflabj32.exe
        
        C:\Windows\system32\Aflabj32.exe
        207⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\Bmfjodgc.exe
        
        C:\Windows\system32\Bmfjodgc.exe
        208⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Bcpblo32.exe
        
        C:\Windows\system32\Bcpblo32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6164
        
        C:\Windows\SysWOW64\Bjjjhifm.exe
        
        C:\Windows\system32\Bjjjhifm.exe
        210⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Bfqkmj32.exe
        
        C:\Windows\system32\Bfqkmj32.exe
        211⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Boipfp32.exe
        
        C:\Windows\system32\Boipfp32.exe
        212⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Bfchcijo.exe
        
        C:\Windows\system32\Bfchcijo.exe
        213⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Bpkllo32.exe
        
        C:\Windows\system32\Bpkllo32.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6656
        
        C:\Windows\SysWOW64\Ggfombmd.exe
        
        C:\Windows\system32\Ggfombmd.exe
        215⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Gdjpff32.exe
        
        C:\Windows\system32\Gdjpff32.exe
        216⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6760
        
        C:\Windows\SysWOW64\Gkdhcqcj.exe
        
        C:\Windows\system32\Gkdhcqcj.exe
        217⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Ganppk32.exe
        
        C:\Windows\system32\Ganppk32.exe
        218⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Ggkiha32.exe
        
        C:\Windows\system32\Ggkiha32.exe
        219⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Gneaelqk.exe
        
        C:\Windows\system32\Gneaelqk.exe
        220⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Gdoiaf32.exe
        
        C:\Windows\system32\Gdoiaf32.exe
        221⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Gkianp32.exe
        
        C:\Windows\system32\Gkianp32.exe
        222⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Gpfjfg32.exe
        
        C:\Windows\system32\Gpfjfg32.exe
        223⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Gnjjpk32.exe
        
        C:\Windows\system32\Gnjjpk32.exe
        224⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Hgboiq32.exe
        
        C:\Windows\system32\Hgboiq32.exe
        225⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Hahcfi32.exe
        
        C:\Windows\system32\Hahcfi32.exe
        226⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Hjchjl32.exe
        
        C:\Windows\system32\Hjchjl32.exe
        227⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\Hhdhhchf.exe
        
        C:\Windows\system32\Hhdhhchf.exe
        228⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Halmaiog.exe
        
        C:\Windows\system32\Halmaiog.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6340
        
        C:\Windows\SysWOW64\Hjjnkkjp.exe
        
        C:\Windows\system32\Hjjnkkjp.exe
        230⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Ikqqfm32.exe
        
        C:\Windows\system32\Ikqqfm32.exe
        231⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Idieob32.exe
        
        C:\Windows\system32\Idieob32.exe
        232⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Jhlgpp32.exe
        
        C:\Windows\system32\Jhlgpp32.exe
        233⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Jnhphg32.exe
        
        C:\Windows\system32\Jnhphg32.exe
        234⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\Jgqdal32.exe
        
        C:\Windows\system32\Jgqdal32.exe
        235⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\Jgcafl32.exe
        
        C:\Windows\system32\Jgcafl32.exe
        236⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Kqkeoama.exe
        
        C:\Windows\system32\Kqkeoama.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6792
        
        C:\Windows\SysWOW64\Kkechjib.exe
        
        C:\Windows\system32\Kkechjib.exe
        238⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Obgccn32.exe
        
        C:\Windows\system32\Obgccn32.exe
        239⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Pcepdl32.exe
        
        C:\Windows\system32\Pcepdl32.exe
        240⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Bcddlhgo.exe
        
        C:\Windows\system32\Bcddlhgo.exe
        241⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Cooolhin.exe
        
        C:\Windows\system32\Cooolhin.exe
        242⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Diafkl32.exe
        
        C:\Windows\system32\Diafkl32.exe
        243⤵
        Drops file in System32 directory
        
        PID:820
        
        C:\Windows\SysWOW64\Dpknhfoq.exe
        
        C:\Windows\system32\Dpknhfoq.exe
        244⤵
        Drops file in System32 directory
        
        PID:5128
        
        C:\Windows\SysWOW64\Diccal32.exe
        
        C:\Windows\system32\Diccal32.exe
        245⤵
        
        PID:776
        
        C:\Windows\SysWOW64\Dfgcjpdk.exe
        
        C:\Windows\system32\Dfgcjpdk.exe
        246⤵
        Drops file in System32 directory
        
        PID:2344
        
        C:\Windows\SysWOW64\Dpphcf32.exe
        
        C:\Windows\system32\Dpphcf32.exe
        247⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Djelqo32.exe
        
        C:\Windows\system32\Djelqo32.exe
        248⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\Dpbdiehi.exe
        
        C:\Windows\system32\Dpbdiehi.exe
        249⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Eijiak32.exe
        
        C:\Windows\system32\Eijiak32.exe
        250⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Ebcmjqej.exe
        
        C:\Windows\system32\Ebcmjqej.exe
        251⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Eimegk32.exe
        
        C:\Windows\system32\Eimegk32.exe
        252⤵
        Modifies registry class
        
        PID:3044
        
        C:\Windows\SysWOW64\Epgndedc.exe
        
        C:\Windows\system32\Epgndedc.exe
        253⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\Efafqolp.exe
        
        C:\Windows\system32\Efafqolp.exe
        254⤵
        Drops file in System32 directory
        
        PID:6944
        
        C:\Windows\SysWOW64\Elnoifjg.exe
        
        C:\Windows\system32\Elnoifjg.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6992
        
        C:\Windows\SysWOW64\Efccfojn.exe
        
        C:\Windows\system32\Efccfojn.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7076
        
        C:\Windows\SysWOW64\Elpknehe.exe
        
        C:\Windows\system32\Elpknehe.exe
        257⤵
        Modifies registry class
        
        PID:5748
        
        C:\Windows\SysWOW64\Efepln32.exe
        
        C:\Windows\system32\Efepln32.exe
        258⤵
        Drops file in System32 directory
        
        PID:2284
        
        C:\Windows\SysWOW64\Elbhde32.exe
        
        C:\Windows\system32\Elbhde32.exe
        259⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Efhlan32.exe
        
        C:\Windows\system32\Efhlan32.exe
        260⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Fldeie32.exe
        
        C:\Windows\system32\Fldeie32.exe
        261⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Ffjignde.exe
        
        C:\Windows\system32\Ffjignde.exe
        262⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Flgaodbm.exe
        
        C:\Windows\system32\Flgaodbm.exe
        263⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Fbajlo32.exe
        
        C:\Windows\system32\Fbajlo32.exe
        264⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Fmfnig32.exe
        
        C:\Windows\system32\Fmfnig32.exe
        265⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\Fdqffaql.exe
        
        C:\Windows\system32\Fdqffaql.exe
        266⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Ffaogm32.exe
        
        C:\Windows\system32\Ffaogm32.exe
        267⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\Fmkgdgej.exe
        
        C:\Windows\system32\Fmkgdgej.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1144
        
        C:\Windows\SysWOW64\Gbjlbm32.exe
        
        C:\Windows\system32\Gbjlbm32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5892
        
        C:\Windows\SysWOW64\Glbakchp.exe
        
        C:\Windows\system32\Glbakchp.exe
        270⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Gkdaij32.exe
        
        C:\Windows\system32\Gkdaij32.exe
        271⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Gpqjaanf.exe
        
        C:\Windows\system32\Gpqjaanf.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1552
        
        C:\Windows\SysWOW64\Glgjfb32.exe
        
        C:\Windows\system32\Glgjfb32.exe
        273⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\Gljgkb32.exe
        
        C:\Windows\system32\Gljgkb32.exe
        274⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Gdaomobj.exe
        
        C:\Windows\system32\Gdaomobj.exe
        275⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Hingefqa.exe
        
        C:\Windows\system32\Hingefqa.exe
        276⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Hipdjfoo.exe
        
        C:\Windows\system32\Hipdjfoo.exe
        277⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Hlnqfanb.exe
        
        C:\Windows\system32\Hlnqfanb.exe
        278⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Hibape32.exe
        
        C:\Windows\system32\Hibape32.exe
        279⤵
        Drops file in System32 directory
        
        PID:1424
        
        C:\Windows\SysWOW64\Icalij32.exe
        
        C:\Windows\system32\Icalij32.exe
        280⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Igpdph32.exe
        
        C:\Windows\system32\Igpdph32.exe
        281⤵
        Drops file in System32 directory
        
        PID:5108
        
        C:\Windows\SysWOW64\Injmlbkh.exe
        
        C:\Windows\system32\Injmlbkh.exe
        282⤵
        Drops file in System32 directory
        
        PID:5868
        
        C:\Windows\SysWOW64\Iloimopp.exe
        
        C:\Windows\system32\Iloimopp.exe
        283⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Ikpjkf32.exe
        
        C:\Windows\system32\Ikpjkf32.exe
        284⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Jdodekhg.exe
        
        C:\Windows\system32\Jdodekhg.exe
        285⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\Lqkgli32.exe
        
        C:\Windows\system32\Lqkgli32.exe
        286⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\Lkchoaif.exe
        
        C:\Windows\system32\Lkchoaif.exe
        287⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\Mcnmccfa.exe
        
        C:\Windows\system32\Mcnmccfa.exe
        288⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Mgclja32.exe
        
        C:\Windows\system32\Mgclja32.exe
        289⤵
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Nalpbf32.exe
        
        C:\Windows\system32\Nalpbf32.exe
        290⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Ojmhaklf.exe
        
        C:\Windows\system32\Ojmhaklf.exe
        291⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\Ojbamj32.exe
        
        C:\Windows\system32\Ojbamj32.exe
        292⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Pecefa32.exe
        
        C:\Windows\system32\Pecefa32.exe
        293⤵
        Modifies registry class
        
        PID:5152
        
        C:\Windows\SysWOW64\Phaabm32.exe
        
        C:\Windows\system32\Phaabm32.exe
        294⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Amhlpb32.exe
        
        C:\Windows\system32\Amhlpb32.exe
        295⤵
        Drops file in System32 directory
        
        PID:3208
        
        C:\Windows\SysWOW64\Alnfiifd.exe
        
        C:\Windows\system32\Alnfiifd.exe
        296⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Aajoapdk.exe
        
        C:\Windows\system32\Aajoapdk.exe
        297⤵
        
        PID:260
        
        C:\Windows\SysWOW64\Akccje32.exe
        
        C:\Windows\system32\Akccje32.exe
        298⤵
        Drops file in System32 directory
        
        PID:5860
        
        C:\Windows\SysWOW64\Aamkgpbi.exe
        
        C:\Windows\system32\Aamkgpbi.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:560
        
        C:\Windows\SysWOW64\Bkeppeii.exe
        
        C:\Windows\system32\Bkeppeii.exe
        300⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\Bddjijia.exe
        
        C:\Windows\system32\Bddjijia.exe
        301⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Bojogb32.exe
        
        C:\Windows\system32\Bojogb32.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4572
        
        C:\Windows\SysWOW64\Cdnmphag.exe
        
        C:\Windows\system32\Cdnmphag.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6688
        
        C:\Windows\SysWOW64\Cdpjeh32.exe
        
        C:\Windows\system32\Cdpjeh32.exe
        304⤵
        
        PID:496
        
        C:\Windows\SysWOW64\Cofnba32.exe
        
        C:\Windows\system32\Cofnba32.exe
        305⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Dfpfokfg.exe
        
        C:\Windows\system32\Dfpfokfg.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4780
        
        C:\Windows\SysWOW64\Dmcabd32.exe
        
        C:\Windows\system32\Dmcabd32.exe
        307⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\Gbgibgpf.exe
        
        C:\Windows\system32\Gbgibgpf.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:748
        
        C:\Windows\SysWOW64\Imfill32.exe
        
        C:\Windows\system32\Imfill32.exe
        309⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\Ilnbch32.exe
        
        C:\Windows\system32\Ilnbch32.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:116
        
        C:\Windows\SysWOW64\Jofaeb32.exe
        
        C:\Windows\system32\Jofaeb32.exe
        311⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Jikfbkbc.exe
        
        C:\Windows\system32\Jikfbkbc.exe
        312⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\Mflbdibj.exe
        
        C:\Windows\system32\Mflbdibj.exe
        313⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Ncgiolkk.exe
        
        C:\Windows\system32\Ncgiolkk.exe
        314⤵
        Modifies registry class
        
        PID:5904
        
        C:\Windows\SysWOW64\Ngeaej32.exe
        
        C:\Windows\system32\Ngeaej32.exe
        315⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Nmdgbamf.exe
        
        C:\Windows\system32\Nmdgbamf.exe
        316⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Nnccmddi.exe
        
        C:\Windows\system32\Nnccmddi.exe
        317⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Ppclej32.exe
        
        C:\Windows\system32\Ppclej32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5624
        
        C:\Windows\SysWOW64\Pnkbdqpo.exe
        
        C:\Windows\system32\Pnkbdqpo.exe
        319⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Qfhdnb32.exe
        
        C:\Windows\system32\Qfhdnb32.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3064
        
        C:\Windows\SysWOW64\Qpahghbg.exe
        
        C:\Windows\system32\Qpahghbg.exe
        321⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\Bonhqnpi.exe
        
        C:\Windows\system32\Bonhqnpi.exe
        322⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\Bdjqienq.exe
        
        C:\Windows\system32\Bdjqienq.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5684
        
        C:\Windows\SysWOW64\Ehndhn32.exe
        
        C:\Windows\system32\Ehndhn32.exe
        324⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Fepehm32.exe
        
        C:\Windows\system32\Fepehm32.exe
        325⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\Ipbahb32.exe
        
        C:\Windows\system32\Ipbahb32.exe
        326⤵
        Modifies registry class
        
        PID:6380
        
        C:\Windows\SysWOW64\Ilibmcln.exe
        
        C:\Windows\system32\Ilibmcln.exe
        327⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\Jblmpl32.exe
        
        C:\Windows\system32\Jblmpl32.exe
        328⤵
        Modifies registry class
        
        PID:5028
        
        C:\Windows\SysWOW64\Jifemfcl.exe
        
        C:\Windows\system32\Jifemfcl.exe
        329⤵
        
        PID:208
        
        C:\Windows\SysWOW64\Jemfbgiq.exe
        
        C:\Windows\system32\Jemfbgiq.exe
        330⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Kimlnemd.exe
        
        C:\Windows\system32\Kimlnemd.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3268
        
        C:\Windows\SysWOW64\Lomjbikf.exe
        
        C:\Windows\system32\Lomjbikf.exe
        332⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\Mbppjd32.exe
        
        C:\Windows\system32\Mbppjd32.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6208
        
        C:\Windows\SysWOW64\Nbbefafp.exe
        
        C:\Windows\system32\Nbbefafp.exe
        334⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Oqcedino.exe
        
        C:\Windows\system32\Oqcedino.exe
        335⤵
        
        PID:636
        
        C:\Windows\SysWOW64\Ofqnlplf.exe
        
        C:\Windows\system32\Ofqnlplf.exe
        336⤵
        Modifies registry class
        
        PID:2168
        
        C:\Windows\SysWOW64\Oqhooh32.exe
        
        C:\Windows\system32\Oqhooh32.exe
        337⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Oicccj32.exe
        
        C:\Windows\system32\Oicccj32.exe
        338⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Ocihqc32.exe
        
        C:\Windows\system32\Ocihqc32.exe
        339⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\Omalii32.exe
        
        C:\Windows\system32\Omalii32.exe
        340⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\Ofjqbndk.exe
        
        C:\Windows\system32\Ofjqbndk.exe
        341⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Pbqago32.exe
        
        C:\Windows\system32\Pbqago32.exe
        342⤵
        Drops file in System32 directory
        
        PID:4464
        
        C:\Windows\SysWOW64\Pmfedhie.exe
        
        C:\Windows\system32\Pmfedhie.exe
        343⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\Pfojmn32.exe
        
        C:\Windows\system32\Pfojmn32.exe
        344⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\Pfagcm32.exe
        
        C:\Windows\system32\Pfagcm32.exe
        345⤵
        Modifies registry class
        
        PID:4160
        
        C:\Windows\SysWOW64\Pafkpfni.exe
        
        C:\Windows\system32\Pafkpfni.exe
        346⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\Pbgghn32.exe
        
        C:\Windows\system32\Pbgghn32.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3700
        
        C:\Windows\SysWOW64\Pcgdbakj.exe
        
        C:\Windows\system32\Pcgdbakj.exe
        348⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Qjalok32.exe
        
        C:\Windows\system32\Qjalok32.exe
        349⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\Qciqga32.exe
        
        C:\Windows\system32\Qciqga32.exe
        350⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Qjcidkpd.exe
        
        C:\Windows\system32\Qjcidkpd.exe
        351⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Qamaae32.exe
        
        C:\Windows\system32\Qamaae32.exe
        352⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\Apbnbali.exe
        
        C:\Windows\system32\Apbnbali.exe
        353⤵
        Drops file in System32 directory
        
        PID:6980
        
        C:\Windows\SysWOW64\Aikbkgcj.exe
        
        C:\Windows\system32\Aikbkgcj.exe
        354⤵
        Drops file in System32 directory
        
        PID:5828
        
        C:\Windows\SysWOW64\Aimoqgqg.exe
        
        C:\Windows\system32\Aimoqgqg.exe
        355⤵
        
        PID:6156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 6156 -ip 6156
1⤵
PID:6292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abhqefpg.exe

Filesize
60KB

MD5
63adc855c5b4c1a0b077c50b40dd9bad

SHA1
39b4a9e9c5b122973a07506948aa65ea151936fc

SHA256
f11cdd4e960cf34354569988d0071bdc0e60db8f0f2fac54782390471f1b8a66

SHA512
dd4d1a17e703517aacc46732a8f92b533ba035430e6bb5e72d28e30a6eadc4402339f0efb6632fb9bbcf64fc41c6437873fcfbaccb5518692c45fbdc17dd9126

Download Submit
C:\Windows\SysWOW64\Agfnhf32.exe

Filesize
60KB

MD5
963a2cb754c97e4ce9ddfe5d7b43b35b

SHA1
f71d681f77dbf9c33ecbd2b486e827b32a543f05

SHA256
2c7c6d695f802841faa8f4251718fabacecaf83c35859be194666659d63aa4a4

SHA512
269d77cc3bd0b089ebb3cda48f42e92e06e8d5483adbbb500bed100ce167d1a64c152fe24d89d41c39b12cc593c664e815cfa5d44c79b4f728fd81d6102052ef

Download Submit
C:\Windows\SysWOW64\Apbnbali.exe

Filesize
60KB

MD5
7c2d87c485f9e6143cd3af51cfcb9809

SHA1
100d003079d3d9b6639d009b69220e4788d803d7

SHA256
bcaf20ec66e2da64dfd55f05b0caa18f39e4ff0b90ef5fe8c0864c1762928309

SHA512
b6ec96b2fd8fbc776cb2b11ec96950d94f854bceff5e07d86adbc0c7f4f176de8bfc49161b7fdc3e75bbe37d4361d6396f6475bf136efd04a0cbda13d9d0605d

Download Submit
C:\Windows\SysWOW64\Apqhldjp.exe

Filesize
60KB

MD5
2f6bac8fea80a62374adba241730a261

SHA1
0c817eab9a45e782e571f86d5c3aab80497c8b3d

SHA256
c023cd389b33efd57b957d0b4843798771553f10fa2a5905cf24385de6c80a9d

SHA512
a8153a06c81ad17577d927b6e7185a662b116ba261f6b957560895f9992812f1c0c1ad73a6250ef6d4d9827222de6c2f05e79d09edd00fafe8d30c0d913110fd

Download Submit
C:\Windows\SysWOW64\Bdapehop.exe

Filesize
60KB

MD5
d37f760b4b0397f28629f2791f5ea3d2

SHA1
af212a18350d809a02a2064c63babc58ef21a079

SHA256
05c13df93e8f98895513a3b7c82a2e663f4823ed446983ded70074aa6d440068

SHA512
e48ff536c1cbf553b3c44d5c5883ae2eebc669e995f8b56dd985e73097ae5a1452f8ddaa9ef10bfdc6bc3afc72176a6aef46efcfd8480c322271dcf894b0324e

Download Submit
C:\Windows\SysWOW64\Biolkc32.exe

Filesize
60KB

MD5
d333645415da1dfb9e78e57637197503

SHA1
d866ad374a65d99a939ac4585ad17dd55bb004dc

SHA256
2aa515801781a0bf89a30e6db918c97b39995e3b0c0623f7be43a7e358ad1c22

SHA512
2c287432d644d9b1afad4d37e1c6ac16fce1a5918ffaf792761cb9e61b81c75920f20e59629c26531603929e35911eb0715ce03e0e36a822a7bdca86879bce3e

Download Submit
C:\Windows\SysWOW64\Bojogb32.exe

Filesize
60KB

MD5
9bacee2ca058ea7e2217436761cb9754

SHA1
b286fe9f0ed30246c9b9069b36d16ba0dfef67af

SHA256
375b6f45edff30646c1956debebb20c7c25c2696d5e160842aaf86815448da48

SHA512
d6c96ecd690e1fe9462c241ecf1eddf50faf2e6a3aa15dccf324187fb27967e10c5d3e3e2c1e31c214a17623384d7be6806780edc249cd1b29660952989a3571

Download Submit
C:\Windows\SysWOW64\Cpogkhnl.exe

Filesize
60KB

MD5
29771c49ee892ace928f6a434d3069fa

SHA1
beb0d653d6894a1d459206ac6b4918afa7e15d0a

SHA256
d1c21a3a8fd05d93e679e6a896b84db057461da08108d1247851ce1c672078e3

SHA512
7c75361cb4f79355101086f7abe9911dd7122938b3627bddcde7abe559209aedcb3643e6c6833c0917144e19ecce2a7c04b62c4bdb005ff0a9bc7f143bd752dc

Download Submit
C:\Windows\SysWOW64\Dgihop32.exe

Filesize
60KB

MD5
7e65f9bd336aded7774a357f4385b6d3

SHA1
b3d74b1faf746e4473f6685cd1603e74741e96fa

SHA256
287bb37cfd84ae0348b95778c91d949d851de76d801ef7aced965c25c18bfbe7

SHA512
6f521d022bac49b1ed05039276e5ef5e9effa7a5caed65e5766958a837e126ab0088583687060b14e62fc6bada9dad2d517aa87be305a2230a1eed70eaf020d9

Download Submit
C:\Windows\SysWOW64\Djnhne32.exe

Filesize
60KB

MD5
b148b4a9d0d3d9597dced6ccf7806bbb

SHA1
e34546166663b58ae743983b49b129f904fc2897

SHA256
389d0b7bfd2ccd62388157bafd75c2d7511a72d038215f93ced33c9eef16eeb0

SHA512
fe923e8cb1bc7d789a0501482481b4fb7edc50213790f6f6a585243fb33ecebff0ad67bdf066b0f902ba3cb354c91e82a9c1121ffb647e6272de54794c985c2e

Download Submit
C:\Windows\SysWOW64\Dkbgjo32.exe

Filesize
60KB

MD5
e1a5a9e6497fd6d2c4aff0f3749071bf

SHA1
a574c8f6748f6c3f1052462ee21ca7b22d452252

SHA256
dbd9f6ec7e22bb6ba1797d4e4e544a0d298b7f0938c49b046bd4d84ae71114b9

SHA512
bcacdd632d3c7eb9fd625937835039d16952648f3ea4de12d063fcb9bb32ecbb30bcee4493c9f4c08ee0cc03733a686d28d140789b163b4f1eb2741cbb8f2d02

Download Submit
C:\Windows\SysWOW64\Eafbmgad.exe

Filesize
60KB

MD5
d512adcd7085f78a62c2919cd99e5709

SHA1
525e03ef9787f7e393a4f88f20a248eec294ac6f

SHA256
66b6f07739cb7b6e539645bd2259342ce43ee25de23a7b25e8adcdadb7236195

SHA512
4a92082ea1fd7eb264191bd695f2de4cd5835de3761abef169113b5830fb4c409d3c4939ccbe073d375eecab5310cb3b7bc9a3cd36d516987fb383b4cf8db7da

Download Submit
C:\Windows\SysWOW64\Ejnbdp32.exe

Filesize
60KB

MD5
ceaffd3e5faaea4e7a16e489a232d928

SHA1
3e49ac514c681c6466a4eb48a55cbf5b996981ea

SHA256
223efc4cfa130b04bd82254ce4ce77b589747b51de08aebc8c09f72aa912abc5

SHA512
27ce6977c259c247a57f16dcbe0112b6d228f01b694c42ecfea2b79e624b82a46be7ad0e2b11d9e7ce8822c2c2b8441d6fce06b654ca17f67363a2b65dabacc6

Download Submit
C:\Windows\SysWOW64\Fcmgpbjc.exe

Filesize
60KB

MD5
9d4f3c184c23372f846b788124f24b2a

SHA1
1ab7470f293035fb9c873d8010a2e7b489ddb6d5

SHA256
48b95dad4132906286e80b5d17d7f4b5622896f7879cd9d0575708d5c41fdf76

SHA512
c7b9050aedc15ca251e28be42d8a5d86c3a9118a999870d76f1d295ec5f970c81ed47f07d172bf8c84f4698c15f778102bf65e37e776d58fc06257c7fd7788aa

Download Submit
C:\Windows\SysWOW64\Fepehm32.exe

Filesize
60KB

MD5
9ae60f99381e8ad69b608685c40b0adf

SHA1
4d149a553e855003e365a6c2bcb4d2ad6e09247c

SHA256
e19c29bccf911e69d5b181bdd0f70330fc294972c162e8fbeaade2d9ec65f0fc

SHA512
ebfe158df5e5f14b5467201198257d3143349786152c1d65b2d39c0c1fb41eb097cda09f062652b34c0b851d1b400e81465e68d09ef73f9393348e755c574cae

Download Submit
C:\Windows\SysWOW64\Fnhbmgmk.exe

Filesize
60KB

MD5
539f4194d9d094fc2b5451e056945637

SHA1
67ca11aa7d1f7197986f29221f6fa42a637f4c67

SHA256
f627f443277734a5f3f535d1bda98f360f3049e84bce7c49593490574ab711ca

SHA512
a1adea432d41fda2494ed67a091c05f17bfe8b21ee87dd81b4e9eaf71b78c0e0f9ed9da3319ee8b9a18c4b7f47f48f836d5b857a22632c19cd80815e44cc726e

Download Submit
C:\Windows\SysWOW64\Fqppci32.exe

Filesize
60KB

MD5
996cee7df5285cf4e62be034bbf69f20

SHA1
2c43786199ffe14b8cf6f1141c15d692a631ea9b

SHA256
69bc363e5de0cf3d89f41d1b00661d3b1c734133711459c0ccf42fee1f5502e8

SHA512
0e26bc778d87caaa4e7ad88b57f0cefa8f6aead8d324862fd2da11c8fe87166d7a405089a459a4c511edebb28eb50e4745aed5c45fca6543cc338c218e3dadf2

Download Submit
C:\Windows\SysWOW64\Giecfejd.exe

Filesize
60KB

MD5
9bb5de1a3a426e0c14b5a4379ef3cd04

SHA1
b2104989eddecc347acdf2f874f1cd58c8eff392

SHA256
42be062e1e7b925806c86ada6b7eb35b1e6cbf210f0829ffcaf2fdb0b4daf0d6

SHA512
eeddd91d8615f5ecc891b9777e0f7a8b65cdcabeeb86f72f2d220c4c35e342d2d11841b283d51d8e376572a7bbf9247a661704f6554e8b3e5b7e628a143879a1

Download Submit
C:\Windows\SysWOW64\Glbakchp.exe

Filesize
60KB

MD5
b78cafbb5cdec7d61a88a8ac74568a4a

SHA1
1313ce4d9d5e1ed3f57c9589d818c93961b9dc08

SHA256
aeaa8fb84b748c629ef66e78ac1f2ba466a9a1863b59162cda8619d7da10602e

SHA512
f4fe9e1d6e60741ed116ee08dbd645c9c99c7caa731365722f010b3da919d365d0c04e6ee1b4458b4b2d0d5fc107d2383976f1f223817e7da4376e50c4eff112

Download Submit
C:\Windows\SysWOW64\Glgjfb32.exe

Filesize
60KB

MD5
9c3eccacc8fb1e96eaa93cf87db3d141

SHA1
77037a13eea3eeb8687f8ee8cea1457eb38c5dfd

SHA256
6d00a5ce27cc6841ed82c30c5b5eab72ec641ffc61895c93e3f529cccfe26404

SHA512
1796fd98198bbc09924933ea498c6adf6faef99fb32f6114287d7fb4043fb349e7b699c1c56279580873088b961131dcc9ee652c98f6707489ae6926eb3bbea0

Download Submit
C:\Windows\SysWOW64\Gngeik32.exe

Filesize
60KB

MD5
f6e34feb431e3d80f5d3565afc9fa90b

SHA1
472e48fa01f550fc86e010b4aa0aa0b83973983b

SHA256
25b9b900e429b542f8ce5bf8a566b677a5331f8ae79a7562df50295d39f6ba72

SHA512
8145f7e66e5c065142a42a8f2634994a480bbd1b1806d505cccf57735182a021523faf5061aedbb1187757e29a0c980f851012f510b4994ce613cac6b0b347c0

Download Submit
C:\Windows\SysWOW64\Gnohnffc.exe

Filesize
60KB

MD5
d73bfad3502bd89aa75294c902f8317d

SHA1
5531ce51401daac75f3f037556e140eb2a66acd5

SHA256
8990e4c587fb2f43183e0f9f4d585e6ca595aa429f9b27b424087a9eacf076bb

SHA512
c40a544f873d243cf67577197e54978551ac9f8ae7139711f3d0fe8961334a6304367280d488cb4aedfc146021a2f25b82023e3d734d62ce3c47f04253a563a3

Download Submit
C:\Windows\SysWOW64\Hajkqfoe.exe

Filesize
60KB

MD5
992366ef12bf18e3ef30df5676af7e51

SHA1
391d70030be8f7d90e3f4a03c973711f654ac781

SHA256
79649ae269e7f4ed30fb5ea6a2e112e451e6ea8e9bbffff08ac45b5de456bee0

SHA512
e5a0b8514669f0a86a0c61537b540fdfec5d5e025fb5548d11beba081d90e0c21d91d2ae1ebf6883356b617d58d9b4a1acfa5004f16f986d4f49a3e32f9ae9b9

Download Submit
C:\Windows\SysWOW64\Hihibbjo.exe

Filesize
60KB

MD5
3858dea22204bd4b717e34d0d785d1c6

SHA1
ee5508af416a0afe16c22f66436fc2a8cc323cb0

SHA256
0b4a432c09e059d9a06190674bf1da4e34084f59843183a771fe1ac9a989c553

SHA512
9fd95d17d62b75287495dd8e20bb9a1326a377a49d4c17349777d59f5f3d465bce1e341a786e9c2bb1bbc693935f5f3bca2b781ee3744aacf2cfacd330c4836c

Download Submit
C:\Windows\SysWOW64\Hnphoj32.exe

Filesize
60KB

MD5
60849d823bc53de3a57ee081b1412766

SHA1
6c9a5c8bcee7c5fa795cc7a26bb88684fea4edc6

SHA256
d60578fec71efcce22f7102292379afe7dd9e4c4707fe79dbc8d24dfb978c6e0

SHA512
0ac0c27122cb5340d0984430337a4f3cee7e3ba48ce1e7630921936cc401d0574893d8ab9b0268c071c5dd0d53ed7c9b63f71aabb92e79465d25618d978c9203

Download Submit
C:\Windows\SysWOW64\Iabglnco.exe

Filesize
60KB

MD5
282f713567c50fd6f76dfbee750a8b4e

SHA1
8eef508bc7e1bda948027f63a621fe9bbbbd02af

SHA256
ca4ae096146eed7389231393f3f2aa4ebb416eb905772f40c1a920a5bf98aa5a

SHA512
721ac9ffe48203338a34454c2925b858b77868d547b8d27ee3b1b03593ce940d3fd2f69a79cb35e3cddf08148458c470a580ead07fa4203c56db1873458663e4

Download Submit
C:\Windows\SysWOW64\Icogcjde.exe

Filesize
60KB

MD5
de10a1fb256b9a40a9a0e8710b169b21

SHA1
57dc4af1f0fd6a86f265599b7a140b86ec543fba

SHA256
ffd4190ff897807ebdd242d2a671dc29fd5119aa46e8bff21e2c885ccac139bf

SHA512
bc5503dd227d27d820d217c3e7121168755f78f2f49dbcdbfe04412c9eb6ff3153158e8f206fcf8fb8c4c2bbc215ad542274d6174cbee131abb5402086bd3974

Download Submit
C:\Windows\SysWOW64\Ieccbbkn.exe

Filesize
60KB

MD5
8f1f8b889c9dd37e6bbc5e1988143bc9

SHA1
4c3267d187000426faa98ac17511e1c3a56e4942

SHA256
465bdd2db8f1f39951835794c3828609a6485d37cb8b2783ad9121fd5c5a1671

SHA512
4de0453be215f0dd1d781356f20d0806959e4c5619f47a8a431c7b07299abeedb0dfbd7657035a6938b3e8c852e9c6900eac66564c8bc40d254e77cdc168d3f1

Download Submit
C:\Windows\SysWOW64\Ilibmcln.exe

Filesize
60KB

MD5
9b9b5f2e403d3bacd4de9cc32ae494fe

SHA1
a49529f472c0ceae5664070afe2003a276942352

SHA256
787406e292792f579a85b9128f9168364c782c6f7406740a99740cc776f045a4

SHA512
d9804d725c9d8b6ff8c4219c376c084b7120ca727ac32e90d01320b67b93bfdd5b745664ee7cff420854c6b4cc85102a27fe347150da9d97b32b6583443a695a

Download Submit
C:\Windows\SysWOW64\Ipckqnja.exe

Filesize
60KB

MD5
53702ab73d4ac6f1394e6b2fcdaa1b4f

SHA1
e2481dfb6f6a0d0edcc5ab4514841a6cae433792

SHA256
e34279f18b09b10b8f85dd6eaa7a680a466aef428c33b7731d0139634a8237aa

SHA512
59f87c0bd7f4850165a0d3777f59e1db559307956e49eed1977f479f0f035e795ebab3ab01f4098ad3654a0e369e83fb00ec9899bdc0100871d6874c2625b918

Download Submit
C:\Windows\SysWOW64\Jgjekc32.exe

Filesize
60KB

MD5
58d48ed7d91e03c67f247ee9ee8bd400

SHA1
92240863e2b00af0decec33605096a637b980017

SHA256
81cf3562648c61576c72a8ee9feacd2651c2bda245c5ae8c0354bf1a1160c90a

SHA512
3649bde18a75b80c4d8cddc961f9c855353d2c9196a2ce224a34de2d71ee20ca8d4a344beb77cf81831e383e0f693d541df77ad3d701ce0019baa144cb26ae11

Download Submit
C:\Windows\SysWOW64\Jlidpe32.exe

Filesize
60KB

MD5
4709ce232c81af82ed5543a8d810c838

SHA1
c6157147b1f1ac27764f02603fef8c2c3719138a

SHA256
390365ae48db608c700579153ab752b1671e31a19ce3554569c33eb8a8da99d4

SHA512
8ade3360cde2c2af5b5a146bf8b4cba2817a493e23ec100d511dd22ceb5247abd0d5ec47fda3396740304b0f9793d1bf073bc08524a3c02f46ef0b107127df1a

Download Submit
C:\Windows\SysWOW64\Jnpjlajn.exe

Filesize
60KB

MD5
bbb4ab3bb30b5c91e8e23d00192ebb15

SHA1
0182d784ba40374895c5135bca9ba8d1ec1af097

SHA256
9e67fbec395ef86315ac881bb3a251bb4ae4d43b88c7c588920f2e5ea3ea94f7

SHA512
00fb4e5bf7603efbbded191057f42d5af84a9711e6a2a52eb6bb84dd331ae881bb820574002f60624ddc14abd1acd1a0a796b633106e785a426c901309d3c639

Download Submit
C:\Windows\SysWOW64\Joekag32.exe

Filesize
60KB

MD5
ff7f487a96612d907d15e9b7ad0a6754

SHA1
aa5d71f5176979e916531a8465133067be8c9ed4

SHA256
4f0335b4d4d7d2f309e6748a92c9d1fd5b0fdc91d51f1e472646d784d4ff3840

SHA512
ff928bbbaab5f315a1c9ddc9baef34f27250219f9a5cb309c409bdbc470bd1698200d37deca85e82185150ac6ed6eba7547b56de567bf4701fc7006509ad7e39

Download Submit
C:\Windows\SysWOW64\Kpnjah32.exe

Filesize
60KB

MD5
ba6a94d8eb96e5cafc6e71db1d8f3c5f

SHA1
9fe5ebe02a23d05e62461f817acb0c4dd152f584

SHA256
ed4d88f7892aa37428208214dc873eb1b1b820d7316b25a3592138295f8ee3d2

SHA512
2570464aec3e4a4f679383f158907e3155aae053446c37756989c0fb8eb0f577f4994b36b5d0ac08f4ef1b76b566753ec89fd9987d4f80add3f72f577ca9ff35

Download Submit
C:\Windows\SysWOW64\Leabphmp.exe

Filesize
60KB

MD5
90514754bfcfbbcacc682d39534bbe7f

SHA1
2b4970f9cac5bebf525d403bce0194c0c0830ad2

SHA256
3f363242230034b11a33b8375bd7505524bfcf5e5471562ce8d24d573f4601f4

SHA512
568f3f0644711a9f622e62b062bac33e41611f255a13a937d826391d0d64badb95f8ca1baa5f5ae21160069bf7679ffa11c15feebf087a4f28c36feec3af7354

Download Submit
C:\Windows\SysWOW64\Lefkkg32.exe

Filesize
60KB

MD5
d9007748958b6b445d92cc8748f2b863

SHA1
c45a6f70d2bea6a8f770bae3e30bf9c57e4b49ff

SHA256
562ed09276c5492545b658ae02233c6c2d1e8b14b5d74daae10666ffce2303c0

SHA512
8fbef52cde39422d52a3ce1847f141bd362d5ed75440404602fbf52fc1a32fd8df15236c84973a9d6345bbfcb0399551c11899bf640365983a469e7d98ca0bb7

Download Submit
C:\Windows\SysWOW64\Leoejh32.exe

Filesize
60KB

MD5
5c8b028f6db3cf7f7b9c8c3b98f6a11a

SHA1
0fbcf5b10a49be02e659cee65cf58ba94c8d8079

SHA256
bfb3b08e57634466259c3efdd9f41045a8926fa5e3ee2759346126fdaa6dcf22

SHA512
45c8d22f108e740d8a25396ea04a05e889dc469bf271441daca9a3e42ed29d9d258ea952f5329e4041de9cff62a93eb73a791b11d798fcdd113ac4debf619195

Download Submit
C:\Windows\SysWOW64\Lkiamp32.exe

Filesize
60KB

MD5
a69a8db11547e9015d53af14646e23b1

SHA1
0732e3a21a8ea51e7a3bd3bc191414decd3b2277

SHA256
2952ff58a782ad53dfff0872be283edae20245fae7fc3566301dd7e7b5c64db5

SHA512
32e243ad0a7cb74cd0140bb22ae50a0ce0a60683daec05daae38cd36bf5073586e15eb81035eb95f549c22b6dd294cdb7d1687e573340cc77c5f95245510226e

Download Submit
C:\Windows\SysWOW64\Mjlalkmd.exe

Filesize
60KB

MD5
838bcca738411590fa6265a1522deaf2

SHA1
ea134a215bec3daa8a108d32e3b8ce644f1456cd

SHA256
d6521665ae6e0c5baa95fb14abacba39c08680037868beb239dc5e5796ca312b

SHA512
72d28e27808cdce70664afb47b037804574621c4733334ec8afc2588c9857d55a5a5b657da380b0ccdc0948b8009e793f16886bc993f059b3922f7236056f804

Download Submit
C:\Windows\SysWOW64\Nckkfp32.exe

Filesize
60KB

MD5
7a7d80fdcd8559fec20ed71d2aedae93

SHA1
756d46cd796466164ad4cd908309fb8a49e2b14f

SHA256
f01afedd294c2f1329a9eba3acf729d23cf81c7d7387e239ab5474abf196bb4e

SHA512
390b4e4538b7b2c853c4aa42989d4c78432f4d3dc9e85c974f265fa32847773acd7bb276a358fbb574e2ed48d5e391c6d9d2912d32f850f2228b01a156a4b9e3

Download Submit
C:\Windows\SysWOW64\Ofgdcipq.exe

Filesize
60KB

MD5
943a41ebc7be761d3e763e6b610ed6e1

SHA1
aa1cd043e04c4d13a53a67e8cd6168fdcf836430

SHA256
9be4305490a96cae34967ec558e874415f8b06d3ea7439d8819e9e765b000c47

SHA512
f41ebcf685afc3fad279c3ac82018641fc575399a504d021c98d923833b3e1cb6bc5b8ce5f94d5b2d80c8c2dc0c091a2b3307fabd0cc58f7c008b40245a0b5d6

Download Submit
C:\Windows\SysWOW64\Ojnfihmo.exe

Filesize
60KB

MD5
9bb51bf4241f0c6e5656d96515c7b562

SHA1
9a1549e84606fbf2f264bd6cb796e270e6aeee0c

SHA256
2ea815bcfc17348ce9b4211f0b7512553be068c1aa10b5d54fdc66e29a7bd7f4

SHA512
f271dc005ddd4442e8e5615e08bf1b34bee795fcf38c601f95337d3afc66a88d87a04cab4adaa952c290f88572120bbccd5e91adb0e1847b82618b152b2fec3b

Download Submit
C:\Windows\SysWOW64\Pcepdl32.exe

Filesize
60KB

MD5
f3c1164356341eb216b1c2af6bb7a195

SHA1
e9be89d79781ffb0a0579047380ba1206ea7628e

SHA256
037fbe4c2be1ec7d4d9106a5cb7bc2fa6712c46814d6cdb6d39a079b238bce9f

SHA512
a60170cc83669bf53f1164f7638853d7a1b339d325b1dd3186e356ace627b2d25d4c8fee609579d16368e63a665e779ff7878f6447264c6dc4458cf69e7b0ead

Download Submit
C:\Windows\SysWOW64\Pcpnhl32.exe

Filesize
60KB

MD5
064021015d7c134eba3046794535c9ee

SHA1
0e8891272c17a7be67e268cfd6888289e5589200

SHA256
0a4d9ad8903f38a5f4d477666b36d44e552d61ef3f86f5165fcb11e5c8d144de

SHA512
0b8a0f5c5678f7481e52326bb03757eb1b56c665e991ad805c9d888847cc6b43e2233a2ca49d495da1f34f61ff102125edc6a55d4a05ddbf84b09fed9d52550b

Download Submit
C:\Windows\SysWOW64\Piapkbeg.exe

Filesize
60KB

MD5
ccaa8b042c463345db596972fade2cb7

SHA1
f186e76e06f9e968ff3fcdc83f0dac5801212188

SHA256
1ee53c8e2a1184fab7c67ef8fe2a85d7cc745b71c96e1fb8304873371e096dec

SHA512
31261c2136c13d9264bfe95b1249e2a21ca3b11c7a5446a4d58c5b51673cc230a7de1a7c0572616d820f2e28396e8cc3a1475198d4f11e939dd617afa7bf76f8

Download Submit
C:\Windows\SysWOW64\Qppaclio.exe

Filesize
60KB

MD5
4e23143ca6feb572f96a77a94acfcb22

SHA1
d857f754d5972d01c4ca72e529777b2d9146257e

SHA256
6fa2e8f56a56129fea0da06cf47c629ccabf557ac3eff5b5c884592bcf597894

SHA512
1a6d0fda15abfd599dc276043d7d8dfa1a91a97aaecbbb1bdf9112c9e1e0bef218798ee1d9ceff872b10f235edac356024312073941aba2d374080c10e8a69e5

Download Submit
memory/548-107-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/548-24-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/788-91-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/788-173-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/920-158-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1012-351-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1052-237-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1092-377-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1148-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1148-80-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1148-1-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1148-72-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1364-348-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1600-397-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1728-196-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1828-356-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1976-314-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1976-229-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1996-359-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2260-350-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2328-134-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2508-246-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2516-407-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2692-183-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2692-280-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2796-132-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2796-48-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3004-141-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3004-56-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3064-287-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3064-358-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3108-298-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3108-371-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3224-100-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3236-372-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3384-64-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3384-150-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3456-40-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3456-124-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3524-8-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3524-89-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3564-306-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3564-376-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3720-307-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3720-220-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3924-413-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4008-37-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4008-116-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4216-109-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4248-256-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4248-336-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4256-330-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4320-239-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4508-211-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4524-328-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4536-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4536-98-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4552-263-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4552-175-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4660-297-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4816-165-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4816-254-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4936-296-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4960-390-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads