9ec4eb51c3e41346ab7a355e2eefcefef4f3c6d0960f4046244ff8444157402f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ec4eb51c3e41346ab7a355e2eefcefef4f3c6d0960f4046244ff8444157402f.exe
Size

52KB
MD5

1d2904cd22ebfc3bc70db94aa550bc0e
SHA1

903c42636459152a18760ffa99ed5b559faabb46
SHA256

9ec4eb51c3e41346ab7a355e2eefcefef4f3c6d0960f4046244ff8444157402f
SHA512

2cc752536527dccd76f217f49c2c0b7d6eb4c6563218efe5351c5809f1e05fdfc452d4e490f18d77a0eb05ebea8aa9da601b4502b6731110e009907c1082113d
SSDEEP

768:r58E8lyo+USm+Q0DkdNHT55lzmZOKkvFIIIzZnSf6/1H56:KEMNaO0DsT55pgkvFIII84E

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acocaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmlhii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdcbom32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdmegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jioaqfcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qqfmde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbefaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anpncp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lljfpnjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpepcedo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcbihpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmfhig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iabgaklg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdemhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bganhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baocghgi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfhdlh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofcmfodb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmemac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oboaabga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nilcjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhdbhcck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iblfnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcbihpel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeklag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocgdji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onmhgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkciihgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olfobjbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eemnjbaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdlnbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klngdpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lphoelqn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehedfo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipldfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmfkoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kboljk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Himcoo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjmoibog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfqlnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icljbg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhaebcen.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjpaooda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmhhehlb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okolkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Becifhfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbmncp32.exe

Executes dropped EXE 64 IoCs

pid	Process
1404	Fqmlhpla.exe
432	Fckhdk32.exe
228	Fbnhphbp.exe
1476	Fjepaecb.exe
2568	Fmclmabe.exe
2920	Fobiilai.exe
3528	Fbqefhpm.exe
3984	Fjhmgeao.exe
736	Fmficqpc.exe
2316	Gcpapkgp.exe
1676	Gjjjle32.exe
4256	Gmhfhp32.exe
1960	Gidphq32.exe
528	Gqkhjn32.exe
3664	Gbldaffp.exe
1856	Gmaioo32.exe
2156	Gppekj32.exe
4180	Hboagf32.exe
1816	Hmdedo32.exe
4436	Hpbaqj32.exe
3504	Hcnnaikp.exe
3180	Hjhfnccl.exe
3432	Hmfbjnbp.exe
668	Hpenfjad.exe
3968	Hbckbepg.exe
1320	Himcoo32.exe
1440	Hpgkkioa.exe
4380	Hbeghene.exe
4540	Hjmoibog.exe
212	Haggelfd.exe
2128	Hpihai32.exe
544	Hbhdmd32.exe
3764	Ipldfi32.exe
4596	Ibjqcd32.exe
4004	Iidipnal.exe
4356	Iakaql32.exe
4060	Ibmmhdhm.exe
3212	Ijdeiaio.exe
3348	Imbaemhc.exe
2028	Icljbg32.exe
2904	Ifjfnb32.exe
3100	Ijfboafl.exe
3992	Iapjlk32.exe
1392	Ipckgh32.exe
2964	Ifmcdblq.exe
2444	Iikopmkd.exe
2200	Iabgaklg.exe
916	Idacmfkj.exe
4904	Ifopiajn.exe
4428	Iinlemia.exe
1684	Jpgdbg32.exe
5044	Jbfpobpb.exe
2068	Jagqlj32.exe
2324	Jdemhe32.exe
2700	Jmnaakne.exe
3316	Jdhine32.exe
2344	Jfffjqdf.exe
4224	Jidbflcj.exe
1008	Jaljgidl.exe
368	Jdjfcecp.exe
1644	Jfhbppbc.exe
3600	Jigollag.exe
1744	Jpaghf32.exe
2996	Jbocea32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Idacmfkj.exe	Iabgaklg.exe
File created	C:\Windows\SysWOW64\Hkikkeeo.exe	Hmfkoh32.exe
File opened for modification	C:\Windows\SysWOW64\Hcpclbfa.exe	Hkikkeeo.exe
File opened for modification	C:\Windows\SysWOW64\Mpoefk32.exe	Mmpijp32.exe
File opened for modification	C:\Windows\SysWOW64\Nlmllkja.exe	Nnjlpo32.exe
File created	C:\Windows\SysWOW64\Fbqefhpm.exe	Fobiilai.exe
File opened for modification	C:\Windows\SysWOW64\Icljbg32.exe	Imbaemhc.exe
File opened for modification	C:\Windows\SysWOW64\Jmbdbd32.exe	Jeklag32.exe
File created	C:\Windows\SysWOW64\Pfhfan32.exe	Pgefeajb.exe
File opened for modification	C:\Windows\SysWOW64\Dfiafg32.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Ceaklo32.dll	Hjmoibog.exe
File created	C:\Windows\SysWOW64\Ogpnaafp.dll	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Obangb32.exe	Ojjffddl.exe
File created	C:\Windows\SysWOW64\Ffddka32.exe	Faihkbci.exe
File created	C:\Windows\SysWOW64\Jlnnmb32.exe	Jioaqfcc.exe
File created	C:\Windows\SysWOW64\Mcnhmm32.exe	Mpolqa32.exe
File created	C:\Windows\SysWOW64\Gaiann32.dll	Mgfqmfde.exe
File created	C:\Windows\SysWOW64\Odegmceb.dll	Mamleegg.exe
File opened for modification	C:\Windows\SysWOW64\Lpqiemge.exe	Lmbmibhb.exe
File created	C:\Windows\SysWOW64\Anadoi32.exe	Ajfhnjhq.exe
File opened for modification	C:\Windows\SysWOW64\Ajneip32.exe	Ahoimd32.exe
File created	C:\Windows\SysWOW64\Hnigkegh.dll	Chpada32.exe
File opened for modification	C:\Windows\SysWOW64\Oddmdf32.exe	Olmeci32.exe
File created	C:\Windows\SysWOW64\Elkadb32.dll	Deagdn32.exe
File created	C:\Windows\SysWOW64\Eegdfm32.dll	Acocaf32.exe
File created	C:\Windows\SysWOW64\Cklaknjd.exe	Ceoibflm.exe
File created	C:\Windows\SysWOW64\Nilcjp32.exe	Nepgjaeg.exe
File created	C:\Windows\SysWOW64\Pkaiqf32.exe	Pcjapi32.exe
File opened for modification	C:\Windows\SysWOW64\Anpncp32.exe	Ajdbcano.exe
File created	C:\Windows\SysWOW64\Bblckl32.exe	Bhfonc32.exe
File created	C:\Windows\SysWOW64\Fjbnapki.dll	Pfhfan32.exe
File opened for modification	C:\Windows\SysWOW64\Bnbmefbg.exe	Bfkedibe.exe
File created	C:\Windows\SysWOW64\Hfcicmqp.exe	Hbgmcnhf.exe
File created	C:\Windows\SysWOW64\Gfhkicbi.dll	Mdhdajea.exe
File created	C:\Windows\SysWOW64\Lcpllo32.exe	Laopdgcg.exe
File created	C:\Windows\SysWOW64\Dajbcgdm.dll	Baocghgi.exe
File created	C:\Windows\SysWOW64\Phaedfje.dll	Jpgmha32.exe
File created	C:\Windows\SysWOW64\Oneklm32.exe	Ofnckp32.exe
File opened for modification	C:\Windows\SysWOW64\Gcpapkgp.exe	Fmficqpc.exe
File opened for modification	C:\Windows\SysWOW64\Kdgljmcd.exe	Klqcioba.exe
File created	C:\Windows\SysWOW64\Gnpllc32.dll	Njefqo32.exe
File created	C:\Windows\SysWOW64\Adgbpc32.exe	Ampkof32.exe
File created	C:\Windows\SysWOW64\Pohdbiic.dll	Odnnnnfe.exe
File opened for modification	C:\Windows\SysWOW64\Pqnaim32.exe	Pnpemb32.exe
File created	C:\Windows\SysWOW64\Lpqiemge.exe	Lmbmibhb.exe
File opened for modification	C:\Windows\SysWOW64\Dhmgki32.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Mngoghpn.dll	Gmaioo32.exe
File created	C:\Windows\SysWOW64\Qcepkg32.exe	Pagdol32.exe
File opened for modification	C:\Windows\SysWOW64\Fakdpb32.exe	Fkalchij.exe
File created	C:\Windows\SysWOW64\Liddbc32.exe	Lffhfh32.exe
File created	C:\Windows\SysWOW64\Abkjdnoa.exe	Anpncp32.exe
File created	C:\Windows\SysWOW64\Bganhm32.exe	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Gohibf32.dll	Cklaknjd.exe
File created	C:\Windows\SysWOW64\Fhqcam32.exe	Febgea32.exe
File created	C:\Windows\SysWOW64\Dhkjej32.exe	Daqbip32.exe
File opened for modification	C:\Windows\SysWOW64\Nnhfee32.exe	Mgnnhk32.exe
File opened for modification	C:\Windows\SysWOW64\Okolkg32.exe	Ocgdji32.exe
File created	C:\Windows\SysWOW64\Hfbcpl32.dll	Cecbmf32.exe
File opened for modification	C:\Windows\SysWOW64\Ehedfo32.exe	Echknh32.exe
File opened for modification	C:\Windows\SysWOW64\Ogifjcdp.exe	Odkjng32.exe
File opened for modification	C:\Windows\SysWOW64\Anogiicl.exe	Ajckij32.exe
File created	C:\Windows\SysWOW64\Ipkobd32.dll	Njacpf32.exe
File created	C:\Windows\SysWOW64\Gfogkano.dll	Ojjffddl.exe
File created	C:\Windows\SysWOW64\Dalchnkg.dll	Onklabip.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
14304	14144	WerFault.exe	700

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndcdmikd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Joamagmq.dll"	Kmlnbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oboaabga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qloebdig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbifelba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cilkoi32.dll"	Cbqlfkmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gcojed32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gppekj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndkahnhh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnqbanmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qchmagie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhgaocmg.dll"	Kefkme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpckhigh.dll"	Gjjjle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfankifm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngbpidjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eemnjbaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbglkbhg.dll"	Ffddka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkfoeega.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnjlpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Menjdbgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chmhoe32.dll"	Oneklm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmaioo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfdjmlhn.dll"	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpenfjad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ceipnc32.dll"	Qjpiha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcmgfbhd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmdedo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bkidenlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiojlkkj.dll"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iidipnal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kknafn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlklhm32.dll"	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcbldglg.dll"	Demecd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejckel32.dll"	Jlnnmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kefkme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggcjqj32.dll"	Jbfpobpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcfmgfde.dll"	Ddbbeade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgnkd32.dll"	Nnneknob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcgdbi32.dll"	Gcagkdba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfkfpo32.dll"	Lbjlfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idodkeom.dll"	Mnebeogl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmfbjnbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciglpe32.dll"	Hobkfd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fhemmlhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mipcob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpoefk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmlhii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chpada32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlbgha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kibpam32.dll"	Fjepaecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nljofl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocgdji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eapedd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohfjnoma.dll"	Iblfnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inpocg32.dll"	Kmkfhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipkobd32.dll"	Njacpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbhkac32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 1404	4100	9ec4eb51c3e41346ab7a355e2eefcefef4f3c6d0960f4046244ff8444157402f.exe	90
PID 4100 wrote to memory of 1404	4100	9ec4eb51c3e41346ab7a355e2eefcefef4f3c6d0960f4046244ff8444157402f.exe	90
PID 4100 wrote to memory of 1404	4100	9ec4eb51c3e41346ab7a355e2eefcefef4f3c6d0960f4046244ff8444157402f.exe	90
PID 1404 wrote to memory of 432	1404	Fqmlhpla.exe	91
PID 1404 wrote to memory of 432	1404	Fqmlhpla.exe	91
PID 1404 wrote to memory of 432	1404	Fqmlhpla.exe	91
PID 432 wrote to memory of 228	432	Fckhdk32.exe	92
PID 432 wrote to memory of 228	432	Fckhdk32.exe	92
PID 432 wrote to memory of 228	432	Fckhdk32.exe	92
PID 228 wrote to memory of 1476	228	Fbnhphbp.exe	93
PID 228 wrote to memory of 1476	228	Fbnhphbp.exe	93
PID 228 wrote to memory of 1476	228	Fbnhphbp.exe	93
PID 1476 wrote to memory of 2568	1476	Fjepaecb.exe	94
PID 1476 wrote to memory of 2568	1476	Fjepaecb.exe	94
PID 1476 wrote to memory of 2568	1476	Fjepaecb.exe	94
PID 2568 wrote to memory of 2920	2568	Fmclmabe.exe	95
PID 2568 wrote to memory of 2920	2568	Fmclmabe.exe	95
PID 2568 wrote to memory of 2920	2568	Fmclmabe.exe	95
PID 2920 wrote to memory of 3528	2920	Fobiilai.exe	96
PID 2920 wrote to memory of 3528	2920	Fobiilai.exe	96
PID 2920 wrote to memory of 3528	2920	Fobiilai.exe	96
PID 3528 wrote to memory of 3984	3528	Fbqefhpm.exe	97
PID 3528 wrote to memory of 3984	3528	Fbqefhpm.exe	97
PID 3528 wrote to memory of 3984	3528	Fbqefhpm.exe	97
PID 3984 wrote to memory of 736	3984	Fjhmgeao.exe	98
PID 3984 wrote to memory of 736	3984	Fjhmgeao.exe	98
PID 3984 wrote to memory of 736	3984	Fjhmgeao.exe	98
PID 736 wrote to memory of 2316	736	Fmficqpc.exe	99
PID 736 wrote to memory of 2316	736	Fmficqpc.exe	99
PID 736 wrote to memory of 2316	736	Fmficqpc.exe	99
PID 2316 wrote to memory of 1676	2316	Gcpapkgp.exe	100
PID 2316 wrote to memory of 1676	2316	Gcpapkgp.exe	100
PID 2316 wrote to memory of 1676	2316	Gcpapkgp.exe	100
PID 1676 wrote to memory of 4256	1676	Gjjjle32.exe	101
PID 1676 wrote to memory of 4256	1676	Gjjjle32.exe	101
PID 1676 wrote to memory of 4256	1676	Gjjjle32.exe	101
PID 4256 wrote to memory of 1960	4256	Gmhfhp32.exe	102
PID 4256 wrote to memory of 1960	4256	Gmhfhp32.exe	102
PID 4256 wrote to memory of 1960	4256	Gmhfhp32.exe	102
PID 1960 wrote to memory of 528	1960	Gidphq32.exe	103
PID 1960 wrote to memory of 528	1960	Gidphq32.exe	103
PID 1960 wrote to memory of 528	1960	Gidphq32.exe	103
PID 528 wrote to memory of 3664	528	Gqkhjn32.exe	104
PID 528 wrote to memory of 3664	528	Gqkhjn32.exe	104
PID 528 wrote to memory of 3664	528	Gqkhjn32.exe	104
PID 3664 wrote to memory of 1856	3664	Gbldaffp.exe	105
PID 3664 wrote to memory of 1856	3664	Gbldaffp.exe	105
PID 3664 wrote to memory of 1856	3664	Gbldaffp.exe	105
PID 1856 wrote to memory of 2156	1856	Gmaioo32.exe	106
PID 1856 wrote to memory of 2156	1856	Gmaioo32.exe	106
PID 1856 wrote to memory of 2156	1856	Gmaioo32.exe	106
PID 2156 wrote to memory of 4180	2156	Gppekj32.exe	107
PID 2156 wrote to memory of 4180	2156	Gppekj32.exe	107
PID 2156 wrote to memory of 4180	2156	Gppekj32.exe	107
PID 4180 wrote to memory of 1816	4180	Hboagf32.exe	108
PID 4180 wrote to memory of 1816	4180	Hboagf32.exe	108
PID 4180 wrote to memory of 1816	4180	Hboagf32.exe	108
PID 1816 wrote to memory of 4436	1816	Hmdedo32.exe	109
PID 1816 wrote to memory of 4436	1816	Hmdedo32.exe	109
PID 1816 wrote to memory of 4436	1816	Hmdedo32.exe	109
PID 4436 wrote to memory of 3504	4436	Hpbaqj32.exe	110
PID 4436 wrote to memory of 3504	4436	Hpbaqj32.exe	110
PID 4436 wrote to memory of 3504	4436	Hpbaqj32.exe	110
PID 3504 wrote to memory of 3180	3504	Hcnnaikp.exe	111

C:\Users\Admin\AppData\Local\Temp\9ec4eb51c3e41346ab7a355e2eefcefef4f3c6d0960f4046244ff8444157402f.exe
"C:\Users\Admin\AppData\Local\Temp\9ec4eb51c3e41346ab7a355e2eefcefef4f3c6d0960f4046244ff8444157402f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\SysWOW64\Fqmlhpla.exe
  C:\Windows\system32\Fqmlhpla.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\Fckhdk32.exe
    C:\Windows\system32\Fckhdk32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\SysWOW64\Fbnhphbp.exe
      C:\Windows\system32\Fbnhphbp.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:228
    - - C:\Windows\SysWOW64\Fjepaecb.exe
        
        C:\Windows\system32\Fjepaecb.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1476
      - C:\Windows\SysWOW64\Fmclmabe.exe
        
        C:\Windows\system32\Fmclmabe.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3984
        
        C:\Windows\SysWOW64\Fmficqpc.exe
        
        C:\Windows\system32\Fmficqpc.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:736
        
        C:\Windows\SysWOW64\Gcpapkgp.exe
        
        C:\Windows\system32\Gcpapkgp.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1960
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:528
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3664
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\SysWOW64\Hpbaqj32.exe
        
        C:\Windows\system32\Hpbaqj32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        23⤵
        Executes dropped EXE
        
        PID:3180
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3432
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:668
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        26⤵
        Executes dropped EXE
        
        PID:3968
        
        C:\Windows\SysWOW64\Himcoo32.exe
        
        C:\Windows\system32\Himcoo32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1320
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        28⤵
        Executes dropped EXE
        
        PID:1440
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        29⤵
        Executes dropped EXE
        
        PID:4380
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4540
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        31⤵
        Executes dropped EXE
        
        PID:212
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        32⤵
        Executes dropped EXE
        
        PID:2128
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        33⤵
        Executes dropped EXE
        
        PID:544
        
        C:\Windows\SysWOW64\Ipldfi32.exe
        
        C:\Windows\system32\Ipldfi32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3764
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        35⤵
        Executes dropped EXE
        
        PID:4596
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4004
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        37⤵
        Executes dropped EXE
        
        PID:4356
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        38⤵
        Executes dropped EXE
        
        PID:4060
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        39⤵
        Executes dropped EXE
        
        PID:3212
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3348
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2028
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        42⤵
        Executes dropped EXE
        
        PID:2904
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        43⤵
        Executes dropped EXE
        
        PID:3100
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        44⤵
        Executes dropped EXE
        
        PID:3992
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        45⤵
        Executes dropped EXE
        
        PID:1392
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        46⤵
        Executes dropped EXE
        
        PID:2964
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        47⤵
        Executes dropped EXE
        
        PID:2444
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2200
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        49⤵
        Executes dropped EXE
        
        PID:916
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        50⤵
        Executes dropped EXE
        
        PID:4904
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        51⤵
        Executes dropped EXE
        
        PID:4428
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        52⤵
        Executes dropped EXE
        
        PID:1684
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5044
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        54⤵
        Executes dropped EXE
        
        PID:2068
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2324
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        56⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        57⤵
        Executes dropped EXE
        
        PID:2700
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        58⤵
        Executes dropped EXE
        
        PID:3316
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        59⤵
        Executes dropped EXE
        
        PID:2344
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        60⤵
        Executes dropped EXE
        
        PID:4224
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        61⤵
        Executes dropped EXE
        
        PID:1008
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        62⤵
        Executes dropped EXE
        
        PID:368
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        63⤵
        Executes dropped EXE
        
        PID:1644
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        64⤵
        Executes dropped EXE
        
        PID:3600
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        65⤵
        Executes dropped EXE
        
        PID:1744
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        66⤵
        Executes dropped EXE
        
        PID:2996
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        67⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        68⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        69⤵
        
        PID:1220
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4440
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        71⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        72⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        73⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        74⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        75⤵
        Modifies registry class
        
        PID:3440
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        76⤵
        Modifies registry class
        
        PID:4188
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        77⤵
        
        PID:996
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        78⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        79⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        80⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        81⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        82⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        83⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        84⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        85⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        86⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        87⤵
        Drops file in System32 directory
        
        PID:5504
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        88⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        89⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        90⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        91⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        92⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        93⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        94⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        95⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5896
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        97⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        98⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6024
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        100⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        101⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        102⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        103⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5128
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5232
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        106⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        107⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        108⤵
        Drops file in System32 directory
        
        PID:5440
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        109⤵
        Drops file in System32 directory
        
        PID:5528
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        110⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        111⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5912
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        113⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        114⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        115⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        116⤵
        Drops file in System32 directory
        
        PID:5200
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        117⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        118⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        119⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        120⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        121⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        122⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        123⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        124⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        125⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6084
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        126⤵
        Modifies registry class
        
        PID:5136
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5296
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        128⤵
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        129⤵
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        130⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        131⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        132⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        133⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        134⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        135⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        136⤵
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        137⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        138⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1208
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        140⤵
        Drops file in System32 directory
        
        PID:5704
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        141⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        142⤵
        Drops file in System32 directory
        
        PID:5604
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        143⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        144⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        145⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        146⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        147⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        148⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        149⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        150⤵
        Drops file in System32 directory
        
        PID:6484
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        151⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6580
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6616
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6664
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        155⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        156⤵
        Drops file in System32 directory
        
        PID:6756
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        157⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        158⤵
        Drops file in System32 directory
        
        PID:6840
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        159⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        160⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        161⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        162⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7048
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        164⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        165⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        166⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        167⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        168⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        169⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        170⤵
        Drops file in System32 directory
        
        PID:6444
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        171⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        172⤵
        Modifies registry class
        
        PID:6556
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        173⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        174⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        175⤵
        Modifies registry class
        
        PID:6752
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        176⤵
        Modifies registry class
        
        PID:6836
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        177⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        178⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        179⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        180⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        181⤵
        Drops file in System32 directory
        
        PID:1916
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6164
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        183⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        184⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        185⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        186⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        187⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        188⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6832
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        190⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        191⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        192⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        193⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        194⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        195⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        196⤵
        Drops file in System32 directory
        
        PID:6684
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        197⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        198⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7140
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6256
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6472
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        202⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        203⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6340
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        205⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        206⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        207⤵
        Modifies registry class
        
        PID:6748
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        208⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        209⤵
        Drops file in System32 directory
        
        PID:7204
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        210⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7288
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        212⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        213⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        214⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        215⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        216⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        217⤵
        Modifies registry class
        
        PID:7536
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        218⤵
        Modifies registry class
        
        PID:7576
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        219⤵
        Drops file in System32 directory
        
        PID:7616
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        220⤵
        Drops file in System32 directory
        
        PID:7656
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        221⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        222⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        223⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        224⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7816
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        225⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7904
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        227⤵
        Drops file in System32 directory
        
        PID:7944
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        228⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        229⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        230⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        231⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        232⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        233⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        234⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        235⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        236⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        237⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        238⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        239⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        240⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        241⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        242⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        243⤵
        Modifies registry class
        
        PID:7804
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        244⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        245⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        246⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        247⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        248⤵
        Modifies registry class
        
        PID:8156
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        249⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        250⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        251⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        252⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        253⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        254⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        255⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        256⤵
        Drops file in System32 directory
        
        PID:8100
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7240
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        258⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        259⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        260⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        261⤵
        Modifies registry class
        
        PID:7188
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        262⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        263⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        264⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7520
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        266⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        267⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        268⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        269⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        270⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        271⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        272⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        273⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        274⤵
        Drops file in System32 directory
        
        PID:8520
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        275⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        276⤵
        Drops file in System32 directory
        
        PID:8612
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        277⤵
        Modifies registry class
        
        PID:8648
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        278⤵
        Drops file in System32 directory
        
        PID:8688
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        279⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        280⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        281⤵
        Modifies registry class
        
        PID:8824
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8868
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        283⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8960
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        285⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        286⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        287⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        288⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        289⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        290⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        291⤵
        Modifies registry class
        
        PID:8252
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        292⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        293⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        294⤵
        Modifies registry class
        
        PID:8528
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        295⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        296⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        297⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        298⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        299⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        300⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9040
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        302⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        303⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        304⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        305⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        306⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        307⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        308⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        309⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        310⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        311⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        312⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        313⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        314⤵
        Modifies registry class
        
        PID:8628
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        315⤵
        Modifies registry class
        
        PID:8832
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        316⤵
        Modifies registry class
        
        PID:9000
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        317⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        318⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8800
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        320⤵
        Drops file in System32 directory
        
        PID:8240
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        321⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        322⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        323⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9088
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        325⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        326⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        327⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9320
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        329⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        330⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        331⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        332⤵
        Drops file in System32 directory
        
        PID:9496
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        333⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        334⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        335⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        336⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        337⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        338⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9788
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        340⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        341⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        342⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        343⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        344⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        345⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        346⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        347⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        348⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        349⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        350⤵
        Drops file in System32 directory
        
        PID:9248
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9300
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        352⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9420
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        354⤵
        Modifies registry class
        
        PID:9492
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        355⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        356⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        357⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        358⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        359⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        360⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        361⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        362⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        363⤵
        Modifies registry class
        
        PID:10108
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        364⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        365⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        366⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9444
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        368⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        369⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        370⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9860
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        372⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        373⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        374⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        375⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        376⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        377⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        378⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        379⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        380⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        381⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        382⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        383⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9480
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        385⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        386⤵
        Modifies registry class
        
        PID:9488
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        387⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        388⤵
        Modifies registry class
        
        PID:10248
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10292
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        390⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        391⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        392⤵
        Modifies registry class
        
        PID:10412
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        393⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        394⤵
        Drops file in System32 directory
        
        PID:10496
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        395⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        396⤵
        Modifies registry class
        
        PID:10576
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        397⤵
        Drops file in System32 directory
        
        PID:10624
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        398⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        399⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        400⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        401⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        402⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10868
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        404⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        405⤵
        Drops file in System32 directory
        
        PID:10960
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        406⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        407⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        408⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        409⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        410⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        411⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        412⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        413⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10340
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        415⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        416⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        417⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        418⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        419⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10732
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        421⤵
        Modifies registry class
        
        PID:10812
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        422⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        423⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        424⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        425⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        426⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        427⤵
        Drops file in System32 directory
        
        PID:11232
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        428⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        429⤵
        Drops file in System32 directory
        
        PID:10400
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        430⤵
        Drops file in System32 directory
        
        PID:10528
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        431⤵
        Modifies registry class
        
        PID:10656
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        432⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        433⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        434⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        435⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        436⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        437⤵
        Modifies registry class
        
        PID:10352
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        438⤵
        Modifies registry class
        
        PID:10620
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        439⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        440⤵
        Drops file in System32 directory
        
        PID:11108
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        441⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9724
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        442⤵
        Modifies registry class
        
        PID:10608
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        443⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        444⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        445⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        446⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10392
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        447⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        448⤵
        Modifies registry class
        
        PID:11276
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        449⤵
        Modifies registry class
        
        PID:11312
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        450⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        451⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        452⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        453⤵
        Modifies registry class
        
        PID:11476
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        454⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        455⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        456⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        457⤵
        Modifies registry class
        
        PID:11644
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        458⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        459⤵
        
        PID:11732
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        460⤵
        
        PID:11776
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        461⤵
        Drops file in System32 directory
        
        PID:11816
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        462⤵
        Modifies registry class
        
        PID:11860
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        463⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11904
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        464⤵
        Drops file in System32 directory
        
        PID:11940
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        465⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        466⤵
        
        PID:12032
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12076
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        468⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        469⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        470⤵
        Drops file in System32 directory
        
        PID:12196
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        471⤵
        Modifies registry class
        
        PID:12236
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        472⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        473⤵
        Modifies registry class
        
        PID:11300
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        474⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        475⤵
        
        PID:11472
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        476⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        477⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        478⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11712
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        479⤵
        Drops file in System32 directory
        
        PID:11812
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        480⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        481⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        482⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        483⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        484⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        485⤵
        
        PID:12284
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        486⤵
        Drops file in System32 directory
        
        PID:11348
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        487⤵
        Drops file in System32 directory
        
        PID:11488
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        488⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        489⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        490⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        491⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        492⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        493⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        494⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        495⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        496⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12264
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        497⤵
        
        PID:11384
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        498⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        499⤵
        Modifies registry class
        
        PID:10788
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        500⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        501⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        502⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        503⤵
        
        PID:12372
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        504⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12420
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        505⤵
        
        PID:12464
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        506⤵
        
        PID:12508
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        507⤵
        
        PID:12552
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        508⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12592
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        509⤵
        
        PID:12628
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        510⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        511⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        512⤵
        Drops file in System32 directory
        
        PID:12756
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        513⤵
        
        PID:12792
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        514⤵
        
        PID:12832
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        515⤵
        Drops file in System32 directory
        
        PID:12872
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        516⤵
        
        PID:12912
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        517⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        518⤵
        Modifies registry class
        
        PID:12984
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        519⤵
        
        PID:13024
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        520⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        521⤵
        Drops file in System32 directory
        
        PID:13096
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        522⤵
        Modifies registry class
        
        PID:13132
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        523⤵
        
        PID:13168
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        524⤵
        
        PID:13204
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        525⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13240
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        526⤵
        
        PID:13276
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        527⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        528⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12336
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        529⤵
        
        PID:12404
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        530⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        531⤵
        
        PID:12520
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        532⤵
        
        PID:12584
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        533⤵
        
        PID:12656
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        534⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        535⤵
        Drops file in System32 directory
        
        PID:12744
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        536⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12820
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        537⤵
        Modifies registry class
        
        PID:12880
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        538⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        539⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        540⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13092
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        541⤵
        
        PID:13124
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        542⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        543⤵
        
        PID:13268
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        544⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        545⤵
        
        PID:12428
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        546⤵
        
        PID:12532
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        547⤵
        
        PID:12612
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        548⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12736
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        549⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        550⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12980
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        551⤵
        Drops file in System32 directory
        
        PID:13116
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        552⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        553⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12300
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        554⤵
        
        PID:12500
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        555⤵
        
        PID:12704
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        556⤵
        
        PID:12956
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        557⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        558⤵
        
        PID:12368
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        559⤵
        
        PID:12740
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        560⤵
        Modifies registry class
        
        PID:13068
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        561⤵
        
        PID:12636
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        562⤵
        
        PID:12856
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        563⤵
        
        PID:12868
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        564⤵
        
        PID:13324
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        565⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13360
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        566⤵
        
        PID:13400
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        567⤵
        
        PID:13436
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        568⤵
        
        PID:13472
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        569⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13508
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        570⤵
        
        PID:13544
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        571⤵
        
        PID:13580
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        572⤵
        
        PID:13616
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        573⤵
        Modifies registry class
        
        PID:13652
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        574⤵
        
        PID:13688
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        575⤵
        
        PID:13724
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        576⤵
        
        PID:13760
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        577⤵
        
        PID:13796
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        578⤵
        
        PID:13832
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        579⤵
        
        PID:13868
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        580⤵
        
        PID:13908
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        581⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13944
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        582⤵
        
        PID:13992
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        583⤵
        
        PID:14028
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        584⤵
        
        PID:14064
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        585⤵
        Drops file in System32 directory
        
        PID:14100
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        586⤵
        
        PID:14136
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        587⤵
        
        PID:14172
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        588⤵
        
        PID:14208
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        589⤵
        
        PID:14244
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        590⤵
        
        PID:14280
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        591⤵
        
        PID:14316
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        592⤵
        
        PID:13384
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        593⤵
        
        PID:13464
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        594⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:13532
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        595⤵
        
        PID:13604
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        596⤵
        
        PID:13660
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        597⤵
        Drops file in System32 directory
        
        PID:13716
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        598⤵
        
        PID:13788
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        599⤵
        
        PID:13852
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        600⤵
        Drops file in System32 directory
        
        PID:13932
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        601⤵
        
        PID:14000
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        602⤵
        
        PID:14088
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        603⤵
        
        PID:14144
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14144 -s 396
        604⤵
        Program crash
        
        PID:14304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 14144 -ip 14144
1⤵
PID:14252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bapiabak.exe

Filesize
52KB

MD5
74dc33781f8bbf9f1a3bddd89ba3ff11

SHA1
f2710a570e98fd2306b4daee93bd0f18b4536712

SHA256
ed57b3edf39426e97a3bbf26bd55b7b5cb4234e7d5288397e4d9043feb50fdc6

SHA512
4d2f98155d4682f82df524f51e8a3872cb9822f01769bb2c6a4ff6dcbaf008b92ecfcb259aae28ac266949f8f50d3590d3e3a84f9599122d799a7aecf627271e

Download Submit
C:\Windows\SysWOW64\Bcebhoii.exe

Filesize
52KB

MD5
186b4b502b1d59c74d6112018b2b2a78

SHA1
9d7dd489ca896e3ee2db288d9bebd3e436ae3c2a

SHA256
ad7a1d92208080404295700c4d937961ea64d2405099e1bacaab170932417a17

SHA512
4aa9b9293a990345469c5b817ef28c89bd7c1a96aaf47cd226bdeb7eb07efa34005c770995cbd9d083014b6634d90fb41b0579206f4a80362833921d133924fc

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
52KB

MD5
84c392a2a1f01b5d1d3f3aaba75d6ce8

SHA1
368209fd8a39a76bc143d5c3046fb6166a8d5022

SHA256
130e71526c0404edc665af86bbb76b9c73ba57cef912510f9c8f9df11c8ed7f4

SHA512
da2247d093caec0915c8f62ceb8524b0ef50115d510ebc78c3a99e1d30028c4cddc36bd4848bf74e08ecababfd22e8974920af088364d714b79192ad742df381

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
52KB

MD5
ec0f6b1c973338c78253cfa375eb50f0

SHA1
aed8ee77a859fdb562d9a24a9a05e9a75a38b358

SHA256
bb8eca85cc8369888b528d9aa9022cc65d4746dead2ba2ed142b70b184d52de7

SHA512
88a63889d771b17e0de8f2171a32d7d228ebd55163491425b557a67fb7da17d3a3835293870a4966d70c0fb0cd7fa47d48e798602ddbabd805457517c2138759

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
52KB

MD5
8de7640f17501bf580a59a4eb6c9d91d

SHA1
338c168b3e49a1a988f9ce4637003e7911907bfa

SHA256
4c866ce4ab67687fe1046bffafa235330d3b9af0aeff85f966dbd437174d171e

SHA512
ba195853b5782a40b53c4173ff78ee3a6f863dea7c0acd920aeaf90778f90772203ce9ee449cad0f689a77ae62ae4193a0225ecbf88903a6a62fa699c4024b21

Download Submit
C:\Windows\SysWOW64\Cnkplejl.exe

Filesize
52KB

MD5
14821890b102e154359e9d14c6034126

SHA1
6b28a7fdbe9d5437d34c2afcc388dcfd252387e4

SHA256
50dddc513827f22b7028a0c7dbc33e6812e738baa5896423468303fb43dcf74c

SHA512
ff8d3634b2a69e7185a3842ccffa588d6b55e72962105b0e615d18e2c74f0df788bb40206131eaa36291f9703999d9e79b0ea55c6d2f0f9e36bdb5f2064a18aa

Download Submit
C:\Windows\SysWOW64\Dekhneap.exe

Filesize
52KB

MD5
9aa98d7b413b2bde0a76efcc49bccb26

SHA1
34c49912d5deba76e5633b5d6621fce70e817c37

SHA256
6692a3d3f377b20a33bb645d2edaf21c75410a078907e9ac650c4584ae0259a4

SHA512
eafa23ce7015578725131c0df6838ef2eec406f09454c981459f957486134cb072cf7677763ffefe37ade372cd1e8c906fca024afbc9e3e1793f0366285adb1c

Download Submit
C:\Windows\SysWOW64\Dodbbdbb.exe

Filesize
52KB

MD5
d0a94f048e1240190774b3630db80a31

SHA1
4a27499239040849c1fe0ffc3af72ff799bff566

SHA256
6993757625fcfef4687b1d2161a14c51a67984114eb7f4355baa0c1983ccc600

SHA512
a7261f19a416475ea4822f5c5c27b194ccd6f59c7f237e361ceeca8915fb2ac8b7d8a9fe7d5a32602fe16b00cdd7062ab701a0c065600689e0610eb0775c9a71

Download Submit
C:\Windows\SysWOW64\Fbnhphbp.exe

Filesize
52KB

MD5
03314aaa9378fe97d75c02d2b7699559

SHA1
b4bc0c10111c77a0ceca2a679a3116576eaf61ac

SHA256
a6127f3a3391b44492013976cf4aad58161aa698830c07458a5abb73c2dadbb4

SHA512
0f5f8a8486eef5a17f3140586d21668491e2745ec41dbc73c939d377ced59142341b153d5c058275315d0be5621e5a48accb13cbc631e6c855b7c279a00e02eb

Download Submit
C:\Windows\SysWOW64\Fbqefhpm.exe

Filesize
52KB

MD5
b9ca755d18599cbdd7de952887ac3581

SHA1
f6c8f3b01a53731373c4c17abecc7161c0a4fe7a

SHA256
4e1ee640336f2bc9111c82c55a869c13105b5ab84df3cc2c5809e093624f8050

SHA512
d942bb6b3915971f3790f6a42ed68b16108c1b0aeaf7e682dbfafbf361d076be28e06505cce803151e619ba2783d475651face989f7e6b50efd9776a2cc05d68

Download Submit
C:\Windows\SysWOW64\Fckhdk32.exe

Filesize
52KB

MD5
24b65e7c3f7387a8ddcae66e0aa83904

SHA1
a507e8d264998c577b52af24e8941ace6a4bfabd

SHA256
c783e8a952c00a6d2b413f5297d0c99b7d50f7a4b8c9c0d934ca17f414da5cb3

SHA512
0542ac64d9d40e9930724fd3e906f0147676437b790973ab75e49e3c1fb8a688504c1298985a6db7fef06216c38655fbfef72a76378f4e7695c21b5792ba9082

Download Submit
C:\Windows\SysWOW64\Fjepaecb.exe

Filesize
52KB

MD5
95b30e0e27c838ed9d875979da9daea9

SHA1
43406f56a9e54d3dc9044d0abd0a2e84c3a0623e

SHA256
693a8fc88a8d2c1716a0f46e9f945fb596649ddef333e402fc68da3c71851012

SHA512
80cf3261cb07dc741fbdacd735a1c94674c73de89743e8f662f671091b1a921d2fb3b2933b6bf713210ce068edd0db119859d19a69a6007ab12a4e6ea1dbea1b

Download Submit
C:\Windows\SysWOW64\Fjhmgeao.exe

Filesize
52KB

MD5
b572c7f6e142be5d433f156b7ece1401

SHA1
efd870b29f2a463a4c5b91c3fedfed437454304a

SHA256
3f0229465700a2974c08124a3e4cb5393095f9a6ad157829f86dc38310d4dbed

SHA512
663b6f3e1e835a9bfdb57642c3c3c215bad3219c06b57ed3de5a19ec0238eb6bba5842d3ba8ed9beaa90c905e4f025dce0290ee29610a18430876a2fd883425d

Download Submit
C:\Windows\SysWOW64\Fmclmabe.exe

Filesize
52KB

MD5
1c8c56663bfcdf684877413a05fa2e04

SHA1
890707b78f00f110566a49205013507f59add595

SHA256
feb696ff4c1379043036ea5ce81a3b0e10ca7ce02e4468d2a3bdf0cc3692ea3e

SHA512
ce91597a39e6ed5136528f14838d89d7c1b931412766602657c581cd5e79fe6d3ad2d8a5e14e9f7908dbb390041fb3375f7829669a5006580aaea8f587e4926c

Download Submit
C:\Windows\SysWOW64\Fmficqpc.exe

Filesize
52KB

MD5
8cc8f9b1e21a0be18f8a871550c8cb78

SHA1
6e1958ce1fc2942236c336de0c67d01cfdbd34d8

SHA256
75c798dcc5976d7b44b11fc9fc1f8f9d7d2ad34267572100b17b12fe164890a5

SHA512
4d7d980ecae643750d9565fbdc5d1bf8d7b8290ee12896ac21d8ec26dbf009c250a6f50f973789b0f4e1022c466af222b229cb1df21c36a7bf19781de0f83d8c

Download Submit
C:\Windows\SysWOW64\Fobiilai.exe

Filesize
52KB

MD5
1acf1309f8c9eda61782d235231376f0

SHA1
292f180c996f78eb0cc62e9b9bb29d355f347f95

SHA256
37ea20f01649ea563137aa2faed29468cf44b4171eefe085b2ccca075cccabcb

SHA512
0001c095a23ac74799f634d3b0af0e25894fb3f6167bd0afd159eba8f0f4ee5daf867138824d882c85e568f91fcd1f044bf7f385fc69546d7bb1295703cd00fc

Download Submit
C:\Windows\SysWOW64\Fqmlhpla.exe

Filesize
52KB

MD5
4f17aca0b0925c80d018040bf66f0e4b

SHA1
ad6a7865227d9bf953bf6e576dc47ab8ff0affca

SHA256
bcd983110c60412aaf0acb8f4d0fc817e67cbd711dd9b86b37c07c9a3e18dd90

SHA512
a5728c4ecdb6809ae42bd18c4b975c1bddae8a5216e309e1a761440b0b9f415a6de2d709c006ef73b38c445d2ca17cf721777a873d4a7afbb27dac4077fcf953

Download Submit
C:\Windows\SysWOW64\Gbldaffp.exe

Filesize
52KB

MD5
1a8718418bce83ec6b82d440912de93c

SHA1
d2e9462417cd44f5c2da30affede300ec74a8d9f

SHA256
8a547f27a9433f4539d84f69ee02380d6e1c1201d8fa7aaf324b2dc07a988ff1

SHA512
5b071253a54e7033066862d6fa79a93684dbf9efc7ac15feceed632638e3f4d50c808cc0f37983e12d35f0fa2ade101a461df8abf74db3936c19f253b6e34147

Download Submit
C:\Windows\SysWOW64\Gcpapkgp.exe

Filesize
52KB

MD5
f5a6fe282777915a14ab2dc30d527afc

SHA1
87962c4eb3cceaddba04a9ceb6acf380db17526c

SHA256
1538bd04c1342ebc36f7507393fd091b2ee37e1ba6e6ef289e1b51e8838d2dff

SHA512
5e365c20e19712bbc4f273d7c299f4118d81ddd03f6fa09155bcb950de31475d8e43ba1c083c4ae5776c98d0967822c1cadbc6fa65ac1383b8e2b4a2b61af8d4

Download Submit
C:\Windows\SysWOW64\Gidphq32.exe

Filesize
52KB

MD5
407fa893b4f4475ac949ed71ef101b1d

SHA1
cff456f45f6d42ca6d53d179f12558b61f8f5335

SHA256
b6c55f6fa119dae5cc227e9a7377873ebd7a25a121d169cbf1fa379ea3dafa69

SHA512
15376a4e13a000f844f34121afc50ad244b54bb14694e2ef65be2a4e59faa5d1983dd764fd19d393263b76d44448a40e4aeb65f0ed1360d4020708690a75d9cd

Download Submit
C:\Windows\SysWOW64\Gjjjle32.exe

Filesize
52KB

MD5
2a62a7ab869dbc26c683fa74c325c058

SHA1
8ccdbbe6a2e58efcf9e510b97bdbac1c953f2136

SHA256
b2d9eeed6a9c079314301d88196877728b127fc9953bd2418314de34e67d8f5b

SHA512
961f21a603ff726d8c14ee990b2fe667c93becb8e0f6c59762ebc4725a7daf7edc1b887ad4dc9c62b82bb1e28310f0553b20165fdc19619ac12d92c4c14d65bc

Download Submit
C:\Windows\SysWOW64\Gmaioo32.exe

Filesize
52KB

MD5
45a741b673bed9ea5e1a6a73d85fbaa5

SHA1
d62a04f4f1e998c92ff6601b489bcabd3cb680bf

SHA256
62edd70262edc4159cd57902259edb0b95d8e5ec06f6b0db4a06a1e7f6b4e8da

SHA512
92feb788fa6f9c8a60c789d1c8a4d57d418829909f47af9f42bf9838e8a7d9005aa0ed0781a33350a9dd2af76983e0a532ed5936b447c4e4ee1c61bbedae8db8

Download Submit
C:\Windows\SysWOW64\Gmhfhp32.exe

Filesize
52KB

MD5
e4ff474ddedd0c8680417b47c3d78fdd

SHA1
edc40ca2dcc868ff96f90ab3f5ffcd5274687a85

SHA256
b17d5f8381c33e86c75387d013f05246db0414c3f1543a5afa59fae54aed8eea

SHA512
e036fbe47f45c233ac922cdfae05cf5f8b1a05bd576e4e5a45bdf3c6b1e0dc4794fa4c8fa16de6653de005c714390cc459ee116cf89c8920539c7c4bb1001bcf

Download Submit
C:\Windows\SysWOW64\Gppekj32.exe

Filesize
52KB

MD5
bbf33c9d314b84a9178f649fbe17be62

SHA1
80ce29fa3dada2d4554128a135b1f668cee36d11

SHA256
2e958e49d4167bcca7126ee44a3f4dcfd1abd5ab2004a50f3147a8765910d4f8

SHA512
593215efb495ae72d5677f2ffcb986085a5f64f88cc3528e52e9a4a96b25e3b218f19d10e2fc89e3c7ce74e3b38d5f93136a2f2198849662b1fb310916473092

Download Submit
C:\Windows\SysWOW64\Gqkhjn32.exe

Filesize
52KB

MD5
7af42025fa912c9da7ba6ac97a51ff68

SHA1
d82cc426cb4f3511c5575886b8619382e7919739

SHA256
c28dda327fb01c7a29d898407b292dd4cb566307a1a386b377cd1e9882b7f6f0

SHA512
d7de4686dec3b70b5af6f39d7868b81f892a189b86473cb9af64836463391e9d03481224ec64f319729adb9a2de14c35521abf09a10ef3041ed37f290f6ee12b

Download Submit
C:\Windows\SysWOW64\Haggelfd.exe

Filesize
52KB

MD5
8b6db989f0489dbc9b7498c1f125907b

SHA1
7f45543246bb9e5c5301330ddc8d8ae483003035

SHA256
dfbe3d3c4f6ced197abf989f24ab4989d1d32a064050462ba0c443ebe331af41

SHA512
4e26edfa766c95645a8142f0ee9e80094b6d2ff1e0c4683f2553a4ebb518f54a651fd3471e451c9cb03bae97a07aa7cd7f2affe8f5fbab4d0dbfe3abe0a2204f

Download Submit
C:\Windows\SysWOW64\Hbckbepg.exe

Filesize
52KB

MD5
3e4f0dd6d19f0f58e66d2e355e71bae6

SHA1
efb016ab434d64c94332ffa2a6d48d799c9e1ec4

SHA256
690d8ae93c5f0a31457fad67d9d69c2861019855beb388afa080d58d7c45ae7f

SHA512
e36745ecfb9300a352a41824415a1eb050f39aede260f832e46b8277f5fc3d173a5a234bb6aa201b34b2a88709a09764c1fd126f9d2120c212965ee854eaae5b

Download Submit
C:\Windows\SysWOW64\Hbeghene.exe

Filesize
52KB

MD5
cdb47ff168a5b12294c6156a654aa1cd

SHA1
59856c7c666d068ae619549503ccbe78e0b21fe9

SHA256
ea4f2df4c12149ea60b39183e32c98c1eb6b10b0658bd19648eb1c4e263109dd

SHA512
174baa8ecad54de6ff48f4ccd0dc6970a336924f138972d78d34ffcb143420e89becde953888ad7289eae84566b001b65091e9888e80a099deb9dbb77420a87f

Download Submit
C:\Windows\SysWOW64\Hbhdmd32.exe

Filesize
52KB

MD5
2d0a219c088760ea4f69af161757c836

SHA1
9bdccffaf40001c99ebc99c0f7a70eeca16e80de

SHA256
be7cc1155136c49aa8420441bea309964642fe9e31c6e6526eb6d503d8f09443

SHA512
5f64795ef6c461ed09f75587cdd4dd34cce12f256d09a088ecb2f1d408237b889fc5605882b047af7c6d2a0281049328bbc7596a33f7ed71fbfb440b8e0ede2d

Download Submit
C:\Windows\SysWOW64\Hboagf32.exe

Filesize
52KB

MD5
bf7c96b49099534ac6ebe1b12a9289e9

SHA1
8f2abb2377849ab04f14b42560c7c302fc054f8d

SHA256
8381c6a09962120d28aa9c1ad0c9bb579e178c9604d37a7c7a881d37b47fa140

SHA512
cc7c9eb11dbe0941064da403bbc54173cbb63b51c1217ccda16cf417799b0952805be05d6e9cb8abb5b396b573bc25b6e09712e3c3faea54cdff82f91d2f72a5

Download Submit
C:\Windows\SysWOW64\Hcnnaikp.exe

Filesize
52KB

MD5
ced1e0539e1fedb4de5c9a6b109e5490

SHA1
9f716694c50b8549ee472b86cee7f6ac30f34277

SHA256
b3ff2c32767d0f0cfdd913c8bc270d910cc8ef4127f8ac1ed06e620146e0f079

SHA512
7595184303ab6b5b7956f8666932ffd6199bf1d491e713729724258b7e8017dddc8109cc151e78855d79ea098f0c68f2d654d4d1bae1dc6c00df2e0d845576c8

Download Submit
C:\Windows\SysWOW64\Hfqlnm32.exe

Filesize
52KB

MD5
b3105d4648a65d81e70c275cfb8c0a4f

SHA1
a242d982514539e988540be49362fbe9db3edbcc

SHA256
d2b5bd4138057041390dcf3d7fccbaa94a02cf93894f47f74dea8602a6460dd2

SHA512
1ed8183b2c688fdbfdecee371b5f1f317ffd178c717d55a2f28622d4b5043f9b2309ba93819c078ebfea3f6d87d197e3009a78727a820163c54b152adb8ac2cf

Download Submit
C:\Windows\SysWOW64\Himcoo32.exe

Filesize
52KB

MD5
ff1937589faf6b5e91407efe8bd56e80

SHA1
1242be2370d9b648f240934052f286ec3baa9e6d

SHA256
451fa3eefcbb8d28aa574eeff96e456c43799b6fa3ef6947664b4940f0b42b10

SHA512
427527ef154f19264a858a36ed39fb3aa34de7289a0d6c7d7dbb8ca18c81ad0c9e001a5d9513f98633c334a4d890449f3a92486e3e027bdd2b90482a504e8a6c

Download Submit
C:\Windows\SysWOW64\Hjhfnccl.exe

Filesize
52KB

MD5
8a048b0ebff609eff5c99818a714c47c

SHA1
6e9af40fbf7be72a061fb4e2ebb6e729cb6ee87f

SHA256
3fc25b68b3ab54c48d6568c11840472a4d7f53ff12fbfa6ee5840d4582b6bdaf

SHA512
5ba6e95a736e90286d8a42ff9bb9221a914d4eae87739d905a10b99760b555759527b8d7637d5859486b4a2e4f159530a606b71986193b2b0652537a87fe1b45

Download Submit
C:\Windows\SysWOW64\Hjmoibog.exe

Filesize
52KB

MD5
0d27fd5b27f3c1764529dab63c634663

SHA1
364e323bf19565807c38661f2a2d1a774552688d

SHA256
6ab9f07de1325a70386d6033b3841de5efa7e61d3501b41893b17747d2456f4d

SHA512
1b5d82457ad471619ebc226e1a8947a810cbeede4c18cd44704f88eba8191e14bfe56e4e387acc7c34342d48d18cc3ab7b961299e73b84beac0027c5f7bbc1ed

Download Submit
C:\Windows\SysWOW64\Hmdedo32.exe

Filesize
52KB

MD5
d79652a49540f9ec5f50650f61458fd4

SHA1
02def2120254d74de16ee86989ef3592135fe265

SHA256
8c042f5bb57e0f793059a4e9cb0b1660fb738bec2d396d7a3a5ab6a38b68959b

SHA512
f12ea3d358a20d455cb31097645d8c0487fe1390e2561a82940a292ec846f5c726c43629b2e329b813b588353f563b50d1adb9cdbe1257b99b3966293f96f1ec

Download Submit
C:\Windows\SysWOW64\Hmfbjnbp.exe

Filesize
52KB

MD5
c730aaf0a1f5123eb58f3051f66c9dd4

SHA1
13fb62bd3a38d58f7ff4d1f3ad7708cc762034fe

SHA256
e46b207b1de5d8dbfdf6ab1fa258d8a91e8164f05594873ab42de4f7a85c0542

SHA512
779946be134324c40beec106bd3bd591e33d54760802f2041febf1993ef9f3e1158a086dce5a0e42dfc12da12f4b1297c85e35887e3d24f048b489608deb85bb

Download Submit
C:\Windows\SysWOW64\Hoiafcic.exe

Filesize
52KB

MD5
b795143b7d8045d1aaa6e5b7572e9b24

SHA1
00eb0dd338d66683560a4c24d6930ecde369dc30

SHA256
0e1ebde28a3f7a58152c69a5f3c90d68d8fa832e251c300298f53e0fe9848e36

SHA512
578f0fb0233ffe8fca0b66a198b7f0f5567269ddddc882b845981dfa0bf33b7b1b84e990ec28690f0dae439388c3d5f34ef582bbafa9df18ef3b1669c8995c5a

Download Submit
C:\Windows\SysWOW64\Hpbaqj32.exe

Filesize
52KB

MD5
997cab35e3efc4232e0cdf28d08ca905

SHA1
339a2295fc03c2987de0ed88ac9c1a2d1a705f60

SHA256
49715a5a272defa7cd765b54133419f8d7ae463efb7c9f7a540b11db491eff9d

SHA512
63ff5ea128c7524fd528bfcb07db99b78e0a5fe76e9077e731b21ab2dca2451ce28abb73058ef55a2fe3e6c20497e481514e8de2a7c2d2d9839413ce73957a7d

Download Submit
C:\Windows\SysWOW64\Hpenfjad.exe

Filesize
52KB

MD5
8cdc3ab0b14eb67af8eb0b2d04337808

SHA1
d43e770d62070b1104c058500dab557223fba9a0

SHA256
69ec4f008702b0e4e1869c31b6ec310b23c83dedf8343461bf6f5378a3aea841

SHA512
1385915f0dcd7989d8acc2c9b8c8714a607361a9de058cc369419e4897527e4914c9d8c19c416c6b238d0b5e1af9b1d85f6507d1784fab6e35f1d0569b0a322c

Download Submit
C:\Windows\SysWOW64\Hpgkkioa.exe

Filesize
52KB

MD5
97b0487091012a4da6146667e91c6fdd

SHA1
7ddfa9e7ca9c78a6f1b919fa2f60bda9ef161e49

SHA256
d96a79d2f723b288ce3b7ba9eb2ed696ca9bc4031f0759994d009b49642d7327

SHA512
903f8a4de9a44b53d7e7a2218d264a66f0c923a68d596cdec443c3cdc0a72a0e4966dabfa43f7139dcfe370c90d243a60886076ff23b4c2a58559c9c2d582462

Download Submit
C:\Windows\SysWOW64\Hpihai32.exe

Filesize
52KB

MD5
8b505a5a9542e0e992d0aa63bc0b6560

SHA1
c570eb135461904fc41f947577f4a80ecab4d025

SHA256
fea89059249cc271f7d7fa779ab904bdcc7d23ec4dd9a71468189459a6d45c66

SHA512
3bd4c8504057ac322b86151f5d342dbc4cae2295f3779b838cc6b8a0fd1f84321694ea0b85e51564435db400a05788ec15020c1b6a0308e2283fba4cf76510b4

Download Submit
C:\Windows\SysWOW64\Jdhine32.exe

Filesize
52KB

MD5
cecd61e86776278db99143ae5ebd5cda

SHA1
c4af59f1d6debfc7adb7ec83aa7dce53cf22b979

SHA256
490a7b902cdca8437687ee1a2e1ec1fb533e4bebc4d8b7fc8a7c3eb80424e73a

SHA512
d87a0aa5539d44a8af5aadb5ec1dfdf5711c556c1b7340edf102dd9faf3f75a21f7d644ce74bb8b8ed48467f3143125ed542c55c4f61df2ba58b316eb4357a36

Download Submit
C:\Windows\SysWOW64\Kkkdan32.exe

Filesize
52KB

MD5
70d24bbcb746d3f51ff69dc96cb506c8

SHA1
4a48edd86af5dde881430725bc73e6b669955348

SHA256
ac932573e83c0e63a62546ed30fb38c7a7e75baaba4f6b8102edeb9eba31512f

SHA512
721c8f2a4fbb3c015db3b370d39c2428c210642ba1a7f2656c6561844735885ec5fdcd2bdd6a047d0f3b0416cac09ec975b21115c32b979946ec15b34809017c

Download Submit
C:\Windows\SysWOW64\Laopdgcg.exe

Filesize
52KB

MD5
3fd29c9a02d9b39d65de9effef62ae22

SHA1
15da3cb3bdb4be231a4081fafa597032dbb23cb9

SHA256
22354f8382b9cb8c533f3c2e24299f4cd418561b27abae8c2cf33769bb615ba1

SHA512
e606a783703b3ff8e5dd6eb0eaef39e7f7730846e841adf2a3cd0852fd729f981ae2c8d482f640076d7a8d5a957388534a3929a4be9681ffd04dd264d3070188

Download Submit
C:\Windows\SysWOW64\Mibpda32.exe

Filesize
52KB

MD5
99eb0556ed18cdea70c48a56d7ef16e6

SHA1
10b0b83c8091ac5eb660d86232f3ca3a606d5de1

SHA256
04f2c1a661ff2929c6204a70d819d24f5cb7688fff494854288a505d2c19fb8c

SHA512
a3b0218ad1926b1887657bc881f2b1af813ccb92cfb234242babb2c432cc8d53dac3612692b8891e2d23514370655065923c39dc8e5a041a7d091ae1dddf62eb

Download Submit
C:\Windows\SysWOW64\Pnpemb32.exe

Filesize
52KB

MD5
33316ebed4bd747016453e2f0e3a53ae

SHA1
3db275c3e3ab37c78668a049779825aa6e475fc4

SHA256
1ce22a021aaeae7669c184d50f8acb80de9a61fd20f386d6576d3e4af9ccd78a

SHA512
898630a23a10cb789268fac1be722697ce086c32d523aba3f2aa7a286f6e532e39abdc8581071902e1221584389ee06adf38952e63f2e01a2a4a287ff44eb1e1

Download Submit
C:\Windows\SysWOW64\Qalnjkgo.exe

Filesize
52KB

MD5
db4f72a3e25ddb4dd7977136ea5b34b4

SHA1
8afcde89066a732f2a45aa3fa352f91db53b00a6

SHA256
18e2e6d928c200e8b61c9c3d1247982adbd6ee8f25e447a5fea90166ecfb7531

SHA512
77423c48773d3be5660382214531055b601a6009d2a8e50c592a5bd8edf5809907f0599520e7b7de7f0dcafb2c6e3fea41907e04e11ef2b50fb19dc51f660999

Download Submit
memory/212-239-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/228-24-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/368-425-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/432-16-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/528-112-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/544-256-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/668-192-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/736-72-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/916-352-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1008-419-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1320-208-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1392-332-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1404-10-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1440-216-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1476-32-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1644-431-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1676-92-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1684-374-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1816-152-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1856-128-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1960-104-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2028-308-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2068-382-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2128-248-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2156-136-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2200-346-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2316-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2324-388-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2344-407-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2444-340-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2568-39-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2696-389-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2700-395-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2904-310-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2920-47-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2964-334-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3100-320-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3180-180-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3212-292-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3316-401-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3348-298-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3432-184-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3504-167-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3528-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3600-437-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3664-120-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3764-262-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3968-200-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3984-64-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3992-326-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4004-278-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4060-286-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4100-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4180-143-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4224-413-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4256-95-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4356-280-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4380-223-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4428-364-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4436-160-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4540-231-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4596-268-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4904-358-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5044-376-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13384-3818-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13464-3817-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13532-3816-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13604-3815-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13616-3838-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13652-3837-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13660-3814-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13688-3836-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13716-3813-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13724-3835-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13760-3834-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13788-3812-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13796-3833-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13832-3832-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13852-3811-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13868-3831-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13908-3830-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13932-3810-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13944-3829-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/13992-3828-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/14000-3809-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/14028-3827-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/14064-3826-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/14088-3808-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/14100-3825-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/14136-3824-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/14144-3807-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/14172-3823-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/14208-3822-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/14244-3821-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/14280-3820-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/14316-3819-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads