5a9546e983605e247c8ab6447e9eacabb9af69564bfb3fe35bfd7fc9d677f2eb

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5a9546e983605e247c8ab6447e9eacabb9af69564bfb3fe35bfd7fc9d677f2eb.exe
Size

272KB
MD5

bddc91e1107c16baf52667e3b15e2188
SHA1

b448efc53366e01bb6fc4ae4c085454ef31c7fcc
SHA256

5a9546e983605e247c8ab6447e9eacabb9af69564bfb3fe35bfd7fc9d677f2eb
SHA512

7b8d4b305e0eedef4c23114365de37c0909527889fc0ea28a1a25adce8a6b6cd0f4d341fc6ecbabe8174e3c8d064a102a1a2e672b39f0cd3294314151f1517c1
SSDEEP

6144:XKT4tmb+Iahj9OByvZ6Mxv5Rar3O6B9fZSLhZmzbByvZ6Mxv5R:64AbesByvNv54B9f01ZmHByvNv5

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oldjcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Megljppl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gnepna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbgcih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oemefcap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njinmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Anclbkbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knqepc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gadqlkep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Diffglam.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iklgah32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihbdplfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oaqbkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bpkdjofm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fafdkmap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbphdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Glgcbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hifcgion.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aihaoqlp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jglklggl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plndcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afinioip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmabggdm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcblpdgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgpmmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddadpdmn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpcodihc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqfpckhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oblmdhdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bidqko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nlphbnoe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gblbca32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loighj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hhfedm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ggeboaob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mibijk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahjgjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fngcmcfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gddinf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bcelmhen.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipflihfq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aefjii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnlkfal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iknmla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hoeieolb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Icnpmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mifljdjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coknoaic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lgffic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pddhbipj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bkobmnka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mjlhgaqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mmpmnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cncnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jlkipgpe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icnklbmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Amodep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mnlnbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpggamqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jcphab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdaaaeqg.exe

Executes dropped EXE 64 IoCs

pid	Process
2948	Hkmefd32.exe
1444	Ikpaldog.exe
5060	Icifbang.exe
3824	Ifjodl32.exe
2700	Icnpmp32.exe
1956	Jcbihpel.exe
3852	Jfeopj32.exe
3168	Jcllonma.exe
3200	Kbceejpf.exe
2276	Opdghh32.exe
3076	Ojllan32.exe
3504	Ofcmfodb.exe
1832	Ogbipa32.exe
2984	Pfhfan32.exe
780	Pfjcgn32.exe
4876	Pmfhig32.exe
2340	Pqdqof32.exe
4864	Qnhahj32.exe
4636	Qceiaa32.exe
1836	Qmmnjfnl.exe
1412	Qcgffqei.exe
1876	Afhohlbj.exe
1372	Aqncedbp.exe
3992	Afjlnk32.exe
4540	Andqdh32.exe
388	Acqimo32.exe
3184	Aadifclh.exe
1228	Bjmnoi32.exe
5020	Bjokdipf.exe
1224	Beeoaapl.exe
3784	Bjagjhnc.exe
2560	Bnpppgdj.exe
1280	Bclhhnca.exe
2960	Bapiabak.exe
4228	Chjaol32.exe
3500	Cjinkg32.exe
3320	Cmiflbel.exe
1512	Cdcoim32.exe
4020	Cfdhkhjj.exe
3684	Cnkplejl.exe
4000	Cffdpghg.exe
884	Cegdnopg.exe
3196	Ddmaok32.exe
4440	Dhhnpjmh.exe
548	Djgjlelk.exe
1696	Ddonekbl.exe
5056	Dkifae32.exe
1384	Ddakjkqi.exe
3236	Deagdn32.exe
1180	Dknpmdfc.exe
4488	Egdqae32.exe
404	Eggmge32.exe
4328	Emaedo32.exe
1856	Egijmegb.exe
2740	Eemgplno.exe
1712	Eoekia32.exe
2272	Fdbdah32.exe
4528	Fafdkmap.exe
4880	Fgbmccpg.exe
2876	Gochjpho.exe
556	Ghklce32.exe
2472	Gadqlkep.exe
3580	Ggqida32.exe
688	Gddinf32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bbgeno32.exe	Bkmmaeap.exe
File created	C:\Windows\SysWOW64\Bjdlfi32.dll	Flmqlg32.exe
File created	C:\Windows\SysWOW64\Jcbihpel.exe	Icnpmp32.exe
File created	C:\Windows\SysWOW64\Fjecoi32.dll	Ohkbbn32.exe
File created	C:\Windows\SysWOW64\Mdfggeba.dll	Ejoomhmi.exe
File created	C:\Windows\SysWOW64\Jnelok32.exe	Jcphab32.exe
File opened for modification	C:\Windows\SysWOW64\Albpkc32.exe	Adkgje32.exe
File opened for modification	C:\Windows\SysWOW64\Dgcihgaj.exe	Cgqlcg32.exe
File created	C:\Windows\SysWOW64\Kgngca32.dll	Qceiaa32.exe
File created	C:\Windows\SysWOW64\Ncfmno32.exe	Nlleaeff.exe
File created	C:\Windows\SysWOW64\Ljdceo32.exe	Lgffic32.exe
File created	C:\Windows\SysWOW64\Aoabad32.exe	Afinioip.exe
File created	C:\Windows\SysWOW64\Kgnbdh32.exe	Kofkbk32.exe
File created	C:\Windows\SysWOW64\Nonlon32.dll	Nbnpcj32.exe
File opened for modification	C:\Windows\SysWOW64\Kofkbk32.exe	Klhnfo32.exe
File created	C:\Windows\SysWOW64\Qfcnkn32.dll	Bbdhiojo.exe
File created	C:\Windows\SysWOW64\Qabjcina.dll	Gbdoof32.exe
File created	C:\Windows\SysWOW64\Minqeaad.dll	Lfbped32.exe
File created	C:\Windows\SysWOW64\Pjigamma.dll	Jglklggl.exe
File created	C:\Windows\SysWOW64\Pplobcpp.exe	Pnkbkk32.exe
File created	C:\Windows\SysWOW64\Amlogfel.exe	Aphnnafb.exe
File created	C:\Windows\SysWOW64\Mlkpophj.dll	Hmdlmg32.exe
File created	C:\Windows\SysWOW64\Famkjfqd.dll	Lnoaaaad.exe
File opened for modification	C:\Windows\SysWOW64\Bkmmaeap.exe	Bljlfh32.exe
File opened for modification	C:\Windows\SysWOW64\Cjjlkk32.exe	Cijpahho.exe
File created	C:\Windows\SysWOW64\Bqjoqdcl.dll	Blqllqqa.exe
File opened for modification	C:\Windows\SysWOW64\Dokgdkeh.exe	Dmlkhofd.exe
File opened for modification	C:\Windows\SysWOW64\Gldglf32.exe	Gifkpknp.exe
File created	C:\Windows\SysWOW64\Akcjkfij.exe	Ajbmdn32.exe
File created	C:\Windows\SysWOW64\Kahdohfm.dll	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Cibncf32.dll	Gkdhjknm.exe
File opened for modification	C:\Windows\SysWOW64\Jepjhg32.exe	Jofalmmp.exe
File created	C:\Windows\SysWOW64\Lnnlhc32.dll	Gjfnedho.exe
File created	C:\Windows\SysWOW64\Lmeffoid.dll	Nlleaeff.exe
File created	C:\Windows\SysWOW64\Ehailbaa.exe	Eipinkib.exe
File created	C:\Windows\SysWOW64\Ofdljpcg.dll	Fdkpma32.exe
File created	C:\Windows\SysWOW64\Iqipio32.exe	Iklgah32.exe
File opened for modification	C:\Windows\SysWOW64\Mjellmbp.exe	Mehcdfch.exe
File opened for modification	C:\Windows\SysWOW64\Afjlnk32.exe	Aqncedbp.exe
File created	C:\Windows\SysWOW64\Ohqbhdpj.exe	Ocdjpmac.exe
File opened for modification	C:\Windows\SysWOW64\Emehdh32.exe	Embkoi32.exe
File created	C:\Windows\SysWOW64\Mgdkaadn.dll	Cfcjfk32.exe
File opened for modification	C:\Windows\SysWOW64\Dheibpje.exe	Dfglfdkb.exe
File created	C:\Windows\SysWOW64\Mibijk32.exe	Mimpolee.exe
File opened for modification	C:\Windows\SysWOW64\Nlkgmh32.exe	Nhokljge.exe
File opened for modification	C:\Windows\SysWOW64\Oodcdb32.exe	Odoogi32.exe
File created	C:\Windows\SysWOW64\Klhnfo32.exe	Kgkfnh32.exe
File opened for modification	C:\Windows\SysWOW64\Iojbpo32.exe	Illfdc32.exe
File created	C:\Windows\SysWOW64\Anhejhfp.dll	Jlgepanl.exe
File created	C:\Windows\SysWOW64\Jfeopj32.exe	Jcbihpel.exe
File created	C:\Windows\SysWOW64\Lomqcjie.exe	Lnldla32.exe
File opened for modification	C:\Windows\SysWOW64\Lomqcjie.exe	Lnldla32.exe
File created	C:\Windows\SysWOW64\Pmcclm32.exe	Phfjcf32.exe
File created	C:\Windows\SysWOW64\Aolblopj.exe	Alnfpcag.exe
File created	C:\Windows\SysWOW64\Nhpbfpka.exe	Nafjjf32.exe
File created	C:\Windows\SysWOW64\Njinmf32.exe	Ncofplba.exe
File created	C:\Windows\SysWOW64\Lgffic32.exe	Lalnmiia.exe
File created	C:\Windows\SysWOW64\Iekkfckg.dll	Kggcnoic.exe
File created	C:\Windows\SysWOW64\Okopkl32.dll	Hffcmh32.exe
File created	C:\Windows\SysWOW64\Oghppm32.exe	Olckbd32.exe
File opened for modification	C:\Windows\SysWOW64\Fbpchb32.exe	Fpbflg32.exe
File created	C:\Windows\SysWOW64\Hhaljido.dll	Jphkkpbp.exe
File created	C:\Windows\SysWOW64\Pgpecj32.dll	Kflide32.exe
File opened for modification	C:\Windows\SysWOW64\Ajbmdn32.exe	Akamff32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5980	12044	WerFault.exe	692

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kbceejpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggmookkn.dll"	Npedmdab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fbpchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ggqida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckhain32.dll"	Gkmdecbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmbgla32.dll"	Aogbfi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emekpbca.dll"	Qoifflkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdlgno32.dll"	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Acokhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fccfqqkf.dll"	Bljlfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgaeof32.dll"	Aphnnafb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kmkbfeab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Acqimo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pkhjph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bcinna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljalni32.dll"	Bbnkonbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Deagdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Npedmdab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bahkih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bgpcliao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lalnmiia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgaemg32.dll"	Kdpmbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjlhgaqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohepjfbb.dll"	Ggcfja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilnpcnol.dll"	Kmieae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bcelmhen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cpbbch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lkalplel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmlkhofd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imjfmjln.dll"	Jnfcia32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cfcjfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fideeaco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pdhbmh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gochjpho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gddinf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Opadhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fkbkdkpp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pffgom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnoknihb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Feoodn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgngp32.dll"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nabbod32.dll"	Embkoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Malhfo32.dll"	Piijno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bhldpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglncdoj.dll"	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hiipmhmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Illfdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aihaoqlp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dpnbog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cbbnpg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Flmqlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nmipdk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Coknoaic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcecjmkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmhgag32.dll"	Hiipmhmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kpmdfonj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iklgah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkpmpo32.dll"	Oloahhki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmklglpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppajlp32.dll"	Mecjif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oldjcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Phincl32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2948	1800	5a9546e983605e247c8ab6447e9eacabb9af69564bfb3fe35bfd7fc9d677f2eb.exe	88
PID 1800 wrote to memory of 2948	1800	5a9546e983605e247c8ab6447e9eacabb9af69564bfb3fe35bfd7fc9d677f2eb.exe	88
PID 1800 wrote to memory of 2948	1800	5a9546e983605e247c8ab6447e9eacabb9af69564bfb3fe35bfd7fc9d677f2eb.exe	88
PID 2948 wrote to memory of 1444	2948	Hkmefd32.exe	89
PID 2948 wrote to memory of 1444	2948	Hkmefd32.exe	89
PID 2948 wrote to memory of 1444	2948	Hkmefd32.exe	89
PID 1444 wrote to memory of 5060	1444	Ikpaldog.exe	90
PID 1444 wrote to memory of 5060	1444	Ikpaldog.exe	90
PID 1444 wrote to memory of 5060	1444	Ikpaldog.exe	90
PID 5060 wrote to memory of 3824	5060	Icifbang.exe	91
PID 5060 wrote to memory of 3824	5060	Icifbang.exe	91
PID 5060 wrote to memory of 3824	5060	Icifbang.exe	91
PID 3824 wrote to memory of 2700	3824	Ifjodl32.exe	92
PID 3824 wrote to memory of 2700	3824	Ifjodl32.exe	92
PID 3824 wrote to memory of 2700	3824	Ifjodl32.exe	92
PID 2700 wrote to memory of 1956	2700	Icnpmp32.exe	93
PID 2700 wrote to memory of 1956	2700	Icnpmp32.exe	93
PID 2700 wrote to memory of 1956	2700	Icnpmp32.exe	93
PID 1956 wrote to memory of 3852	1956	Jcbihpel.exe	94
PID 1956 wrote to memory of 3852	1956	Jcbihpel.exe	94
PID 1956 wrote to memory of 3852	1956	Jcbihpel.exe	94
PID 3852 wrote to memory of 3168	3852	Jfeopj32.exe	95
PID 3852 wrote to memory of 3168	3852	Jfeopj32.exe	95
PID 3852 wrote to memory of 3168	3852	Jfeopj32.exe	95
PID 3168 wrote to memory of 3200	3168	Jcllonma.exe	96
PID 3168 wrote to memory of 3200	3168	Jcllonma.exe	96
PID 3168 wrote to memory of 3200	3168	Jcllonma.exe	96
PID 3200 wrote to memory of 2276	3200	Kbceejpf.exe	97
PID 3200 wrote to memory of 2276	3200	Kbceejpf.exe	97
PID 3200 wrote to memory of 2276	3200	Kbceejpf.exe	97
PID 2276 wrote to memory of 3076	2276	Opdghh32.exe	98
PID 2276 wrote to memory of 3076	2276	Opdghh32.exe	98
PID 2276 wrote to memory of 3076	2276	Opdghh32.exe	98
PID 3076 wrote to memory of 3504	3076	Ojllan32.exe	99
PID 3076 wrote to memory of 3504	3076	Ojllan32.exe	99
PID 3076 wrote to memory of 3504	3076	Ojllan32.exe	99
PID 3504 wrote to memory of 1832	3504	Ofcmfodb.exe	100
PID 3504 wrote to memory of 1832	3504	Ofcmfodb.exe	100
PID 3504 wrote to memory of 1832	3504	Ofcmfodb.exe	100
PID 1832 wrote to memory of 2984	1832	Ogbipa32.exe	101
PID 1832 wrote to memory of 2984	1832	Ogbipa32.exe	101
PID 1832 wrote to memory of 2984	1832	Ogbipa32.exe	101
PID 2984 wrote to memory of 780	2984	Pfhfan32.exe	102
PID 2984 wrote to memory of 780	2984	Pfhfan32.exe	102
PID 2984 wrote to memory of 780	2984	Pfhfan32.exe	102
PID 780 wrote to memory of 4876	780	Pfjcgn32.exe	103
PID 780 wrote to memory of 4876	780	Pfjcgn32.exe	103
PID 780 wrote to memory of 4876	780	Pfjcgn32.exe	103
PID 4876 wrote to memory of 2340	4876	Pmfhig32.exe	104
PID 4876 wrote to memory of 2340	4876	Pmfhig32.exe	104
PID 4876 wrote to memory of 2340	4876	Pmfhig32.exe	104
PID 2340 wrote to memory of 4864	2340	Pqdqof32.exe	105
PID 2340 wrote to memory of 4864	2340	Pqdqof32.exe	105
PID 2340 wrote to memory of 4864	2340	Pqdqof32.exe	105
PID 4864 wrote to memory of 4636	4864	Qnhahj32.exe	106
PID 4864 wrote to memory of 4636	4864	Qnhahj32.exe	106
PID 4864 wrote to memory of 4636	4864	Qnhahj32.exe	106
PID 4636 wrote to memory of 1836	4636	Qceiaa32.exe	107
PID 4636 wrote to memory of 1836	4636	Qceiaa32.exe	107
PID 4636 wrote to memory of 1836	4636	Qceiaa32.exe	107
PID 1836 wrote to memory of 1412	1836	Qmmnjfnl.exe	108
PID 1836 wrote to memory of 1412	1836	Qmmnjfnl.exe	108
PID 1836 wrote to memory of 1412	1836	Qmmnjfnl.exe	108
PID 1412 wrote to memory of 1876	1412	Qcgffqei.exe	109

C:\Users\Admin\AppData\Local\Temp\5a9546e983605e247c8ab6447e9eacabb9af69564bfb3fe35bfd7fc9d677f2eb.exe
"C:\Users\Admin\AppData\Local\Temp\5a9546e983605e247c8ab6447e9eacabb9af69564bfb3fe35bfd7fc9d677f2eb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\Hkmefd32.exe
  C:\Windows\system32\Hkmefd32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\SysWOW64\Ikpaldog.exe
    C:\Windows\system32\Ikpaldog.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\SysWOW64\Icifbang.exe
      C:\Windows\system32\Icifbang.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5060
    - - C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3824
      - C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3852
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3200
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3076
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1832
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:780
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        23⤵
        Executes dropped EXE
        
        PID:1876
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1372
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        25⤵
        Executes dropped EXE
        
        PID:3992
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4540
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:388
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        28⤵
        Executes dropped EXE
        
        PID:3184
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1228
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        30⤵
        Executes dropped EXE
        
        PID:5020
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        31⤵
        Executes dropped EXE
        
        PID:1224
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        32⤵
        Executes dropped EXE
        
        PID:3784
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        33⤵
        Executes dropped EXE
        
        PID:2560
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1280
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        35⤵
        Executes dropped EXE
        
        PID:2960
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        36⤵
        Executes dropped EXE
        
        PID:4228
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        37⤵
        Executes dropped EXE
        
        PID:3500
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        38⤵
        Executes dropped EXE
        
        PID:3320
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        39⤵
        Executes dropped EXE
        
        PID:1512
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        40⤵
        Executes dropped EXE
        
        PID:4020
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3684
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        42⤵
        Executes dropped EXE
        
        PID:4000
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        43⤵
        Executes dropped EXE
        
        PID:884
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3196
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4440
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        46⤵
        Executes dropped EXE
        
        PID:548
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        47⤵
        Executes dropped EXE
        
        PID:1696
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        48⤵
        Executes dropped EXE
        
        PID:5056
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1384
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3236
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        51⤵
        Executes dropped EXE
        
        PID:1180
        
        C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        52⤵
        Executes dropped EXE
        
        PID:4488
        
        C:\Windows\SysWOW64\Eggmge32.exe
        
        C:\Windows\system32\Eggmge32.exe
        53⤵
        Executes dropped EXE
        
        PID:404
        
        C:\Windows\SysWOW64\Emaedo32.exe
        
        C:\Windows\system32\Emaedo32.exe
        54⤵
        Executes dropped EXE
        
        PID:4328
        
        C:\Windows\SysWOW64\Egijmegb.exe
        
        C:\Windows\system32\Egijmegb.exe
        55⤵
        Executes dropped EXE
        
        PID:1856
        
        C:\Windows\SysWOW64\Eemgplno.exe
        
        C:\Windows\system32\Eemgplno.exe
        56⤵
        Executes dropped EXE
        
        PID:2740
        
        C:\Windows\SysWOW64\Eoekia32.exe
        
        C:\Windows\system32\Eoekia32.exe
        57⤵
        Executes dropped EXE
        
        PID:1712
        
        C:\Windows\SysWOW64\Fdbdah32.exe
        
        C:\Windows\system32\Fdbdah32.exe
        58⤵
        Executes dropped EXE
        
        PID:2272
        
        C:\Windows\SysWOW64\Fafdkmap.exe
        
        C:\Windows\system32\Fafdkmap.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4528
        
        C:\Windows\SysWOW64\Fgbmccpg.exe
        
        C:\Windows\system32\Fgbmccpg.exe
        60⤵
        Executes dropped EXE
        
        PID:4880
        
        C:\Windows\SysWOW64\Gochjpho.exe
        
        C:\Windows\system32\Gochjpho.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2876
        
        C:\Windows\SysWOW64\Ghklce32.exe
        
        C:\Windows\system32\Ghklce32.exe
        62⤵
        Executes dropped EXE
        
        PID:556
        
        C:\Windows\SysWOW64\Gadqlkep.exe
        
        C:\Windows\system32\Gadqlkep.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2472
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3580
        
        C:\Windows\SysWOW64\Gddinf32.exe
        
        C:\Windows\system32\Gddinf32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:688
        
        C:\Windows\SysWOW64\Ggcfja32.exe
        
        C:\Windows\system32\Ggcfja32.exe
        66⤵
        Modifies registry class
        
        PID:1320
        
        C:\Windows\SysWOW64\Gahjgj32.exe
        
        C:\Windows\system32\Gahjgj32.exe
        67⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\Ggeboaob.exe
        
        C:\Windows\system32\Ggeboaob.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4056
        
        C:\Windows\SysWOW64\Hffcmh32.exe
        
        C:\Windows\system32\Hffcmh32.exe
        69⤵
        Drops file in System32 directory
        
        PID:2728
        
        C:\Windows\SysWOW64\Lbnngbbn.exe
        
        C:\Windows\system32\Lbnngbbn.exe
        70⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\Loglacfo.exe
        
        C:\Windows\system32\Loglacfo.exe
        71⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\Mimpolee.exe
        
        C:\Windows\system32\Mimpolee.exe
        72⤵
        Drops file in System32 directory
        
        PID:1212
        
        C:\Windows\SysWOW64\Mibijk32.exe
        
        C:\Windows\system32\Mibijk32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:900
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        74⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\Mffjcopi.exe
        
        C:\Windows\system32\Mffjcopi.exe
        75⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\Midfokpm.exe
        
        C:\Windows\system32\Midfokpm.exe
        76⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\Moaogand.exe
        
        C:\Windows\system32\Moaogand.exe
        77⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\Mpqkad32.exe
        
        C:\Windows\system32\Mpqkad32.exe
        78⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        79⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Niipjj32.exe
        
        C:\Windows\system32\Niipjj32.exe
        80⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Nlglfe32.exe
        
        C:\Windows\system32\Nlglfe32.exe
        81⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Ngmpcn32.exe
        
        C:\Windows\system32\Ngmpcn32.exe
        82⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Npedmdab.exe
        
        C:\Windows\system32\Npedmdab.exe
        83⤵
        Modifies registry class
        
        PID:5352
        
        C:\Windows\SysWOW64\Nbcqiope.exe
        
        C:\Windows\system32\Nbcqiope.exe
        84⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Niniei32.exe
        
        C:\Windows\system32\Niniei32.exe
        85⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        86⤵
        Drops file in System32 directory
        
        PID:5492
        
        C:\Windows\SysWOW64\Ncfmno32.exe
        
        C:\Windows\system32\Ncfmno32.exe
        87⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        88⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Npjnhc32.exe
        
        C:\Windows\system32\Npjnhc32.exe
        89⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        90⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Nlqomd32.exe
        
        C:\Windows\system32\Nlqomd32.exe
        91⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        92⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        93⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Olckbd32.exe
        
        C:\Windows\system32\Olckbd32.exe
        94⤵
        Drops file in System32 directory
        
        PID:5864
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        95⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Opadhb32.exe
        
        C:\Windows\system32\Opadhb32.exe
        96⤵
        Modifies registry class
        
        PID:5964
        
        C:\Windows\SysWOW64\Ocopdn32.exe
        
        C:\Windows\system32\Ocopdn32.exe
        97⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        98⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        99⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        100⤵
        Drops file in System32 directory
        
        PID:5124
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        101⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Ophjiaql.exe
        
        C:\Windows\system32\Ophjiaql.exe
        102⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Pgflqkdd.exe
        
        C:\Windows\system32\Pgflqkdd.exe
        103⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Pjehmfch.exe
        
        C:\Windows\system32\Pjehmfch.exe
        104⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        105⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        106⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Plhnda32.exe
        
        C:\Windows\system32\Plhnda32.exe
        107⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        108⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Qhonib32.exe
        
        C:\Windows\system32\Qhonib32.exe
        109⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Qljjjqlc.exe
        
        C:\Windows\system32\Qljjjqlc.exe
        110⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Qoifflkg.exe
        
        C:\Windows\system32\Qoifflkg.exe
        111⤵
        Modifies registry class
        
        PID:6044
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        112⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Aokcklid.exe
        
        C:\Windows\system32\Aokcklid.exe
        113⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5236
        
        C:\Windows\SysWOW64\Afghneoo.exe
        
        C:\Windows\system32\Afghneoo.exe
        115⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Ahfdjanb.exe
        
        C:\Windows\system32\Ahfdjanb.exe
        116⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Aqmlknnd.exe
        
        C:\Windows\system32\Aqmlknnd.exe
        117⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Aopmfk32.exe
        
        C:\Windows\system32\Aopmfk32.exe
        118⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        119⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Aihaoqlp.exe
        
        C:\Windows\system32\Aihaoqlp.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5972
        
        C:\Windows\SysWOW64\Aobilkcl.exe
        
        C:\Windows\system32\Aobilkcl.exe
        121⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Bfqkddfd.exe
        
        C:\Windows\system32\Bfqkddfd.exe
        122⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\Biogppeg.exe
        
        C:\Windows\system32\Biogppeg.exe
        123⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Bqfoamfj.exe
        
        C:\Windows\system32\Bqfoamfj.exe
        124⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\Bcelmhen.exe
        
        C:\Windows\system32\Bcelmhen.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5708
        
        C:\Windows\SysWOW64\Bgpgng32.exe
        
        C:\Windows\system32\Bgpgng32.exe
        126⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\Bmmpfn32.exe
        
        C:\Windows\system32\Bmmpfn32.exe
        127⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        128⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Bidqko32.exe
        
        C:\Windows\system32\Bidqko32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5808
        
        C:\Windows\SysWOW64\Bifmqo32.exe
        
        C:\Windows\system32\Bifmqo32.exe
        130⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Bclang32.exe
        
        C:\Windows\system32\Bclang32.exe
        131⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Cpbbch32.exe
        
        C:\Windows\system32\Cpbbch32.exe
        132⤵
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Cjhfpa32.exe
        
        C:\Windows\system32\Cjhfpa32.exe
        133⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\Ccqkigkp.exe
        
        C:\Windows\system32\Ccqkigkp.exe
        134⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        135⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Cmklglpn.exe
        
        C:\Windows\system32\Cmklglpn.exe
        136⤵
        Modifies registry class
        
        PID:6152
        
        C:\Windows\SysWOW64\Cjaifp32.exe
        
        C:\Windows\system32\Cjaifp32.exe
        137⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        138⤵
        Modifies registry class
        
        PID:6240
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6284
        
        C:\Windows\SysWOW64\Diicml32.exe
        
        C:\Windows\system32\Diicml32.exe
        140⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Dikpbl32.exe
        
        C:\Windows\system32\Dikpbl32.exe
        141⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6408
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        143⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Eipinkib.exe
        
        C:\Windows\system32\Eipinkib.exe
        144⤵
        Drops file in System32 directory
        
        PID:6500
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        145⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        146⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6584
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        147⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        148⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        149⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        150⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        151⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        152⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Fpjjac32.exe
        
        C:\Windows\system32\Fpjjac32.exe
        153⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Fkbkdkpp.exe
        
        C:\Windows\system32\Fkbkdkpp.exe
        154⤵
        Modifies registry class
        
        PID:6936
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        155⤵
        Drops file in System32 directory
        
        PID:6976
        
        C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        156⤵
        Drops file in System32 directory
        
        PID:7028
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        157⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        158⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Gmeakf32.exe
        
        C:\Windows\system32\Gmeakf32.exe
        159⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        160⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        161⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        162⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Hkpheidp.exe
        
        C:\Windows\system32\Hkpheidp.exe
        163⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Hpomcp32.exe
        
        C:\Windows\system32\Hpomcp32.exe
        164⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Hhfedm32.exe
        
        C:\Windows\system32\Hhfedm32.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6596
        
        C:\Windows\SysWOW64\Hncmmd32.exe
        
        C:\Windows\system32\Hncmmd32.exe
        166⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        167⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        168⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        169⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        171⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7108
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        173⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Inomhbeq.exe
        
        C:\Windows\system32\Inomhbeq.exe
        174⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Iqmidndd.exe
        
        C:\Windows\system32\Iqmidndd.exe
        175⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        176⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Iggaah32.exe
        
        C:\Windows\system32\Iggaah32.exe
        177⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        178⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        179⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Jglklggl.exe
        
        C:\Windows\system32\Jglklggl.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6984
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        181⤵
        Modifies registry class
        
        PID:7116
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        182⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Jjopcb32.exe
        
        C:\Windows\system32\Jjopcb32.exe
        183⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        184⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        185⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        186⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        187⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        188⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        189⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Kjpijpdg.exe
        
        C:\Windows\system32\Kjpijpdg.exe
        190⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        191⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Lalnmiia.exe
        
        C:\Windows\system32\Lalnmiia.exe
        192⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6692
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5336
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        194⤵
        
        PID:644
        
        C:\Windows\SysWOW64\Lbkkgl32.exe
        
        C:\Windows\system32\Lbkkgl32.exe
        195⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        196⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        197⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        198⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Lgkpdcmi.exe
        
        C:\Windows\system32\Lgkpdcmi.exe
        199⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        200⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        201⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        202⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        203⤵
        Modifies registry class
        
        PID:7576
        
        C:\Windows\SysWOW64\Mnlnbl32.exe
        
        C:\Windows\system32\Mnlnbl32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7616
        
        C:\Windows\SysWOW64\Mhdckaeo.exe
        
        C:\Windows\system32\Mhdckaeo.exe
        205⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        206⤵
        Drops file in System32 directory
        
        PID:7700
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        207⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        208⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7828
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        210⤵
        Drops file in System32 directory
        
        PID:7872
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        211⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        212⤵
        Drops file in System32 directory
        
        PID:7960
        
        C:\Windows\SysWOW64\Nhpbfpka.exe
        
        C:\Windows\system32\Nhpbfpka.exe
        213⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Nojjcj32.exe
        
        C:\Windows\system32\Nojjcj32.exe
        214⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        215⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        216⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8176
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7228
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7280
        
        C:\Windows\SysWOW64\Oekiqccc.exe
        
        C:\Windows\system32\Oekiqccc.exe
        220⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        221⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        222⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7604
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        224⤵
        Drops file in System32 directory
        
        PID:7668
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        225⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Ohpkmn32.exe
        
        C:\Windows\system32\Ohpkmn32.exe
        226⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7900
        
        C:\Windows\SysWOW64\Pchlpfjb.exe
        
        C:\Windows\system32\Pchlpfjb.exe
        228⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        229⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        230⤵
        
        PID:952
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        231⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        232⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        233⤵
        Modifies registry class
        
        PID:7196
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        234⤵
        Modifies registry class
        
        PID:7292
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        235⤵
        Modifies registry class
        
        PID:7528
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        236⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        237⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        238⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        239⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        240⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        241⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Akamff32.exe
        
        C:\Windows\system32\Akamff32.exe
        242⤵
        Drops file in System32 directory
        
        PID:8164
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        243⤵
        Drops file in System32 directory
        
        PID:7332
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        244⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Afinioip.exe
        
        C:\Windows\system32\Afinioip.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7708
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        246⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        247⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2844
        
        C:\Windows\SysWOW64\Acokhc32.exe
        
        C:\Windows\system32\Acokhc32.exe
        249⤵
        Modifies registry class
        
        PID:7208
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        250⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        251⤵
        Modifies registry class
        
        PID:7768
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        252⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        253⤵
        Drops file in System32 directory
        
        PID:8168
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        254⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7516
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        255⤵
        Drops file in System32 directory
        
        PID:5224
        
        C:\Windows\SysWOW64\Bbgeno32.exe
        
        C:\Windows\system32\Bbgeno32.exe
        256⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        257⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        258⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        259⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        260⤵
        Modifies registry class
        
        PID:3440
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8232
        
        C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        262⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        263⤵
        Modifies registry class
        
        PID:8316
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        264⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8408
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        266⤵
        Drops file in System32 directory
        
        PID:8452
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        267⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        268⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        269⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        270⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8624
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8672
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        272⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        273⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        274⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        275⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        276⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        277⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        278⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        279⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        280⤵
        Drops file in System32 directory
        
        PID:9108
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        281⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        282⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        283⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        284⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        285⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        286⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        287⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        288⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        289⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        290⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:400
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        292⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        293⤵
        Modifies registry class
        
        PID:8956
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        294⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        295⤵
        Drops file in System32 directory
        
        PID:9096
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        296⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        297⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        298⤵
        Drops file in System32 directory
        
        PID:8356
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        299⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        300⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        301⤵
        Modifies registry class
        
        PID:8696
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        302⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        303⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        304⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        305⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9200
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8308
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8516
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        309⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        310⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9016
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        312⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        313⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        314⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        315⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8444
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        317⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        318⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8404
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        320⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8664
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3712
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5060
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        324⤵
        
        PID:448
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        325⤵
        
        PID:836
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        326⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        327⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        328⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        329⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        330⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        331⤵
        Drops file in System32 directory
        
        PID:9452
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        332⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        333⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        334⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        335⤵
        Modifies registry class
        
        PID:9640
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        336⤵
        Modifies registry class
        
        PID:9684
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        337⤵
        Modifies registry class
        
        PID:9732
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        338⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        339⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        340⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        341⤵
        Modifies registry class
        
        PID:9912
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        342⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        343⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        344⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        345⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        346⤵
        Modifies registry class
        
        PID:10124
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        347⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        348⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        349⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9232
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        351⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        352⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        353⤵
        Drops file in System32 directory
        
        PID:9420
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9460
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        355⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        356⤵
        Drops file in System32 directory
        
        PID:9588
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        357⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        358⤵
        
        PID:784
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        359⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        360⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        361⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        362⤵
        Modifies registry class
        
        PID:9964
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10024
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10104
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        365⤵
        Drops file in System32 directory
        
        PID:10168
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        366⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        367⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        368⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        369⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9432
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        370⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        371⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        372⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        373⤵
        Modifies registry class
        
        PID:9856
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        374⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        375⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        376⤵
        Drops file in System32 directory
        
        PID:10144
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        377⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        378⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        379⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        380⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        381⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        382⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        383⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        384⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        385⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        386⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        387⤵
        Drops file in System32 directory
        
        PID:2632
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        388⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2156
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        390⤵
        Drops file in System32 directory
        
        PID:9980
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        391⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        392⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        393⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9444
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        394⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        395⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        396⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        397⤵
        
        PID:452
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        398⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        399⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        400⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        401⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        402⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10092
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        404⤵
        Modifies registry class
        
        PID:9416
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        405⤵
        
        PID:3704
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        406⤵
        Modifies registry class
        
        PID:9700
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        407⤵
        Drops file in System32 directory
        
        PID:8788
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        408⤵
        
        PID:872
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        409⤵
        Modifies registry class
        
        PID:1160
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        410⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        411⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        412⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        413⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3020
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        414⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        415⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        416⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        417⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        418⤵
        Drops file in System32 directory
        
        PID:388
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        419⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        420⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        421⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        422⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        423⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        424⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        425⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        426⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        427⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        428⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        429⤵
        
        PID:548
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        430⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        431⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        432⤵
        
        PID:728
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        433⤵
        Drops file in System32 directory
        
        PID:3884
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        434⤵
        Modifies registry class
        
        PID:3340
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        435⤵
        Modifies registry class
        
        PID:4508
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        436⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        437⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4580
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        438⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        439⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        440⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        441⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        442⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1268
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        443⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        444⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        445⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        446⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        447⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        448⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4840
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        449⤵
        Drops file in System32 directory
        
        PID:3196
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        450⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        451⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        452⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10424
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10468
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        455⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        456⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        457⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        458⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        459⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        460⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        461⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        462⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        463⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        464⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10972
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        465⤵
        Modifies registry class
        
        PID:11024
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        466⤵
        Drops file in System32 directory
        
        PID:11072
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11108
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        468⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        469⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        470⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        471⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        472⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        473⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10364
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        474⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        475⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        476⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        477⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        478⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        479⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        480⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        481⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        482⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        483⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        484⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        485⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        486⤵
        Drops file in System32 directory
        
        PID:11096
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        487⤵
        Drops file in System32 directory
        
        PID:11188
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        488⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        489⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        490⤵
        Drops file in System32 directory
        
        PID:10376
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        491⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        492⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        493⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        494⤵
        Modifies registry class
        
        PID:2876
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        495⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        496⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        497⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10920
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        498⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        499⤵
        Drops file in System32 directory
        
        PID:11124
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        500⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        501⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        502⤵
        Drops file in System32 directory
        
        PID:10500
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        503⤵
        Drops file in System32 directory
        
        PID:3736
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        504⤵
        Drops file in System32 directory
        
        PID:10788
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        505⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        506⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        507⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        508⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10388
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        509⤵
        Drops file in System32 directory
        
        PID:4568
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        510⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        511⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        512⤵
        Drops file in System32 directory
        
        PID:10348
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        513⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        514⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        515⤵
        Drops file in System32 directory
        
        PID:10700
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        516⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        517⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        518⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        519⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        520⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        521⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        522⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        523⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        524⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        525⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11520
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11572
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        527⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11616
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        528⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        529⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        530⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        531⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11816
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        532⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        533⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        534⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        535⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        536⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        537⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        538⤵
        Modifies registry class
        
        PID:12144
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        539⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        540⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        541⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        542⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        543⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        544⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        545⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        546⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        547⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        548⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        549⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        550⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        551⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        552⤵
        Drops file in System32 directory
        
        PID:11948
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        553⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        554⤵
        Modifies registry class
        
        PID:12036
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        555⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        556⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        557⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        558⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        559⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        560⤵
        
        PID:12236
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        561⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        562⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        563⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        564⤵
        Modifies registry class
        
        PID:11416
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        565⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        566⤵
        Modifies registry class
        
        PID:5584
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        567⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11640
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        568⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        569⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        570⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        571⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        572⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        573⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        574⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        575⤵
        Modifies registry class
        
        PID:5552
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        576⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        577⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        578⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        579⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        580⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        581⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4976
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        582⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        583⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        584⤵
        
        PID:11508
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        585⤵
        Modifies registry class
        
        PID:1480
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        586⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5616
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        587⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        588⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        589⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        590⤵
        Drops file in System32 directory
        
        PID:11892
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        591⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        592⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        593⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        594⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        595⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12044 -s 412
        596⤵
        Program crash
        
        PID:5980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 12044 -ip 12044
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aadifclh.exe

Filesize
272KB

MD5
d4e5fbbc9419b66df1e2924e90cfaa7f

SHA1
45e257522e3d84d7598911b95acac90ef920d616

SHA256
c4074ce5ef207582033fbd2d0e4e8049d1e371a18429a03ec806b1633050f31f

SHA512
fbb8d687b089baba84815267b805eff57b65060ddec43408d89851a674173a51003a22c35c85169312c8ae9ca36f5e6a1cd584f64f5a841fbbfdacdecef09548

Download Submit
C:\Windows\SysWOW64\Acqimo32.exe

Filesize
272KB

MD5
1539482c5a05d4b382b6d4e7c660d0d1

SHA1
abb6b0873870c06a036225786766c556ed71d51a

SHA256
6b68e665f055f76137f5eb82232501ea87c5276d5443bc5fdcd6099dd3fccc4b

SHA512
c2eef361918c65f52a133af3f3a58cbdb3ba2adc4d894ef9fc9abdfccc60949ed32e9411807390b5c598f940d94f10eb8ff36d4a02ffdad68311b0e697a5264d

Download Submit
C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
272KB

MD5
448c6ca1b4fa4c0fa1e763ab903f4adb

SHA1
2ef858fd19c4a64755f7e9af8bc18bc719aa8a63

SHA256
e54b87651710bf143d526d0736c2b1c0c4d51c55790b218f13a6ef053e15fb93

SHA512
eadf8bbb2c1e0073523a7b242e2c03e9ef7cfd99fce2f974e69c5e27ceff8291e900123f65ed390334aa506cf390ebed38a2c68ef72450b9af5eeb48b5787db6

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
272KB

MD5
662d731cb6ddc30da277d5e589edd22c

SHA1
7319000436d08b329b18f6525094b4f709d4a603

SHA256
782d11471de66ed0473706ba5aee76fb5dc7b31dc1b27e704ee371f0d693d102

SHA512
a31cc07625f96c1ffd99e13ccd59198d36e200cf9adde5fca8f8a43f68565f7fbdbd5e2d66969d29a6c877af2834db732d2e0ede10bca7e86d0c3011796684e0

Download Submit
C:\Windows\SysWOW64\Andqdh32.exe

Filesize
272KB

MD5
71e42ae6aaf55b5c88261105290dd153

SHA1
714a38c6d2ec83b269920262cd10d73637e4ac9f

SHA256
ea3b42e4b7189c0b27175769062841b802b0bf7e4c70b979dc7645e9a21fa08e

SHA512
e8b8334f9e2a8035bcfcb8badd36f6d8dc20aff2b90b3902966fd2ae0441dc2074325ee77eb2ad6e2d884a4e69650f44b2337bc09e0b186e5577ef3d19bb636d

Download Submit
C:\Windows\SysWOW64\Aobilkcl.exe

Filesize
272KB

MD5
e4b782107838791581c157ea3cf4a398

SHA1
4f543835fa0568ead577a543b2a508dd7281d7fb

SHA256
a778e1dd43f7cf3f97e22c9adef660df5ce75075e960595f44c4ab572b612a9f

SHA512
6c17033eaf6f0e380fd8526bc8cb40e4a4054fcc74c0b77100ab4329ab19cc6682b2b8fa44cd5de40e42479a9dd79c8d36e098c82a24c0f3d4ce60efd2c9ca87

Download Submit
C:\Windows\SysWOW64\Aqncedbp.exe

Filesize
272KB

MD5
2675a1334838dc8fffb98f0ea15828a6

SHA1
760620a485c28d2f3bb3ae07ec476b7a80b14ef3

SHA256
a8551445c748d9448ebbe7fda6d3edff2251b8facb98f4fc74ded8c72e7470a4

SHA512
901c0d606e7e3c2c29f2188deacf340085ab0713e9d467afc095c80d1c181343fab1f0e713936cc2b01af09f03898217502dc75824086d2b60cddf5c52e26cf6

Download Submit
C:\Windows\SysWOW64\Beeoaapl.exe

Filesize
272KB

MD5
38c5a4782ef0f0c4be48fbc0805fc360

SHA1
c45ee7e434b51b16c776ab435c5da6fe368c5d7f

SHA256
d744cfa231141ca370195be2794f599deef5ecec0050a3c6d163994eeb58bb8b

SHA512
0e85e5361b0378aee41ae29d529e9495024abca4387e0bf092618c94878d1c9b6a5c77ec466d98d5132921f7825df9d20ab72e165a3e6c4d695e92a8302f7647

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
272KB

MD5
6e541b3e454f5772758489b24ec153b5

SHA1
68be554c5261a8e8ab7aaea89378ee359cd18b93

SHA256
f24ee8b21d3ec551a54f388d47ecb1150b6a3ae2ef5a94da5af460b677a5057f

SHA512
8ddebd76f46750b05993f95ac8898119771693672402fd39a56482a6efc5c53e4332b4775ab740cb73aa55a6d558e0b8370b00f14b10e1a86c1c101a2c107c61

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
272KB

MD5
1a60cc2287c10472f668dec2aa84a5cb

SHA1
6873a5f8679bc9bb69b800ca237de7c9cdabf877

SHA256
2274adead77b5700ca40bbcb68b4a8673de71c77c2d32d520ed5648f0cdfcfe0

SHA512
67a115950221751594316b65b3b79a4cbe06d8b3dd278a4086ccea883be20e7f1ed8a4ca11f920e87834c5acd11dff928745ed6771c27a770ffade499038c805

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
272KB

MD5
b62ad18e3ae6a15c1c9ec12fd7731a89

SHA1
ec5316c3e5f95202308fd0fce659230973316a16

SHA256
c08d6335dfa3646226b6b1b992c490cae3592a4ff30f27547dbaad163bfd2c67

SHA512
7e005c9b5ac93d86d938a9f13d0e942daaa3ec85bbf487b85f3e9e26454428e097e7d3a97df7c1ff1c750073105db0bb65de628a3feff2158347848a1c6e09c9

Download Submit
C:\Windows\SysWOW64\Bnpppgdj.exe

Filesize
272KB

MD5
da5ec328b4f5620c015bf54192c6f5ba

SHA1
32bc32e7b6af5b2f4e5a5255283c4e370af3809a

SHA256
72b366145e070fb9250b4d95542c5cbf168a7ec53ed488f6529d2da15d7e3cfe

SHA512
50a03ce9a0def363de9b7ac2c7abdc01225e9ae6ec66bb7682836d1855892cbec4dfceee91a319fbd8b7af387b41b3510bac9f511b8d740bc0eb8c0129688b08

Download Submit
C:\Windows\SysWOW64\Cijpahho.exe

Filesize
256KB

MD5
4b743532b1cde26f867603976b5340c7

SHA1
3a053673c9747b54da5046a4eaa797bafca62cd0

SHA256
c24059c947249bf537e0fce055db1afe705ced6ca3d50929056b0ffb3aba0f4e

SHA512
f853a6cf803fbcacdb9a94bf4113eb7ca3fe4fee3c1b1e5a94d0433e22303e992b89fa5fdc065f89bc63e0296fc52b2c552ec7f3dc6787a2db7a59b4acb0b1b9

Download Submit
C:\Windows\SysWOW64\Ckmehb32.exe

Filesize
64KB

MD5
c8ab560b574d17eef107da1b2bb3266a

SHA1
470e4357b85c4d51eec1479478f9ec3263724901

SHA256
a6313aea331c925c3b1c21b5b10a47774d44c3108015e31bc2e43e7b8d6398cb

SHA512
be38a53ed30595865a494bef213f74e8baa58b948f235f00f151b522320ea247cb4f0ac718f67751691de4e90d84956c41faa0c701ee518d88f351924d9d87c0

Download Submit
C:\Windows\SysWOW64\Ddmaok32.exe

Filesize
272KB

MD5
4dfb497aa80d7b4c696d5c1df5c2e3f4

SHA1
89b8bdbe08e50fbdf208d6a09a0806742a2a378d

SHA256
44f795aa893781c96376bfa8a1d9a21d300555255e86b5ed9598d450f31372aa

SHA512
3a4b290b29af208d364ea8e3be3dfe00f8aac2b6f97485984a707e75eefd4596a8681c4b969d0dc18773f82ef8612f5306e53721b0d68a134c87cebd3adb52f2

Download Submit
C:\Windows\SysWOW64\Deagdn32.exe

Filesize
272KB

MD5
80de31623401975ae7b59b90ff5b8032

SHA1
cb8d75a78612bd5101f7e65101f0bd12bc294c90

SHA256
2202e5fd6df8226df4802bf488fd85709271acced8092e325bf2cb424ea7ffee

SHA512
b25ee7bdd02fa5daf21959d8a46d522346989a6092a675202e42a623ef916d36a7e248811e645bef95b488aedee68c5894a4380af76ff094e3acbb888c0a0422

Download Submit
C:\Windows\SysWOW64\Eemgplno.exe

Filesize
272KB

MD5
4ff9422b2650562d3c481ed557c59046

SHA1
b76349e11c9f7353778c948c8243820a96926e7d

SHA256
52ee435fc1ace2f9389384bd85615fb2774ad5893f1e0d5ef0d0723a61f9af85

SHA512
cafbae5b18b01e6f34198c50870328c4423eeae8dd54a5d73167a6d307923a27918c38ef1679f7f0112b399d0ae2d16bad835fefba67d48d63c3e97b875b1046

Download Submit
C:\Windows\SysWOW64\Fkgoikdb.dll

Filesize
7KB

MD5
ce17b451a765fc257d318ec4a2e43884

SHA1
820660888b2248adaf5395b918e4472ea3d67dfb

SHA256
a97f02ae9ead2dbf2c94d022b18a295d32eba358128f3f8d6f19bd380562c457

SHA512
65bb75c726dcc57b51deccb4026b244b96052fea2386ecc20ed12feb864d220673a951253f114baa130c27e601e4d1ac193cdf870e913fbe3d84d8970b4cf7ec

Download Submit
C:\Windows\SysWOW64\Flinkojm.exe

Filesize
128KB

MD5
1b69f2f82a07d7d483577a406d1c6171

SHA1
05a4c166544165749fc3d7a397db3723327846c0

SHA256
2e9ef85c159c9a9bd46b7b6b06a435b1a5cb55ceffffdb6818ad33d1a64ca509

SHA512
529e5b7a05753dbf859a5e7810b2c7b10b996db6b1d422a3a0a66d4af6dbec4a1e3df0b86fd98899f99ba3d5562757145cbda44ac2e6bde3e9452bc535e98ab3

Download Submit
C:\Windows\SysWOW64\Glengm32.exe

Filesize
64KB

MD5
95cfed8b1b74293ed06259a8830b59aa

SHA1
cb5da8b3ce881aa312ad8bda14e62b5eb90294eb

SHA256
14b61618d0435201511195b4ad029b1cd05015dc1d73837dab8326c69d6c8d81

SHA512
453d407f242961f3af197373c69cbe3ea1ce0f663580cbe7a917c0e37fea60fc0ad03835a227d9ce8816aaa86280975ec83404b9051074f0cba2fa5d42df533e

Download Submit
C:\Windows\SysWOW64\Hkmefd32.exe

Filesize
272KB

MD5
f373129ef29b6fe460bab1cc32e79740

SHA1
776c8d6ed71f4db91e01518dc818aee69d05cac0

SHA256
0d6cb191c519941f9bb147ad99644ed52a5eae096837a1052a7718889fcb3316

SHA512
ae4a826b5233ea40e66ceaa9abb834d792366ed3ddd822a7b2af96f17fbbbbd59bcc9bf90758d9af604257e1a3e11a1644d19f44bfacc86172569b3d9d25facd

Download Submit
C:\Windows\SysWOW64\Hmlpaoaj.exe

Filesize
272KB

MD5
d3961187b2739bbebc0439d50a5aba86

SHA1
238927684848a9b39d89b03ba3545cb2988f1f50

SHA256
7046d18f34f244612a4b8e52ca24b8d50bd47bdace6e81f6fc3f1582c00e44db

SHA512
f5e1e69888126fab2c54d62000673acde1a91ebf69cf08a536fbf1c4da57b6271ebf6187c12eb69034bc480b32f955da66f109d9cfbf49b12f98d233619c7b1d

Download Submit
C:\Windows\SysWOW64\Icifbang.exe

Filesize
272KB

MD5
5b97e35e59c5ac41803d842c35f18d88

SHA1
6a32b9612d994102d508bf84d42f51ab4c0020f7

SHA256
ee8e9643f886dfcde2f7b8d372cead1abd753a39ddf48ba473092229f624ee3d

SHA512
2ac6c2543947a85056009804a6ecbeb94af33c7f93890c7d34624d0b98e54f44a507bb29fb0fc391b12af6e396b34e21efde80e330d3b8969e74adadb56fca0f

Download Submit
C:\Windows\SysWOW64\Icnpmp32.exe

Filesize
272KB

MD5
fd76398f7eb7c3e290a2c9348cbf691e

SHA1
474f4d138c773f08a31c6759c89a78436519741a

SHA256
2eeffc525c875ca890bb8628ab23c33f927a922c3c5f1106950e976f830c5d8b

SHA512
3530be7fe97e12a96c2a7d8a800ab789af5d08e2592ae7f3ee80d949fba7430fb0498ecece88dd9ab1a11bb4c01edf51f7743609c8fb65e0732c53bec2875f60

Download Submit
C:\Windows\SysWOW64\Ifjodl32.exe

Filesize
272KB

MD5
dd284ab0cbfe3651d0c6632e9f23231b

SHA1
fff5ea03557f31f68e2c48296e8a9225df96b61e

SHA256
b63a066d8773885f39ddcd1509a709063d5afcda49f2b09fdad87cbf45684c3d

SHA512
202ed700e7f09429092b0fa7a3b69e1f312e1421b7aaf924bdd5b429892fa70ca1a72231493e3240c5440e167c82b03b7c9a92c34c62b1227f39109b56388b2c

Download Submit
C:\Windows\SysWOW64\Ikpaldog.exe

Filesize
272KB

MD5
735461d577405df568163de685304e12

SHA1
3edd1ecc5fb3c723b146a76c19425f87d8d07998

SHA256
d2ada753fce61ca78d0def9cd3170f88cc106f79e5826ebfee7621aaab9625c4

SHA512
136183c2c005fd4dec3049709581e47bf7cbcf307ada2d4cd5d9fd5390dc5bc3901cc086cbe606ce5e8b4adc8ec6b11340c2ba7e7048cd7e81e6003c0ce0c9f6

Download Submit
C:\Windows\SysWOW64\Ipmbjgpi.exe

Filesize
272KB

MD5
8fda6d6c55e0d5d044fe7c30d82f27d6

SHA1
1a1d662f93a7315de2026adf82d3b23316a5296d

SHA256
834ab8f696c432fbe162012e632fa589de65cdc0b9b0b678d9c9b692ab67f95d

SHA512
62f746fdcc0470fb7637ebc538e8d62dce9c98bcf2b45b44dd200d4d040fb1e2fc25cb210291016f39fa9b3c1a64740f53fe0c324445ccc3c10e6e938f618d68

Download Submit
C:\Windows\SysWOW64\Jcbihpel.exe

Filesize
192KB

MD5
88776711c9785aee304389a4de50f3b2

SHA1
ea64026fc93454fb59249e1ab6e4c3af0016dee6

SHA256
6617e33c2d4f79c918422ad93ca288362553292122f993fdb0ea6fad79f70ccc

SHA512
1e6330eae9b6bc66aeebebafa308d4c64116547c2da0b8b526d9ff00ca645cfd3ccd0a09868805a5eb93540a76de006d982a8ba50099e84cb06be8bfb1fc618f

Download Submit
C:\Windows\SysWOW64\Jcbihpel.exe

Filesize
272KB

MD5
b771fd6c00ec751c63dc561095295082

SHA1
6a132c34fc3e1d7c1b1333bde229f8569305452b

SHA256
28a4fd0947181f17c15158a0dfd41b46f6166867fa38964bd5965dc5c15cc5a7

SHA512
a89b58c85c0fcbf54742e8e44df04760401fe7f24cf1a76132aeb8ad2c801724758cf6beccd2ae72e454d37863c6b523b1218077eac504959ce427e56ed2df1d

Download Submit
C:\Windows\SysWOW64\Jcllonma.exe

Filesize
272KB

MD5
055b1557846044dd385883739a9b8735

SHA1
9a424bda26d114471b22e25778a6900afed9536a

SHA256
6f691db7de6f026f0b98e0385cfbb9d98c30b119cf7b135e0e82b1df8c9c3100

SHA512
3801d49cb34d72083d495bbfde23584e82526e2769ba55c6241842a4d5e040e063e27ea917dfc94b05285c9be916983757630e4c3eaa72285d953700c9c21189

Download Submit
C:\Windows\SysWOW64\Jfeopj32.exe

Filesize
272KB

MD5
c7ac8c0b4a9ced1b3413ad3fad0cb801

SHA1
e4aa2c018fe099f97f4c46177c9b4ad34762143e

SHA256
c9c502ef3d7ae428a7580da5573b62e212ca25a7870af960263b9bc58f062bda

SHA512
e262cf59d1ebc1877b9546d9fc0102f0c301b34b8496da726a6f7c2424a91cdb070cc362d781174e337d669b7f72a810b8d2e64907dc46f1ac28b982f7becd7f

Download Submit
C:\Windows\SysWOW64\Jnlkedai.exe

Filesize
272KB

MD5
4ff4d4272666d62ebab97e328168c229

SHA1
7bb36e9e290a6b82182ed8606a60ed3c17205405

SHA256
b47e185efb2467e5122a7691cb86dda440153f3d95a9d4c4b7d07c84a3aca272

SHA512
6b48a85ceff0571be70211efea1e0eabf8bdf01e12624faaed455bffd6a1bdc5fbf5c5b53be416275fd1b13086d5d18f6010f9a912821c3a746357bdfe0f07ca

Download Submit
C:\Windows\SysWOW64\Kbceejpf.exe

Filesize
272KB

MD5
f17e3d0f1d0216cf3cc213391a888d75

SHA1
630f4ffe868b95b3ee2dde71952e054959cf72a3

SHA256
7a54d13774a557cfc8aac48bedcab3bca896d132971a60e42d3a89cc48847835

SHA512
d25977fb5468233755defc4b16e36513ebbf370a6ac9d602711557de825fc7af4df9f3302996a5934a483cb3f8c574549df6f36bfffd9480e5501ebf5de2a774

Download Submit
C:\Windows\SysWOW64\Lmdemd32.exe

Filesize
272KB

MD5
4fed161982a284069f23c5050ea1d268

SHA1
23d14bcf257b617faccda52e7a6dc8428dd5eb16

SHA256
6f0f18d0c92f8dd12dbde8abffc583e69f5feca09f2ff4a5f4e75837ca5ebfe6

SHA512
d64095347e169ab444c76ca7d6bfc3a494fd96b3262316e6ef0c2d2041ccfa60d9323983f2e4d7328b40cf85d3028f2ebbf8f64b3ba5a78ad2988c0bbbdfab8e

Download Submit
C:\Windows\SysWOW64\Mhdckaeo.exe

Filesize
272KB

MD5
bf8e87288fb11848205c80a82cb1578c

SHA1
67ea5ab4af15e2c17384e54053b222008540f928

SHA256
8916865362d08be90a2c6a76c880e1885022bae1454aca2b77041c7acdd66cd9

SHA512
1c7b17ec391a4b2c84627adfde74be97b89f51c2c0770752a9d50209f309585afb737a9c59021c71e26d37e4aed5c7fc8e393e600bb733ea1056d3478dc895dd

Download Submit
C:\Windows\SysWOW64\Mimpolee.exe

Filesize
272KB

MD5
02096ace5435b8facd0262043604b38d

SHA1
e4b7b7db3683de0b455b4910f17114cb9c6e696d

SHA256
7093bc8ba7c10f4cd7fa1d0c9cb298c779dbe8858fb212eb7133f1d5a0d37fec

SHA512
e0ddca1ac0bae7c2dbd91411e1ad90c71d80b559d3e9c60c83637f17e12456b95b6436e8c93eb496d840cc4919dc15b7037b47d77d3bb520dfc32ff0a9259a0b

Download Submit
C:\Windows\SysWOW64\Mminhceb.exe

Filesize
272KB

MD5
a17062e73197601ad1f9d6c37413543f

SHA1
513d18c0af056bd53ab30373432a8d0aa697cde0

SHA256
1f5ec58a47cfcc7191c8649261a5d86a55d06503e61767e8570bb9b5d0ce95e5

SHA512
25f0f8ebffdd6a32f12c54f5834b654955e23f91c1e7c957c08c85b396e0d5ec30b45fadbadf263ba684808095484bad9803b98f5c1bb8e3585550cc5eb780dd

Download Submit
C:\Windows\SysWOW64\Oblmdhdo.exe

Filesize
272KB

MD5
3b3f91b32c25ab111730f68bfa0dbbb3

SHA1
cae6da9e6dabf8684f9e6baf59d0c97be92fd563

SHA256
06521d23b2d082cd9ca594d0192c255ef6cca17c099ad43b2f13509626521d8b

SHA512
9f9e6ec138b136510bee718751a813e67014a01cc4020a6cb1f62db275f624993cc8b17d13e3cd2677577cd69ae4f410b53ab2929bc5b2f4ef7fbe00d4ef3cac

Download Submit
C:\Windows\SysWOW64\Ofcmfodb.exe

Filesize
272KB

MD5
9598168e5bcacdc0ed9f827ec569bd88

SHA1
388320c29825ffca2c223090c6cf70fd2b1235a7

SHA256
78cebf5f79581d13e16b9e17adb49dbf1df464ed67c1633972a3f7bfbd0a4013

SHA512
900f17b53b220511274086c2c986aeed7ee99454aec90ffb216cc6fca585451ffa23e6163b93c4b34b339ef147deb4eabc83774c3d074f209b0b288eca2ca720

Download Submit
C:\Windows\SysWOW64\Ogbipa32.exe

Filesize
128KB

MD5
2c9c5cd264732c3da6f994c20fb6e27f

SHA1
89b253d06ce7569c567400a87d46c11cce9760dd

SHA256
5f61fee4eaed5de17557b4e7a4491b25fc2d4ae6a708706cbde875703486a3ba

SHA512
18b99abedc128bb9fce055658f8c7b96eafbeb5360459e064c8dde25544057b264ab9ddd8a55ac6b3960a3cf638a57fd433df1f52f7371473ec3ad66c665135a

Download Submit
C:\Windows\SysWOW64\Ogbipa32.exe

Filesize
272KB

MD5
266408e570fdff34f73f8dc6675c5e40

SHA1
e1248a4d7cb41e58869a359be67c2c794be8ef23

SHA256
50aeb1b79bb196202082a257ca61de872a3ba28301d6ccf802b7f076ddcbf65e

SHA512
5b35368204cd09d556705f2d5379e1d436fbd0b3faa4ebb3b096a84cfbb49c253da468128022389eecc0146843e7075766c62760141afdec9f991cd81ec58624

Download Submit
C:\Windows\SysWOW64\Ojllan32.exe

Filesize
272KB

MD5
df1f24e1879b19dda3eb427c8cd2e02a

SHA1
a6aa45cf7029dc8adcbee950617af2fe09030cb5

SHA256
90f51243714bf7afef29bf9bab8727b845f5936d52cede9bbc22cae2b6f8a32e

SHA512
e6dfbba82e907c85bbcb2f1993647c5c91d7ac1dbc9b2c61dc5b3fc95bc2317e00e65911b2d1754eaf87cda784048db39cda9913b45970d0b26f4f7339b581ef

Download Submit
C:\Windows\SysWOW64\Opdghh32.exe

Filesize
272KB

MD5
e5160b48aab91054a57297b5f2ab1263

SHA1
396892e3298228b8fcdc20c3e7eeb670953204d3

SHA256
cfeda0fbf88ed6b99c146c3725a457dd7b5d6fe9b5a6015431c2dc3e4c109144

SHA512
37bb44de67b4c2ceb20561e7ade71e844701f0ffaacf1f6a6015b7796e16f7b37d86b3087663567935f165a18ea758e644a14d08f6e0b00b93d3819599828c4e

Download Submit
C:\Windows\SysWOW64\Pfhfan32.exe

Filesize
272KB

MD5
131f493ccf02174fcdb72df29e461e4a

SHA1
3578a1655bc6511390f8a9d25240de2f880a3504

SHA256
92605b6a8c4ec461c579837193889ad3cc9f0e46dd583df46cde980a7274a0c8

SHA512
61bbce23ab381d6e957b62b8c10ce8f61a4df91f78d407d6e5eefba38232f99a68c6e53701cf1a2dc77c52d23b046838cb7c4b9533866e13f42da7bdc1b60ff6

Download Submit
C:\Windows\SysWOW64\Pfjcgn32.exe

Filesize
272KB

MD5
f510514efff2b1deef6db16889503073

SHA1
51399dc93ecc8421e10312e40ce7f58c04cc99fd

SHA256
93c2712465b776e1ecf0339e951957272a2b717e52ab4b9272737f8357603ba3

SHA512
bbd250920dd0403975409050328ce3dffeb6b316598e920e264668517f03f8c3f3b590a8d9c741a9a522b710f6e9cccc73858c383659ba6fef57f4f76c5c7769

Download Submit
C:\Windows\SysWOW64\Pfjcgn32.exe

Filesize
272KB

MD5
a376ba414592d7e8e64c0cbc7dab0898

SHA1
db7eb5fa51b35d8e50fa82df9f3e6d3f88657248

SHA256
a64627826bca33b1c06fbf55b698a19833bb74012807e143ed9bd6705c5ef301

SHA512
6d2c6a169cdbc586f232680c376c2346e3d4bb0d6d106cfddc2a3a1a069e64f5a2259dd216b3ba5fc8bdd15d68a12cf9c0d3532f03997e67592ae54338904c96

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
272KB

MD5
81fadfa4fc03f70360703d86064f49bb

SHA1
2dd4f3abe19d2c8fa9a4027a2fc7cf9089f1c751

SHA256
4de3cc997a8c2f10cbcabdd5d82441b52a69f38b80a473044b13d5097412573a

SHA512
9956ddf5d9acaa8f3d7ac30e24ca46f9c6f0490a7d9ea538d7f1994b0e5f2078ba29d7d20132c0ac25274d98db7495c6641f3b0ed5dd12dbf349b09312d596fd

Download Submit
C:\Windows\SysWOW64\Pqdqof32.exe

Filesize
272KB

MD5
de150def797e8a19ca513d7a600ec306

SHA1
c2f434a7e7baf106ba3351d3c00c792fd56165e1

SHA256
0b7b658791373feceb19e74a3dc928b5b73b42b71007fae4a87d1019018327dd

SHA512
a8ea82b50397dfa43bc2565b06f788d7b16dc4000b67fecab0a978c86b724bb9c03e4b8c08019d6bfe31a34de7b71f4ad1dec67c7eb7211551d53e0dc48c13bc

Download Submit
C:\Windows\SysWOW64\Qceiaa32.exe

Filesize
272KB

MD5
c6b2b79255d9cef1f61b832b7db64c4a

SHA1
c41b7fd5db8dfb8982668c251b60873de0c7fcdc

SHA256
76a8e52232f32de40cf8dc1795af079847cbb6b9f10eea7a9c278414a95d57e0

SHA512
3402ccac00ded76d78c2b518c60a9671f96960240c192d557da4eeb30647bb44bac9cea203c62f7eadbc271dcc5f771035d1f166e32bcbfdb6afe9696eebea10

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
272KB

MD5
9f6e8e115dc1a9ad96188e9be68915ad

SHA1
655a46b85101034c3997e0fc2783a726ef28d010

SHA256
44134a8b2bde583a8302000816ee3ac2f4d92db6a438657711a06080e68cdbd3

SHA512
f4a4c3ebe670bedd771d6218fbe0c19a24a43f43c686d6c28d0460f5fb5e30bbafaa0904fc7f1bf4bfbe66fc26a5a0a06c3470ad8109526c229885592daeeb1f

Download Submit
C:\Windows\SysWOW64\Qmmnjfnl.exe

Filesize
272KB

MD5
0235fca950d718f8f8851f5e3a9244e8

SHA1
3d2d4edd7ca548fff680ddaf2b56ad7c7a580dcb

SHA256
1f05c128c16feb2469f2fa10f36ed6ffd62a1ff387fbc5585e9ab35f8f8b4ae0

SHA512
e0f87bc82c3c0a74210c774b364216f8d0ece0df2c9c1de47720c7d58e973f1e8fb01962a9f50efe330929c18164e87b911c9f986fef4e9a62e14a370288f825

Download Submit
C:\Windows\SysWOW64\Qnhahj32.exe

Filesize
272KB

MD5
38d3a4bf0721e14aa026328ec585e867

SHA1
04c8097976869688ab173da021d6e752aedc95e6

SHA256
df5dd18ff3b20cc6514abe670bcb97ee3d6830a7d4c27b7609682b2ddb8dde52

SHA512
eb89923ca7f2ffbfd6b860c797a11314dab5c33d56688a4edfad8c66c0fc452dae27990d9a3438ba57838b1aeccfb2c8a79cb6d0db1b6e206946272d37d6a66f

Download Submit
memory/388-212-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/404-376-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/548-334-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/556-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/780-119-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/884-316-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1180-364-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1224-244-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1228-228-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1280-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1372-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1384-352-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1412-170-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1444-20-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1512-292-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1696-340-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1712-400-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1800-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1800-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1832-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1836-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1856-388-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1876-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1956-477-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1956-47-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2272-410-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2276-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2340-139-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2472-437-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2560-255-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2700-39-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2700-476-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2740-394-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2876-425-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2948-472-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2948-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2960-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2984-111-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3076-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3168-63-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3168-479-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3184-216-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3196-324-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3200-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3236-358-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3320-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3500-280-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3504-95-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3580-443-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3684-304-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3784-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3824-475-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3824-31-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3852-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3852-478-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3992-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4000-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4020-298-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4228-274-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4328-382-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4440-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4488-370-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4528-416-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4540-203-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4636-156-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4864-147-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4876-127-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4880-422-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5020-236-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5056-346-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5060-474-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5060-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads