41497ab0231e4238ff8739c2ea1e2eb3af2e0b183fbc8218a3697e09314bc7c1

Analysis

max time kernel
152s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41497ab0231e4238ff8739c2ea1e2eb3af2e0b183fbc8218a3697e09314bc7c1.exe
Size

482KB
MD5

167b4c84732171297fe6c25d0c3c066a
SHA1

2845d18d98ce4020874d414fff14ad1d3f493ecb
SHA256

41497ab0231e4238ff8739c2ea1e2eb3af2e0b183fbc8218a3697e09314bc7c1
SHA512

21f6cceef06fb7ebf2053155444d99f7e08eba75105c6587f17cb350b0b9bff9f1e27c4e546eafb683364c2d499ee2ffb91ee9814367420e26666853a816dcaa
SSDEEP

6144:B9kU8gLl+wGXAF2PbgKLVGFM6234lKm3mo8Yvi4KsLTFM6234lKm3:BfhLMwGXAF5KLVGFB24lwR45FB24l

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Igajal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pofjpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hjlkge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Igjngh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lkabjbih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pkogiikb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcmeke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiieicml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jelonkph.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfbkpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Abponp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjdedepg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnpofnhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Meiioonj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfjdqmng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppgegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Obkahddl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Akglloai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chiigadc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hplbickp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dgeenfog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pakdbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nfnjbdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kghjhemo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phganm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hoclopne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hmdlmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aoioli32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iahgad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Khdoqefq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjepjkhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kcpjnjii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cpmapodj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgeenfog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iacngdgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhgiim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mklfjm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkphhgfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lalnmiia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pifnhpmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ebjcajjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebommi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Plbfdekd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hoaojp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njhgbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iddljmpc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfjkjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hffken32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjfmkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iknmla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hffken32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gmdcfidg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aimkjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kkjlic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbgeno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jgeghp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plmmif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efblbbqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efgemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nadleilm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hbiapb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ljbnfleo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fphnlcdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Meamcg32.exe

Executes dropped EXE 64 IoCs

pid	Process
4948	Igfkfo32.exe
1872	Ibkpcg32.exe
1280	Ighhln32.exe
1968	Jkhngl32.exe
1060	Jfbkpd32.exe
4340	Jgfdmlcm.exe
3084	Kfjapcii.exe
2112	Mekgdl32.exe
1008	Mockmala.exe
1348	Nhlpfgbb.exe
4092	Niklpj32.exe
4328	Npjnhc32.exe
4748	Nookip32.exe
2988	Olckbd32.exe
2800	Ocamjm32.exe
4660	Opemca32.exe
4564	Phcomcng.exe
2980	Pcicklnn.exe
3876	Phelcc32.exe
2300	Pgflqkdd.exe
4300	Plcdiabk.exe
3964	Ppamophb.exe
1100	Pgkelj32.exe
2968	Phlacbfm.exe
836	Pofjpl32.exe
2232	Qgnbaj32.exe
2180	Qlmgopjq.exe
4352	Aimkjp32.exe
1052	Bmkcqn32.exe
4204	Boklbi32.exe
4600	Bqkill32.exe
1312	Bfjnjcni.exe
3092	Cgjjdf32.exe
1696	Cmfclm32.exe
2540	Cimcan32.exe
4980	Cippgm32.exe
3880	Cfcqpa32.exe
3028	Cpleig32.exe
3620	Cffmfadl.exe
2936	Dfhjkabi.exe
2672	Dfmcfp32.exe
932	Ddadpdmn.exe
1400	Dmihij32.exe
4676	Dfamapjo.exe
3716	Ehailbaa.exe
2404	Edhjqc32.exe
5080	Eidbij32.exe
4852	Edjgfcec.exe
1004	Ehhpla32.exe
3392	Emehdh32.exe
656	Filiii32.exe
1520	Fhmigagd.exe
3384	Fphnlcdo.exe
3132	Fipbdikp.exe
1432	Fhabbp32.exe
4576	Fajgkfio.exe
4928	Fggocmhf.exe
4736	Fpodlbng.exe
116	Gigheh32.exe
3304	Gdmmbq32.exe
1172	Gkgeoklj.exe
2376	Gdoihpbk.exe
5116	Gilapgqb.exe
4428	Ggpbjkpl.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ccdnjp32.exe	Cioilg32.exe
File opened for modification	C:\Windows\SysWOW64\Amjillkj.exe	Qeodhjmo.exe
File created	C:\Windows\SysWOW64\Igajal32.exe	Imiehfao.exe
File created	C:\Windows\SysWOW64\Gapbdjgd.dll	Hjjnae32.exe
File created	C:\Windows\SysWOW64\Hplbickp.exe	Hmkigh32.exe
File created	C:\Windows\SysWOW64\Ooqqdi32.exe	Oidhlb32.exe
File opened for modification	C:\Windows\SysWOW64\Bjlpjm32.exe	Bbdhiojo.exe
File created	C:\Windows\SysWOW64\Pjcmhh32.dll	Dimenegi.exe
File opened for modification	C:\Windows\SysWOW64\Mmpdhboj.exe	Maiccajf.exe
File opened for modification	C:\Windows\SysWOW64\Efblbbqd.exe	Emjgim32.exe
File opened for modification	C:\Windows\SysWOW64\Hbiapb32.exe	Hgcmbj32.exe
File created	C:\Windows\SysWOW64\Hkbdki32.exe	Hpmpnp32.exe
File created	C:\Windows\SysWOW64\Ipeeobbe.exe	Iepaaico.exe
File created	C:\Windows\SysWOW64\Hjpcoo32.dll	Hammhcij.exe
File created	C:\Windows\SysWOW64\Jcdala32.exe	Jlkipgpe.exe
File created	C:\Windows\SysWOW64\Lpepbgbd.exe	Kofdhd32.exe
File opened for modification	C:\Windows\SysWOW64\Obkahddl.exe	Oomelheh.exe
File created	C:\Windows\SysWOW64\Gnlgleef.exe	Gphgbafl.exe
File created	C:\Windows\SysWOW64\Akpoaj32.exe	Aoioli32.exe
File opened for modification	C:\Windows\SysWOW64\Hgcmbj32.exe	Haidfpki.exe
File opened for modification	C:\Windows\SysWOW64\Domdjj32.exe	Ddgplado.exe
File created	C:\Windows\SysWOW64\Ojgjndno.exe	Oejbfmpg.exe
File created	C:\Windows\SysWOW64\Afnqfkij.dll	Cljobphg.exe
File opened for modification	C:\Windows\SysWOW64\Apaadpng.exe	Aopemh32.exe
File opened for modification	C:\Windows\SysWOW64\Pofjpl32.exe	Phlacbfm.exe
File created	C:\Windows\SysWOW64\Ppgegd32.exe	Pnfiplog.exe
File opened for modification	C:\Windows\SysWOW64\Omopjcjp.exe	Ofegni32.exe
File created	C:\Windows\SysWOW64\Eephln32.dll	Icnklbmj.exe
File opened for modification	C:\Windows\SysWOW64\Pldcjeia.exe	Paoollik.exe
File created	C:\Windows\SysWOW64\Ckjbhmad.exe	Cdpjlb32.exe
File created	C:\Windows\SysWOW64\Apjfbb32.dll	Lomjicei.exe
File created	C:\Windows\SysWOW64\Aannbg32.dll	Idhiii32.exe
File created	C:\Windows\SysWOW64\Bdkohe32.dll	Mcqjon32.exe
File created	C:\Windows\SysWOW64\Cdpjlb32.exe	Cbbnpg32.exe
File created	C:\Windows\SysWOW64\Fcndmiqg.dll	Lhgkgijg.exe
File created	C:\Windows\SysWOW64\Dagdgfkf.dll	Ipdndloi.exe
File created	C:\Windows\SysWOW64\Ilmifh32.dll	Enigke32.exe
File created	C:\Windows\SysWOW64\Jgpfbjlo.exe	Jpenfp32.exe
File opened for modification	C:\Windows\SysWOW64\Hejjanpm.exe	Hbknebqi.exe
File created	C:\Windows\SysWOW64\Hkfglb32.exe	Hpabni32.exe
File created	C:\Windows\SysWOW64\Pakllc32.exe	Polppg32.exe
File created	C:\Windows\SysWOW64\Ijcjmmil.exe	Iciaqc32.exe
File created	C:\Windows\SysWOW64\Imnocf32.exe	Ipjoja32.exe
File created	C:\Windows\SysWOW64\Cgjjdf32.exe	Bfjnjcni.exe
File opened for modification	C:\Windows\SysWOW64\Abbkcpma.exe	Akhcfe32.exe
File created	C:\Windows\SysWOW64\Jddnfd32.exe	Jjoiil32.exe
File created	C:\Windows\SysWOW64\Oeehkn32.exe	Nnkpnclp.exe
File created	C:\Windows\SysWOW64\Jjpode32.exe	Jokkgl32.exe
File created	C:\Windows\SysWOW64\Hanpdgfl.dll	Kiphjo32.exe
File created	C:\Windows\SysWOW64\Mnfgko32.dll	Kofdhd32.exe
File created	C:\Windows\SysWOW64\Hgcmbj32.exe	Haidfpki.exe
File created	C:\Windows\SysWOW64\Niklpj32.exe	Nhlpfgbb.exe
File opened for modification	C:\Windows\SysWOW64\Dfmcfp32.exe	Dfhjkabi.exe
File created	C:\Windows\SysWOW64\Lkofdbkj.exe	Knkekn32.exe
File created	C:\Windows\SysWOW64\Ajpqnneo.exe	Akoqpg32.exe
File created	C:\Windows\SysWOW64\Iafkni32.dll	Akcjkfij.exe
File created	C:\Windows\SysWOW64\Meiioonj.exe	Mmbanbmg.exe
File opened for modification	C:\Windows\SysWOW64\Kjeiodek.exe	Kpmdfonj.exe
File created	C:\Windows\SysWOW64\Ckjfdocc.dll	Qiiflaoo.exe
File created	C:\Windows\SysWOW64\Mekgdl32.exe	Kfjapcii.exe
File opened for modification	C:\Windows\SysWOW64\Panhbfep.exe	Pjdpelnc.exe
File created	C:\Windows\SysWOW64\Cbeapmll.exe	Ckkiccep.exe
File created	C:\Windows\SysWOW64\Eifaim32.exe	Efgemb32.exe
File opened for modification	C:\Windows\SysWOW64\Kflide32.exe	Kcmmhj32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dmcain32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Khiofk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cgjjdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jaddoaap.dll"	Fhabbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hildmn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Knkekn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ekjded32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkaokcqj.dll"	Mjggal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oqmhqapg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ggjjlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhbejblj.dll"	Hgcmbj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kpcjgnhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ibkpcg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dfefkkqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iofeei32.dll"	Jnelok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oejbfmpg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dfglfdkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dfmcfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pcmeke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ffaong32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oiagde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkiebg32.dll"	Gkgeoklj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbeojn32.dll"	Jncoikmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kcidmkpq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djfoankj.dll"	Diccgfpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmnajl32.dll"	Meiioonj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Didmdo32.dll"	Igajal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jadgnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkhfob32.dll"	Kfjapcii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bmkcqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ooejohhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieoacg32.dll"	Adfnofpd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ejlbhh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Igpdfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jncoikmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bjlpjm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ebejfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jlgepanl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlpncq32.dll"	Nlcalieg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Eqdpgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Akhcfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ckkiccep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehkljb32.dll"	Lnmkfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddplkbaa.dll"	Jdmgfedl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njkkbehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eopjfnlo.dll"	Pnfiplog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnpofk32.dll"	Dhphmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jblpmmae.dll"	Niklpj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fpodlbng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ejalcgkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebdoljdi.dll"	Mhldbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Piomhofd.dll"	Iafonaao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ckclhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcleff32.dll"	Ncnofeof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bfjnjcni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fljcnd32.dll"	Cfcqpa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jdmgfedl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkhimi32.dll"	Ehailbaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eemnff32.dll"	Jgpfbjlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fphnlcdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oidhlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Moehgcil.dll"	Aefjii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcjdoc32.dll"	Kdbjhbbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dpdaepai.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 4948	220	41497ab0231e4238ff8739c2ea1e2eb3af2e0b183fbc8218a3697e09314bc7c1.exe	87
PID 220 wrote to memory of 4948	220	41497ab0231e4238ff8739c2ea1e2eb3af2e0b183fbc8218a3697e09314bc7c1.exe	87
PID 220 wrote to memory of 4948	220	41497ab0231e4238ff8739c2ea1e2eb3af2e0b183fbc8218a3697e09314bc7c1.exe	87
PID 4948 wrote to memory of 1872	4948	Igfkfo32.exe	88
PID 4948 wrote to memory of 1872	4948	Igfkfo32.exe	88
PID 4948 wrote to memory of 1872	4948	Igfkfo32.exe	88
PID 1872 wrote to memory of 1280	1872	Ibkpcg32.exe	89
PID 1872 wrote to memory of 1280	1872	Ibkpcg32.exe	89
PID 1872 wrote to memory of 1280	1872	Ibkpcg32.exe	89
PID 1280 wrote to memory of 1968	1280	Ighhln32.exe	90
PID 1280 wrote to memory of 1968	1280	Ighhln32.exe	90
PID 1280 wrote to memory of 1968	1280	Ighhln32.exe	90
PID 1968 wrote to memory of 1060	1968	Jkhngl32.exe	91
PID 1968 wrote to memory of 1060	1968	Jkhngl32.exe	91
PID 1968 wrote to memory of 1060	1968	Jkhngl32.exe	91
PID 1060 wrote to memory of 4340	1060	Jfbkpd32.exe	92
PID 1060 wrote to memory of 4340	1060	Jfbkpd32.exe	92
PID 1060 wrote to memory of 4340	1060	Jfbkpd32.exe	92
PID 4340 wrote to memory of 3084	4340	Jgfdmlcm.exe	93
PID 4340 wrote to memory of 3084	4340	Jgfdmlcm.exe	93
PID 4340 wrote to memory of 3084	4340	Jgfdmlcm.exe	93
PID 3084 wrote to memory of 2112	3084	Kfjapcii.exe	94
PID 3084 wrote to memory of 2112	3084	Kfjapcii.exe	94
PID 3084 wrote to memory of 2112	3084	Kfjapcii.exe	94
PID 2112 wrote to memory of 1008	2112	Mekgdl32.exe	95
PID 2112 wrote to memory of 1008	2112	Mekgdl32.exe	95
PID 2112 wrote to memory of 1008	2112	Mekgdl32.exe	95
PID 1008 wrote to memory of 1348	1008	Mockmala.exe	96
PID 1008 wrote to memory of 1348	1008	Mockmala.exe	96
PID 1008 wrote to memory of 1348	1008	Mockmala.exe	96
PID 1348 wrote to memory of 4092	1348	Nhlpfgbb.exe	97
PID 1348 wrote to memory of 4092	1348	Nhlpfgbb.exe	97
PID 1348 wrote to memory of 4092	1348	Nhlpfgbb.exe	97
PID 4092 wrote to memory of 4328	4092	Niklpj32.exe	98
PID 4092 wrote to memory of 4328	4092	Niklpj32.exe	98
PID 4092 wrote to memory of 4328	4092	Niklpj32.exe	98
PID 4328 wrote to memory of 4748	4328	Npjnhc32.exe	99
PID 4328 wrote to memory of 4748	4328	Npjnhc32.exe	99
PID 4328 wrote to memory of 4748	4328	Npjnhc32.exe	99
PID 4748 wrote to memory of 2988	4748	Nookip32.exe	101
PID 4748 wrote to memory of 2988	4748	Nookip32.exe	101
PID 4748 wrote to memory of 2988	4748	Nookip32.exe	101
PID 2988 wrote to memory of 2800	2988	Olckbd32.exe	102
PID 2988 wrote to memory of 2800	2988	Olckbd32.exe	102
PID 2988 wrote to memory of 2800	2988	Olckbd32.exe	102
PID 2800 wrote to memory of 4660	2800	Ocamjm32.exe	103
PID 2800 wrote to memory of 4660	2800	Ocamjm32.exe	103
PID 2800 wrote to memory of 4660	2800	Ocamjm32.exe	103
PID 4660 wrote to memory of 4564	4660	Opemca32.exe	104
PID 4660 wrote to memory of 4564	4660	Opemca32.exe	104
PID 4660 wrote to memory of 4564	4660	Opemca32.exe	104
PID 4564 wrote to memory of 2980	4564	Phcomcng.exe	105
PID 4564 wrote to memory of 2980	4564	Phcomcng.exe	105
PID 4564 wrote to memory of 2980	4564	Phcomcng.exe	105
PID 2980 wrote to memory of 3876	2980	Pcicklnn.exe	106
PID 2980 wrote to memory of 3876	2980	Pcicklnn.exe	106
PID 2980 wrote to memory of 3876	2980	Pcicklnn.exe	106
PID 3876 wrote to memory of 2300	3876	Phelcc32.exe	107
PID 3876 wrote to memory of 2300	3876	Phelcc32.exe	107
PID 3876 wrote to memory of 2300	3876	Phelcc32.exe	107
PID 2300 wrote to memory of 4300	2300	Pgflqkdd.exe	108
PID 2300 wrote to memory of 4300	2300	Pgflqkdd.exe	108
PID 2300 wrote to memory of 4300	2300	Pgflqkdd.exe	108
PID 4300 wrote to memory of 3964	4300	Plcdiabk.exe	109

C:\Users\Admin\AppData\Local\Temp\41497ab0231e4238ff8739c2ea1e2eb3af2e0b183fbc8218a3697e09314bc7c1.exe
"C:\Users\Admin\AppData\Local\Temp\41497ab0231e4238ff8739c2ea1e2eb3af2e0b183fbc8218a3697e09314bc7c1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\SysWOW64\Igfkfo32.exe
  C:\Windows\system32\Igfkfo32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\SysWOW64\Ibkpcg32.exe
    C:\Windows\system32\Ibkpcg32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\Windows\SysWOW64\Ighhln32.exe
      C:\Windows\system32\Ighhln32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1280
    - - C:\Windows\SysWOW64\Jkhngl32.exe
        
        C:\Windows\system32\Jkhngl32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1968
      - C:\Windows\SysWOW64\Jfbkpd32.exe
        
        C:\Windows\system32\Jfbkpd32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Windows\SysWOW64\Kfjapcii.exe
        
        C:\Windows\system32\Kfjapcii.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\SysWOW64\Mekgdl32.exe
        
        C:\Windows\system32\Mekgdl32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2112
        
        C:\Windows\SysWOW64\Mockmala.exe
        
        C:\Windows\system32\Mockmala.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1008
        
        C:\Windows\SysWOW64\Nhlpfgbb.exe
        
        C:\Windows\system32\Nhlpfgbb.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1348
        
        C:\Windows\SysWOW64\Niklpj32.exe
        
        C:\Windows\system32\Niklpj32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Windows\SysWOW64\Npjnhc32.exe
        
        C:\Windows\system32\Npjnhc32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\SysWOW64\Nookip32.exe
        
        C:\Windows\system32\Nookip32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\SysWOW64\Olckbd32.exe
        
        C:\Windows\system32\Olckbd32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\SysWOW64\Ocamjm32.exe
        
        C:\Windows\system32\Ocamjm32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\SysWOW64\Phcomcng.exe
        
        C:\Windows\system32\Phcomcng.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\SysWOW64\Pcicklnn.exe
        
        C:\Windows\system32\Pcicklnn.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\SysWOW64\Pgflqkdd.exe
        
        C:\Windows\system32\Pgflqkdd.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\SysWOW64\Plcdiabk.exe
        
        C:\Windows\system32\Plcdiabk.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4300
        
        C:\Windows\SysWOW64\Ppamophb.exe
        
        C:\Windows\system32\Ppamophb.exe
        23⤵
        Executes dropped EXE
        
        PID:3964
        
        C:\Windows\SysWOW64\Pgkelj32.exe
        
        C:\Windows\system32\Pgkelj32.exe
        24⤵
        Executes dropped EXE
        
        PID:1100
        
        C:\Windows\SysWOW64\Phlacbfm.exe
        
        C:\Windows\system32\Phlacbfm.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2968
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:836
        
        C:\Windows\SysWOW64\Qgnbaj32.exe
        
        C:\Windows\system32\Qgnbaj32.exe
        27⤵
        Executes dropped EXE
        
        PID:2232
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        28⤵
        Executes dropped EXE
        
        PID:2180
        
        C:\Windows\SysWOW64\Aimkjp32.exe
        
        C:\Windows\system32\Aimkjp32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\Bmkcqn32.exe
        
        C:\Windows\system32\Bmkcqn32.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1052
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        31⤵
        Executes dropped EXE
        
        PID:4204
        
        C:\Windows\SysWOW64\Bqkill32.exe
        
        C:\Windows\system32\Bqkill32.exe
        32⤵
        Executes dropped EXE
        
        PID:4600
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1312
        
        C:\Windows\SysWOW64\Cgjjdf32.exe
        
        C:\Windows\system32\Cgjjdf32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3092
        
        C:\Windows\SysWOW64\Cmfclm32.exe
        
        C:\Windows\system32\Cmfclm32.exe
        35⤵
        Executes dropped EXE
        
        PID:1696
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        36⤵
        Executes dropped EXE
        
        PID:2540
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        37⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\Cfcqpa32.exe
        
        C:\Windows\system32\Cfcqpa32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3880
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        39⤵
        Executes dropped EXE
        
        PID:3028
        
        C:\Windows\SysWOW64\Cffmfadl.exe
        
        C:\Windows\system32\Cffmfadl.exe
        40⤵
        Executes dropped EXE
        
        PID:3620
        
        C:\Windows\SysWOW64\Dfhjkabi.exe
        
        C:\Windows\system32\Dfhjkabi.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2936
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2672
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        43⤵
        Executes dropped EXE
        
        PID:932
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        44⤵
        Executes dropped EXE
        
        PID:1400
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        45⤵
        Executes dropped EXE
        
        PID:4676
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3716
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        47⤵
        Executes dropped EXE
        
        PID:2404
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        48⤵
        Executes dropped EXE
        
        PID:5080
        
        C:\Windows\SysWOW64\Edjgfcec.exe
        
        C:\Windows\system32\Edjgfcec.exe
        49⤵
        Executes dropped EXE
        
        PID:4852
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        50⤵
        Executes dropped EXE
        
        PID:1004
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        51⤵
        Executes dropped EXE
        
        PID:3392
        
        C:\Windows\SysWOW64\Filiii32.exe
        
        C:\Windows\system32\Filiii32.exe
        52⤵
        Executes dropped EXE
        
        PID:656
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        53⤵
        Executes dropped EXE
        
        PID:1520
        
        C:\Windows\SysWOW64\Fphnlcdo.exe
        
        C:\Windows\system32\Fphnlcdo.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3384
        
        C:\Windows\SysWOW64\Fipbdikp.exe
        
        C:\Windows\system32\Fipbdikp.exe
        55⤵
        Executes dropped EXE
        
        PID:3132
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1432
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        57⤵
        Executes dropped EXE
        
        PID:4576
        
        C:\Windows\SysWOW64\Fggocmhf.exe
        
        C:\Windows\system32\Fggocmhf.exe
        58⤵
        Executes dropped EXE
        
        PID:4928
        
        C:\Windows\SysWOW64\Fpodlbng.exe
        
        C:\Windows\system32\Fpodlbng.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4736
        
        C:\Windows\SysWOW64\Gigheh32.exe
        
        C:\Windows\system32\Gigheh32.exe
        60⤵
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        61⤵
        Executes dropped EXE
        
        PID:3304
        
        C:\Windows\SysWOW64\Gkgeoklj.exe
        
        C:\Windows\system32\Gkgeoklj.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1172
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        63⤵
        Executes dropped EXE
        
        PID:2376
        
        C:\Windows\SysWOW64\Gilapgqb.exe
        
        C:\Windows\system32\Gilapgqb.exe
        64⤵
        Executes dropped EXE
        
        PID:5116
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        65⤵
        Executes dropped EXE
        
        PID:4428
        
        C:\Windows\SysWOW64\Gphgbafl.exe
        
        C:\Windows\system32\Gphgbafl.exe
        66⤵
        Drops file in System32 directory
        
        PID:3488
        
        C:\Windows\SysWOW64\Gnlgleef.exe
        
        C:\Windows\system32\Gnlgleef.exe
        67⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        68⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Hpmpnp32.exe
        
        C:\Windows\system32\Hpmpnp32.exe
        69⤵
        Drops file in System32 directory
        
        PID:5244
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        70⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        71⤵
        Drops file in System32 directory
        
        PID:5328
        
        C:\Windows\SysWOW64\Hncmmd32.exe
        
        C:\Windows\system32\Hncmmd32.exe
        72⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        73⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Hjjnae32.exe
        
        C:\Windows\system32\Hjjnae32.exe
        74⤵
        Drops file in System32 directory
        
        PID:5456
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        75⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5532
        
        C:\Windows\SysWOW64\Igqkqiai.exe
        
        C:\Windows\system32\Igqkqiai.exe
        77⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Iafonaao.exe
        
        C:\Windows\system32\Iafonaao.exe
        78⤵
        Modifies registry class
        
        PID:5608
        
        C:\Windows\SysWOW64\Iddljmpc.exe
        
        C:\Windows\system32\Iddljmpc.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5652
        
        C:\Windows\SysWOW64\Ijadbdoj.exe
        
        C:\Windows\system32\Ijadbdoj.exe
        80⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        81⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        82⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Iqmidndd.exe
        
        C:\Windows\system32\Iqmidndd.exe
        83⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        84⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5904
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        86⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        87⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        88⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        89⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        90⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Jdedak32.exe
        
        C:\Windows\system32\Jdedak32.exe
        91⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        92⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        93⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        94⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Kghjhemo.exe
        
        C:\Windows\system32\Kghjhemo.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5452
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        96⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        97⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Kkfcndce.exe
        
        C:\Windows\system32\Kkfcndce.exe
        98⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        99⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Kgmcce32.exe
        
        C:\Windows\system32\Kgmcce32.exe
        100⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        101⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5928
        
        C:\Windows\SysWOW64\Kecabifp.exe
        
        C:\Windows\system32\Kecabifp.exe
        103⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        104⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Knkekn32.exe
        
        C:\Windows\system32\Knkekn32.exe
        105⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5148
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        106⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Lalnmiia.exe
        
        C:\Windows\system32\Lalnmiia.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5376
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5616
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        110⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        111⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        112⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        113⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        114⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\Lijlof32.exe
        
        C:\Windows\system32\Lijlof32.exe
        115⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        116⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5564
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        118⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        119⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        120⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        121⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        122⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        123⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        124⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5316
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        125⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\Oekiqccc.exe
        
        C:\Windows\system32\Oekiqccc.exe
        126⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        127⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        128⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        129⤵
        Modifies registry class
        
        PID:6184
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        130⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        131⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        132⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Pkogiikb.exe
        
        C:\Windows\system32\Pkogiikb.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6364
        
        C:\Windows\SysWOW64\Pahpfc32.exe
        
        C:\Windows\system32\Pahpfc32.exe
        134⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        135⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        136⤵
        Drops file in System32 directory
        
        PID:6492
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        137⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        138⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        139⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        140⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6756
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6796
        
        C:\Windows\SysWOW64\Pifnhpmi.exe
        
        C:\Windows\system32\Pifnhpmi.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6844
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        144⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        145⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        146⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        147⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        148⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        149⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        150⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        151⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        152⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6280
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        154⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Akamff32.exe
        
        C:\Windows\system32\Akamff32.exe
        155⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        156⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        157⤵
        Drops file in System32 directory
        
        PID:6528
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        158⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        159⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6788
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        161⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        162⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        163⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        164⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        165⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        166⤵
        Drops file in System32 directory
        
        PID:6196
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        167⤵
        Modifies registry class
        
        PID:6300
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        168⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Bbgeno32.exe
        
        C:\Windows\system32\Bbgeno32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6508
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        170⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        171⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        172⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        173⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        174⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        175⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        176⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        177⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        178⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        179⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        180⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        181⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        182⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        183⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        184⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7076
        
        C:\Windows\SysWOW64\Cbeapmll.exe
        
        C:\Windows\system32\Cbeapmll.exe
        185⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        186⤵
        Drops file in System32 directory
        
        PID:6928
        
        C:\Windows\SysWOW64\Ccdnjp32.exe
        
        C:\Windows\system32\Ccdnjp32.exe
        187⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        188⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        189⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        190⤵
        Modifies registry class
        
        PID:7244
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        191⤵
        Modifies registry class
        
        PID:7280
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        192⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        193⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Djelgied.exe
        
        C:\Windows\system32\Djelgied.exe
        194⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        195⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        196⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        197⤵
        Modifies registry class
        
        PID:7516
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        198⤵
        Drops file in System32 directory
        
        PID:7556
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        199⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        200⤵
        Modifies registry class
        
        PID:7636
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        201⤵
        Modifies registry class
        
        PID:7676
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        202⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        203⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        204⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7836
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        206⤵
        Modifies registry class
        
        PID:7876
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        207⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        208⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        209⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        210⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8080
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8124
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        213⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        214⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        215⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        216⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        217⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        218⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        219⤵
        Modifies registry class
        
        PID:7576
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        220⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        221⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        222⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        223⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        224⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        225⤵
        Drops file in System32 directory
        
        PID:8028
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        226⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        227⤵
        Modifies registry class
        
        PID:6780
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        228⤵
        Modifies registry class
        
        PID:7304
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        229⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        230⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7684
        
        C:\Windows\SysWOW64\Ipjedh32.exe
        
        C:\Windows\system32\Ipjedh32.exe
        232⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        233⤵
        Drops file in System32 directory
        
        PID:7896
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        234⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        235⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        236⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        237⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        238⤵
        Drops file in System32 directory
        
        PID:7448
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        239⤵
        Modifies registry class
        
        PID:7704
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        240⤵
        Modifies registry class
        
        PID:7788
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        241⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        242⤵
        Modifies registry class
        
        PID:2984
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        243⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        244⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        245⤵
        Drops file in System32 directory
        
        PID:7908
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        246⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        247⤵
        Drops file in System32 directory
        
        PID:7348
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        248⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        249⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        250⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        251⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7976
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        253⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        254⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8284
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        256⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        257⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        258⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        259⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        260⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        261⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        262⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        263⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        264⤵
        Modifies registry class
        
        PID:8632
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        265⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        266⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        267⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        268⤵
        Modifies registry class
        
        PID:8796
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        269⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        270⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        271⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        272⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        273⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        274⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        275⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        276⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        277⤵
        Drops file in System32 directory
        
        PID:9144
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        278⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        279⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        280⤵
        Drops file in System32 directory
        
        PID:8272
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        281⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        282⤵
        Drops file in System32 directory
        
        PID:3220
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8464
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        284⤵
        Modifies registry class
        
        PID:8588
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        285⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        286⤵
        Modifies registry class
        
        PID:8712
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        287⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        288⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        289⤵
        Drops file in System32 directory
        
        PID:8920
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        290⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        291⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        292⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        293⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        294⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        295⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8352
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        296⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        297⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        298⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        299⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8692
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        301⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        302⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9016
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        304⤵
        Drops file in System32 directory
        
        PID:9128
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        305⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        306⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        307⤵
        Drops file in System32 directory
        
        PID:8540
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        308⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        309⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        310⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        311⤵
        Modifies registry class
        
        PID:8980
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        312⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        313⤵
        Modifies registry class
        
        PID:8428
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        314⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        315⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        316⤵
        
        PID:820
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8436
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        318⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        319⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        320⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        321⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        322⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        323⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        324⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        325⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        326⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        327⤵
        Modifies registry class
        
        PID:9400
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        328⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        329⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        330⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9588
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        332⤵
        Drops file in System32 directory
        
        PID:9636
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        333⤵
        Drops file in System32 directory
        
        PID:9684
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        334⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        335⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        336⤵
        Drops file in System32 directory
        
        PID:9816
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        337⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        338⤵
        Drops file in System32 directory
        
        PID:9896
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        339⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        340⤵
        Modifies registry class
        
        PID:9976
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        341⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        342⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        343⤵
        Modifies registry class
        
        PID:10096
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        344⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        345⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        346⤵
        Drops file in System32 directory
        
        PID:10220
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        347⤵
        Drops file in System32 directory
        
        PID:9232
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9304
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        349⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        350⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        351⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        352⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9600
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        354⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        355⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        356⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        357⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        358⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        359⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        360⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        361⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        362⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9308
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9424
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        365⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        366⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        367⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        368⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        369⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        370⤵
        Drops file in System32 directory
        
        PID:10124
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10212
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        372⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9392
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        373⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9764
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        375⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10204
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9396
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9808
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        379⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        380⤵
        Drops file in System32 directory
        
        PID:9272
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        381⤵
        
        PID:212
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        382⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        383⤵
        Drops file in System32 directory
        
        PID:10164
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10248
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        385⤵
        Drops file in System32 directory
        
        PID:10296
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        386⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        387⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        388⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        389⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        390⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        391⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        392⤵
        Modifies registry class
        
        PID:10612
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        393⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        394⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        395⤵
        Drops file in System32 directory
        
        PID:10760
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        396⤵
        Modifies registry class
        
        PID:10808
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        397⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        398⤵
        Drops file in System32 directory
        
        PID:10896
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        399⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        400⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        401⤵
        Modifies registry class
        
        PID:11024
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        402⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        403⤵
        Drops file in System32 directory
        
        PID:11104
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        404⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        405⤵
        Drops file in System32 directory
        
        PID:11196
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        406⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        407⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10348
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        409⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        410⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        411⤵
        Modifies registry class
        
        PID:10496
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        412⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        413⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        414⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        415⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        416⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        417⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        418⤵
        Modifies registry class
        
        PID:10796
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10860
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        420⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        421⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11072
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        423⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        424⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        425⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        426⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        427⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        428⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        429⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        430⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        431⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        432⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        433⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        434⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        435⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        436⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        437⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        438⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1060
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        439⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10320
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        440⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        441⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        442⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        443⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        444⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        445⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        446⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        447⤵
        Drops file in System32 directory
        
        PID:1988
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        448⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10308
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        450⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        451⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        452⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10968
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        454⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        455⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        456⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        457⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        458⤵
        Drops file in System32 directory
        
        PID:4140
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        459⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        460⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        461⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        462⤵
        
        PID:860
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        463⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        464⤵
        
        PID:836
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        465⤵
        
        PID:960
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        466⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        467⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        468⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        469⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        470⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        471⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2076
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1600
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        473⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        474⤵
        Modifies registry class
        
        PID:4656
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        475⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        476⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1312
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        478⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        479⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        480⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        481⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        482⤵
        Modifies registry class
        
        PID:10964
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        483⤵
        Modifies registry class
        
        PID:2504
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        484⤵
        
        PID:924
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        485⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        486⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        487⤵
        
        PID:752
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        488⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        489⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        490⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        491⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        492⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        493⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        494⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        495⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        496⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        497⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        498⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        499⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        500⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        501⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        502⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        503⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        504⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        505⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4736
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        506⤵
        Drops file in System32 directory
        
        PID:4456
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        507⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4984
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        508⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        509⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5220
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        510⤵
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        511⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        512⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        513⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        514⤵
        Drops file in System32 directory
        
        PID:4892
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        515⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        516⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        517⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        518⤵
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        519⤵
        Drops file in System32 directory
        
        PID:5752
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        520⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        521⤵
        Drops file in System32 directory
        
        PID:2140
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        522⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5368
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        523⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        524⤵
        Drops file in System32 directory
        
        PID:4352
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        525⤵
        Modifies registry class
        
        PID:5972
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        526⤵
        Modifies registry class
        
        PID:5656
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        527⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        528⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        529⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        530⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        531⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        532⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        533⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        534⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        535⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        536⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        537⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        538⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        539⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        540⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        541⤵
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        542⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        543⤵
        Drops file in System32 directory
        
        PID:5232
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        544⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        545⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        546⤵
        Modifies registry class
        
        PID:2060
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        547⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        548⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        549⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        550⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6136
        
        C:\Windows\SysWOW64\Qppaclio.exe
        
        C:\Windows\system32\Qppaclio.exe
        551⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Qiiflaoo.exe
        
        C:\Windows\system32\Qiiflaoo.exe
        552⤵
        Drops file in System32 directory
        
        PID:2952
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        553⤵
        
        PID:496
        
        C:\Windows\SysWOW64\Babcil32.exe
        
        C:\Windows\system32\Babcil32.exe
        554⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        555⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        556⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\Dckoia32.exe
        
        C:\Windows\system32\Dckoia32.exe
        557⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Ggjjlk32.exe
        
        C:\Windows\system32\Ggjjlk32.exe
        558⤵
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Hbdgec32.exe
        
        C:\Windows\system32\Hbdgec32.exe
        559⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Hkmlnimb.exe
        
        C:\Windows\system32\Hkmlnimb.exe
        560⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Haidfpki.exe
        
        C:\Windows\system32\Haidfpki.exe
        561⤵
        Drops file in System32 directory
        
        PID:6640
        
        C:\Windows\SysWOW64\Hgcmbj32.exe
        
        C:\Windows\system32\Hgcmbj32.exe
        562⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Hbiapb32.exe
        
        C:\Windows\system32\Hbiapb32.exe
        563⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3224
        
        C:\Windows\SysWOW64\Hcjmhk32.exe
        
        C:\Windows\system32\Hcjmhk32.exe
        564⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Hjdedepg.exe
        
        C:\Windows\system32\Hjdedepg.exe
        565⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6464
        
        C:\Windows\SysWOW64\Hbknebqi.exe
        
        C:\Windows\system32\Hbknebqi.exe
        566⤵
        Drops file in System32 directory
        
        PID:6228
        
        C:\Windows\SysWOW64\Hejjanpm.exe
        
        C:\Windows\system32\Hejjanpm.exe
        567⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Hghfnioq.exe
        
        C:\Windows\system32\Hghfnioq.exe
        568⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Hjfbjdnd.exe
        
        C:\Windows\system32\Hjfbjdnd.exe
        569⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Iencmm32.exe
        
        C:\Windows\system32\Iencmm32.exe
        570⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Iccpniqp.exe
        
        C:\Windows\system32\Iccpniqp.exe
        571⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Icfmci32.exe
        
        C:\Windows\system32\Icfmci32.exe
        572⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Idhiii32.exe
        
        C:\Windows\system32\Idhiii32.exe
        573⤵
        Drops file in System32 directory
        
        PID:7416
        
        C:\Windows\SysWOW64\Jdmcdhhe.exe
        
        C:\Windows\system32\Jdmcdhhe.exe
        574⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Jelonkph.exe
        
        C:\Windows\system32\Jelonkph.exe
        575⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7124
        
        C:\Windows\SysWOW64\Jacpcl32.exe
        
        C:\Windows\system32\Jacpcl32.exe
        576⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Kkpnga32.exe
        
        C:\Windows\system32\Kkpnga32.exe
        577⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Khdoqefq.exe
        
        C:\Windows\system32\Khdoqefq.exe
        578⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7980
        
        C:\Windows\SysWOW64\Kbnlim32.exe
        
        C:\Windows\system32\Kbnlim32.exe
        579⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Ledoegkm.exe
        
        C:\Windows\system32\Ledoegkm.exe
        580⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Mdpagc32.exe
        
        C:\Windows\system32\Mdpagc32.exe
        581⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Mklfjm32.exe
        
        C:\Windows\system32\Mklfjm32.exe
        582⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6364
        
        C:\Windows\SysWOW64\Nfnjbdep.exe
        
        C:\Windows\system32\Nfnjbdep.exe
        583⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7840
        
        C:\Windows\SysWOW64\Okolfj32.exe
        
        C:\Windows\system32\Okolfj32.exe
        584⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Ohcmpn32.exe
        
        C:\Windows\system32\Ohcmpn32.exe
        585⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Oomelheh.exe
        
        C:\Windows\system32\Oomelheh.exe
        586⤵
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\Obkahddl.exe
        
        C:\Windows\system32\Obkahddl.exe
        587⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8016
        
        C:\Windows\SysWOW64\Odjmdocp.exe
        
        C:\Windows\system32\Odjmdocp.exe
        588⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Pbddobla.exe
        
        C:\Windows\system32\Pbddobla.exe
        589⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Pcdqhecd.exe
        
        C:\Windows\system32\Pcdqhecd.exe
        590⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Pehjfm32.exe
        
        C:\Windows\system32\Pehjfm32.exe
        591⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Qfgfpp32.exe
        
        C:\Windows\system32\Qfgfpp32.exe
        592⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Qifbll32.exe
        
        C:\Windows\system32\Qifbll32.exe
        593⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Abpcja32.exe
        
        C:\Windows\system32\Abpcja32.exe
        594⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Afnlpohj.exe
        
        C:\Windows\system32\Afnlpohj.exe
        595⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Amhdmi32.exe
        
        C:\Windows\system32\Amhdmi32.exe
        596⤵
        
        PID:7256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aimkjp32.exe

Filesize
482KB

MD5
23512147f19a01de9e686aa9a3b83b13

SHA1
42168b5427c70d7b27df1696a9c616a86ab5cb79

SHA256
63fd19741f0cccdc5369bd324aec6d3fb07a3ef4428e18082453312d5aaafbc9

SHA512
83b080e203e7554773f5bef2cc87eaec09cc1cde76ff73e512e798b6d58ec5c774a9450b0390b149d39b14b88d94a819adffe46e64eab1b5102e64d2a0fc5585

Download Submit
C:\Windows\SysWOW64\Akoqpg32.exe

Filesize
482KB

MD5
0a053ab5b35ba56865ac32557da62e22

SHA1
973359565f1d63926d69c0a81414f0a7a085676f

SHA256
dba3d360acb1632faaeb99a5de7f361c88d4592bfe6b3863dc33f24c41a9fcbd

SHA512
f7cfbbedecdd984432d74ed9ca6e3b819353c41b6f4737aeeb42cafe46c63fd401b2f64f65cba02561c4ce85723b7210218f7b38bd5289905aa2582bb652322a

Download Submit
C:\Windows\SysWOW64\Bdbnjdfg.exe

Filesize
482KB

MD5
4d87c4ef6ae391a3245110484f20b48e

SHA1
d8a3e69261f16e5a34d47217e23c36450a6cb62f

SHA256
6ccbc7e76e439595c926d249172af8dd40040a61c698d5e614766c23e92a5674

SHA512
518d967ef64d1ed80f3b57f3eacf4a5e42f384c088d530e5a7741cd85842c81f8ec16add46b7badcc193d855598d14baada471eef2e7f8568490d47151181617

Download Submit
C:\Windows\SysWOW64\Bfjnjcni.exe

Filesize
482KB

MD5
ae17ccf813d287067d0acbd5bb3deb6c

SHA1
2c31e57aff6ae32b384e51ddca76921c2650aab3

SHA256
dda089c7a226c823dc7c3b9d27912e2fa141324413571e24c5eb2cdf67d69763

SHA512
84bdf0089c3ed9624978b4d3e33f6a3a6b67c35cf07a34f6787defe57f2320d02adfb382c7971bef9264eab40dd2b38fca81f2a3886ae27b3eb3f5ca56b18c6f

Download Submit
C:\Windows\SysWOW64\Bmkcqn32.exe

Filesize
482KB

MD5
8a8bd974b7d805939effdee1e8da901e

SHA1
a736a33a1e24ecd421df5d5f679c938909f393ca

SHA256
97210c3d2d200d79f35a991425e1729cfa4c32da4acf0b01a9d41e5740c1168e

SHA512
479c3709fcdf2e52a74928e9d98f26a6afd9b584f6661cfd20d34e057b963f4737bc6cab4bc8382481b90901d372467567fbf359aaa08504fe1be8e655766cc0

Download Submit
C:\Windows\SysWOW64\Boklbi32.exe

Filesize
482KB

MD5
1808b16f4a40eefda8da70c0e6401ffd

SHA1
fe23c18a57f593004964025a3f28af0373cb4e2d

SHA256
6d0d76f8cbce196a0bbcb6edd64ef19f5111dde5dc856a91b736e9a79d1bd969

SHA512
f86f623d08bb5cda75f5e603de8f59e56e52a312625e89e6741fe90565e2ae1568ecd5b4fa4634b5231a4b40a298cc93569a4ec9636ec2f54677f067613c2e76

Download Submit
C:\Windows\SysWOW64\Bqkill32.exe

Filesize
482KB

MD5
0ea21b338783f883568f5d7e039a88fc

SHA1
f43ccc4bf77dc4158084b17e32f8258f3e203950

SHA256
2a53c13998c11873894b8ada489c74dbeaef90bc69c60bfa2ad42b1bfd34c2e7

SHA512
0290f23700cf852cd8bfbbbad9bb567b97e9b368eb5c35375496fe8ecfb7c17849ad71072b105a6d7c0d8be6434b7d06b2665d363b0863286c02b3d4a6168117

Download Submit
C:\Windows\SysWOW64\Dbqqkkbo.exe

Filesize
320KB

MD5
c26a5d596ff08b663cb27efbfecaf66b

SHA1
e18c795073bbff46b70199216f57803505297104

SHA256
2c78b1a7ebfb28dc44d8790569c462786e0f12c52a8fe8d1d073d1e9e1a98dcf

SHA512
5654942aebb0764dbe92e4e7c2d0b6b3bf8032adadc10f70b257644f0a9a7b5cda747cbafb4244a846073f938b2c4e125a3e87e1e7a63c39c6b75f75d5da6db4

Download Submit
C:\Windows\SysWOW64\Dcigeooj.exe

Filesize
482KB

MD5
801587282f2c65be69342c35152cc0e6

SHA1
6e6b340486f90d313e970e99b813bf946f085036

SHA256
83b32b20cccec84b8d37c3137aae664d48d8e6196b7af2adf46da54603c58d60

SHA512
15cec40676efa02ab78e6d7aac7dfb60980735a602414387e853241900c58fe8a873e6af811aab346d3f3034fc8153ddc69b85a6c990d7e4b7769ef5fb4c2ec9

Download Submit
C:\Windows\SysWOW64\Fmcjpl32.exe

Filesize
482KB

MD5
45dc93a5ede595e0e460ef77dd2a0ac5

SHA1
13c61f78958a259277598329233f2df40dc163b7

SHA256
712b7a812c3ce519e1c1b798c9af6ee4111c4663d6fa6bc366fa3172a4eedcc8

SHA512
c4795b0380345ef4c7c8b8008e7a168d4955025e34f163e889353384a99801c06a6fc47b8771bb6bd8784dbcce3c42566787635a0be8a4a753fc099276914206

Download Submit
C:\Windows\SysWOW64\Hkfglb32.exe

Filesize
482KB

MD5
4a0a220c20e027fd38325cc2a812cd5c

SHA1
b6daf37a0b8ed6c619afdf1646826dfdfdb29895

SHA256
f81e49f92c091fce012019057791028a6d32abb51e67e09bccfec177f6967967

SHA512
dc7ed49b51feaad84d15e80b65b35d20355f544f1b305d2138c7cc02f346fe994fae0a72e8882dc15cd84cac778d09b5a8b9f2056acd4687be06edba7ca2d48e

Download Submit
C:\Windows\SysWOW64\Hmkigh32.exe

Filesize
482KB

MD5
226730ac96cce7be6aa1a7191b6606a1

SHA1
119561b0eb426bfb23554de59e3c842cd06513d3

SHA256
107447e06266033edd809a7b77c73392eccb0d0ce310daedd0db7bbe10817638

SHA512
f20c4c38faa32cd320b822f2a5fa5a22caf8f9b4397237c0d83ebd1373a3511d080123387820130f79541af06c4f0417f396bb956dea956fe3913c677bd67465

Download Submit
C:\Windows\SysWOW64\Ibkpcg32.exe

Filesize
482KB

MD5
c081b9562fa1b94012b7475cdb578628

SHA1
46fd5fb6522750f2c0cfbc36bb533ec691c68fdd

SHA256
ce833402222e6244d141fb828b6f60e0a2260ef4cb52c5450ab9c167ecea44a8

SHA512
e38b71c23922005aa724b90e690b6d61667cf5b0803e00a092feae85c0f2e5ad0b1d5fc629e60a8e69df71d2ff77cf18c11042332f9972617b0fa724c96acfe8

Download Submit
C:\Windows\SysWOW64\Igfkfo32.exe

Filesize
482KB

MD5
fcc1970d8bc7bcad394c373568b880dc

SHA1
0373d85f48e482885a0357dcc6ad6cf520b24e4e

SHA256
157192b4e1f4a94548dfd6d42658ed582de6b83f3b35e251243367fcaefa7158

SHA512
ff9422d5ca91dbd3df24027a20d2c98438696a1dad9ee0560e912f763537071eeaa1d9bd7f22e7d6e1dc5b28a10c4eb081dbed47d009a151f7c06cf279fe3765

Download Submit
C:\Windows\SysWOW64\Ighhln32.exe

Filesize
482KB

MD5
841d405d04daa0ddd71e5d3b4aeb1698

SHA1
8a7ab4d7d9673648c7aaad59c31eca32d0ab701b

SHA256
6a6c903c6b02a5c0314c11a3f1a145e954cc0df92f52c9e1bf5f46e0a0afe42c

SHA512
50ac32b6ace69e0568f40f2bcd3b004e47d174ed3ca0e9ed4dcdd75ee58ca1d95d029617c0a82bde5950084be545cea374739150d22520b73dc054104479a21b

Download Submit
C:\Windows\SysWOW64\Jfbkpd32.exe

Filesize
482KB

MD5
f487c3db88c886c8da43f7960a16d714

SHA1
9e72e6383731a1dc694c4bbebec0634f1c537bf5

SHA256
e1dd942af50c290fc828c6ca8e3ec1d2feea31e92468d5035bbb9c3cb574bf28

SHA512
6a58297fbc3ece6e4109277c1c9f663736047b463a0f0d615401b098fcaf95570d38eca8b23b18f096abeb08748c8c21604373fe33cd9ff7450994ee0ee98c53

Download Submit
C:\Windows\SysWOW64\Jgfdmlcm.exe

Filesize
482KB

MD5
c9419fbd814585e482096d7d984dafb9

SHA1
b68b8831d57b2ea25b018b0083546410d1b40d31

SHA256
6b6c6807355e2c1d68af874a085d2fe7083517bc5bb12104669eab13aafb627f

SHA512
61a9405d1360bf04034faf7a8d0d47bb41af2cca6c25f19057bae8b659cdf762c1ddcbf77a8cb25c9245795748362e4456f7718abdbba52821a0df38c5860a20

Download Submit
C:\Windows\SysWOW64\Jkhngl32.exe

Filesize
482KB

MD5
c45e9dbde7e35767af904151a076cbfc

SHA1
db635ec8bfe590472f85d2c0846db308ea4074b7

SHA256
2e185124435c91f74077541f4901a5ffa8c88664a7ea4ecf0077b6ef640a9761

SHA512
7e5a116946c68652448358661cde9f1044dacdfec59978d9939e85dcb9e54d87051f79042ba13a6662f150be870ddad782a6fca41d01b2f730868d8e310b5408

Download Submit
C:\Windows\SysWOW64\Jnmijq32.exe

Filesize
482KB

MD5
37d753c6602b1800a0927e104347a6a4

SHA1
4ebf070c04bcdbee41760b4024acc50d692827a6

SHA256
354224fd1dfd738490191f2f5a1f34bb495231b47ae0b0bb0e1f622e5a85788a

SHA512
9e1e47df736939fc264f5328b9304112c1d1e251b27ae2b3eb50d8bc54d8cbdef11776b5a08eb7b1f937dea6a6b0800f743ca8e6f0661e6ead1587d208ed7823

Download Submit
C:\Windows\SysWOW64\Kbdmhm32.dll

Filesize
7KB

MD5
b0b64a9ebb5df69a38922dbadb16f2c1

SHA1
91bbfaf831c6f8c4d1a55dec8a3cac1a04bce58f

SHA256
cbf63e6512e452d7acd23dc9bfb88d15fcc1e988e64911681de165b80b25fe4b

SHA512
585fee7cd0f6aff183b96b280e95370efc4a411980d1d8b060b98f2d82ed306e5c7ce542f84563bdb6f6245e2b8bac1e5c2d1366952e4a60c3b43fe177e783c9

Download Submit
C:\Windows\SysWOW64\Kfjapcii.exe

Filesize
482KB

MD5
96d11e0b993856c055a86549c4b3ab7e

SHA1
2f23a6de75ae1571475206c98a6244dd6912654f

SHA256
0717ec4a7f8aaf35f509668f5583094543bd1f505d87d8c37c5ce4810071d60a

SHA512
534b20f7c942e8b1fda0b401a9fe9fef7b7737efa026102e24c614509517fd503a3fb578f49b6101eb827b510bbd4e727e9289d1bde2735c6165b714e20a0f76

Download Submit
C:\Windows\SysWOW64\Kpmdfonj.exe

Filesize
482KB

MD5
96db38897d6f229763587e10d6be44f1

SHA1
1dfe56f2f97c64059a35bf9b7f4c5920083c3b62

SHA256
4672a64e73500283a67aa24767d83b32cc64fb32d2551f0cc69634e216d5eba7

SHA512
ce90a7a5822fa07fbf8ae391575b83d6bbe9ffd1ff32444540b74bd3bfe363dc5a1daef1d90dfe373c0b0a991bcaf165d9604b05f9120c3b3502541f83bf2a35

Download Submit
C:\Windows\SysWOW64\Mekgdl32.exe

Filesize
482KB

MD5
2a57f8ba2a67b53660b12b291425d2c3

SHA1
2668b5c419ed1da35b153336e1d8e18497031fa8

SHA256
69e3afd11a994f84f343c28aed48b39367a88a55ada466b48f91ee1da6eda36f

SHA512
cb721bb5886761d85e6b7f936c816b1e12faa115a748187cb1ca5663c15556d0018ba6aec12da127a0fddc3ed94f446d1d5181e101caf87aacb8d9159523845c

Download Submit
C:\Windows\SysWOW64\Mockmala.exe

Filesize
482KB

MD5
857a25d26a6fad046403edc52090f762

SHA1
db9a5ca95f2609015e3330cf0e4c993cb1c545ea

SHA256
a0bc831e1c5e923332f56003491b454928c9987551333e79754b97e0393407f7

SHA512
176bd4af440dca99ba1d0554f684b36fca627ace2986e1ebc35e749677d24a4a4656817e50116d759f259870c9b133d7c4b7f5f937ec924541a5cda0a616e67e

Download Submit
C:\Windows\SysWOW64\Nhlpfgbb.exe

Filesize
482KB

MD5
742e82003bf2adef0d65fdafe5e2c867

SHA1
3cdaf7df91043ff91ca0e8cb941fd5258935c391

SHA256
4ad1e7f36b031ce3453c9dcb54d421649133c7dac01b793c6799336037d4b225

SHA512
b3dcf5553d62b00187080ab1c69051670857aa96744d0cf8d4bae5ae0c38f61c4b936a79dabc35208e4ace44a79b24e0917f9fa1c628477c43a8c716b71e1bfc

Download Submit
C:\Windows\SysWOW64\Niklpj32.exe

Filesize
482KB

MD5
71bef8b3ad1c567a587044abe5e1a39e

SHA1
1075a9cbd0ec052f2961245732c3d5eb558e8812

SHA256
1220caff1d30dd4599821b9e3acf2d19e80c22f065243bf0e3595016356b1af7

SHA512
ccb083ef989b1b52c58620a1fba5317bf049de6ce81858aecd1f146208970efd31121b8283c8b013782e3f7e13ac4d33c4a99c13aa1fb39e4c3356ae403b1059

Download Submit
C:\Windows\SysWOW64\Nookip32.exe

Filesize
482KB

MD5
a4c42d12ca91a81e493bdb8c31373a54

SHA1
503067970ba4dc711f3d6def34778ba54baed238

SHA256
ab9360380d7f641271e26fc005500ca953d9430377846aed39a9fea1c5c4ee36

SHA512
59a2170b9980c0084accd963fcdcf6756e199192da8e2c14682f974a067decc6e94a4db6b20c509e2a00a14096208d70d0251d5a93c36537c376984f7c172509

Download Submit
C:\Windows\SysWOW64\Npjnhc32.exe

Filesize
482KB

MD5
88153254791ba09586013187fc17392f

SHA1
67ca3868796f944f4e96f479d8979ff9d2387a56

SHA256
1182a5b96c826d2c90f66cc260095bd20614a2af03c5890980c83dcd4265c7dd

SHA512
f56b944f5ebaf376d90dc74f169c0c60c806d03e187310f92f84e1e4c2ff89b6085f1932c84561b533fc39c8790f73b3c637543ac53eabe913ad8956c2185885

Download Submit
C:\Windows\SysWOW64\Ocamjm32.exe

Filesize
482KB

MD5
4c58f11f4144b1f6d6ff632cbdb88872

SHA1
03e88222348903b7e6ab24c8339feb3dc0c10a32

SHA256
c3237c619dc70ae6fa04b5fdb68b1b6aff44652dda213b1032d3e80d12d45ab2

SHA512
dff5c1fbecf2e34683069078f8de96bf001fab3dc06b7773d38bc5ac1da0f4130d2c9b112e89f60e94fda88c643efb1443f90e3f88641dded95f4ae77c044954

Download Submit
C:\Windows\SysWOW64\Olckbd32.exe

Filesize
482KB

MD5
429357fa96903f954c13c7e169f1c263

SHA1
b05205b0917b863038848dc613509ce9b2feeded

SHA256
1813790eb36761781736b80c3931202b970fd88e62979bc78ff41b0d0405883f

SHA512
12214c88cbdd85aa210c39c24a3eddd29e95c20aabea7f1e9c8eb1e52c767aa52fc6bef1e0e16c865e0062630d31eb84f0ffe8a5a58cd3537fe42d9a38f1fdb4

Download Submit
C:\Windows\SysWOW64\Olfghg32.exe

Filesize
482KB

MD5
ce06a36d0702fbe2f661ce502f952590

SHA1
facadf8e8d2e8df091c41012ae1cdd453110575d

SHA256
dec28c0017c7493fb0a19d167cd62fc97a083d74fb72185790b06dc371349eb4

SHA512
c164c0a5dd0f81fea3d13f74d44f01d0e270045eea051fa602e0d213b8b5b0472ac9f2fa4318129930d5d04f488c24c0fe49702e6e8269ee130689e4da81f735

Download Submit
C:\Windows\SysWOW64\Opemca32.exe

Filesize
482KB

MD5
eb6c5e2b9b8e80e6c915a50fdbac4361

SHA1
f920c4367d1f3e3e40217950ee04588ca6a5c968

SHA256
2d3d458e1ce94b6465a88ccb6e583828fce716e6f7744ee26c4dd854eb66f9be

SHA512
b442568e8921f99353e35ccf0fa78776491f66216091cc724447fe68948074f79b22cc7f9acc74988071efad2653229ef72ed512e46c68a3d079d1c266d3bcc5

Download Submit
C:\Windows\SysWOW64\Pcicklnn.exe

Filesize
482KB

MD5
e70edc47e816d7e28768bf741fe51061

SHA1
ab0c7ddec08be84fa45140d9144f787d5f6c88ad

SHA256
04a947806c810c4560528d4250e0495c67c579813addbe8dbf47c409019f0f4c

SHA512
cb4aef797ce6a90253aa489198cada256aeab951aedccecd3e7bb14e50c2ecc8619677b6034a62aefdab6faa44860ff02d6e60b1b6b289bfaab3fbab0db97abc

Download Submit
C:\Windows\SysWOW64\Pgflqkdd.exe

Filesize
128KB

MD5
fcb02f4598dd6650211832392b2b08a3

SHA1
cf037c38dd1a3e90331fb152a09ec7a658e1912a

SHA256
f0fa54dcf754a0760c0fe5abb7d89a6640fcbc9033e022308ef4383a55a8685e

SHA512
83049cede3b0d27a73a0b2164b3ffae2ccf978276708de86bf006b0dd8494c40e7584671165a3e3a0cdd0f1bbb015f368dfae2a896b96ce169b83dac083c4d89

Download Submit
C:\Windows\SysWOW64\Pgflqkdd.exe

Filesize
482KB

MD5
24af4c4f00864b8b22ddbe7946149cc1

SHA1
9a7ebbb12c594e6ead8bc0adfb37ec481b193671

SHA256
456979a653626d22a4cc159b8b727c2e2caecee2fb0cce1c505ffc4dd8a53488

SHA512
0afeb57edb7f692eeeb55078e7d6499d36eab0a451ba32ec7c3b567ad952d5d71a061901f5a7f2f9ead4caad528e0a5eff481dba443fcb3cc2f1282531b9bf3f

Download Submit
C:\Windows\SysWOW64\Pgkelj32.exe

Filesize
482KB

MD5
2161b82339f15c16c78d0f74cfb57d94

SHA1
a4d5f45b729b357ded060395a471d67ed3a8a3f7

SHA256
02ac2ed4e0f61cfa2ec9ac098cd9a40ced86211f0f8b63745666920fa9593244

SHA512
03dacabdc1c931da67605ffc53c3fcc22f6a3e9dfee9030df04dace104d997c6e7800918be0d7c52e9b590f4e2113d1ecc6507890b78f64fc5c5acd95ee64807

Download Submit
C:\Windows\SysWOW64\Phcomcng.exe

Filesize
482KB

MD5
001bdee95560d79f2f48aa0fb3477d3c

SHA1
40364bb4d906a392a19cb5675bfe6ad25215a72e

SHA256
ce77e1f99e5962f46f5f27df4a0a960874f86a9ced030b6713618bc01d8b78c9

SHA512
3693101813d33586382d869efaed239258729fff57c668986b095e771ba75d5d49c20a6c38e6cabf28d190fc1e3231578abceb006beefe6a3ab03fd67cf9861c

Download Submit
C:\Windows\SysWOW64\Phelcc32.exe

Filesize
482KB

MD5
0bd571b16b6afe647b616105bf1b4f41

SHA1
c3acb8f85e7db59f57c5c51aef5919c338fd78f2

SHA256
e83f8823ff66ad9d9aa4ca45aafa766c26fe53eed3c674d0196fb9e58db3dffd

SHA512
a9eca851ce14c0ff60e2bf7068dfc043fdb305cda08d891425f276fc63c268f1033579e02b3c3f5a0f590650440f5ed10f6f2764920e55d6c4bed50267c1c23d

Download Submit
C:\Windows\SysWOW64\Phelcc32.exe

Filesize
192KB

MD5
ded701586a4168f6ba6a82e2c356ff8f

SHA1
6175bfb7ec672f4e2373dd4d689bad84ef028f38

SHA256
ad6144089a17ff5a8f4dac4f01837f51e04552862c92c897d10a136207fd2505

SHA512
8f15375c4bdc6e5e04e1271533022435c11a630cd42e3d6a6cc6ee0c11673f18b58349bb0cff13dc12c4d9324718ceb7f2e5796de4ff47d072fdb27fcdfcfec0

Download Submit
C:\Windows\SysWOW64\Phlacbfm.exe

Filesize
482KB

MD5
b6a41c798b18056f8ecc5a5558ad0c65

SHA1
09c52564cff09d29ade2bddb4c82d1ab5908cacd

SHA256
c0d988ec56476c2d1372bc2a0fe203a1d1fbfce11ef6f14e4358dcc6b8fe1daa

SHA512
79d9766ba467b5f21aeda1c5eae9bdf9b97fab86db42b5d286a6aa9151e8dc5b404c60ddd363e32a38b095e5b9fb6e374163c3e6caf69e6f4a2a48de9b297385

Download Submit
C:\Windows\SysWOW64\Plcdiabk.exe

Filesize
384KB

MD5
bef34da748298a4f047bbce8409f69bf

SHA1
6109b2e37ebe485e6080f1f8aef27bddeb39d979

SHA256
e2b59ae78367a82ae7e5a9d191df7f0793b795aaedcd2ab4c848c7c122116b4b

SHA512
accccbbba1100c9a468043fe5ed3282940bd333f70bd30fe5879cd256807da8da017798e5cfdd8f83ff3f83d70796196d1ebbae80bc95ad4dae6d2e6fac741c2

Download Submit
C:\Windows\SysWOW64\Plcdiabk.exe

Filesize
482KB

MD5
5d9fbfc173e37d1ddaf14153486869c6

SHA1
61f062a0d9aac02366d11f1fd87e863281d86273

SHA256
a5f920f01b1287afa7cabed120ec963feb2e2d40a4daa7fc7bdb489ce9653feb

SHA512
d9020681a2a7a49c854918237b7241612d675d6521af00c365f95f7b967a1a8f8015a3ae907da7c9f7e57d82da726ec2743cf0ef9c7132b928374483f4ebe2a8

Download Submit
C:\Windows\SysWOW64\Pofjpl32.exe

Filesize
482KB

MD5
e945dff83d53d5c0b1269baacbc51f42

SHA1
0de23db433957bb9fb0eb77823164af760faf58b

SHA256
e9583055f45280edd1a4cbbeca28d5abe181199a9ca5d1efadf33b7b75e70f7b

SHA512
7365516457e44394081d1254c22f5a4b8b867cde720189ded17b2472718b3e208281936df16a90b927b906e14a8624e95b52fae7e50318118e8bcdf6a959c9d0

Download Submit
C:\Windows\SysWOW64\Ppamophb.exe

Filesize
482KB

MD5
04d6b53b079f79832f251689add8f0d6

SHA1
14752a6d011baa9cd222010a3741f9f31eb7868c

SHA256
32562df3a6e792109666d7a1cf96283cdc951e592fbd00d5bb37b1e0762dab1e

SHA512
0bc35678316bdc3f9e5f24f41ff6eacb1f62d4c1d869370b44e68a3a46ed8e8026b6de562c4b6b72fc343870d35f7a92a08e902215200618b1ebef1ef40e72ed

Download Submit
C:\Windows\SysWOW64\Qgnbaj32.exe

Filesize
482KB

MD5
25bcb0e5c48c76ba97b45d43358fac1c

SHA1
75f5d89d3aa19daaa3013980db45a85c531ce533

SHA256
ba5bb610428a23cd7522273f912fe605cdf09fb6f659d253c6e8d2360327c6d2

SHA512
dfa5485e5d41c21ffcd57a92b99628db2131dd9759369c748297fd311689ae6c6b2feb3e44b4daef94fa261c6c76b4ce878893248c89f7758e3e5f607bcf749b

Download Submit
C:\Windows\SysWOW64\Qlmgopjq.exe

Filesize
482KB

MD5
5c87d9b7bb56dcf1ccae91062367a2e2

SHA1
a1f8ae6e521e55fbbf0ea1ac3603417bbbe4612e

SHA256
832d1c1b15e7ad9289e5a82d27eb7ad450788b4dddbe66fa9ece900db1181148

SHA512
eb46ad46957cc4a1e3257ba4b3101d419efe6dadb2210ab9ed293b6f017c93e43e057938f7805c408fcc8fe269ae10b6ded711b217c1a4204e237447817adac1

Download Submit
C:\Windows\SysWOW64\Qmepam32.exe

Filesize
482KB

MD5
7607b409f3f0d9ee59b8871162123536

SHA1
c245289a78d7a9cbb356d0a1a4bd2eccf82515ac

SHA256
e15ff9e69b604c042255205f962fad51ef4a39a0fd32cd2e7fcf594280228c98

SHA512
364047e05eb8eef948a1c3072d652ac4f45adf73609d096309a0d9f044fa9135ee5804b652727939c9fd31311ae0027b78080b973305ae374dd6a4d854508af6

Download Submit
memory/220-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/656-367-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/836-203-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/932-313-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1004-355-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1008-72-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1052-230-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1060-39-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1100-197-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1172-426-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1280-23-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1312-258-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1348-81-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1400-319-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1432-391-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1520-373-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1696-265-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1872-16-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1968-32-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2112-63-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2180-213-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2300-164-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2376-432-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2404-338-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2540-271-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2672-307-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2800-120-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2936-301-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2968-200-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2980-144-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2988-111-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3028-293-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3084-55-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3092-262-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3132-385-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3304-421-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3384-379-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3392-361-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3488-450-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3620-295-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3716-331-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3876-157-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3880-283-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4092-88-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4204-238-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4300-167-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4328-96-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4340-47-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4352-221-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4428-444-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4564-140-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4576-397-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4660-127-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4676-325-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4736-409-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4748-108-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4852-349-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4928-406-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4948-8-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4980-277-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5080-343-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5116-438-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5156-456-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5208-466-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads