c84d0b38bc28bdbd7569463fba7003bb8cbf56bcfa13fe10245a9ca66f991051

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c84d0b38bc28bdbd7569463fba7003bb8cbf56bcfa13fe10245a9ca66f991051.exe
Size

55KB
MD5

e254c80ad7e343eadec7584a90a2e5d0
SHA1

3e09b81563053baad6179dff347ccc0999be4882
SHA256

c84d0b38bc28bdbd7569463fba7003bb8cbf56bcfa13fe10245a9ca66f991051
SHA512

cd7eaad3816c02522cead70fc04be19e537e172ff4cafc452f49147d2030c4e5348bba8521def9315b27aa9258dd7928f76f4266eac1a75b9139160a4bb972f0
SSDEEP

768:05MI2iXq/0NIgMmyj7wB7W0zpWK1dKMV6cnIbYc5YGQ7eAzB0JZ/1H5mXdnh:sP7XUdjUB/V9VrxKYYAVSa

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdhbmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aknbkjfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfpcoefj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdaaaeqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qaqegecm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfbploob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdhmnlcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llbidimc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnoknihb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfmmplad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikbnacmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npjebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcobaedj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gppcmeem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imiehfao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ippggbck.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baadiiif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiahnnph.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfbkpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlkngo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbpgbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnpmjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Digehphc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpnfge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahdged32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipgbdbqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkoiefmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mplhql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kihnmohm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igjngh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aojlaeei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pecellgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qobhkjdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpchib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iefgbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcmdaljn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqmmmmph.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inmpcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aojlaeei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkbjjbda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chqogq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efblbbqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgffic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfcdfbqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbqmiinl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Camddhoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glkmmefl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hblkjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipeeobbe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibnccmbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbqmiinl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coadnlnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbhboolf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Impliekg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahdpjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpnlpnih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lldfjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Miofjepg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Malgcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bknlbhhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehgqln32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mahnhhod.exe

Executes dropped EXE 64 IoCs

pid	Process
4372	Ehedfo32.exe
552	Eamhodmf.exe
4256	Ehgqln32.exe
4176	Ecmeig32.exe
4872	Eocenh32.exe
3040	Eepjpb32.exe
1664	Fohoigfh.exe
2908	Fdegandp.exe
4668	Fojlngce.exe
1464	Fkalchij.exe
4156	Fakdpb32.exe
2372	Flqimk32.exe
1004	Fbnafb32.exe
3872	Flceckoj.exe
4908	Fcmnpe32.exe
4636	Fdnjgmle.exe
3132	Gcojed32.exe
3148	Ghlcnk32.exe
1592	Gofkje32.exe
4360	Gfpcgpae.exe
2268	Gmjlcj32.exe
396	Gohhpe32.exe
2744	Gfbploob.exe
4444	Gkoiefmj.exe
1632	Gcfqfc32.exe
3036	Gdhmnlcj.exe
2580	Gomakdcp.exe
2692	Gfgjgo32.exe
920	Hiefcj32.exe
2376	Hckjacjg.exe
1684	Helfik32.exe
332	Hmcojh32.exe
2404	Hbpgbo32.exe
3636	Heocnk32.exe
4392	Hmfkoh32.exe
3336	Hbbdholl.exe
1908	Hmhhehlb.exe
4560	Hcbpab32.exe
2308	Hecmijim.exe
4960	Hmjdjgjo.exe
3712	Hcdmga32.exe
2076	Iiaephpc.exe
1404	Icgjmapi.exe
4964	Iehfdi32.exe
3408	Ikbnacmd.exe
436	Iblfnn32.exe
2360	Imakkfdg.exe
4032	Ippggbck.exe
4744	Ibnccmbo.exe
2816	Kdqejn32.exe
4012	Kebbafoj.exe
1932	Kpgfooop.exe
4456	Kfankifm.exe
4680	Kipkhdeq.exe
3420	Kpjcdn32.exe
3128	Kfckahdj.exe
2316	Kibgmdcn.exe
464	Kplpjn32.exe
4408	Liddbc32.exe
2544	Lpnlpnih.exe
2088	Lekehdgp.exe
2416	Llemdo32.exe
1864	Lfkaag32.exe
1828	Lmdina32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Megdccmb.exe	Lllcen32.exe
File created	C:\Windows\SysWOW64\Hmlgah32.dll	Ngmpcn32.exe
File created	C:\Windows\SysWOW64\Chflphjh.dll	Iefgbh32.exe
File created	C:\Windows\SysWOW64\Jefjbddd.dll	Jgkmgk32.exe
File opened for modification	C:\Windows\SysWOW64\Moaogand.exe	Mlbbkfoq.exe
File created	C:\Windows\SysWOW64\Eppjfgcp.exe	Efgemb32.exe
File created	C:\Windows\SysWOW64\Flhkmbmp.dll	Nagiji32.exe
File created	C:\Windows\SysWOW64\Ophfae32.dll	Flqimk32.exe
File opened for modification	C:\Windows\SysWOW64\Lebkhc32.exe	Lbdolh32.exe
File opened for modification	C:\Windows\SysWOW64\Npjebj32.exe	Nphhmj32.exe
File created	C:\Windows\SysWOW64\Hiacfqch.dll	Aojlaeei.exe
File created	C:\Windows\SysWOW64\Nchcpi32.dll	Ckmonl32.exe
File created	C:\Windows\SysWOW64\Lfbped32.exe	Kfpcoefj.exe
File opened for modification	C:\Windows\SysWOW64\Phcgcqab.exe	Pplobcpp.exe
File created	C:\Windows\SysWOW64\Iiaephpc.exe	Hcdmga32.exe
File created	C:\Windows\SysWOW64\Lnnikdnj.exe	Llpmoiof.exe
File opened for modification	C:\Windows\SysWOW64\Hacbhb32.exe	Hjlkge32.exe
File created	C:\Windows\SysWOW64\Qhkdof32.exe	Pocpfphe.exe
File opened for modification	C:\Windows\SysWOW64\Fmkqpkla.exe	Fechomko.exe
File created	C:\Windows\SysWOW64\Pmiikh32.exe	Pfoann32.exe
File opened for modification	C:\Windows\SysWOW64\Flceckoj.exe	Fbnafb32.exe
File created	C:\Windows\SysWOW64\Nodfmh32.dll	Mplhql32.exe
File opened for modification	C:\Windows\SysWOW64\Majjng32.exe	Mjpbam32.exe
File opened for modification	C:\Windows\SysWOW64\Nlfelogp.exe	Malgcg32.exe
File opened for modification	C:\Windows\SysWOW64\Cfpffeaj.exe	Cocacl32.exe
File created	C:\Windows\SysWOW64\Phajna32.exe	Ppjbmc32.exe
File created	C:\Windows\SysWOW64\Ocalcppo.dll	Ehedfo32.exe
File created	C:\Windows\SysWOW64\Kpjcdn32.exe	Kipkhdeq.exe
File created	C:\Windows\SysWOW64\Mmbfpp32.exe	Mgimcebb.exe
File created	C:\Windows\SysWOW64\Acpcoaap.dll	Ojoign32.exe
File created	C:\Windows\SysWOW64\Coadnlnb.exe	Clchbqoo.exe
File created	C:\Windows\SysWOW64\Ipgijcij.dll	Kfpcoefj.exe
File created	C:\Windows\SysWOW64\Odocigqg.exe	Oneklm32.exe
File opened for modification	C:\Windows\SysWOW64\Pqknig32.exe	Ofeilobp.exe
File created	C:\Windows\SysWOW64\Mehjol32.exe	Mbjnbqhp.exe
File created	C:\Windows\SysWOW64\Gihgfk32.exe	Gfjkjo32.exe
File created	C:\Windows\SysWOW64\Pfabjq32.dll	Gfjkjo32.exe
File opened for modification	C:\Windows\SysWOW64\Hnfjbdmk.exe	Hkgnfhnh.exe
File opened for modification	C:\Windows\SysWOW64\Plejdkmm.exe	Pekbga32.exe
File created	C:\Windows\SysWOW64\Knefeffd.exe	Kihnmohm.exe
File created	C:\Windows\SysWOW64\Neafjdkn.exe	Nklbmllg.exe
File opened for modification	C:\Windows\SysWOW64\Nbefdijg.exe	Nlkngo32.exe
File opened for modification	C:\Windows\SysWOW64\Jdaaaeqg.exe	Aojlaeei.exe
File created	C:\Windows\SysWOW64\Adkgje32.exe	Akccap32.exe
File created	C:\Windows\SysWOW64\Kcdgbkil.dll	Lmdina32.exe
File created	C:\Windows\SysWOW64\Nhnlkfpp.exe	Ngmpcn32.exe
File created	C:\Windows\SysWOW64\Nklinjmj.dll	Dnbakghm.exe
File opened for modification	C:\Windows\SysWOW64\Jcdjbk32.exe	Jljbeali.exe
File created	C:\Windows\SysWOW64\Ojfcdnjc.exe	Oclkgccf.exe
File created	C:\Windows\SysWOW64\Eicedn32.exe	Efeihb32.exe
File created	C:\Windows\SysWOW64\Cncnob32.exe	Ckebcg32.exe
File created	C:\Windows\SysWOW64\Fojlngce.exe	Fdegandp.exe
File created	C:\Windows\SysWOW64\Clhkicgk.dll	Gfpcgpae.exe
File opened for modification	C:\Windows\SysWOW64\Gdhmnlcj.exe	Gcfqfc32.exe
File created	C:\Windows\SysWOW64\Einbcgha.dll	Knlleepl.exe
File opened for modification	C:\Windows\SysWOW64\Lldfjh32.exe	Lejnmncd.exe
File opened for modification	C:\Windows\SysWOW64\Pcobaedj.exe	Plejdkmm.exe
File created	C:\Windows\SysWOW64\Fgibng32.dll	Lhmmjbkf.exe
File opened for modification	C:\Windows\SysWOW64\Oafcqcea.exe	Olijhmgj.exe
File opened for modification	C:\Windows\SysWOW64\Hiefcj32.exe	Gfgjgo32.exe
File opened for modification	C:\Windows\SysWOW64\Hmcojh32.exe	Helfik32.exe
File created	C:\Windows\SysWOW64\Ngdmod32.exe	Npjebj32.exe
File created	C:\Windows\SysWOW64\Mkankndb.dll	Kngcje32.exe
File created	C:\Windows\SysWOW64\Hdpbon32.exe	Hnfjbdmk.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10192	10088	WerFault.exe	594

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jljbeali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecpfpo32.dll"	Bdagpnbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lndigcej.dll"	Iqmidndd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiljkifg.dll"	Mmpijp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmhgag32.dll"	Hfjdqmng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iebngial.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apgnjp32.dll"	Pnkbkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fohoigfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbgkhpld.dll"	Mimpolee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chiigadc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lldfjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdifpa32.dll"	Gejopl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqknpl32.dll"	Hbhboolf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljeafb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bacjdbch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Khpgckkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kfankifm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mehjol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Occomh32.dll"	Empoiimf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfjkjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hiefcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Namdcd32.dll"	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npjebj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbbfdfkn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jkmgblok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Algpao32.dll"	Jkodhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oloahhki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idllbp32.dll"	Aafemk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpgfooop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhjmpfcl.dll"	Dmennnni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojfcdnjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aolblopj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kfckahdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mahnhhod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Boenhgdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpjcdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kaedkn32.dll"	Laqhhi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hpchib32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdagpnbk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbnepe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kihnmohm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mhdjehhj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cbpajgmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nklinjmj.dll"	Dnbakghm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jflbhhom.dll"	Fefedmil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kfpcoefj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clhkicgk.dll"	Gfpcgpae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfandnla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Alkijdci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Clchbqoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebcneqod.dll"	Ebnfbcbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdblhj32.dll"	Fmcjpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdmfllhn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dgcihgaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pclgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iblfnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klgmcn32.dll"	Jilnqqbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aoalgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqhfnd32.dll"	Hmdlmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmcckk32.dll"	Jocefm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Opclldhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qpeahb32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 4372	1296	c84d0b38bc28bdbd7569463fba7003bb8cbf56bcfa13fe10245a9ca66f991051.exe	91
PID 1296 wrote to memory of 4372	1296	c84d0b38bc28bdbd7569463fba7003bb8cbf56bcfa13fe10245a9ca66f991051.exe	91
PID 1296 wrote to memory of 4372	1296	c84d0b38bc28bdbd7569463fba7003bb8cbf56bcfa13fe10245a9ca66f991051.exe	91
PID 4372 wrote to memory of 552	4372	Ehedfo32.exe	93
PID 4372 wrote to memory of 552	4372	Ehedfo32.exe	93
PID 4372 wrote to memory of 552	4372	Ehedfo32.exe	93
PID 552 wrote to memory of 4256	552	Eamhodmf.exe	94
PID 552 wrote to memory of 4256	552	Eamhodmf.exe	94
PID 552 wrote to memory of 4256	552	Eamhodmf.exe	94
PID 4256 wrote to memory of 4176	4256	Ehgqln32.exe	95
PID 4256 wrote to memory of 4176	4256	Ehgqln32.exe	95
PID 4256 wrote to memory of 4176	4256	Ehgqln32.exe	95
PID 4176 wrote to memory of 4872	4176	Ecmeig32.exe	96
PID 4176 wrote to memory of 4872	4176	Ecmeig32.exe	96
PID 4176 wrote to memory of 4872	4176	Ecmeig32.exe	96
PID 4872 wrote to memory of 3040	4872	Eocenh32.exe	98
PID 4872 wrote to memory of 3040	4872	Eocenh32.exe	98
PID 4872 wrote to memory of 3040	4872	Eocenh32.exe	98
PID 3040 wrote to memory of 1664	3040	Eepjpb32.exe	99
PID 3040 wrote to memory of 1664	3040	Eepjpb32.exe	99
PID 3040 wrote to memory of 1664	3040	Eepjpb32.exe	99
PID 1664 wrote to memory of 2908	1664	Fohoigfh.exe	100
PID 1664 wrote to memory of 2908	1664	Fohoigfh.exe	100
PID 1664 wrote to memory of 2908	1664	Fohoigfh.exe	100
PID 2908 wrote to memory of 4668	2908	Fdegandp.exe	101
PID 2908 wrote to memory of 4668	2908	Fdegandp.exe	101
PID 2908 wrote to memory of 4668	2908	Fdegandp.exe	101
PID 4668 wrote to memory of 1464	4668	Fojlngce.exe	102
PID 4668 wrote to memory of 1464	4668	Fojlngce.exe	102
PID 4668 wrote to memory of 1464	4668	Fojlngce.exe	102
PID 1464 wrote to memory of 4156	1464	Fkalchij.exe	103
PID 1464 wrote to memory of 4156	1464	Fkalchij.exe	103
PID 1464 wrote to memory of 4156	1464	Fkalchij.exe	103
PID 4156 wrote to memory of 2372	4156	Fakdpb32.exe	104
PID 4156 wrote to memory of 2372	4156	Fakdpb32.exe	104
PID 4156 wrote to memory of 2372	4156	Fakdpb32.exe	104
PID 2372 wrote to memory of 1004	2372	Flqimk32.exe	105
PID 2372 wrote to memory of 1004	2372	Flqimk32.exe	105
PID 2372 wrote to memory of 1004	2372	Flqimk32.exe	105
PID 1004 wrote to memory of 3872	1004	Fbnafb32.exe	106
PID 1004 wrote to memory of 3872	1004	Fbnafb32.exe	106
PID 1004 wrote to memory of 3872	1004	Fbnafb32.exe	106
PID 3872 wrote to memory of 4908	3872	Flceckoj.exe	107
PID 3872 wrote to memory of 4908	3872	Flceckoj.exe	107
PID 3872 wrote to memory of 4908	3872	Flceckoj.exe	107
PID 4908 wrote to memory of 4636	4908	Fcmnpe32.exe	108
PID 4908 wrote to memory of 4636	4908	Fcmnpe32.exe	108
PID 4908 wrote to memory of 4636	4908	Fcmnpe32.exe	108
PID 4636 wrote to memory of 3132	4636	Fdnjgmle.exe	109
PID 4636 wrote to memory of 3132	4636	Fdnjgmle.exe	109
PID 4636 wrote to memory of 3132	4636	Fdnjgmle.exe	109
PID 3132 wrote to memory of 3148	3132	Gcojed32.exe	110
PID 3132 wrote to memory of 3148	3132	Gcojed32.exe	110
PID 3132 wrote to memory of 3148	3132	Gcojed32.exe	110
PID 3148 wrote to memory of 1592	3148	Ghlcnk32.exe	111
PID 3148 wrote to memory of 1592	3148	Ghlcnk32.exe	111
PID 3148 wrote to memory of 1592	3148	Ghlcnk32.exe	111
PID 1592 wrote to memory of 4360	1592	Gofkje32.exe	113
PID 1592 wrote to memory of 4360	1592	Gofkje32.exe	113
PID 1592 wrote to memory of 4360	1592	Gofkje32.exe	113
PID 4360 wrote to memory of 2268	4360	Gfpcgpae.exe	114
PID 4360 wrote to memory of 2268	4360	Gfpcgpae.exe	114
PID 4360 wrote to memory of 2268	4360	Gfpcgpae.exe	114
PID 2268 wrote to memory of 396	2268	Gmjlcj32.exe	115

C:\Users\Admin\AppData\Local\Temp\c84d0b38bc28bdbd7569463fba7003bb8cbf56bcfa13fe10245a9ca66f991051.exe
"C:\Users\Admin\AppData\Local\Temp\c84d0b38bc28bdbd7569463fba7003bb8cbf56bcfa13fe10245a9ca66f991051.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\Ehedfo32.exe
  C:\Windows\system32\Ehedfo32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\SysWOW64\Eamhodmf.exe
    C:\Windows\system32\Eamhodmf.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:552
  - - C:\Windows\SysWOW64\Ehgqln32.exe
      C:\Windows\system32\Ehgqln32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4256
    - - C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4176
      - C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4156
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4360
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2268
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        23⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2744
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4444
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1632
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3036
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        28⤵
        Executes dropped EXE
        
        PID:2580
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2692
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:920
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        31⤵
        Executes dropped EXE
        
        PID:2376
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1684
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        33⤵
        Executes dropped EXE
        
        PID:332
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2404
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        35⤵
        Executes dropped EXE
        
        PID:3636
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        36⤵
        Executes dropped EXE
        
        PID:4392
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        37⤵
        Executes dropped EXE
        
        PID:3336
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        38⤵
        Executes dropped EXE
        
        PID:1908
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        39⤵
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        40⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        41⤵
        Executes dropped EXE
        
        PID:4960
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3712
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        43⤵
        Executes dropped EXE
        
        PID:2076
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        44⤵
        Executes dropped EXE
        
        PID:1404
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        45⤵
        Executes dropped EXE
        
        PID:4964
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3408
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:436
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        48⤵
        Executes dropped EXE
        
        PID:2360
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4032
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4744
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        51⤵
        Executes dropped EXE
        
        PID:2816
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        52⤵
        Executes dropped EXE
        
        PID:4012
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1932
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4456
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4680
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3420
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3128
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2316
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        59⤵
        Executes dropped EXE
        
        PID:464
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        60⤵
        Executes dropped EXE
        
        PID:4408
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2544
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        62⤵
        Executes dropped EXE
        
        PID:2088
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        63⤵
        Executes dropped EXE
        
        PID:2416
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        64⤵
        Executes dropped EXE
        
        PID:1864
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1828
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        66⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        67⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        68⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        69⤵
        Drops file in System32 directory
        
        PID:796
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        70⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        71⤵
        Drops file in System32 directory
        
        PID:1344
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        72⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3664
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        74⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        75⤵
        Modifies registry class
        
        PID:5044
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        76⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        77⤵
        Drops file in System32 directory
        
        PID:1392
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        78⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        79⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        80⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        81⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        82⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        83⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        84⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        85⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        86⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5512
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        88⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        89⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        90⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        91⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        92⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        93⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        94⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        95⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        96⤵
        Drops file in System32 directory
        
        PID:5916
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        97⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        98⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        99⤵
        Modifies registry class
        
        PID:6044
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        100⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        101⤵
        Drops file in System32 directory
        
        PID:6136
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        102⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        103⤵
        Drops file in System32 directory
        
        PID:5244
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        104⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        105⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        106⤵
        Modifies registry class
        
        PID:5772
        
        C:\Windows\SysWOW64\Jbbfdfkn.exe
        
        C:\Windows\system32\Jbbfdfkn.exe
        107⤵
        Modifies registry class
        
        PID:5852
        
        C:\Windows\SysWOW64\Jilnqqbj.exe
        
        C:\Windows\system32\Jilnqqbj.exe
        108⤵
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Jecofa32.exe
        
        C:\Windows\system32\Jecofa32.exe
        109⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Jkmgblok.exe
        
        C:\Windows\system32\Jkmgblok.exe
        110⤵
        Modifies registry class
        
        PID:5128
        
        C:\Windows\SysWOW64\Jnkcogno.exe
        
        C:\Windows\system32\Jnkcogno.exe
        111⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Jfbkpd32.exe
        
        C:\Windows\system32\Jfbkpd32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5372
        
        C:\Windows\SysWOW64\Jkodhk32.exe
        
        C:\Windows\system32\Jkodhk32.exe
        113⤵
        Modifies registry class
        
        PID:5496
        
        C:\Windows\SysWOW64\Jehhaaci.exe
        
        C:\Windows\system32\Jehhaaci.exe
        114⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        115⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Jnpmjf32.exe
        
        C:\Windows\system32\Jnpmjf32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3700
        
        C:\Windows\SysWOW64\Jieagojp.exe
        
        C:\Windows\system32\Jieagojp.exe
        117⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Kbnepe32.exe
        
        C:\Windows\system32\Kbnepe32.exe
        118⤵
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Kihnmohm.exe
        
        C:\Windows\system32\Kihnmohm.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5908
        
        C:\Windows\SysWOW64\Knefeffd.exe
        
        C:\Windows\system32\Knefeffd.exe
        120⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Kflnfcgg.exe
        
        C:\Windows\system32\Kflnfcgg.exe
        121⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Khmknk32.exe
        
        C:\Windows\system32\Khmknk32.exe
        122⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Kngcje32.exe
        
        C:\Windows\system32\Kngcje32.exe
        123⤵
        Drops file in System32 directory
        
        PID:5556
        
        C:\Windows\SysWOW64\Kfnkkb32.exe
        
        C:\Windows\system32\Kfnkkb32.exe
        124⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\Khpgckkb.exe
        
        C:\Windows\system32\Khpgckkb.exe
        125⤵
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Knippe32.exe
        
        C:\Windows\system32\Knippe32.exe
        126⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Kechmoil.exe
        
        C:\Windows\system32\Kechmoil.exe
        127⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Klmpiiai.exe
        
        C:\Windows\system32\Klmpiiai.exe
        128⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        129⤵
        Drops file in System32 directory
        
        PID:5736
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5860
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        131⤵
        Drops file in System32 directory
        
        PID:6068
        
        C:\Windows\SysWOW64\Lnnikdnj.exe
        
        C:\Windows\system32\Lnnikdnj.exe
        132⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        133⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Llbidimc.exe
        
        C:\Windows\system32\Llbidimc.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5588
        
        C:\Windows\SysWOW64\Lblaabdp.exe
        
        C:\Windows\system32\Lblaabdp.exe
        135⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        136⤵
        Drops file in System32 directory
        
        PID:2172
        
        C:\Windows\SysWOW64\Lldfjh32.exe
        
        C:\Windows\system32\Lldfjh32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Lbnngbbn.exe
        
        C:\Windows\system32\Lbnngbbn.exe
        138⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Lihfcm32.exe
        
        C:\Windows\system32\Lihfcm32.exe
        139⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        140⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        141⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Llipehgk.exe
        
        C:\Windows\system32\Llipehgk.exe
        142⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Lbchba32.exe
        
        C:\Windows\system32\Lbchba32.exe
        143⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Mimpolee.exe
        
        C:\Windows\system32\Mimpolee.exe
        144⤵
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        145⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Miomdk32.exe
        
        C:\Windows\system32\Miomdk32.exe
        146⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Mlnipg32.exe
        
        C:\Windows\system32\Mlnipg32.exe
        147⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Mbhamajc.exe
        
        C:\Windows\system32\Mbhamajc.exe
        148⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Mhdjehhj.exe
        
        C:\Windows\system32\Mhdjehhj.exe
        149⤵
        Modifies registry class
        
        PID:6732
        
        C:\Windows\SysWOW64\Mbjnbqhp.exe
        
        C:\Windows\system32\Mbjnbqhp.exe
        150⤵
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Mehjol32.exe
        
        C:\Windows\system32\Mehjol32.exe
        151⤵
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        152⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Moaogand.exe
        
        C:\Windows\system32\Moaogand.exe
        153⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Mfhfhong.exe
        
        C:\Windows\system32\Mfhfhong.exe
        154⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Mleoafmn.exe
        
        C:\Windows\system32\Mleoafmn.exe
        155⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        156⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Niipjj32.exe
        
        C:\Windows\system32\Niipjj32.exe
        157⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Nlglfe32.exe
        
        C:\Windows\system32\Nlglfe32.exe
        158⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Noehba32.exe
        
        C:\Windows\system32\Noehba32.exe
        159⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Ngmpcn32.exe
        
        C:\Windows\system32\Ngmpcn32.exe
        160⤵
        Drops file in System32 directory
        
        PID:6344
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        161⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        162⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        163⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Empoiimf.exe
        
        C:\Windows\system32\Empoiimf.exe
        164⤵
        Modifies registry class
        
        PID:6796
        
        C:\Windows\SysWOW64\Edjgfcec.exe
        
        C:\Windows\system32\Edjgfcec.exe
        165⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Eigonjcj.exe
        
        C:\Windows\system32\Eigonjcj.exe
        166⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Hkgnfhnh.exe
        
        C:\Windows\system32\Hkgnfhnh.exe
        167⤵
        Drops file in System32 directory
        
        PID:5316
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        168⤵
        Drops file in System32 directory
        
        PID:6260
        
        C:\Windows\SysWOW64\Hdpbon32.exe
        
        C:\Windows\system32\Hdpbon32.exe
        169⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        170⤵
        Drops file in System32 directory
        
        PID:6580
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        171⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Igqkqiai.exe
        
        C:\Windows\system32\Igqkqiai.exe
        172⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        173⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Inmpcc32.exe
        
        C:\Windows\system32\Inmpcc32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6320
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        175⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Iqmidndd.exe
        
        C:\Windows\system32\Iqmidndd.exe
        176⤵
        Modifies registry class
        
        PID:6664
        
        C:\Windows\SysWOW64\Ikcmbfcj.exe
        
        C:\Windows\system32\Ikcmbfcj.exe
        177⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        178⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6332
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        180⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6792
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        182⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        183⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        184⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        185⤵
        Modifies registry class
        
        PID:6220
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        186⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        187⤵
        Drops file in System32 directory
        
        PID:7236
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        188⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        189⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        190⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        191⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Mahnhhod.exe
        
        C:\Windows\system32\Mahnhhod.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7436
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7476
        
        C:\Windows\SysWOW64\Mjpbam32.exe
        
        C:\Windows\system32\Mjpbam32.exe
        194⤵
        Drops file in System32 directory
        
        PID:7516
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        195⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Mhdckaeo.exe
        
        C:\Windows\system32\Mhdckaeo.exe
        196⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Malgcg32.exe
        
        C:\Windows\system32\Malgcg32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7652
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        198⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7764
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        200⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        201⤵
        Drops file in System32 directory
        
        PID:7844
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        202⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7932
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        204⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        205⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Nkqkhk32.exe
        
        C:\Windows\system32\Nkqkhk32.exe
        206⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        207⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        208⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        209⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        210⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        211⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        212⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        213⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        214⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        215⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        216⤵
        Drops file in System32 directory
        
        PID:7648
        
        C:\Windows\SysWOW64\Oafcqcea.exe
        
        C:\Windows\system32\Oafcqcea.exe
        217⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        218⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        219⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Piphgq32.exe
        
        C:\Windows\system32\Piphgq32.exe
        220⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        221⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        222⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        223⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        224⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        225⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        226⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        227⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        228⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        229⤵
        Drops file in System32 directory
        
        PID:7688
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        230⤵
        Drops file in System32 directory
        
        PID:7824
        
        C:\Windows\SysWOW64\Pcobaedj.exe
        
        C:\Windows\system32\Pcobaedj.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7924
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        232⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        233⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        234⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        235⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        236⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        237⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6808
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7312
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        240⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        241⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        242⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        243⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        244⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        245⤵
        Modifies registry class
        
        PID:4648
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        246⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        247⤵
        
        PID:316
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        248⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        249⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1636
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4988
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2080
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        253⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        254⤵
        Drops file in System32 directory
        
        PID:4620
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        255⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        256⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        257⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        258⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        259⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        260⤵
        Modifies registry class
        
        PID:3872
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        261⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        262⤵
        Modifies registry class
        
        PID:2180
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        263⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        264⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        265⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        266⤵
        Modifies registry class
        
        PID:1344
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        267⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:816
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        269⤵
        Drops file in System32 directory
        
        PID:4800
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        270⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        271⤵
        
        PID:976
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        272⤵
        Modifies registry class
        
        PID:5252
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        273⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        274⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4992
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        276⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        277⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2044
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        279⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        280⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        281⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5172
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        283⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2904
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        285⤵
        Modifies registry class
        
        PID:5088
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        286⤵
        Modifies registry class
        
        PID:1828
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        287⤵
        Drops file in System32 directory
        
        PID:3036
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        288⤵
        
        PID:636
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        289⤵
        Drops file in System32 directory
        
        PID:1464
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        290⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4676
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        292⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        293⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        294⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        295⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        296⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        297⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5340
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5952
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        299⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        300⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        301⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        302⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        303⤵
        Modifies registry class
        
        PID:1956
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        304⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        305⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        306⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        307⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        308⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        309⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        310⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1716
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2372
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        313⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        314⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        315⤵
        Drops file in System32 directory
        
        PID:5448
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        316⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        317⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        318⤵
        Drops file in System32 directory
        
        PID:5976
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        319⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        320⤵
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        321⤵
        Modifies registry class
        
        PID:2012
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        322⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        323⤵
        Drops file in System32 directory
        
        PID:5132
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        324⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        325⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        326⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        327⤵
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        328⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        329⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1740
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        331⤵
        Modifies registry class
        
        PID:2304
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        332⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2092
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        334⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6460
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        335⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        336⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        337⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        338⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        339⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        340⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1736
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        342⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        343⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        344⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        345⤵
        
        PID:920
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        346⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3040
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        348⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        349⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        350⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        351⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        352⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        353⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8496
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        355⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        356⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        357⤵
        Modifies registry class
        
        PID:8628
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        358⤵
        Modifies registry class
        
        PID:8676
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8716
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        360⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8808
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        362⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        363⤵
        Modifies registry class
        
        PID:8888
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8932
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8980
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        366⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        367⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        368⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        369⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9184
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        371⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        372⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        373⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8396
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        375⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8560
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        377⤵
        Modifies registry class
        
        PID:8660
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        378⤵
        Drops file in System32 directory
        
        PID:8708
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        379⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        380⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        381⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8956
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        382⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        383⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        384⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        385⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        386⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        387⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        388⤵
        
        PID:900
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        389⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        390⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        391⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8872
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        392⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        393⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        394⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        395⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        396⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6080
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        397⤵
        Modifies registry class
        
        PID:5148
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        398⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        399⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        400⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        401⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        402⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        403⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        404⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        405⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        406⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        407⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        408⤵
        Drops file in System32 directory
        
        PID:9088
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        409⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        410⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        411⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        412⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        413⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        414⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        415⤵
        Drops file in System32 directory
        
        PID:5748
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        416⤵
        Modifies registry class
        
        PID:2112
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        417⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        418⤵
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        419⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        420⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        421⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        422⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        423⤵
        Drops file in System32 directory
        
        PID:5936
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        424⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        425⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        426⤵
        Modifies registry class
        
        PID:9008
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        427⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        428⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        429⤵
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        430⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        431⤵
        Modifies registry class
        
        PID:5912
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        432⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        433⤵
        Drops file in System32 directory
        
        PID:5984
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        434⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        435⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        436⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        437⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        438⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        439⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        440⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        441⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4584
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7132
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        443⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        444⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5552
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        445⤵
        Modifies registry class
        
        PID:9164
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        446⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        447⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        448⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6296
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        450⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        451⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        452⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5980
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        454⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        455⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        456⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        457⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        458⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        459⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        460⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        461⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        462⤵
        Modifies registry class
        
        PID:6892
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        463⤵
        Modifies registry class
        
        PID:6380
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        464⤵
        Modifies registry class
        
        PID:8384
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        465⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        466⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        467⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        468⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        469⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6280
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        470⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        471⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        472⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        473⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        474⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        475⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        476⤵
        Drops file in System32 directory
        
        PID:9512
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        477⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        478⤵
        Modifies registry class
        
        PID:9592
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        479⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        480⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        481⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        482⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9816
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        484⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        485⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        486⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        487⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        488⤵
        Modifies registry class
        
        PID:10048
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        489⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10088 -s 400
        490⤵
        Program crash
        
        PID:10192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 10088 -ip 10088
1⤵
PID:10156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Dmadco32.exe

Filesize
55KB

MD5
9267633f41e147216a85da9052c1c9bd

SHA1
182a43343c19009c55ddb0e46a9fc07da8345b06

SHA256
497eb3b08e2850b440f0bec860678ea6b4102df932e9d118f65712c563ce66a7

SHA512
edeaf4fdedb04f403638c464c56bfb1b498e43026e4136a712ab313ccd24589fe8b2b67c17dbb1571fcdbd2f58052ff5feb21723f942c1fc249738f5e56836b5

Download Submit
C:\Windows\SysWOW64\Eamhodmf.exe

Filesize
55KB

MD5
30dd7f6ded672993eddd9714567ac009

SHA1
08c6ecf8ceea5b52089cc015590964796dbfc776

SHA256
ee36eb82f553195f5521aa28dfbbeaa785500236cc87861d5dd4d1c497ce64e0

SHA512
fe4fe310348d6e904a74bc2e11b13ac023704ef291562d86d7801ccc744410d9aff9baf332ef5c8867b3685252918c8a75fb7009d360696dd176d2ed9f4ce6e5

Download Submit
C:\Windows\SysWOW64\Ecmeig32.exe

Filesize
55KB

MD5
1f3d090c0f7df5de8465f2d0e8387bda

SHA1
aec07c137c0aa5e0faa58d237b3da6fa07b3673a

SHA256
ffa1fe280f6b1937a55ed9038b97425b8a97aed716a570395e671bad901fb3ca

SHA512
f5dc48ea47be3f20614b03c27df4ab97376156331d7f4161e0feff10d374fba3e9bf104c887a21fd787f5e8126023d06f28085890746d1dd17d226c393d3ab4c

Download Submit
C:\Windows\SysWOW64\Eepjpb32.exe

Filesize
55KB

MD5
dbd191c19bca8888d856caa6d0024182

SHA1
21f45864a510416a0b628caca47d49cdab4463a6

SHA256
6a402f5df2d0e0169e29a39024b0e43bec5d893dd088fa404a95f4afc42dbf52

SHA512
693fdc262c5384499a0decd749905cb65c92bac6ba25737c50561e94294a7f88e89a098c345a93b8929b933fa3797040e6cf0040f593504327d33396fd493fba

Download Submit
C:\Windows\SysWOW64\Ehedfo32.exe

Filesize
55KB

MD5
e384ec18b455eb35332049065096f250

SHA1
32faf71573174697dd3d887029042bef8a900b2d

SHA256
be5f93c63653581c422aaa7075f7543d590b23a364e5f2a6a147776e0f774086

SHA512
dfaf64591628a9a1fe62cf06f903450360d7f9c891760c303fc13ac7951080412dd525bd3d6957888453bb9c703f836a538a354be64841d336aa8271a90d86ab

Download Submit
C:\Windows\SysWOW64\Ehgqln32.exe

Filesize
55KB

MD5
dbecd1517bbd9c928a33998026e0ac6b

SHA1
84e5e985f0c8433760c6e7a6acea2f7b4bb42721

SHA256
7fd7346fe0b5f5ac88ffdf9c0117d46500b25c475528240210dcb7fcfe7763fb

SHA512
b6fdc2ecb05ddeff5e3edcdab95569e49ec582327d2d94aa908d5f95e37057578a0d61dbb65c84a49bb7f769b6ce6209b758859e4463e4cfb8184b827064abca

Download Submit
C:\Windows\SysWOW64\Eocenh32.exe

Filesize
55KB

MD5
072c71f063ef29cc655a2a431fc6006b

SHA1
4d4756a055cc33cf6934b935d9ff1470592f5150

SHA256
9c2f8af568c47756ad84926658dd32031daeee7bae8e9866b68dab11990ff3b5

SHA512
fa1ab65efee251956d382b81f1613cac724afcef48e8a93a09c39c56111b68ed8927aaaaf11d479241aaac62c06621299238a31c937a9d96a89942f967c55fb4

Download Submit
C:\Windows\SysWOW64\Fakdpb32.exe

Filesize
55KB

MD5
b1de1393d1924994b50c93ebbd857fb1

SHA1
71126c95bfef67f9025e146ef448c697462b22bd

SHA256
41f9cb4f97687457a4b58b6f8f5cdcf3071dacff8e4b78cfff86e72e55c66f07

SHA512
65cbe8e96193f46ebd20cd6ccea666d6c9d62b8b81a675dbcac8e6a8d36d7268090025cb0c29dffdbdee8dc3aff83c01ec64aeb3b8a6268659d2f20e9cc12be2

Download Submit
C:\Windows\SysWOW64\Fbnafb32.exe

Filesize
55KB

MD5
ca61f7d40bad97ced65eae6cb3fb2fbe

SHA1
773a07cc78439e88bfa482954a15c055032cfeb3

SHA256
ce52d6d1ed37670f411a5f8ec850d84e789c07ccf1ff89a48f5750c222df9f1e

SHA512
10984b5cd6578f9e43dcb4d6f52240c1bb92e46dbdb926f8ebfcd8b0ff73fd4983541e6b466b93512c5280938c1794a7d0fb19a6e70cadfc36a7568cafddd934

Download Submit
C:\Windows\SysWOW64\Fcmnpe32.exe

Filesize
55KB

MD5
4dcad5c9c12637cfb1e433556e648a9c

SHA1
2bfd699c99daec08f7a048b96dc8c697783533ba

SHA256
1e1bbe7328c5b4f0a6e86ede2a6032527c6fa344fce7aa4fc67a9a223d15d4eb

SHA512
1fdc9f69412c7429880cd0ae0967138c9ef517a30fa84ecb5b1947a9f20e2422d9b9b2112d1015b5de02979e794d0f0610c3f5bd13478d5338d4d3026ee6358d

Download Submit
C:\Windows\SysWOW64\Fdegandp.exe

Filesize
55KB

MD5
1d49bab0ce7a29220d45806166dbeabb

SHA1
846bc566976631ccbfd257f0043e9ba60c44627f

SHA256
ffd7871f89e2401a42696793502f49588097b8057aadb9f9547244aceb38ad8f

SHA512
be84e690e2c40621f58d917f877dc1dbbe50d8ac5f721ca8078e8743f4c152a4614a910676f7a64cebbb42aff2ba6980ed1033c04e18bc80046c2f63651bbc31

Download Submit
C:\Windows\SysWOW64\Fdnjgmle.exe

Filesize
55KB

MD5
1bd4b01c5ba98bc5e72fe2366f1a18bc

SHA1
543073f53fee451468b9a45f934c3141ecfddeae

SHA256
7d75ebc4048828a360a28877dde539f44324891cb7ba2386de8d6f1ae57e60e6

SHA512
79c397f459c08e9b610ba79bbaea0b105de036f0f071da9d4af4aac44317f65d266926a722314fb2589ace027dfb7d88647a18c83d84063f0458cff3c85aa66c

Download Submit
C:\Windows\SysWOW64\Fkalchij.exe

Filesize
55KB

MD5
bed5ec0909e58e4c8cc9ef16edd0a01f

SHA1
ed27faefff85f2afbbbeb63f5e0a3a77cf4e5801

SHA256
3c72a9cc9289420ff2acd033471a8f32171349e1e1015fb2a14fb70d2c2e071c

SHA512
c51f5a91572fed4bf6ed1acf195a4c6eeb6b8cbc95a82236ae0e77e9f8b69a36b75d8a01a27b2128bc3fe0c16bee4ea3e9b0f78d7799c79be77f479afafe8bba

Download Submit
C:\Windows\SysWOW64\Flceckoj.exe

Filesize
55KB

MD5
abb6c5e4bc918240d185252939239df4

SHA1
786eaab4cc3eac65b40fa0f601679b50524c6574

SHA256
6abdc45615c9a4e49d9900a0112df71f34ae8fb027ffb73424670076c88f509c

SHA512
85bef5b49c12026f337dbb1b6ffd7c262fba44cef9bbf97a0bde02441a542b2b6fa9bad22a77dbe98cc34e684896334c0a962f7b8fc30e7e5b9110959e5920b6

Download Submit
C:\Windows\SysWOW64\Flqimk32.exe

Filesize
55KB

MD5
015c1d26aa42a0a1ecba86ea78c1c3de

SHA1
80fa6e749fea61769ae3c69a94a2e5a4f4fe4aaf

SHA256
de987baca8d4cd991e15843c547c90ad46b802354d222779e918f933bf791bc9

SHA512
7dce487ebb5a799ee91d0b78a7254fdf76a3de36a4eb7e59f408c58f2f93c587280854d3bc3ff5ea9d7bcd065895137dbb8baa04eb65df70302c638311fe4e01

Download Submit
C:\Windows\SysWOW64\Fohoigfh.exe

Filesize
55KB

MD5
63f94424a18aca38925bbc599d55d82a

SHA1
c552fb3c3b0c06398b76a12bac479ea11e262791

SHA256
a216fab4bbe21196012ee6e65522f463a0c5b0c56f72f152b0e76eaf01f2b692

SHA512
80ce8eef9bda4f10b3107b262d483a0605b7d9c046b921dc28e9cb706aeb773b52d2c8e37e58351860083d4772664bbfc7a4089724edf6b83df40437d1592dc8

Download Submit
C:\Windows\SysWOW64\Fojlngce.exe

Filesize
55KB

MD5
f40d6de87e98733a05c81f4014509901

SHA1
d9235aea81e0cd8706c758de409227ecff49f443

SHA256
1b8e00dd55daf647e24f4b3b745ef90581f5b704b486607eae580d2e4ff7f44a

SHA512
6ac9d7244398a370f4bffc95f10e0a2baa67d8736b8c8ac2a93442475d48040dc539a8868dd545ef7b7a7c3f2da014fde2659a96b80727eb68a24416552055d3

Download Submit
C:\Windows\SysWOW64\Gcfqfc32.exe

Filesize
55KB

MD5
974e56029194a57b630e9d9a57fd8b41

SHA1
f0c2d77b5afea26cf53009de88aa0e3886265afb

SHA256
31df20a41a92bf0721920253f5a1c59c120ea3c026fcb468dcd25813f1ed3283

SHA512
5776bfac333bd457eaf6731e43cba531af6284b9c05ae2ba5b7013b0ae5633e48f3da7a37604a9587f68d99165ff65192522f910ef07f62371901ba71ce99001

Download Submit
C:\Windows\SysWOW64\Gcojed32.exe

Filesize
55KB

MD5
e963e442949fabd7e1cf27a2ead200b0

SHA1
375a74e2b65a0096c8e454ba18af4c505d65529e

SHA256
f84470920c2e8ba2a433bf7eebc6513221525782b1b56c0ce7d9989cd3a6899c

SHA512
de9776446dff2a71c87ee36cd5a1fc0ea426081f2feaa3c8801861344041ba5b46fc2784ec72dd8782ee425aabfd3ac9be61551c218247ef45d75f4b05bf0288

Download Submit
C:\Windows\SysWOW64\Gdhmnlcj.exe

Filesize
55KB

MD5
1d38c3566c0eeeb96a0139fb3a405be9

SHA1
9117a332bf1068dc844af17cbe591d8f90a42a82

SHA256
de5e055baddaf8dddd15e265ab207c4c9be14171e0b9b73bc4aafef0b8c25675

SHA512
a7ee4d0f2622ed4d5954dde8a8af4437baeb6d0184a8d7d07bb2f43281686b305d0ee814d76321a502e5deda8538255d1438c114c697aed03141bd526800aa6b

Download Submit
C:\Windows\SysWOW64\Gfbploob.exe

Filesize
55KB

MD5
9aa56887113c3ccc8bc5ad362705ee32

SHA1
ca2ac55368a6385872f789733d93eee2bdb2ba3f

SHA256
ad25fd119db7f1c692217fdcaf441c8aa8b7f7814827497a63889e7ba227027e

SHA512
6f78f8ac72e93ff57606451b8b74ac917a1648c1062c8e21b2d10463cb24d7d0b9ef9da79237f02b0652ef491bf86e27f5abbcce423d6fe6b6fd4dc4b9d046da

Download Submit
C:\Windows\SysWOW64\Gfgjgo32.exe

Filesize
55KB

MD5
01878acc92322f462719b889ea59c86b

SHA1
bac684fd11f659a08f5f85aa24e5837733ca89be

SHA256
90cf5806960a084b29cf35f354e120830dfdbf828c3d508ec0a945c3ed7f5e3b

SHA512
3ae187389ba059d6f9b5271ba5d899d0d4efe05c6680c7b21dc498892a1af84905770921022ae319b218e4a1ada909c49ea43971c4c2c894aa036dd1a429e228

Download Submit
C:\Windows\SysWOW64\Gfpcgpae.exe

Filesize
55KB

MD5
2aa258b9ff756fd52b08e11ef06b3591

SHA1
875549efbd1f6a513b83e33cb503629d0a397bc2

SHA256
792c76a525fe69b87a45a46a686f2da0edb6fccfff28da256542343c7389125d

SHA512
add450c4ebb8b243c7a91488c3923404ebceabfa00b8b4f340b4bd425469ec7d5cc6a3801622c9a00efe11ff88a76c59373605475f1d2ad79e570dd0454c9f04

Download Submit
C:\Windows\SysWOW64\Ghlcnk32.exe

Filesize
55KB

MD5
5281c57b9d0848b582f29615c3c5317e

SHA1
695061797b72c4b216f9217695cc9f87a8d93153

SHA256
6ec046c1a2022bf5d003e8ea70072305359d3ac77f32c85330027dce5a5cd956

SHA512
a2b2fe6bc17e2973d7e3c00ed0415a87a63b329707c64fb5f71997c4dd1c9c8e5a0ddaf1d54f8bd8ed6556fdfdc87bfa43693d61aa45517c7fe08c733d3700fa

Download Submit
C:\Windows\SysWOW64\Gkoiefmj.exe

Filesize
55KB

MD5
9c1b558cf2ebd67316fe05afb02fd2b1

SHA1
ca09cc31dfc987f20dd244e0f78d6e2b8e6e5c81

SHA256
be1d229c39da549df44924b8fa46bb17f62c120ff98a80115038e88b0839735b

SHA512
d25b7bcd040aee59b4a78c7a075d92d79cc65d76027cf9152df67945bee98dfd17340dc6eaf7646b7c366771190747ec4df6b2defc1440a691c42aaf4c24b1aa

Download Submit
C:\Windows\SysWOW64\Gmjlcj32.exe

Filesize
55KB

MD5
5e502ddba4c384c604accd705a2cb8d2

SHA1
e038f51c3b3e8637d6e352e32aabeea5605a8409

SHA256
03e1c363e620d87031d8fd1c0b5d002b5b586ebeae4fae6782565e7e429340bd

SHA512
10e6cde2b4c7f2b6e69b4af023fa2332e5b12773bc006c95c5db0887c71798261df120158e1e89c195a18fb9e8c1cf57a8902043d6599fd5dc573df37915af54

Download Submit
C:\Windows\SysWOW64\Gofkje32.exe

Filesize
55KB

MD5
25f3f14acd4887bf7c91f52680fe93e4

SHA1
90418a5872e995fbbf329f7c23465132066c0be4

SHA256
fa79e503b2a41059d51072bf0c2ae91f31723c5e92fabe6759c01eff03f490a6

SHA512
4f91eb68afd79abeebd061de51033b1bf9956030285c4391be27f5fe9cba783c9b2add98ec1891eeea54abf27500558f37391eebdf8caf7a9575b3bc23884b11

Download Submit
C:\Windows\SysWOW64\Gohhpe32.exe

Filesize
55KB

MD5
9d32d44c88ce1b5efe06417318ad9234

SHA1
e02e8664d4a887cb3820e85ca7bb89c790183bc7

SHA256
ab8470144f15a5299ebfcfbd1a0c66783acd95ec8ac8c2c97ff55598ffc30515

SHA512
da8c4d6c1254d20de95b74a33377122e4cc0d48bf503355fd74997921289d9ef34691ad936771b8e504ad82de714a537a1447f04fddf3ee1fdf47f422806d641

Download Submit
C:\Windows\SysWOW64\Gomakdcp.exe

Filesize
55KB

MD5
5c9bd1d7e4c9b2b9942b701d09f6048e

SHA1
c331f0181843b0f259a53937eb7d722ad9db45a0

SHA256
8f01119819a5247e1fed67e57863257056e3a7cb3f20e69b3ee31f582b0828bf

SHA512
d0b60b583c9110d6ce015e37c7afa2c76ec5af51226aa7c09a079f89cf838f9acb52d4e83b8b2cd10d3b7d2632f897009bc4b77df78f9983e12b53c036580df2

Download Submit
C:\Windows\SysWOW64\Hckjacjg.exe

Filesize
55KB

MD5
359f47d7c546f8d74577f105a170d686

SHA1
ade46a42b77550217a701bf9ecef04a86f849c59

SHA256
cd0767e0d2356180319775d58456fb4906d05037b4261b579d39ab3bb00da1f5

SHA512
88d669591520affd8cebcf0aad7ed202d5d26897e4666de7727a61b6de236ab6996a6726cfca62ad02779aecf8b969ea4861baf0146d85027168b6f39c90d91e

Download Submit
C:\Windows\SysWOW64\Helfik32.exe

Filesize
55KB

MD5
a4be78b20bc3c59296b4cededde3c584

SHA1
e07248e18fe172c3db430bff0f7981199cbeb38a

SHA256
d33e2c1848a82a566bcb9323a0a914f15f05f23a38a9512f51f9f96efb3a7045

SHA512
4d9a41430ec8822326a33bcb46cb21ad869338d1dcc0cb1f23eb3b99fa7fde62d51cb41d5842d3a6923cfc2902f8f636f929ffa3ffc71101d0eca0bc24b0da65

Download Submit
C:\Windows\SysWOW64\Hiefcj32.exe

Filesize
55KB

MD5
5c9e3fc1250365d1ee1920b27b32915f

SHA1
56deb9d4d64bcf48ae44fa867cbb94fd01e275ee

SHA256
dbbc81ca805ed4de5045a952e5f24cee735c916a8ca158d886843960fe241fa6

SHA512
982d72e405d56176cc546cb795b34dcc5e632246c7497778ce045d94e61b4478b6ddfaa24600bc9fd7a2a597bdb29a9eed60b32f32b95688ae9eec176ced575e

Download Submit
C:\Windows\SysWOW64\Hmcojh32.exe

Filesize
55KB

MD5
77dfb737f1b6ea9cff23c8de8611bc8d

SHA1
b825146f9b040e1f184e5ec0d4378db28b9b0508

SHA256
ea061947264cc4d075b111bab0f5ce7bb78bf4f4d7e6901bcf87d8dcdeb810a4

SHA512
45bf0a969d8028c5ff0ef1786a0cf58e8d8d15985b1cb48a0ea8da7832df465d13573fa0c3b4f86dfc9a01d0747a4b206fdc7f6d2825ea8b348eaf5bab1d314e

Download Submit
C:\Windows\SysWOW64\Kfankifm.exe

Filesize
55KB

MD5
fcb36a81fbbba20cb3914f71a8f5b400

SHA1
1b4c1380ce34dc0d0355e0ff79dbdc0d06a35c27

SHA256
8a7fe7b01e5eb99afdc7c95d0a16ec3abad7c329c7d56ae2b7533e56ce1f826a

SHA512
d8288bd4dd9e939a1c118512fd175a36f23af8c37008da3db6cc1ea83d9c79f63a08985f27fb83b4e8eb324301d2b247281ef5f6aceb62fc0ceba5f231f1cf62

Download Submit
C:\Windows\SysWOW64\Kihnmohm.exe

Filesize
55KB

MD5
53b1f41332ae9273c9432b5a6bd1e950

SHA1
7e3e22dfa828eb7932b4a47460e8105968189c61

SHA256
4031cab9239ba83a92bd239bdbc24b23215371883c8c5b6c1327afa6c3d34223

SHA512
cd52eed818910953d3d1389d68a32a58daa12341c717a26cc27cc7d787c0be1abd0f8ef09d28c7605ee7205d1a40c7fe9e46214cc26b0ebc26612d625391d378

Download Submit
memory/332-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/396-182-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/436-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/464-414-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/552-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/920-778-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/920-233-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1004-106-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1296-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1296-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1296-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1404-324-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1464-82-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1592-154-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1632-202-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1664-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1684-250-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1684-785-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1908-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1932-378-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2076-318-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2088-432-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2268-174-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2308-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2316-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2360-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2372-98-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2376-779-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2376-242-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2404-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2544-426-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2580-771-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2580-218-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2692-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2692-772-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2744-186-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2816-366-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2908-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3036-765-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3036-209-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3040-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3128-402-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3132-138-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3148-146-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3336-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3408-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3420-396-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3636-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3712-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3872-114-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4012-372-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4032-354-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4156-90-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4176-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4256-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4360-162-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4372-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4392-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4408-423-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4444-194-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4456-384-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4560-294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4636-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4668-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4680-394-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4744-360-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4872-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4908-122-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4960-306-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4964-330-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads