c9ab15951bbc56ac359cec336ae570e2868557d90c31c180711f5f15172f8d56

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9ab15951bbc56ac359cec336ae570e2868557d90c31c180711f5f15172f8d56.exe
Size

125KB
MD5

29f92bfec65805611a3f1181f8a65fe5
SHA1

177dd7c35f1c9eab85519869b1a30095ecb19878
SHA256

c9ab15951bbc56ac359cec336ae570e2868557d90c31c180711f5f15172f8d56
SHA512

e8d00bb40a6ce1c0c348e37e5872781db8b960c80f8124cc857e2a3e61e81549f87618e8b5d7057b9ba3773440569e73e080f85526c87b2debeaa37f4f1831a6
SSDEEP

3072:CDaEA2ndOHfw1h/cm1WdTCn93OGey/ZhJakrPF:yhA2nLJc9TCndOGeKTaG

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibjjhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iejcji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Melnob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odednmpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abpcon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qcgffqei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pkceffcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkalchij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hkdbpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aaepqjpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecandfpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ednaqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmcojh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlkagbej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehekqe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocegdjij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opdghh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ipldfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iannfk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcfqfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ickchq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eleplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcagphom.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cehkhecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Obfhba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ahhblemi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahkobekf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdlnbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Anogiicl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hcedaheh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blfdia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Imfdff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgioqq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kphmie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqpnombl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pbpjhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lekehdgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocdqjceo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcfebonm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkiqbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fhajlc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogcpjhoq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abngjnmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dahode32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hcdmga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldjhpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jiphkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ijdeiaio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilidbbgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbfpobpb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gofkje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe

Executes dropped EXE 64 IoCs

pid	Process
1408	Ceibclgn.exe
1436	Chgoogfa.exe
1592	Cpofpdgd.exe
1348	Coagla32.exe
1620	Capchmmb.exe
5044	Dlegeemh.exe
4636	Dcopbp32.exe
4776	Dhlhjf32.exe
5100	Dcalgo32.exe
4476	Dephckaf.exe
2372	Dljqpd32.exe
8	Dcdimopp.exe
1376	Debeijoc.exe
4308	Dphifcoi.exe
2200	Dcfebonm.exe
1096	Dhcnke32.exe
2928	Domfgpca.exe
1180	Efgodj32.exe
3060	Ehekqe32.exe
4328	Epmcab32.exe
384	Ebnoikqb.exe
2280	Ejegjh32.exe
3672	Epopgbia.exe
4396	Ecmlcmhe.exe
2800	Eflhoigi.exe
3464	Eleplc32.exe
460	Eodlho32.exe
808	Ejjqeg32.exe
452	Elhmablc.exe
2332	Ecbenm32.exe
1708	Ejlmkgkl.exe
4516	Emjjgbjp.exe
208	Fhajlc32.exe
5060	Fmmfmbhn.exe
3268	Fcgoilpj.exe
2524	Fjqgff32.exe
2988	Fmocba32.exe
2340	Fcikolnh.exe
1384	Ffggkgmk.exe
2328	Fmapha32.exe
2204	Fopldmcl.exe
3824	Fbnhphbp.exe
1840	Fihqmb32.exe
1640	Fobiilai.exe
1516	Fbqefhpm.exe
2352	Fijmbb32.exe
4520	Gcpapkgp.exe
3384	Gjjjle32.exe
3160	Gimjhafg.exe
4624	Gogbdl32.exe
64	Gcbnejem.exe
448	Gjlfbd32.exe
228	Gbgkfg32.exe
4504	Gjocgdkg.exe
1504	Gbjhlfhb.exe
2128	Gmoliohh.exe
4900	Gbldaffp.exe
2944	Gifmnpnl.exe
4168	Gppekj32.exe
2936	Hboagf32.exe
3904	Hbanme32.exe
3736	Hjhfnccl.exe
4896	Habnjm32.exe
1400	Hjjbcbqj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Copfjgjf.dll	Qbimoo32.exe
File created	C:\Windows\SysWOW64\Ffddka32.exe	Fcfhof32.exe
File created	C:\Windows\SysWOW64\Flioncbc.dll	Demecd32.exe
File created	C:\Windows\SysWOW64\Bejfanad.dll	Elgfgl32.exe
File created	C:\Windows\SysWOW64\Knkffk32.dll	Fakdpb32.exe
File created	C:\Windows\SysWOW64\Ldjicq32.dll	Gcddpdpo.exe
File opened for modification	C:\Windows\SysWOW64\Ffggkgmk.exe	Fcikolnh.exe
File created	C:\Windows\SysWOW64\Gnbbnj32.dll	Gbldaffp.exe
File opened for modification	C:\Windows\SysWOW64\Mciobn32.exe	Mpkbebbf.exe
File opened for modification	C:\Windows\SysWOW64\Bbifelba.exe	Bdhfhe32.exe
File opened for modification	C:\Windows\SysWOW64\Kfoafi32.exe	Kdqejn32.exe
File opened for modification	C:\Windows\SysWOW64\Ickchq32.exe	Ildkgc32.exe
File created	C:\Windows\SysWOW64\Dlkhie32.dll	Ilidbbgl.exe
File created	C:\Windows\SysWOW64\Chmhoe32.dll	Oneklm32.exe
File created	C:\Windows\SysWOW64\Kmfiloih.dll	Aminee32.exe
File opened for modification	C:\Windows\SysWOW64\Debeijoc.exe	Dcdimopp.exe
File opened for modification	C:\Windows\SysWOW64\Maaepd32.exe	Mjjmog32.exe
File opened for modification	C:\Windows\SysWOW64\Nceonl32.exe	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Ddpfgd32.dll	Ngedij32.exe
File created	C:\Windows\SysWOW64\Qopkop32.dll	Bagflcje.exe
File opened for modification	C:\Windows\SysWOW64\Dhfajjoj.exe	Cegdnopg.exe
File opened for modification	C:\Windows\SysWOW64\Fckajehi.exe	Fkciihgg.exe
File created	C:\Windows\SysWOW64\Lejfpelg.dll	Hckjacjg.exe
File created	C:\Windows\SysWOW64\Ildkgc32.exe	Iejcji32.exe
File created	C:\Windows\SysWOW64\Kedoge32.exe	Kbfbkj32.exe
File created	C:\Windows\SysWOW64\Bdghlnlo.dll	Ebnoikqb.exe
File created	C:\Windows\SysWOW64\Kbmebabl.dll	Imbaemhc.exe
File opened for modification	C:\Windows\SysWOW64\Aaepqjpd.exe	Alhhhcal.exe
File created	C:\Windows\SysWOW64\Fkciihgg.exe	Fhemmlhc.exe
File created	C:\Windows\SysWOW64\Nhgaocmg.dll	Kfckahdj.exe
File created	C:\Windows\SysWOW64\Hhmkaf32.dll	Mpjlklok.exe
File opened for modification	C:\Windows\SysWOW64\Oqfdnhfk.exe	Ofqpqo32.exe
File created	C:\Windows\SysWOW64\Dmnlpfhd.dll	Fcikolnh.exe
File created	C:\Windows\SysWOW64\Gcpapkgp.exe	Fijmbb32.exe
File created	C:\Windows\SysWOW64\Gbjhlfhb.exe	Gjocgdkg.exe
File created	C:\Windows\SysWOW64\Bgllgqcp.dll	Jdemhe32.exe
File created	C:\Windows\SysWOW64\Kgllfjld.dll	Pkhoae32.exe
File created	C:\Windows\SysWOW64\Ohjdgn32.dll	Ogkcpbam.exe
File opened for modification	C:\Windows\SysWOW64\Pjcbbmif.exe	Pfhfan32.exe
File opened for modification	C:\Windows\SysWOW64\Fbnhphbp.exe	Fopldmcl.exe
File opened for modification	C:\Windows\SysWOW64\Haggelfd.exe	Hjmoibog.exe
File created	C:\Windows\SysWOW64\Hibljoco.exe	Hcedaheh.exe
File opened for modification	C:\Windows\SysWOW64\Pkhoae32.exe	Pcagphom.exe
File opened for modification	C:\Windows\SysWOW64\Imfdff32.exe	Ibqpimpl.exe
File opened for modification	C:\Windows\SysWOW64\Ldjhpl32.exe	Lmppcbjd.exe
File created	C:\Windows\SysWOW64\Oneklm32.exe	Ojjolnaq.exe
File opened for modification	C:\Windows\SysWOW64\Dhocqigp.exe	Deagdn32.exe
File created	C:\Windows\SysWOW64\Dcdimopp.exe	Dljqpd32.exe
File opened for modification	C:\Windows\SysWOW64\Lgikfn32.exe	Lcmofolg.exe
File created	C:\Windows\SysWOW64\Gomakdcp.exe	Gicinj32.exe
File opened for modification	C:\Windows\SysWOW64\Ifjodl32.exe	Ickchq32.exe
File created	C:\Windows\SysWOW64\Gbgkfg32.exe	Gjlfbd32.exe
File created	C:\Windows\SysWOW64\Ibjqcd32.exe	Ipldfi32.exe
File created	C:\Windows\SysWOW64\Gcbifaej.dll	Jimekgff.exe
File created	C:\Windows\SysWOW64\Jcbdhp32.dll	Dfpgffpm.exe
File opened for modification	C:\Windows\SysWOW64\Dephckaf.exe	Dcalgo32.exe
File created	C:\Windows\SysWOW64\Bffkij32.exe	Bchomn32.exe
File created	C:\Windows\SysWOW64\Donfhp32.dll	Ocbddc32.exe
File opened for modification	C:\Windows\SysWOW64\Ceehho32.exe	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Lcpllo32.exe	Laopdgcg.exe
File created	C:\Windows\SysWOW64\Andgoobc.exe	Ahkobekf.exe
File opened for modification	C:\Windows\SysWOW64\Bjpaooda.exe	Bdfibe32.exe
File opened for modification	C:\Windows\SysWOW64\Ckcgkldl.exe	Cajcbgml.exe
File created	C:\Windows\SysWOW64\Cdlgno32.dll	Bganhm32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12944	12848	WerFault.exe	609

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgikfn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Abngjnmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqqlehck.dll"	Hihbijhn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ibcmom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qoecnk32.dll"	Kemhff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdmai32.dll"	Ocdqjceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ampkqqjm.dll"	Ecmlcmhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kilhgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Icgjmapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jlednamo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chkede32.dll"	Epmcab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njcqqgjb.dll"	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fomhdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fckajehi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Klngdpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghekjiam.dll"	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bobiobnp.dll"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmkefnli.dll"	Hjjbcbqj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mciobn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qajadlja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ecandfpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjqkei32.dll"	Ikbnacmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jcioiood.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Najmlf32.dll"	Olcbmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ofeilobp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Icjmmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jpojcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcneih32.dll"	Gfpcgpae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gcddpdpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mbfkbhpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pkfblfab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Deanodkh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhciec32.dll"	Ckpjfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogflbdn.dll"	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Haggelfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Elppfmoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ghopckpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ejegjh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Laopdgcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcfhgi32.dll"	Pengdk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ildkgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ickchq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojleohnl.dll"	Kbfbkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lipdae32.dll"	Pmidog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Okolkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pengdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anmnemcc.dll"	Aanjpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ocdqjceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjjdjk32.dll"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipfna32.dll"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ocegdjij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ldjhpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oqkdcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gomakdcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iclnemml.dll"	Aegikj32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 1408	4128	c9ab15951bbc56ac359cec336ae570e2868557d90c31c180711f5f15172f8d56.exe	90
PID 4128 wrote to memory of 1408	4128	c9ab15951bbc56ac359cec336ae570e2868557d90c31c180711f5f15172f8d56.exe	90
PID 4128 wrote to memory of 1408	4128	c9ab15951bbc56ac359cec336ae570e2868557d90c31c180711f5f15172f8d56.exe	90
PID 1408 wrote to memory of 1436	1408	Ceibclgn.exe	91
PID 1408 wrote to memory of 1436	1408	Ceibclgn.exe	91
PID 1408 wrote to memory of 1436	1408	Ceibclgn.exe	91
PID 1436 wrote to memory of 1592	1436	Chgoogfa.exe	92
PID 1436 wrote to memory of 1592	1436	Chgoogfa.exe	92
PID 1436 wrote to memory of 1592	1436	Chgoogfa.exe	92
PID 1592 wrote to memory of 1348	1592	Cpofpdgd.exe	93
PID 1592 wrote to memory of 1348	1592	Cpofpdgd.exe	93
PID 1592 wrote to memory of 1348	1592	Cpofpdgd.exe	93
PID 1348 wrote to memory of 1620	1348	Coagla32.exe	94
PID 1348 wrote to memory of 1620	1348	Coagla32.exe	94
PID 1348 wrote to memory of 1620	1348	Coagla32.exe	94
PID 1620 wrote to memory of 5044	1620	Capchmmb.exe	95
PID 1620 wrote to memory of 5044	1620	Capchmmb.exe	95
PID 1620 wrote to memory of 5044	1620	Capchmmb.exe	95
PID 5044 wrote to memory of 4636	5044	Dlegeemh.exe	96
PID 5044 wrote to memory of 4636	5044	Dlegeemh.exe	96
PID 5044 wrote to memory of 4636	5044	Dlegeemh.exe	96
PID 4636 wrote to memory of 4776	4636	Dcopbp32.exe	97
PID 4636 wrote to memory of 4776	4636	Dcopbp32.exe	97
PID 4636 wrote to memory of 4776	4636	Dcopbp32.exe	97
PID 4776 wrote to memory of 5100	4776	Dhlhjf32.exe	98
PID 4776 wrote to memory of 5100	4776	Dhlhjf32.exe	98
PID 4776 wrote to memory of 5100	4776	Dhlhjf32.exe	98
PID 5100 wrote to memory of 4476	5100	Dcalgo32.exe	99
PID 5100 wrote to memory of 4476	5100	Dcalgo32.exe	99
PID 5100 wrote to memory of 4476	5100	Dcalgo32.exe	99
PID 4476 wrote to memory of 2372	4476	Dephckaf.exe	100
PID 4476 wrote to memory of 2372	4476	Dephckaf.exe	100
PID 4476 wrote to memory of 2372	4476	Dephckaf.exe	100
PID 2372 wrote to memory of 8	2372	Dljqpd32.exe	101
PID 2372 wrote to memory of 8	2372	Dljqpd32.exe	101
PID 2372 wrote to memory of 8	2372	Dljqpd32.exe	101
PID 8 wrote to memory of 1376	8	Dcdimopp.exe	102
PID 8 wrote to memory of 1376	8	Dcdimopp.exe	102
PID 8 wrote to memory of 1376	8	Dcdimopp.exe	102
PID 1376 wrote to memory of 4308	1376	Debeijoc.exe	103
PID 1376 wrote to memory of 4308	1376	Debeijoc.exe	103
PID 1376 wrote to memory of 4308	1376	Debeijoc.exe	103
PID 4308 wrote to memory of 2200	4308	Dphifcoi.exe	104
PID 4308 wrote to memory of 2200	4308	Dphifcoi.exe	104
PID 4308 wrote to memory of 2200	4308	Dphifcoi.exe	104
PID 2200 wrote to memory of 1096	2200	Dcfebonm.exe	105
PID 2200 wrote to memory of 1096	2200	Dcfebonm.exe	105
PID 2200 wrote to memory of 1096	2200	Dcfebonm.exe	105
PID 1096 wrote to memory of 2928	1096	Dhcnke32.exe	106
PID 1096 wrote to memory of 2928	1096	Dhcnke32.exe	106
PID 1096 wrote to memory of 2928	1096	Dhcnke32.exe	106
PID 2928 wrote to memory of 1180	2928	Domfgpca.exe	107
PID 2928 wrote to memory of 1180	2928	Domfgpca.exe	107
PID 2928 wrote to memory of 1180	2928	Domfgpca.exe	107
PID 1180 wrote to memory of 3060	1180	Efgodj32.exe	108
PID 1180 wrote to memory of 3060	1180	Efgodj32.exe	108
PID 1180 wrote to memory of 3060	1180	Efgodj32.exe	108
PID 3060 wrote to memory of 4328	3060	Ehekqe32.exe	109
PID 3060 wrote to memory of 4328	3060	Ehekqe32.exe	109
PID 3060 wrote to memory of 4328	3060	Ehekqe32.exe	109
PID 4328 wrote to memory of 384	4328	Epmcab32.exe	110
PID 4328 wrote to memory of 384	4328	Epmcab32.exe	110
PID 4328 wrote to memory of 384	4328	Epmcab32.exe	110
PID 384 wrote to memory of 2280	384	Ebnoikqb.exe	111

C:\Users\Admin\AppData\Local\Temp\c9ab15951bbc56ac359cec336ae570e2868557d90c31c180711f5f15172f8d56.exe
"C:\Users\Admin\AppData\Local\Temp\c9ab15951bbc56ac359cec336ae570e2868557d90c31c180711f5f15172f8d56.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\Ceibclgn.exe
  C:\Windows\system32\Ceibclgn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\Chgoogfa.exe
    C:\Windows\system32\Chgoogfa.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Windows\SysWOW64\Cpofpdgd.exe
      C:\Windows\system32\Cpofpdgd.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1592
    - - C:\Windows\SysWOW64\Coagla32.exe
        
        C:\Windows\system32\Coagla32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1348
      - C:\Windows\SysWOW64\Capchmmb.exe
        
        C:\Windows\system32\Capchmmb.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\SysWOW64\Dlegeemh.exe
        
        C:\Windows\system32\Dlegeemh.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\SysWOW64\Dcopbp32.exe
        
        C:\Windows\system32\Dcopbp32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\SysWOW64\Dhlhjf32.exe
        
        C:\Windows\system32\Dhlhjf32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\SysWOW64\Dcalgo32.exe
        
        C:\Windows\system32\Dcalgo32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SysWOW64\Dephckaf.exe
        
        C:\Windows\system32\Dephckaf.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\Dljqpd32.exe
        
        C:\Windows\system32\Dljqpd32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\SysWOW64\Dcdimopp.exe
        
        C:\Windows\system32\Dcdimopp.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\SysWOW64\Debeijoc.exe
        
        C:\Windows\system32\Debeijoc.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1376
        
        C:\Windows\SysWOW64\Dphifcoi.exe
        
        C:\Windows\system32\Dphifcoi.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\Dcfebonm.exe
        
        C:\Windows\system32\Dcfebonm.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Windows\SysWOW64\Dhcnke32.exe
        
        C:\Windows\system32\Dhcnke32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\SysWOW64\Domfgpca.exe
        
        C:\Windows\system32\Domfgpca.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\SysWOW64\Efgodj32.exe
        
        C:\Windows\system32\Efgodj32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1180
        
        C:\Windows\SysWOW64\Ehekqe32.exe
        
        C:\Windows\system32\Ehekqe32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\SysWOW64\Epmcab32.exe
        
        C:\Windows\system32\Epmcab32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\SysWOW64\Ebnoikqb.exe
        
        C:\Windows\system32\Ebnoikqb.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:384
        
        C:\Windows\SysWOW64\Ejegjh32.exe
        
        C:\Windows\system32\Ejegjh32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2280
        
        C:\Windows\SysWOW64\Epopgbia.exe
        
        C:\Windows\system32\Epopgbia.exe
        24⤵
        Executes dropped EXE
        
        PID:3672
        
        C:\Windows\SysWOW64\Ecmlcmhe.exe
        
        C:\Windows\system32\Ecmlcmhe.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4396
        
        C:\Windows\SysWOW64\Eflhoigi.exe
        
        C:\Windows\system32\Eflhoigi.exe
        26⤵
        Executes dropped EXE
        
        PID:2800
        
        C:\Windows\SysWOW64\Eleplc32.exe
        
        C:\Windows\system32\Eleplc32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\SysWOW64\Eodlho32.exe
        
        C:\Windows\system32\Eodlho32.exe
        28⤵
        Executes dropped EXE
        
        PID:460
        
        C:\Windows\SysWOW64\Ejjqeg32.exe
        
        C:\Windows\system32\Ejjqeg32.exe
        29⤵
        Executes dropped EXE
        
        PID:808
        
        C:\Windows\SysWOW64\Elhmablc.exe
        
        C:\Windows\system32\Elhmablc.exe
        30⤵
        Executes dropped EXE
        
        PID:452
        
        C:\Windows\SysWOW64\Ecbenm32.exe
        
        C:\Windows\system32\Ecbenm32.exe
        31⤵
        Executes dropped EXE
        
        PID:2332
        
        C:\Windows\SysWOW64\Ejlmkgkl.exe
        
        C:\Windows\system32\Ejlmkgkl.exe
        32⤵
        Executes dropped EXE
        
        PID:1708
        
        C:\Windows\SysWOW64\Emjjgbjp.exe
        
        C:\Windows\system32\Emjjgbjp.exe
        33⤵
        Executes dropped EXE
        
        PID:4516
        
        C:\Windows\SysWOW64\Fhajlc32.exe
        
        C:\Windows\system32\Fhajlc32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:208
        
        C:\Windows\SysWOW64\Fmmfmbhn.exe
        
        C:\Windows\system32\Fmmfmbhn.exe
        35⤵
        Executes dropped EXE
        
        PID:5060
        
        C:\Windows\SysWOW64\Fcgoilpj.exe
        
        C:\Windows\system32\Fcgoilpj.exe
        36⤵
        Executes dropped EXE
        
        PID:3268
        
        C:\Windows\SysWOW64\Fjqgff32.exe
        
        C:\Windows\system32\Fjqgff32.exe
        37⤵
        Executes dropped EXE
        
        PID:2524
        
        C:\Windows\SysWOW64\Fmocba32.exe
        
        C:\Windows\system32\Fmocba32.exe
        38⤵
        Executes dropped EXE
        
        PID:2988
        
        C:\Windows\SysWOW64\Fcikolnh.exe
        
        C:\Windows\system32\Fcikolnh.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2340
        
        C:\Windows\SysWOW64\Ffggkgmk.exe
        
        C:\Windows\system32\Ffggkgmk.exe
        40⤵
        Executes dropped EXE
        
        PID:1384
        
        C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        41⤵
        Executes dropped EXE
        
        PID:2328
        
        C:\Windows\SysWOW64\Fopldmcl.exe
        
        C:\Windows\system32\Fopldmcl.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2204
        
        C:\Windows\SysWOW64\Fbnhphbp.exe
        
        C:\Windows\system32\Fbnhphbp.exe
        43⤵
        Executes dropped EXE
        
        PID:3824
        
        C:\Windows\SysWOW64\Fihqmb32.exe
        
        C:\Windows\system32\Fihqmb32.exe
        44⤵
        Executes dropped EXE
        
        PID:1840
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        45⤵
        Executes dropped EXE
        
        PID:1640
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        46⤵
        Executes dropped EXE
        
        PID:1516
        
        C:\Windows\SysWOW64\Fijmbb32.exe
        
        C:\Windows\system32\Fijmbb32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2352
        
        C:\Windows\SysWOW64\Gcpapkgp.exe
        
        C:\Windows\system32\Gcpapkgp.exe
        48⤵
        Executes dropped EXE
        
        PID:4520
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        49⤵
        Executes dropped EXE
        
        PID:3384
        
        C:\Windows\SysWOW64\Gimjhafg.exe
        
        C:\Windows\system32\Gimjhafg.exe
        50⤵
        Executes dropped EXE
        
        PID:3160
        
        C:\Windows\SysWOW64\Gogbdl32.exe
        
        C:\Windows\system32\Gogbdl32.exe
        51⤵
        Executes dropped EXE
        
        PID:4624
        
        C:\Windows\SysWOW64\Gcbnejem.exe
        
        C:\Windows\system32\Gcbnejem.exe
        52⤵
        Executes dropped EXE
        
        PID:64
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:448
        
        C:\Windows\SysWOW64\Gbgkfg32.exe
        
        C:\Windows\system32\Gbgkfg32.exe
        54⤵
        Executes dropped EXE
        
        PID:228
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4504
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        56⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Windows\SysWOW64\Gmoliohh.exe
        
        C:\Windows\system32\Gmoliohh.exe
        57⤵
        Executes dropped EXE
        
        PID:2128
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4900
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        59⤵
        Executes dropped EXE
        
        PID:2944
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        60⤵
        Executes dropped EXE
        
        PID:4168
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        61⤵
        Executes dropped EXE
        
        PID:2936
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        62⤵
        Executes dropped EXE
        
        PID:3904
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        63⤵
        Executes dropped EXE
        
        PID:3736
        
        C:\Windows\SysWOW64\Habnjm32.exe
        
        C:\Windows\system32\Habnjm32.exe
        64⤵
        Executes dropped EXE
        
        PID:4896
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1400
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        66⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        67⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        68⤵
        Drops file in System32 directory
        
        PID:2992
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        69⤵
        Modifies registry class
        
        PID:2172
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4912
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        71⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        72⤵
        
        PID:812
        
        C:\Windows\SysWOW64\Ipldfi32.exe
        
        C:\Windows\system32\Ipldfi32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2600
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        74⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        75⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        76⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        77⤵
        Modifies registry class
        
        PID:2504
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3988
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        79⤵
        Drops file in System32 directory
        
        PID:2500
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2160
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        81⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        82⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        83⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        84⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        85⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        86⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        87⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        88⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Imihfl32.exe
        
        C:\Windows\system32\Imihfl32.exe
        89⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        90⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5480
        
        C:\Windows\SysWOW64\Jiphkm32.exe
        
        C:\Windows\system32\Jiphkm32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5524
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        93⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        94⤵
        Drops file in System32 directory
        
        PID:5616
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        95⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        96⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        97⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        98⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        99⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        100⤵
        Modifies registry class
        
        PID:5876
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        101⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        102⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        103⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        104⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        105⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        106⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        107⤵
        Modifies registry class
        
        PID:5200
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        108⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        109⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        110⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        111⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5536
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        113⤵
        Drops file in System32 directory
        
        PID:5612
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        114⤵
        Modifies registry class
        
        PID:5684
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        115⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        116⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5860
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        117⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        118⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        119⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6136
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        121⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        122⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5448
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        124⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        125⤵
        Drops file in System32 directory
        
        PID:5668
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        126⤵
        Modifies registry class
        
        PID:5772
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        127⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        128⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        129⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        130⤵
        Modifies registry class
        
        PID:5204
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        131⤵
        Modifies registry class
        
        PID:5360
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        132⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        133⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        134⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        135⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        136⤵
        Drops file in System32 directory
        
        PID:5256
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        137⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5172
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        140⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6020
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        142⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        143⤵
        Modifies registry class
        
        PID:6092
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        144⤵
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        145⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        146⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        147⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        148⤵
        Drops file in System32 directory
        
        PID:6376
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        149⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        150⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        151⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        152⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        153⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        154⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        155⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        156⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        157⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        158⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        159⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        160⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        161⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        162⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        163⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        164⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7120
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        166⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6172
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6224
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6292
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        170⤵
        Modifies registry class
        
        PID:6396
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        171⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        172⤵
        Modifies registry class
        
        PID:6536
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        173⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        174⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        175⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        176⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6856
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6952
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        179⤵
        Modifies registry class
        
        PID:7008
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7072
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        181⤵
        Modifies registry class
        
        PID:7148
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6180
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        183⤵
        Drops file in System32 directory
        
        PID:6284
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        184⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        185⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        186⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        187⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        188⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        189⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        190⤵
        Modifies registry class
        
        PID:6264
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        191⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        192⤵
        Drops file in System32 directory
        
        PID:6764
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        193⤵
        Modifies registry class
        
        PID:6892
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        194⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        195⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        196⤵
        Modifies registry class
        
        PID:7116
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6664
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        198⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7228
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        200⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7324
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        202⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7408
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        204⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        205⤵
        Drops file in System32 directory
        
        PID:7488
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7532
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        207⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        208⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        209⤵
        Drops file in System32 directory
        
        PID:7656
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        210⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        211⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        212⤵
        Drops file in System32 directory
        
        PID:7780
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        213⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        214⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        215⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        216⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        217⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        218⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        219⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8144
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        221⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        222⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        223⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        224⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        225⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        226⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        227⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        228⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        229⤵
        Modifies registry class
        
        PID:7728
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        230⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        231⤵
        Drops file in System32 directory
        
        PID:7904
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        232⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        233⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8100
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        235⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        236⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        237⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        238⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        239⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        240⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        241⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        242⤵
        Drops file in System32 directory
        
        PID:7924
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        243⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        244⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        245⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        246⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        247⤵
        Modifies registry class
        
        PID:7836
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        248⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        249⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7480
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        251⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        252⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        253⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        254⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        255⤵
        Modifies registry class
        
        PID:7944
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        256⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        257⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        258⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        259⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8360
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        261⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        262⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        263⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        264⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        265⤵
        Drops file in System32 directory
        
        PID:8604
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8640
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        267⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        268⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        269⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        270⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        271⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        272⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        273⤵
        Drops file in System32 directory
        
        PID:8932
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        274⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9012
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        276⤵
        Modifies registry class
        
        PID:9056
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        277⤵
        Drops file in System32 directory
        
        PID:9092
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        278⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        279⤵
        Drops file in System32 directory
        
        PID:9184
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        280⤵
        Drops file in System32 directory
        
        PID:7972
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        281⤵
        Modifies registry class
        
        PID:8224
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8308
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        283⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        284⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        285⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        286⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        287⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        288⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        289⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        290⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8968
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        292⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        293⤵
        Modifies registry class
        
        PID:9108
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        294⤵
        Modifies registry class
        
        PID:9176
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        295⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8232
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        296⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        297⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8592
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        299⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        300⤵
        Drops file in System32 directory
        
        PID:8784
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        301⤵
        Modifies registry class
        
        PID:8896
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        302⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9156
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        304⤵
        Drops file in System32 directory
        
        PID:8248
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        305⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        306⤵
        Modifies registry class
        
        PID:8680
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8840
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        308⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        309⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        310⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        311⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        312⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        313⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        314⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        315⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        316⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9232
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        318⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        319⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        320⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        321⤵
        Modifies registry class
        
        PID:9396
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9440
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        323⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        324⤵
        Modifies registry class
        
        PID:9528
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        325⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9612
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        327⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9656
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9692
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        329⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        330⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        331⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        332⤵
        Drops file in System32 directory
        
        PID:9856
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9904
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9948
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        335⤵
        Modifies registry class
        
        PID:9984
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        336⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        337⤵
        Drops file in System32 directory
        
        PID:10068
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10116
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        339⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        340⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        341⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        342⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        343⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        344⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        345⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        346⤵
        Modifies registry class
        
        PID:9648
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        347⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        348⤵
        Modifies registry class
        
        PID:9828
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        349⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        350⤵
        Modifies registry class
        
        PID:9960
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        351⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        352⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        353⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        354⤵
        Drops file in System32 directory
        
        PID:9252
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        355⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        356⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        357⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9720
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        358⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        359⤵
        Modifies registry class
        
        PID:9980
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        360⤵
        Drops file in System32 directory
        
        PID:10104
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        361⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        362⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        363⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        364⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        365⤵
        Drops file in System32 directory
        
        PID:10128
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9336
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9704
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        368⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        369⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        370⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        371⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        372⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        373⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        374⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        375⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        376⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        377⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        378⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        379⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        380⤵
        Modifies registry class
        
        PID:10584
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        381⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        382⤵
        Drops file in System32 directory
        
        PID:10664
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        383⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        384⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        385⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        386⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        387⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10924
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        389⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        390⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        391⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        392⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        393⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        394⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        395⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        396⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        397⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        398⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        399⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        400⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        401⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        402⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        403⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        404⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        405⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        406⤵
        Modifies registry class
        
        PID:10932
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        407⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        408⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        409⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        410⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        411⤵
        Drops file in System32 directory
        
        PID:9992
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        412⤵
        Drops file in System32 directory
        
        PID:10352
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        413⤵
        Drops file in System32 directory
        
        PID:10468
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10568
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        415⤵
        Drops file in System32 directory
        
        PID:10672
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        416⤵
        Drops file in System32 directory
        
        PID:10768
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        417⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10992
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        419⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        420⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        421⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        422⤵
        Modifies registry class
        
        PID:10480
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        423⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        424⤵
        Modifies registry class
        
        PID:10908
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        425⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11128
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        426⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        427⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        428⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        429⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11252
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        430⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        431⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        432⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6820
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        433⤵
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        434⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        435⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        436⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        437⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        438⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        439⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        440⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11384
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        441⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        442⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        443⤵
        
        PID:11508
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        444⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        445⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11636
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        447⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        448⤵
        Modifies registry class
        
        PID:11720
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        449⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        450⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        451⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        452⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        453⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        454⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12012
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        456⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        457⤵
        Drops file in System32 directory
        
        PID:12096
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        458⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        459⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        460⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        461⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        462⤵
        Drops file in System32 directory
        
        PID:11268
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        463⤵
        Drops file in System32 directory
        
        PID:11368
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        464⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        465⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        466⤵
        Drops file in System32 directory
        
        PID:11580
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        467⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        468⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        469⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        470⤵
        Modifies registry class
        
        PID:11884
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        471⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        472⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        473⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        474⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        475⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        476⤵
        
        PID:12284
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        477⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        478⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        479⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11584
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        480⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        481⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        482⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12060
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        484⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        485⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        486⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4352
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        487⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:10996
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        488⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        489⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        490⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        491⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        492⤵
        Drops file in System32 directory
        
        PID:11556
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        493⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        494⤵
        
        PID:12252
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        495⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        496⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        497⤵
        Modifies registry class
        
        PID:11712
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        498⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        499⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        500⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        501⤵
        
        PID:12428
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        502⤵
        
        PID:12472
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        503⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12512
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        504⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        505⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12596
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        506⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12636
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        507⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        508⤵
        Drops file in System32 directory
        
        PID:12724
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        509⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12764
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        510⤵
        
        PID:12808
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        511⤵
        
        PID:12848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12848 -s 408
        512⤵
        Program crash
        
        PID:12944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 12848 -ip 12848
1⤵
PID:12916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Capchmmb.exe

Filesize
125KB

MD5
abd882da8535dd71cdb0da5d67980203

SHA1
08c4855dd430ff6e592fa790ebc8c16249370888

SHA256
fe199e1bbadbcd92a392b993fe5e45f9a071352f6d081d0cc9adeb2c7f50f77b

SHA512
363693d4bde07ced28b5cfb689248105c9ed07f5854ff12ccf2c41e48728b5337f5b1785923b6e796dbd993420f671efcfbb13749c6612b9ff92cf059fc374c0

Download Submit
C:\Windows\SysWOW64\Ceibclgn.exe

Filesize
125KB

MD5
9abe454f8b039f2ec1ce299fc62f43cb

SHA1
49eda9ad9708a7d4e0865e30bef553354b79ef36

SHA256
f21f9f4ac49de1ebdd1378a4c27f1e590f89e86ed073b7426d69adf4b817260e

SHA512
7c7b2b00d3981efadd6905bd43a74e72b04441d94266c64c3b8cdbdd75bb9e8b07798f3c2a9704a4452405cc53ff5ff175fcfb35a725ab71ab8e6e63ec27176c

Download Submit
C:\Windows\SysWOW64\Chgoogfa.exe

Filesize
125KB

MD5
460312280f401b8b0816e4ff6697951a

SHA1
56e39e24b291eb799e23206aaf0db1f918e4240b

SHA256
febb858aad672ebd6dd55f5c399033b8c1d40199a4b092a2afb02853638bc54e

SHA512
2c10141fda9e443c2a9ba0eca0f652d26a5a49d11acdb2f59fb4b7e6522faed4cc903a0e9d3d40e212227ef88f979ded415cdf4673c89bf0af8cceaf27e3e62f

Download Submit
C:\Windows\SysWOW64\Coagla32.exe

Filesize
125KB

MD5
5df2b65d23a4cc96e6772b386617d6b0

SHA1
62eefb6458b90324766bc1b94123e71b93bedce2

SHA256
307330af0332c0e610f9adb6f53f40869cc74652714ba592500f09ab0cd9a2aa

SHA512
dbf3f3f26c141b0ed7cad34f8a508f1c07e925ee42313c902ef450f91820757e09baa54d1a9d28ca7bb13dc4bbfeb176893b9a820ff3b4c85ec1433bb97403f0

Download Submit
C:\Windows\SysWOW64\Cpofpdgd.exe

Filesize
125KB

MD5
076bafe1ba160c2f1d163df4a87bf483

SHA1
4c4c84cdee4fb7191f36180cddf8830896063669

SHA256
3117f3f497df51405bde5ec505aa809f3b58a13ca42936fbc7e0903d0421f1ab

SHA512
fd8df755b6f3b243ed45791559e823768a89dba98cde01615bdc4c9e51244ffe7c9d5f28c6f0ab2a9d0b6e78b9c799e11ca64a8bb4822d9ed07b8d2857b02c14

Download Submit
C:\Windows\SysWOW64\Dcalgo32.exe

Filesize
125KB

MD5
f18f2050cdd8c73dbd11882058d3860a

SHA1
e1bac8a03b541233c8befabb196a93a9fa1c8c01

SHA256
773473dfbfca5a6a81c5f61f02473d31d8bb6a2dd5c4b7c27c000c67f0648036

SHA512
6b93d3db778d3659b51a777ea0b8b8373f306e7a7d85d58ed21a7d9fd3036e426decdf15c3ac3b2af1fb42cbe5bfcea31fe2c40ae7489cd3fe000e0d32af3b39

Download Submit
C:\Windows\SysWOW64\Dcdimopp.exe

Filesize
125KB

MD5
4a973d1ae7b8c5b972460ad2b4cdc897

SHA1
5622c3cff5f5cd2c52f2ed16d54666784e5ebc91

SHA256
2a07d37cf20ff38c632775807cac64d64d311e2009440d77e9fc885b8b553a99

SHA512
7b45ee758d199513e17bd693ce723f11d7655108561b10e7dbf28cf79786f953fa890437ab95fcb7cf7ae37bed6d8e34729a93873a7e0225b80aeff0460ee175

Download Submit
C:\Windows\SysWOW64\Dcfebonm.exe

Filesize
125KB

MD5
acae0ffd37e03efac1fc038f3895f097

SHA1
e6768ef6ecb2f87181927d47f92ce7b7acf61bad

SHA256
78e5794f37a2ec61027af475fc0b0ac3c2a0b92949d070d4034fb2f711b8d5c9

SHA512
8e6e6ff7d6e5e645c39eaba22f29ba8f336370d1bbb67cdf9cfd5b407e601c14de3e90d60261cb1d0179746c9216a83792a7a3d4f946660cb203efd63f1e30b8

Download Submit
C:\Windows\SysWOW64\Dcopbp32.exe

Filesize
125KB

MD5
e333cd2c236d36325e487794d6bc72fa

SHA1
f12576fb59607b0ca0ce6b971a4e79a420fd02b8

SHA256
d5dc5aceb17226d7cc5bea8a9560d3f0ed53cd09607cff00a61d51814a1dafec

SHA512
074b4bca3996449d2c17136ceebd9a65da118148bdf1155ceea070e4447ac0ad91ddf05f2943ccf12e261ccd2bb535d45ac7d55ff7657582ca1076d888058a1c

Download Submit
C:\Windows\SysWOW64\Debeijoc.exe

Filesize
125KB

MD5
286082a2be625aac4a357060da22f366

SHA1
3de04b69dcabf410d7a2b2b28df2cff0aeb78560

SHA256
b9f5dbfe1f1436670f69f7ea49cb393569e8c72818db9a9df5ce7e76982fa244

SHA512
60c8d04c6a3f401bfac21688c5d36cbd39b113cb548a97dde8e824295ba4f58a796adc7ec608605e8b55e9e1fe2d5b6c000025a72bd9a57751dbc9d6bf181937

Download Submit
C:\Windows\SysWOW64\Dephckaf.exe

Filesize
125KB

MD5
f199201d7e41ebb8c7ab431b31659f75

SHA1
580772d7745a6a22b6f0e8af3b137661825e11bb

SHA256
4cd9a42ca3468aa2e22c94821dcf022e500d369cf60c65719c5736301e046557

SHA512
66b06f964a72c83a161759066ec00b76678536c46d09d82879989df66c21a674ba84c8debdb1a80a82143f991cc74ea31c505a7b59415071a256a8f688e23de8

Download Submit
C:\Windows\SysWOW64\Dhcnke32.exe

Filesize
125KB

MD5
cf530abce2dedfb82e28b369a2a479fe

SHA1
fd7758b4f4bc31fd72382d565bbfc86eb20c44ca

SHA256
a8714df112e0188e651effa227defb9d1db370e3eb1a7f493c9d95c210ae1ac2

SHA512
31ccb7c40ca822b86479cc0442a6e330afce62e8f87739b4064fc164e5549ad9813ed4df32292c2c0d41204f703f6c865bffc4c1999b29347a802453ae4adb7e

Download Submit
C:\Windows\SysWOW64\Dhlhjf32.exe

Filesize
125KB

MD5
39818a68f09830fc5216743d84a15d63

SHA1
fc1c7cbde0ae9c2791ba8f4a39b62c04bfcdddc8

SHA256
cc7abbca689c5604947b9fa62eb8868b13466d8c23de96a9263bf33dd1e929f0

SHA512
2ba996333bb74cc78788412a98aae01641f680eda9b481953722a6d5c14f5a9eedf21cfdc1fe49df9db57c27a00a57af12a3a15b37edc7c396a2aeebdbaf582f

Download Submit
C:\Windows\SysWOW64\Dlegeemh.exe

Filesize
125KB

MD5
6f41981edabf64d21c6ad0a8c0f2f915

SHA1
eb241ee99062f880881a187f8990fb2112badec6

SHA256
9a9a928f01fc31d488b0241afc54fe1dd2557fe75145fc9fd127df6ea731d849

SHA512
d6e3c7814941bdd73ce434755c89a610171e21f1a4602d1447f44e30aa06682cf2ecb21ed614b1871e4ba08909eba9b0c082dc3091965f4d258ac05be21ee004

Download Submit
C:\Windows\SysWOW64\Dljqpd32.exe

Filesize
125KB

MD5
e736184864465a979c9dafb847d9cfe8

SHA1
5cf072c326ad04ebd5b433626ce2246cdaa7000a

SHA256
2686612732ac55139774a699f875341277e05ee58379b2bf90bbd40dc6c43522

SHA512
e3f13ab515d3920c690553d65e7bdd624ae642eddbeb699fc729d6ba63e40265acffff7938839df483cc2d5794dd2043cfeae1cbe69a50576ba54c0d34dc4751

Download Submit
C:\Windows\SysWOW64\Domfgpca.exe

Filesize
125KB

MD5
a018e48dae45aa9dcd8038b83a5349db

SHA1
63460609bf05a43cb438a12c551ee6ad60ae666e

SHA256
06790fada6b06df16067d83aedff384656a7e3a0df54b29368aa83bd56197418

SHA512
86a8721e658815ce5cf34662d56d7ae3ff1f67742a33f606c15ce9cc61fc4956331d17e8f2f9af3e44e4e158a9d26122532d81300a0833663a7af30c1196ceb8

Download Submit
C:\Windows\SysWOW64\Dphifcoi.exe

Filesize
125KB

MD5
c263e4729620afc7d157a2ebf57560ce

SHA1
22cf48e48999489f4370e265e6e62c4b29e84bc5

SHA256
0b524d60c5cca054fd46f10d3704a6ff637fbd234f788ec3d1d0925d1a7c56f8

SHA512
1084f54dc6bd00513b3513d47f46aa1fb450473aed9d030a017d9b717fb816aa0160e6c50fce59def707e6c7c826d2986af5e303f3293affe2d0ca1b15920e24

Download Submit
C:\Windows\SysWOW64\Ebnoikqb.exe

Filesize
125KB

MD5
ee5ef403416b8d559dec5e99856477fa

SHA1
bf7e378df4da1a6724cbe29a7192d4ff6ded16a7

SHA256
ee8b3942c45a685d6d1f9313c978923d672cb227ba867addc944f8e8f6073353

SHA512
df2fdee7c40b347b82c7c615ad14d16d1b61b1c8d5c667d22e3aaaf879bbbb30e23ba1080667732fb4ac72be269e1b78f9005456f0b4d4d820037f8105915880

Download Submit
C:\Windows\SysWOW64\Ebnoikqb.exe

Filesize
125KB

MD5
484a121a4c7433c457622edca0a9d477

SHA1
4d159c2eee9fb0e957ceb9a5bb95b28cc9694238

SHA256
b80d3acbbbfab08df284d08a52ef0c42aae783f0a9bfc0f72f8d145a35e5ab46

SHA512
6cbf54dd6a080229171c96f88cae305e771f5580ac54223ad742f488cc24af69c39775bb24be604dd23a6947bd1695341c6db26a025a2aeafb7548bc333d8656

Download Submit
C:\Windows\SysWOW64\Ecbenm32.exe

Filesize
125KB

MD5
266a2fb95d9198529ebf2d26339af619

SHA1
4c1f548718d84798f06b12a01392b5f756b470d4

SHA256
670e6a852fda0ad13b5910613efb2bbff69a832bff971b14b49634fc345c6930

SHA512
3e7908680d29c055799949725b51d83034cc678035733c6d4a5f2d5fdfb30cdb1f3f6c42faf964f275db53990f217da7f6c23df118ef6aaabd9d5a11457f34ba

Download Submit
C:\Windows\SysWOW64\Ecmlcmhe.exe

Filesize
125KB

MD5
656a4bc4a4dc646f61d152a167386501

SHA1
efa747fa8d6424daecfaad38082fb1c54cb1d167

SHA256
144f5bc861354cac954c90f2e9ca7db011269aef91c2feeddffe064faf7204a5

SHA512
2ed1b281d4ecabddafada43f3d2a3c6d304399348b0eb265a75ec243a1d17785bfe4d00c606ae826b72edfd45b75d9bb3032010ac2fc4a01ffddd331e50bbc34

Download Submit
C:\Windows\SysWOW64\Edkdkplj.exe

Filesize
125KB

MD5
86fb0786781ce9021cef6e747f405bfd

SHA1
b434635a63cc0a278eb8148fe0d27db1f730b486

SHA256
f5dcbf3b346a3a7e5c458f8867a24f2979fdd1867bcb1a3e2c2072c3ebc10e0b

SHA512
eb56e2dfd49292a195e13ef86bb888d15f170dd62255004dab9d978faeab524b7983b112880ae6e8968942d06ca02a9818762bdb5459bcec3a1b4ba78213b0cf

Download Submit
C:\Windows\SysWOW64\Efgodj32.exe

Filesize
125KB

MD5
24f28a20452b2399e54b32d7eda08789

SHA1
5884a9a2f3b47cb8a6cc6d5d4c9f8269b1c2b79c

SHA256
2e796aea982dd6efa5473cc6d78f64e09dc5d372e1e42329564e5bdcb65551b3

SHA512
cd3c8f41acc58339f054d8cb38addde515c7be3c6c5813d24c79e948a2328edba17d697476c673cfc68f7b54e0079dbf11d30de07d420002b74e369184196ca8

Download Submit
C:\Windows\SysWOW64\Eflhoigi.exe

Filesize
125KB

MD5
1867fca095bd1a74ef1b7b415ca6c1f2

SHA1
9703d000ac7547410b3da8b6382f48c676768d6d

SHA256
beb42407b96fa24d34580707e4885197358cfcb7974ff0f42fe1744f83c00c09

SHA512
d0a6f3db9695ab36178ba5bfcd16d362681ac253b6c8f53f98eebde58e74fe294b2bf3b20f532362d42786fbdcb2c30ae5d89f0dbcfc043595adb5630458c714

Download Submit
C:\Windows\SysWOW64\Ehekqe32.exe

Filesize
125KB

MD5
7c5adee595fae87ec86dde209c79a5cf

SHA1
ffa14b12514d231afef7ba43f791ed6957f3cce3

SHA256
7421d27c8b0e462e2ef8e5bc32f64adfd825767420c238a3f04b9f294e613d05

SHA512
5e890bc79d7c0965e5d8301c7f1d4eab8298fc5de5c2bf5320694d9286a2f0ffd41f990ca89c412adf5b24daf590806f0b94304f564eedd9dbd8eedc31c96ab4

Download Submit
C:\Windows\SysWOW64\Ejegjh32.exe

Filesize
125KB

MD5
db8f487f1f7b5499a540fee49c52cf17

SHA1
c28dcc5f328c166124115c0935a6a464e8eb57f3

SHA256
6039732d3b09d01e004bc7733476a048853619b2aeba16ff5b3c2d57af178acd

SHA512
dd6d75cf8a8b4893fa937b1aab3c92d43bfc8e582d3d511432c4d116e9b7514b22ea4b78fa080a54d8ec8615e45d8a7d19c520f95b14c478828d2f644a635fd6

Download Submit
C:\Windows\SysWOW64\Ejjqeg32.exe

Filesize
125KB

MD5
fac59f1ef1e5eb12b5a138799546302f

SHA1
9ea4f00197d92f2d27bb620f635f79ff00e52d4d

SHA256
26a338f20f42a2fac4d28b39c75d55c0f6a94e026ebbec487b2856e691928df0

SHA512
1b523a38f775fd5ccac66fa4deefd1d47ef103f6ee269915fee37945a0e21013f3b8972af7c1eb1820c63e433e2652d5f940107a8cb73c64be65391e718e9492

Download Submit
C:\Windows\SysWOW64\Ejlmkgkl.exe

Filesize
125KB

MD5
bafe56c50aca3186e7922773570479cd

SHA1
19bb538707bc675e826d26cebb848110298651df

SHA256
217d87ec8cd420be992e9190b619996643d400690a0164d28c6712d56187a953

SHA512
7f5aa63e7f51fdb5416ca7b847c83624738f090536bace71892144c019e65c1befe9a7642b837abc6ef7cada1ea4f2aaa29604f0cd37d5983f4f04fe0914061c

Download Submit
C:\Windows\SysWOW64\Eleplc32.exe

Filesize
125KB

MD5
69f44674b88ab70950ced9406199b419

SHA1
af3ea61ea4058baf7096388501666cf69ab5b1b8

SHA256
57b5f7b068e5b8877b4dae31b22a105c552ff05cc03a69fbbe8d9944496e147a

SHA512
8c11db2586945833026228a41fe1e6c1363273b5f2bfbbf2df00e8fb7b13784d141ffab03d4b5f614fcf323cf48e42e236132c0b58b1b63794e17308442c5256

Download Submit
C:\Windows\SysWOW64\Elhmablc.exe

Filesize
125KB

MD5
117ebfc99375d49ffbf0a81deb01237c

SHA1
57ef67b223c227f2814339fa37d9efeb8e2e3570

SHA256
d63f180435d2ef23f77e2e0bd23e011068e4285e8561aa6572d6f18a1d80a0a2

SHA512
c42debb710ec11c8c758d5f3618d3e7c62341afa75d7e5c681c83a88f87bb6d9aa1befe6c03acb2879a59e0aeaaab71e5de74ce5964b6654ad70274df20531a6

Download Submit
C:\Windows\SysWOW64\Emjjgbjp.exe

Filesize
125KB

MD5
00e3f31bd3a6d7e6b748d344469ad1cd

SHA1
63fdd15a0911c541c92e561424acce18ef8c0cf7

SHA256
2e5f8adb4b34d9029b238d57589a48c4886c635507ccedc39a22bc2031052785

SHA512
a4901ca52b94604985139875c4c55a02fc704eb2cc8cc8f7a230c1cde6d6fa66c13a79095eb52d35fcef7e4244a62fbac6dcff8b372b32d3fb3f3cbe37829986

Download Submit
C:\Windows\SysWOW64\Eodlho32.exe

Filesize
125KB

MD5
0fef06f13c550c3d3cb797990d957967

SHA1
c4267dd243fe18ceaf74daef2a5aa1a6d2f9df48

SHA256
01c18d4185e0d092aaa85d15d397e725b6688b0d2be8b2fece9e6a9a43e2473d

SHA512
a99be9176561301963b352124bd464b6afe732b2a75d88b640825c68ac7cca6bf5dee8665467b82a635dd7d7b403ef7fbe8b47c36f28e0758c15467a86f96187

Download Submit
C:\Windows\SysWOW64\Epmcab32.exe

Filesize
125KB

MD5
592f825bf22b67f378ebebe9798c0334

SHA1
b0e155fd7b230a952f232822120713e9f864bcb8

SHA256
190c45743940b48992073a84e5379e80850b1875fac2b07b85a3394c6cf03e65

SHA512
72f1ec72744061c982701d550135e9cd3f47b34227c31fa32b992176a72bf11baf9ef918448bcdf53e2537cad81a54842a8af77846d856cfbaf690b5018d3a4d

Download Submit
C:\Windows\SysWOW64\Epopgbia.exe

Filesize
125KB

MD5
67f72a558fd7867a32e1e9ff6458dbe2

SHA1
c4072144514eb228d8ef6dda5fcb35ba36c5d1a2

SHA256
fdeb070ab3a49fe27bedce9ae73cab30180527d52ff8306852f14c4e2c2a521d

SHA512
a2023864760ce462f6db9f9191663983cf2ff51ecf751f7d474063e8481446818b0f40890e8640b2b9af623384e5e5147cfe4cebf4c65311115e5857e732d621

Download Submit
C:\Windows\SysWOW64\Fmmfmbhn.exe

Filesize
64KB

MD5
40cb3f7c9834211302342545c1605114

SHA1
24d558af63e288fd21e41f23a3a6da8ce906f135

SHA256
bd80b503b8f8921c0092818cf4fa81c37f9a132529dfa42505caf9cc9f9c8ea6

SHA512
ab93122ff7227971de2a7a7df64b7708fa39dbd4e4b35adb8419d7866ab23564236a23dabfa92c1caa48c4c8d11067026ed27cf212480e926e815bf8475bdb67

Download Submit
C:\Windows\SysWOW64\Gjocgdkg.exe

Filesize
125KB

MD5
e44d5d4b6f019ecb4513f56e381f0630

SHA1
6b293b2184b9687e163f81551851685847bc3916

SHA256
b16488dcb36bc554f1aa27c41f8606efe80aa637692cc19febfd58364794ad26

SHA512
f9c4f69d5df2e0547264f91a79a16d28ab42921d9ae5021ed3b3abbf0248f36475e1b57219be456324aa1d403142c4fb206cc273665f91e8394fe60de34c4128

Download Submit
C:\Windows\SysWOW64\Hcedaheh.exe

Filesize
125KB

MD5
565aa9f617090f690071052360136d6a

SHA1
8ecafcb65c80a59c400e61fc30998fc978eacfe9

SHA256
ef51e0a7f75c5d22e73c066f9234e8b6637adf65da5a856d4a786181b8e33109

SHA512
a6cd0b167a4b6dcc7ee6e03df81075d3520cc6e2d64510d266ad63aa62b561f9af602d24ae583f8294c966af86f26e0c8c59a94440a42811cfe6e9b99d690215

Download Submit
C:\Windows\SysWOW64\Jfifijhb.dll

Filesize
7KB

MD5
bc75239294385b024634e577393d9c52

SHA1
c19938f2c1007b5be67dbe32e61c5dde9aabd0b4

SHA256
34b71f6da5876633f64d5d6a54e89ac14a98b0b0191ee34290cb82eb4bf57c35

SHA512
9934820d2cba4ca67906cb6d24a0a50e719b23b3fe5ac9151c96f1fd848e45ab7b6ddaa6ad927e0e0e4b91187870de5f9a72c633474217b7f8a6170310476cc1

Download Submit
C:\Windows\SysWOW64\Lkiqbl32.exe

Filesize
125KB

MD5
b2c55ee2f938e1000895c01600d13079

SHA1
80ff8f9103c3d3d19fe68866f915bbe481140f46

SHA256
24c717984ef3232d07a2e5e4e9d796ff5fa48e88b13cc7f3cc0c2235347b6a46

SHA512
c039e2ba91f7d591a9b8eb063e4e7907b9c3a4b577b5603a27311d700af8ca90890c10173a71bb078f2a036f7edd39cd3f5c1d274b43ad9a42ef0f7eb8576aa7

Download Submit
C:\Windows\SysWOW64\Ndghmo32.exe

Filesize
125KB

MD5
ff9055dad49893d4b3b446a1a1b17e38

SHA1
86e1d23c0e9c4c28760667dabb739a1f103656ef

SHA256
e73be301651607c8e9e5e19bae87da2f4869343d543fc30efe48152f198f05a2

SHA512
709bdcd2334399cfbe4890584e09b67b8d1a368e3efaf0d275aefaff850dcbfb1c304e276d266c504634196a814cfd6bb7b64eb293c08c0ac63462219cb1408c

Download Submit
C:\Windows\SysWOW64\Ocbddc32.exe

Filesize
125KB

MD5
5f368b0f0c16ca4f1563850f914b6b0c

SHA1
c7d2006550e04faef9f426c310ce046bfb77a1cb

SHA256
e2dcd9acc160b90f9a916829de424464560c79a6a8b62a8186c41b4d5f17daf6

SHA512
b46ba8ec9be67809e11de0974115e734ac783df6457876577d0d2fe0a5590b1bbdf6c6e7d1d88b1b871ece6fa5dd3e7b734d2180dc5ccfa889b67562b54fff51

Download Submit
C:\Windows\SysWOW64\Ofcmfodb.exe

Filesize
125KB

MD5
d97fd922765a1441693ca4cad31e7483

SHA1
9c676b53806204130440a4f4910ed9eff39a2255

SHA256
c5afa87a389224193a1a8a5a3d37e41827c55fdd8a84a457e1e822062b8c986f

SHA512
5c1e959972af0186b0afd8f0b6075146deeb548a87a6e12ab7b1c989970f05d5fe57079299b724c6388dbe37c0d3b12d313e41e28a43126f3aef4f7f9cff0e32

Download Submit
memory/8-95-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/64-374-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/208-262-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/228-386-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/384-168-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/448-376-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/452-232-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/460-215-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/808-224-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1096-128-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1180-144-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1348-32-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1376-104-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1384-298-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1408-12-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1436-16-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1504-394-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1516-338-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1592-28-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1620-39-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1640-328-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1708-248-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1840-322-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2128-400-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2200-119-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2204-310-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2280-176-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2328-304-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2332-240-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2340-292-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2352-344-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2372-87-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2524-280-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2800-200-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2928-136-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2936-424-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2944-416-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2988-286-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3060-156-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3160-363-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3268-276-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3384-352-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3464-208-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3672-184-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3736-436-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3824-320-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3904-434-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4128-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4168-422-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4308-112-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4328-159-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4396-192-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4476-80-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4504-388-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4516-256-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4520-351-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4624-364-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4636-55-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4776-63-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4896-442-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4900-406-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5044-48-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5060-268-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5100-72-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads