66b0e49a60d2b09d4ec4f5468c3ebbb8bf844a1f7e762fa5a5e38539e4eb8b11

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

66b0e49a60d2b09d4ec4f5468c3ebbb8bf844a1f7e762fa5a5e38539e4eb8b11.exe
Size

208KB
MD5

d7fd4f701684587998060b7c52143d2f
SHA1

dc72092bd754b5bef1f99d84c0ef3a8aea8c1cd0
SHA256

66b0e49a60d2b09d4ec4f5468c3ebbb8bf844a1f7e762fa5a5e38539e4eb8b11
SHA512

bd43eceb2e3f56174c039b6cd36d7d7f019d21e23a549b87684fe9b18c434bfdcfae25d5674f395d5f896c272a5cedca7b5695fd446ddddc5a9e7504c6366153
SSDEEP

6144:oWjepYGE596wpUYDX4EYtCwGtMtkiXOoloMr1JeSldqP7+x55KmC:oWjKE596wpaChtMtkM71r1MSXqPix554

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbkamqmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnqbanmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qnkdhpjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jlpkba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lmdina32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjoankoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgemphmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pbkamqmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Npfkgjdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ibqpimpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jfcbjk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmijbcpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpjlklok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gjocgdkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dadeieea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dldpkoil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njfmke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqpego32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkaiqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blmacb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcioiood.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gifmnpnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kipkhdeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pqpgdfnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onklabip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkapp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdlnbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jcioiood.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ahkobekf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Odpjcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddbbeade.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghlcnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fokbim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ffggkgmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ndfqbhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajckij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jfhbppbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mdckfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdcijcke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Odgqdlnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjffbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbhmdbnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajiknpjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfhhoi32.exe

Executes dropped EXE 64 IoCs

pid	Process
4220	Dagiil32.exe
4308	Debeijoc.exe
3908	Dhqaefng.exe
4792	Dllmfd32.exe
2988	Daifnk32.exe
4248	Djpnohej.exe
3648	Dlojkddn.exe
2596	Domfgpca.exe
5016	Efgodj32.exe
3536	Ehekqe32.exe
4908	Epmcab32.exe
3096	Ebnoikqb.exe
232	Ejegjh32.exe
456	Elccfc32.exe
4376	Ecmlcmhe.exe
1528	Eflhoigi.exe
3172	Ehjdldfl.exe
1264	Eqalmafo.exe
2484	Ebbidj32.exe
4648	Ejjqeg32.exe
5116	Elhmablc.exe
2736	Eofinnkf.exe
3500	Ebeejijj.exe
2768	Ehonfc32.exe
2624	Eqfeha32.exe
4520	Fbgbpihg.exe
3284	Fhajlc32.exe
2164	Fokbim32.exe
2640	Fbioei32.exe
1364	Fmocba32.exe
3668	Fcikolnh.exe
4548	Ffggkgmk.exe
3148	Fckhdk32.exe
3400	Ffjdqg32.exe
2088	Fmclmabe.exe
4748	Fflaff32.exe
2108	Fijmbb32.exe
1344	Fodeolof.exe
3880	Gfnnlffc.exe
2284	Gimjhafg.exe
2068	Gqdbiofi.exe
1732	Gbenqg32.exe
1236	Giofnacd.exe
3352	Gcekkjcj.exe
3484	Gbgkfg32.exe
3208	Gjocgdkg.exe
2984	Gmmocpjk.exe
3124	Gfedle32.exe
3200	Gidphq32.exe
4972	Gqkhjn32.exe
636	Gbldaffp.exe
2172	Gifmnpnl.exe
1832	Gmaioo32.exe
4540	Hihicplj.exe
4444	Hcnnaikp.exe
2796	Hfljmdjc.exe
3080	Habnjm32.exe
2308	Hcqjfh32.exe
4356	Hfofbd32.exe
3512	Hmioonpn.exe
2772	Hccglh32.exe
2448	Hfachc32.exe
4528	Hippdo32.exe
3312	Haggelfd.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Pggbkagp.exe	Pdifoehl.exe
File created	C:\Windows\SysWOW64\Ngiehn32.dll	Gfnnlffc.exe
File created	C:\Windows\SysWOW64\Kfoafi32.exe	Kpeiioac.exe
File created	C:\Windows\SysWOW64\Nodfmh32.dll	Mdhdajea.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Hihicplj.exe	Gmaioo32.exe
File created	C:\Windows\SysWOW64\Egmhjb32.dll	Hihicplj.exe
File opened for modification	C:\Windows\SysWOW64\Faihkbci.exe	Fojlngce.exe
File created	C:\Windows\SysWOW64\Nnmopdep.exe	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Lebkhc32.exe	Lgokmgjm.exe
File created	C:\Windows\SysWOW64\Cefoce32.exe	Cbgbgj32.exe
File created	C:\Windows\SysWOW64\Jjlogcip.dll	Beihma32.exe
File opened for modification	C:\Windows\SysWOW64\Cjbpaf32.exe	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Dhqaefng.exe	Debeijoc.exe
File created	C:\Windows\SysWOW64\Hifqbnpb.dll	Gbenqg32.exe
File created	C:\Windows\SysWOW64\Mdiklqhm.exe	Mnocof32.exe
File created	C:\Windows\SysWOW64\Ajanck32.exe	Qffbbldm.exe
File opened for modification	C:\Windows\SysWOW64\Gjocgdkg.exe	Gbgkfg32.exe
File opened for modification	C:\Windows\SysWOW64\Qgallfcq.exe	Qcepkg32.exe
File opened for modification	C:\Windows\SysWOW64\Beeflhdh.exe	Bbgipldd.exe
File opened for modification	C:\Windows\SysWOW64\Obangb32.exe	Ojjffddl.exe
File created	C:\Windows\SysWOW64\Gohibf32.dll	Chmeobkq.exe
File opened for modification	C:\Windows\SysWOW64\Kpgfooop.exe	Kmijbcpl.exe
File created	C:\Windows\SysWOW64\Lpcfkm32.exe	Lmdina32.exe
File created	C:\Windows\SysWOW64\Ffggkgmk.exe	Fcikolnh.exe
File opened for modification	C:\Windows\SysWOW64\Imihfl32.exe	Iinlemia.exe
File created	C:\Windows\SysWOW64\Bdkcmdhp.exe	Balfaiil.exe
File created	C:\Windows\SysWOW64\Mjegoo32.dll	Hmcojh32.exe
File created	C:\Windows\SysWOW64\Fflaff32.exe	Fmclmabe.exe
File created	C:\Windows\SysWOW64\Odednmpm.exe	Oqihnn32.exe
File created	C:\Windows\SysWOW64\Paegjl32.exe	Pnfkma32.exe
File created	C:\Windows\SysWOW64\Ifmafkkf.dll	Gdhmnlcj.exe
File created	C:\Windows\SysWOW64\Ajgblabf.dll	Hmfkoh32.exe
File created	C:\Windows\SysWOW64\Ckhindhb.dll	Fcmnpe32.exe
File opened for modification	C:\Windows\SysWOW64\Mdckfk32.exe	Lllcen32.exe
File opened for modification	C:\Windows\SysWOW64\Gmoeoidl.exe	Gdhmnlcj.exe
File created	C:\Windows\SysWOW64\Ngmgne32.exe	Ncbknfed.exe
File created	C:\Windows\SysWOW64\Hlkefpan.dll	Pkaiqf32.exe
File opened for modification	C:\Windows\SysWOW64\Fojlngce.exe	Fhqcam32.exe
File opened for modification	C:\Windows\SysWOW64\Lffhfh32.exe	Kdgljmcd.exe
File created	C:\Windows\SysWOW64\Obangb32.exe	Ojjffddl.exe
File created	C:\Windows\SysWOW64\Nhgfglco.dll	Lpebpm32.exe
File created	C:\Windows\SysWOW64\Nloiakho.exe	Neeqea32.exe
File created	C:\Windows\SysWOW64\Ibaabn32.dll	Ajckij32.exe
File created	C:\Windows\SysWOW64\Dhbgqohi.exe	Dojcgi32.exe
File opened for modification	C:\Windows\SysWOW64\Andqdh32.exe	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Bkjpmk32.dll	Acqimo32.exe
File created	C:\Windows\SysWOW64\Nphqml32.dll	Kmegbjgn.exe
File created	C:\Windows\SysWOW64\Ahkobekf.exe	Acocaf32.exe
File created	C:\Windows\SysWOW64\Iblfnn32.exe	Iicbehnq.exe
File created	C:\Windows\SysWOW64\Pnjpej32.dll	Ogjmdigk.exe
File opened for modification	C:\Windows\SysWOW64\Edkdkplj.exe	Ecjhcg32.exe
File created	C:\Windows\SysWOW64\Knkkfojb.dll	Mnebeogl.exe
File created	C:\Windows\SysWOW64\Bdhngp32.dll	66b0e49a60d2b09d4ec4f5468c3ebbb8bf844a1f7e762fa5a5e38539e4eb8b11.exe
File created	C:\Windows\SysWOW64\Jheiojpj.dll	Ncldnkae.exe
File opened for modification	C:\Windows\SysWOW64\Anadoi32.exe	Ajfhnjhq.exe
File opened for modification	C:\Windows\SysWOW64\Bjokdipf.exe	Bfdodjhm.exe
File opened for modification	C:\Windows\SysWOW64\Kgdbkohf.exe	Kdffocib.exe
File opened for modification	C:\Windows\SysWOW64\Dafbne32.exe	Dccbbhld.exe
File opened for modification	C:\Windows\SysWOW64\Jmmjgejj.exe	Jfcbjk32.exe
File created	C:\Windows\SysWOW64\Oflgep32.exe	Ogifjcdp.exe
File opened for modification	C:\Windows\SysWOW64\Mmlpoqpg.exe	Mdckfk32.exe
File opened for modification	C:\Windows\SysWOW64\Meiaib32.exe	Mdhdajea.exe
File created	C:\Windows\SysWOW64\Nfjjppmm.exe	Npmagine.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
13720	13648	WerFault.exe	664

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ickchq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hopeje32.dll"	Ebbidj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gqdbiofi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kkihknfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdmann32.dll"	Gfngap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bqbodd32.dll"	Qjoankoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjeieojj.dll"	Lgokmgjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbnamnpl.dll"	Pggbkagp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ajdbcano.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Blbknaib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckhindhb.dll"	Fcmnpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmgabj32.dll"	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hchcofhp.dll"	Oboaabga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pkjlge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hioiji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Npjebj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ofnckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcogch32.dll"	Ogaceh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjhib32.dll"	Anbkio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kfmepi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pgllfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kmlnbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnigkegh.dll"	Cknnpm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kfoafi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mdjagjco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fijmbb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jbmfoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pnihcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbcbgk32.dll"	Ecjhcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kldggoeb.dll"	Fojlngce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jcefno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fijmbb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Elgfgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gfngap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jfcbjk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdghlnlo.dll"	Ebnoikqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hfachc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omfnojog.dll"	Jbhmdbnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akihmf32.dll"	Kagichjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofdhdf32.dll"	Liekmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ifgbnlmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Eolpmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhhbcf32.dll"	Ffkjlp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfmbha32.dll"	Ibcmom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkbljp32.dll"	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilabfj32.dll"	Blfdia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nnjlpo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ijfboafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kpgfooop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mmpijp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hfifmnij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ifgbnlmj.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	9652	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 4220	2408	66b0e49a60d2b09d4ec4f5468c3ebbb8bf844a1f7e762fa5a5e38539e4eb8b11.exe	89
PID 2408 wrote to memory of 4220	2408	66b0e49a60d2b09d4ec4f5468c3ebbb8bf844a1f7e762fa5a5e38539e4eb8b11.exe	89
PID 2408 wrote to memory of 4220	2408	66b0e49a60d2b09d4ec4f5468c3ebbb8bf844a1f7e762fa5a5e38539e4eb8b11.exe	89
PID 4220 wrote to memory of 4308	4220	Dagiil32.exe	90
PID 4220 wrote to memory of 4308	4220	Dagiil32.exe	90
PID 4220 wrote to memory of 4308	4220	Dagiil32.exe	90
PID 4308 wrote to memory of 3908	4308	Debeijoc.exe	91
PID 4308 wrote to memory of 3908	4308	Debeijoc.exe	91
PID 4308 wrote to memory of 3908	4308	Debeijoc.exe	91
PID 3908 wrote to memory of 4792	3908	Dhqaefng.exe	92
PID 3908 wrote to memory of 4792	3908	Dhqaefng.exe	92
PID 3908 wrote to memory of 4792	3908	Dhqaefng.exe	92
PID 4792 wrote to memory of 2988	4792	Dllmfd32.exe	93
PID 4792 wrote to memory of 2988	4792	Dllmfd32.exe	93
PID 4792 wrote to memory of 2988	4792	Dllmfd32.exe	93
PID 2988 wrote to memory of 4248	2988	Daifnk32.exe	94
PID 2988 wrote to memory of 4248	2988	Daifnk32.exe	94
PID 2988 wrote to memory of 4248	2988	Daifnk32.exe	94
PID 4248 wrote to memory of 3648	4248	Djpnohej.exe	95
PID 4248 wrote to memory of 3648	4248	Djpnohej.exe	95
PID 4248 wrote to memory of 3648	4248	Djpnohej.exe	95
PID 3648 wrote to memory of 2596	3648	Dlojkddn.exe	96
PID 3648 wrote to memory of 2596	3648	Dlojkddn.exe	96
PID 3648 wrote to memory of 2596	3648	Dlojkddn.exe	96
PID 2596 wrote to memory of 5016	2596	Domfgpca.exe	97
PID 2596 wrote to memory of 5016	2596	Domfgpca.exe	97
PID 2596 wrote to memory of 5016	2596	Domfgpca.exe	97
PID 5016 wrote to memory of 3536	5016	Efgodj32.exe	98
PID 5016 wrote to memory of 3536	5016	Efgodj32.exe	98
PID 5016 wrote to memory of 3536	5016	Efgodj32.exe	98
PID 3536 wrote to memory of 4908	3536	Ehekqe32.exe	99
PID 3536 wrote to memory of 4908	3536	Ehekqe32.exe	99
PID 3536 wrote to memory of 4908	3536	Ehekqe32.exe	99
PID 4908 wrote to memory of 3096	4908	Epmcab32.exe	100
PID 4908 wrote to memory of 3096	4908	Epmcab32.exe	100
PID 4908 wrote to memory of 3096	4908	Epmcab32.exe	100
PID 3096 wrote to memory of 232	3096	Ebnoikqb.exe	101
PID 3096 wrote to memory of 232	3096	Ebnoikqb.exe	101
PID 3096 wrote to memory of 232	3096	Ebnoikqb.exe	101
PID 232 wrote to memory of 456	232	Ejegjh32.exe	102
PID 232 wrote to memory of 456	232	Ejegjh32.exe	102
PID 232 wrote to memory of 456	232	Ejegjh32.exe	102
PID 456 wrote to memory of 4376	456	Elccfc32.exe	103
PID 456 wrote to memory of 4376	456	Elccfc32.exe	103
PID 456 wrote to memory of 4376	456	Elccfc32.exe	103
PID 4376 wrote to memory of 1528	4376	Ecmlcmhe.exe	104
PID 4376 wrote to memory of 1528	4376	Ecmlcmhe.exe	104
PID 4376 wrote to memory of 1528	4376	Ecmlcmhe.exe	104
PID 1528 wrote to memory of 3172	1528	Eflhoigi.exe	105
PID 1528 wrote to memory of 3172	1528	Eflhoigi.exe	105
PID 1528 wrote to memory of 3172	1528	Eflhoigi.exe	105
PID 3172 wrote to memory of 1264	3172	Ehjdldfl.exe	106
PID 3172 wrote to memory of 1264	3172	Ehjdldfl.exe	106
PID 3172 wrote to memory of 1264	3172	Ehjdldfl.exe	106
PID 1264 wrote to memory of 2484	1264	Eqalmafo.exe	107
PID 1264 wrote to memory of 2484	1264	Eqalmafo.exe	107
PID 1264 wrote to memory of 2484	1264	Eqalmafo.exe	107
PID 2484 wrote to memory of 4648	2484	Ebbidj32.exe	108
PID 2484 wrote to memory of 4648	2484	Ebbidj32.exe	108
PID 2484 wrote to memory of 4648	2484	Ebbidj32.exe	108
PID 4648 wrote to memory of 5116	4648	Ejjqeg32.exe	109
PID 4648 wrote to memory of 5116	4648	Ejjqeg32.exe	109
PID 4648 wrote to memory of 5116	4648	Ejjqeg32.exe	109
PID 5116 wrote to memory of 2736	5116	Elhmablc.exe	110

C:\Users\Admin\AppData\Local\Temp\66b0e49a60d2b09d4ec4f5468c3ebbb8bf844a1f7e762fa5a5e38539e4eb8b11.exe
"C:\Users\Admin\AppData\Local\Temp\66b0e49a60d2b09d4ec4f5468c3ebbb8bf844a1f7e762fa5a5e38539e4eb8b11.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\Dagiil32.exe
  C:\Windows\system32\Dagiil32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\Debeijoc.exe
    C:\Windows\system32\Debeijoc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Windows\SysWOW64\Dhqaefng.exe
      C:\Windows\system32\Dhqaefng.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3908
    - - C:\Windows\SysWOW64\Dllmfd32.exe
        
        C:\Windows\system32\Dllmfd32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4792
      - C:\Windows\SysWOW64\Daifnk32.exe
        
        C:\Windows\system32\Daifnk32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\SysWOW64\Djpnohej.exe
        
        C:\Windows\system32\Djpnohej.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4248
        
        C:\Windows\SysWOW64\Dlojkddn.exe
        
        C:\Windows\system32\Dlojkddn.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3648
        
        C:\Windows\SysWOW64\Domfgpca.exe
        
        C:\Windows\system32\Domfgpca.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\Windows\SysWOW64\Efgodj32.exe
        
        C:\Windows\system32\Efgodj32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Ehekqe32.exe
        
        C:\Windows\system32\Ehekqe32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3536
        
        C:\Windows\SysWOW64\Epmcab32.exe
        
        C:\Windows\system32\Epmcab32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\SysWOW64\Ebnoikqb.exe
        
        C:\Windows\system32\Ebnoikqb.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        C:\Windows\SysWOW64\Ejegjh32.exe
        
        C:\Windows\system32\Ejegjh32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:232
        
        C:\Windows\SysWOW64\Elccfc32.exe
        
        C:\Windows\system32\Elccfc32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\SysWOW64\Ecmlcmhe.exe
        
        C:\Windows\system32\Ecmlcmhe.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4376
        
        C:\Windows\SysWOW64\Eflhoigi.exe
        
        C:\Windows\system32\Eflhoigi.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1528
        
        C:\Windows\SysWOW64\Ehjdldfl.exe
        
        C:\Windows\system32\Ehjdldfl.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3172
        
        C:\Windows\SysWOW64\Eqalmafo.exe
        
        C:\Windows\system32\Eqalmafo.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\SysWOW64\Ebbidj32.exe
        
        C:\Windows\system32\Ebbidj32.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\SysWOW64\Ejjqeg32.exe
        
        C:\Windows\system32\Ejjqeg32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\SysWOW64\Elhmablc.exe
        
        C:\Windows\system32\Elhmablc.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\Eofinnkf.exe
        
        C:\Windows\system32\Eofinnkf.exe
        23⤵
        Executes dropped EXE
        
        PID:2736
        
        C:\Windows\SysWOW64\Ebeejijj.exe
        
        C:\Windows\system32\Ebeejijj.exe
        24⤵
        Executes dropped EXE
        
        PID:3500
        
        C:\Windows\SysWOW64\Ehonfc32.exe
        
        C:\Windows\system32\Ehonfc32.exe
        25⤵
        Executes dropped EXE
        
        PID:2768
        
        C:\Windows\SysWOW64\Eqfeha32.exe
        
        C:\Windows\system32\Eqfeha32.exe
        26⤵
        Executes dropped EXE
        
        PID:2624
        
        C:\Windows\SysWOW64\Fbgbpihg.exe
        
        C:\Windows\system32\Fbgbpihg.exe
        27⤵
        Executes dropped EXE
        
        PID:4520
        
        C:\Windows\SysWOW64\Fhajlc32.exe
        
        C:\Windows\system32\Fhajlc32.exe
        28⤵
        Executes dropped EXE
        
        PID:3284
        
        C:\Windows\SysWOW64\Fokbim32.exe
        
        C:\Windows\system32\Fokbim32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2164
        
        C:\Windows\SysWOW64\Fbioei32.exe
        
        C:\Windows\system32\Fbioei32.exe
        30⤵
        Executes dropped EXE
        
        PID:2640
        
        C:\Windows\SysWOW64\Fmocba32.exe
        
        C:\Windows\system32\Fmocba32.exe
        31⤵
        Executes dropped EXE
        
        PID:1364
        
        C:\Windows\SysWOW64\Fcikolnh.exe
        
        C:\Windows\system32\Fcikolnh.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3668
        
        C:\Windows\SysWOW64\Ffggkgmk.exe
        
        C:\Windows\system32\Ffggkgmk.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\SysWOW64\Fckhdk32.exe
        
        C:\Windows\system32\Fckhdk32.exe
        34⤵
        Executes dropped EXE
        
        PID:3148
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        35⤵
        Executes dropped EXE
        
        PID:3400
        
        C:\Windows\SysWOW64\Fmclmabe.exe
        
        C:\Windows\system32\Fmclmabe.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2088
        
        C:\Windows\SysWOW64\Fflaff32.exe
        
        C:\Windows\system32\Fflaff32.exe
        37⤵
        Executes dropped EXE
        
        PID:4748
        
        C:\Windows\SysWOW64\Fijmbb32.exe
        
        C:\Windows\system32\Fijmbb32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2108
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        39⤵
        Executes dropped EXE
        
        PID:1344
        
        C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3880
        
        C:\Windows\SysWOW64\Gimjhafg.exe
        
        C:\Windows\system32\Gimjhafg.exe
        41⤵
        Executes dropped EXE
        
        PID:2284
        
        C:\Windows\SysWOW64\Gqdbiofi.exe
        
        C:\Windows\system32\Gqdbiofi.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2068
        
        C:\Windows\SysWOW64\Gbenqg32.exe
        
        C:\Windows\system32\Gbenqg32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1732
        
        C:\Windows\SysWOW64\Giofnacd.exe
        
        C:\Windows\system32\Giofnacd.exe
        44⤵
        Executes dropped EXE
        
        PID:1236
        
        C:\Windows\SysWOW64\Gcekkjcj.exe
        
        C:\Windows\system32\Gcekkjcj.exe
        45⤵
        Executes dropped EXE
        
        PID:3352
        
        C:\Windows\SysWOW64\Gbgkfg32.exe
        
        C:\Windows\system32\Gbgkfg32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3484
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3208
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        48⤵
        Executes dropped EXE
        
        PID:2984
        
        C:\Windows\SysWOW64\Gfedle32.exe
        
        C:\Windows\system32\Gfedle32.exe
        49⤵
        Executes dropped EXE
        
        PID:3124
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        50⤵
        Executes dropped EXE
        
        PID:3200
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        51⤵
        Executes dropped EXE
        
        PID:4972
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        52⤵
        Executes dropped EXE
        
        PID:636
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2172
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1832
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4540
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        56⤵
        Executes dropped EXE
        
        PID:4444
        
        C:\Windows\SysWOW64\Hfljmdjc.exe
        
        C:\Windows\system32\Hfljmdjc.exe
        57⤵
        Executes dropped EXE
        
        PID:2796
        
        C:\Windows\SysWOW64\Habnjm32.exe
        
        C:\Windows\system32\Habnjm32.exe
        58⤵
        Executes dropped EXE
        
        PID:3080
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        59⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        60⤵
        Executes dropped EXE
        
        PID:4356
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        61⤵
        Executes dropped EXE
        
        PID:3512
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        62⤵
        Executes dropped EXE
        
        PID:2772
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2448
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        64⤵
        Executes dropped EXE
        
        PID:4528
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        65⤵
        Executes dropped EXE
        
        PID:3312
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        66⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        67⤵
        
        PID:776
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        68⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        69⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        70⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        71⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        72⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        73⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        74⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        75⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        76⤵
        Modifies registry class
        
        PID:3048
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        77⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        78⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        79⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        80⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        81⤵
        Drops file in System32 directory
        
        PID:3920
        
        C:\Windows\SysWOW64\Imihfl32.exe
        
        C:\Windows\system32\Imihfl32.exe
        82⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        83⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        84⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        85⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        86⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        88⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        89⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Jjbako32.exe
        
        C:\Windows\system32\Jjbako32.exe
        90⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        91⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        92⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        93⤵
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5588
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        95⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        96⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        97⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        98⤵
        Drops file in System32 directory
        
        PID:5792
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        99⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        100⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        101⤵
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        102⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        103⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        104⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        105⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        106⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        107⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5268
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        109⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        110⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        111⤵
        Modifies registry class
        
        PID:5456
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        112⤵
        Modifies registry class
        
        PID:5544
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        113⤵
        Drops file in System32 directory
        
        PID:5628
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5688
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        115⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        116⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        117⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        118⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        119⤵
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        120⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        121⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        122⤵
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        123⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        124⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5732
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        126⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        127⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        128⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        129⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        130⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        131⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        132⤵
        Drops file in System32 directory
        
        PID:6020
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        133⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        134⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        135⤵
        Modifies registry class
        
        PID:5360
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        136⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        137⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        138⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        139⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        140⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6384
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        142⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        143⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6512
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        145⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        146⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        147⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        148⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        149⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        150⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        151⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        152⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6944
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        154⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        155⤵
        Modifies registry class
        
        PID:7040
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7080
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        157⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        158⤵
        Drops file in System32 directory
        
        PID:6128
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6184
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6256
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        161⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        162⤵
        Drops file in System32 directory
        
        PID:6420
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        163⤵
        Modifies registry class
        
        PID:6492
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        164⤵
        Drops file in System32 directory
        
        PID:6584
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        165⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6768
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        167⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        168⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        169⤵
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        170⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7104
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        172⤵
        Drops file in System32 directory
        
        PID:6148
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        173⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        174⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        175⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6648
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6832
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6940
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        179⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7140
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        181⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        182⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        183⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6752
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        185⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        186⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        187⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        188⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        189⤵
        Drops file in System32 directory
        
        PID:6704
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        190⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        191⤵
        Modifies registry class
        
        PID:3820
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        192⤵
        Modifies registry class
        
        PID:7204
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        193⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        194⤵
        Drops file in System32 directory
        
        PID:7284
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        195⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        196⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7416
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        198⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        199⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        200⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        201⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        202⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        203⤵
        Modifies registry class
        
        PID:7652
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        204⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        205⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        206⤵
        Modifies registry class
        
        PID:7780
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        207⤵
        Drops file in System32 directory
        
        PID:7824
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7868
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7904
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        210⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        211⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        212⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        213⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        214⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        215⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        216⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        217⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7356
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        219⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        220⤵
        Drops file in System32 directory
        
        PID:7484
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        221⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        222⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        223⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        224⤵
        Drops file in System32 directory
        
        PID:7768
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        225⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        226⤵
        Modifies registry class
        
        PID:7888
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        227⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        228⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        229⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        230⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        231⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        232⤵
        Modifies registry class
        
        PID:7340
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        233⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        234⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        235⤵
        Drops file in System32 directory
        
        PID:7748
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        236⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        237⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        238⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        239⤵
        Modifies registry class
        
        PID:1904
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        240⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        241⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        242⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        243⤵
        Drops file in System32 directory
        
        PID:7956
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        244⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        245⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        246⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        247⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        248⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        249⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        250⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8196
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        252⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        253⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        254⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8360
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        256⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        257⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8480
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8532
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        260⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        261⤵
        Drops file in System32 directory
        
        PID:8612
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        262⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        263⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        264⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        265⤵
        Drops file in System32 directory
        
        PID:8772
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        266⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        267⤵
        Modifies registry class
        
        PID:8860
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        268⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        269⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        270⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8984
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        271⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        272⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        273⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        274⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        275⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        276⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        277⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        278⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        279⤵
        Modifies registry class
        
        PID:8368
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        280⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        281⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        282⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        283⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        284⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        285⤵
        Drops file in System32 directory
        
        PID:8808
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        286⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8888
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        287⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        288⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        289⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        290⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        291⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        292⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        293⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        294⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        295⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8712
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        297⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        298⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8972
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        299⤵
        Modifies registry class
        
        PID:9136
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        300⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        301⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        302⤵
        Modifies registry class
        
        PID:8792
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8276
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        304⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        305⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        306⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        307⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        308⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        309⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        310⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        311⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        312⤵
        Drops file in System32 directory
        
        PID:9456
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        313⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        314⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        315⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        316⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        317⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        318⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        319⤵
        Modifies registry class
        
        PID:9760
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        320⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        321⤵
        Drops file in System32 directory
        
        PID:9840
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        322⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        323⤵
        Drops file in System32 directory
        
        PID:9932
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        324⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        325⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        326⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        327⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        328⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        329⤵
        Modifies registry class
        
        PID:10184
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        330⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        331⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        332⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        333⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        334⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        335⤵
        Drops file in System32 directory
        
        PID:9536
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        336⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        337⤵
        Modifies registry class
        
        PID:9676
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        338⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        339⤵
        Modifies registry class
        
        PID:9848
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        340⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        341⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        342⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10100
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        344⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        345⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        346⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        347⤵
        Modifies registry class
        
        PID:9448
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        348⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        349⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        350⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        351⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        352⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        353⤵
        Modifies registry class
        
        PID:10228
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9360
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        355⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9856
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        357⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        358⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        359⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        360⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10192
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        362⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        363⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        364⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        365⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        366⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        367⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        368⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        369⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        370⤵
        Modifies registry class
        
        PID:10492
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        371⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        372⤵
        Drops file in System32 directory
        
        PID:10576
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        373⤵
        Modifies registry class
        
        PID:10620
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        374⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10700
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        376⤵
        Modifies registry class
        
        PID:10744
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        377⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        378⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        379⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10912
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        381⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        382⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        383⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        384⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        385⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        386⤵
        Drops file in System32 directory
        
        PID:11164
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        387⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        388⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        389⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        390⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        391⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        392⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        393⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        394⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10692
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        396⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        397⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        398⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        399⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        400⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        401⤵
        Drops file in System32 directory
        
        PID:11072
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        402⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        403⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11220
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        404⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        405⤵
        Drops file in System32 directory
        
        PID:10392
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10472
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        407⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        408⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10852
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        410⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        411⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        412⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        413⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        414⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        415⤵
        Modifies registry class
        
        PID:10332
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        416⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        417⤵
        Modifies registry class
        
        PID:10712
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        418⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        419⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        420⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        421⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        422⤵
        Drops file in System32 directory
        
        PID:10516
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        423⤵
        Drops file in System32 directory
        
        PID:10860
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        424⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        425⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        426⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        427⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11028
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        428⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        429⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        430⤵
        Modifies registry class
        
        PID:10668
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        431⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        432⤵
        Drops file in System32 directory
        
        PID:11312
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        433⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        434⤵
        Modifies registry class
        
        PID:11392
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11440
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        436⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        437⤵
        
        PID:11528
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        438⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        439⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        440⤵
        Drops file in System32 directory
        
        PID:11652
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        441⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11732
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        443⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        444⤵
        Drops file in System32 directory
        
        PID:11820
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        445⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        446⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        447⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        448⤵
        Modifies registry class
        
        PID:11984
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        449⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        450⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        451⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        452⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        453⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        454⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        455⤵
        Modifies registry class
        
        PID:12280
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        456⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        457⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        458⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        459⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        460⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        461⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        462⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        463⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        464⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        465⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11896
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        466⤵
        Drops file in System32 directory
        
        PID:11972
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        467⤵
        Modifies registry class
        
        PID:11932
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        468⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        469⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        470⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12248
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        471⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11344
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        473⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        474⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        475⤵
        Modifies registry class
        
        PID:11684
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        476⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        477⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        478⤵
        
        PID:12032
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        479⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        480⤵
        
        PID:12252
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        481⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11596
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12084
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        484⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        485⤵
        Drops file in System32 directory
        
        PID:12136
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        486⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        487⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        488⤵
        Modifies registry class
        
        PID:11776
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        489⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12060
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        490⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        491⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        492⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        493⤵
        Drops file in System32 directory
        
        PID:11892
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        494⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        495⤵
        
        PID:12308
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        496⤵
        
        PID:12356
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        497⤵
        Drops file in System32 directory
        
        PID:12396
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        498⤵
        
        PID:12432
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        499⤵
        
        PID:12480
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        500⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12520
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        501⤵
        Modifies registry class
        
        PID:12560
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        502⤵
        
        PID:12612
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        503⤵
        
        PID:12648
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        504⤵
        
        PID:12692
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        505⤵
        
        PID:12732
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        506⤵
        
        PID:12780
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        507⤵
        Drops file in System32 directory
        
        PID:12824
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        508⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        509⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        510⤵
        
        PID:12940
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        511⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        512⤵
        
        PID:13020
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        513⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        514⤵
        
        PID:13116
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        515⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13156
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        516⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        517⤵
        
        PID:13228
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        518⤵
        Drops file in System32 directory
        
        PID:13264
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        519⤵
        Modifies registry class
        
        PID:13300
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        520⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        521⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12344
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        522⤵
        
        PID:12416
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        523⤵
        
        PID:12468
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        524⤵
        
        PID:12516
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        525⤵
        
        PID:12584
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        526⤵
        
        PID:12660
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        527⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        528⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12760
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        529⤵
        Modifies registry class
        
        PID:12848
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        530⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12932
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        531⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        532⤵
        Drops file in System32 directory
        
        PID:13036
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        533⤵
        Modifies registry class
        
        PID:13100
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        534⤵
        
        PID:13164
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        535⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        536⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13284
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        537⤵
        
        PID:12320
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        538⤵
        
        PID:12448
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        539⤵
        
        PID:12536
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        540⤵
        Modifies registry class
        
        PID:12640
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        541⤵
        
        PID:12752
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        542⤵
        Drops file in System32 directory
        
        PID:12856
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        543⤵
        
        PID:13008
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        544⤵
        
        PID:13096
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        545⤵
        
        PID:13216
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        546⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        547⤵
        Modifies registry class
        
        PID:12512
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        548⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        549⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12820
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        550⤵
        
        PID:13144
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        551⤵
        
        PID:13248
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        552⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12508
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        553⤵
        
        PID:12844
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        554⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        555⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        556⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:13184
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        557⤵
        
        PID:12952
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        558⤵
        
        PID:13324
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        559⤵
        
        PID:13360
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        560⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13396
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        561⤵
        
        PID:13432
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        562⤵
        
        PID:13468
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        563⤵
        
        PID:13504
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        564⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13540
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        565⤵
        
        PID:13576
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        566⤵
        
        PID:13612
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        567⤵
        
        PID:13648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13648 -s 408
        568⤵
        Program crash
        
        PID:13720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 13648 -ip 13648
1⤵
PID:13700

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:9384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:9652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aejfpjne.exe

Filesize
208KB

MD5
b15c1ac0ca8e2941308f84abfd3ec2a2

SHA1
1f8f20455a49621f19132523e25f8ab9a54a2320

SHA256
8d8e8b2fc067db7431aea7e4aeb7306b1a268346f29346453ffc0e66a2c033b5

SHA512
85a422ddc6406f5cbaf66cf7703143a632e687690810869c51b951eea1690f90407b57be4953a50bffc25ce12ce8f53495c9790720dbb5c98bd535bd1989d487

Download Submit
C:\Windows\SysWOW64\Bjpaooda.exe

Filesize
208KB

MD5
9092371e0f63686bf88c42e885fc66e3

SHA1
7ac9f4eb34def486a90d2378fb134ae3bdbef78e

SHA256
91af5a6f2462b4d5126ddd48100a7d5aa1c949a87a14af8d15d52934674b7c69

SHA512
33c2def756b444f6635395e29aa9b76898c43072b0469d3e8c4d5a2a786d5bc3ccf361872901cbcebeff0f7462724c1855a2b28f1d7278174ae5224132c048b0

Download Submit
C:\Windows\SysWOW64\Cdabcm32.exe

Filesize
208KB

MD5
fabcbb4cac7c390ad891c32ba202b1f1

SHA1
f36c27192a6f516de1cbb571d5b7b6a02bd69116

SHA256
98ceeb746bc8ebe19523bf3f8cc09550a845125e33583202014db49e0f04f145

SHA512
eefb1b3e608c6f3610827cadad73e40fc765cbf8aa36092980753010d921246ead43fcc16490b527588b0918f5458a25b0eb3317499f8cff4fb34dd9929ecba5

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
208KB

MD5
2b2680b0afc7023252195830355e5efc

SHA1
1a2fdbbbc30d8cfef68e5bec848c099cafee0c9f

SHA256
72b70bcaf0e0d285aa67cff806a8a5ef9a97dd49525fcdbdfca5e3adb62b8a3b

SHA512
988c840cc60571c0a17506db203700487adc3cb2c5250eb2a5dbd874422404d389aa507566b7090285b0420ba822ad174cc427b021d4d9378cdc95e37164145f

Download Submit
C:\Windows\SysWOW64\Cefoce32.exe

Filesize
208KB

MD5
d7e537190ccb0a2a05b120e8eb82046c

SHA1
352f2254ab8994212ae3e3fc8e76950e53181a71

SHA256
417126e07a89c0746f6bda5cfbf6f5a2b3e3e3d5ed99d26d120d8452bd2a0078

SHA512
fda4d751c2c2c13c3e25591b14ed9aa48cc12f03c87181645ee4ab071a7e517ff458259a5e005e68df712c0cbaa2145fbd1d6375329845437f2f9aab3fdd0bc8

Download Submit
C:\Windows\SysWOW64\Cjbpaf32.exe

Filesize
208KB

MD5
7a1237fead7d8a715d976c157644a33f

SHA1
6b8253e42c42b39074c5038e40620552e9f32969

SHA256
5aafab6c7ed796750b4cf9eab95a1f433836b9efcce869aea9593e144a23bd19

SHA512
261e572c78cec00500972b82a69b88a50f9241ab60b3736edea6c2b0f50904c96f105606e22b1349c957222dfb4e67586f840771d328c6c11bf8732a940ca24d

Download Submit
C:\Windows\SysWOW64\Ckpjfm32.exe

Filesize
208KB

MD5
7ca56de71f6783709a924eedd6aa63d4

SHA1
aac98db9f67752926f2961866384fffcbfec6bbb

SHA256
cd852252b3f61b145ab68aeecc3b1c14c9cff0d671ecb6a955c0ab6f87f6fff8

SHA512
dd31c962c34c0bc5c49ff14ce5bc3e93eb787ffcdc3c2ddd04c2d657ac038138917bf3c1c67f3b9a10958d65d196545162f815bb6985caf9fc5a9c0a78faa512

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
208KB

MD5
cbd981973798a12433fdc96f3495a4df

SHA1
cd1c61d1261a77cf07cd67746583778103c48ae3

SHA256
eb9945a080c42e25c6c7275032fa04e11f5cb50a7a900ce632ead601f89b9fa5

SHA512
ade6b60789eb68c7b5221c2db27ffb96ab0f5ea3f0fbc0666af64aeba6cbe8ad973a61189b74ac2941c09b4863950c41f9f1e3351f7e9cd3bd39c28e258acbbe

Download Submit
C:\Windows\SysWOW64\Dagiil32.exe

Filesize
208KB

MD5
0d06f2c00368c4d9ab7d8611b08868b1

SHA1
fe66acd6f54a7dd99d487437e55a746b689d2917

SHA256
5b516aaa77bc31e1f4ab91a43962080338a63e9ed6d8e899e6c28d45780c6511

SHA512
fa076d76e474ce233ce30ba4850239eac45a3a563075201dc566df61bf99f803c0ea20769e6775ce8f007de7ec7750328130aa0615108604d1032f2c3b12760e

Download Submit
C:\Windows\SysWOW64\Daifnk32.exe

Filesize
208KB

MD5
2434a164fbd25a077b0ee48ca7ce686e

SHA1
d73060ab153aa08df7eb1d053041906d9b981500

SHA256
1134031a0edca8f4a9911a282eadfb91837969a95d3962f485ea466d78f7a3c9

SHA512
f6033cda261b9a3d91053bbcc7944d8b1bb08fbfa97396f05d1b3341ce141b5aa58df3628842693f72e536afc9028bfaf34f99e522badd9a9ebf80e9fda33e07

Download Submit
C:\Windows\SysWOW64\Debeijoc.exe

Filesize
208KB

MD5
503cfa2cab31a586dcd55f4a179a2f4c

SHA1
8970cd893940bf079568fb8ae614291ed1e65b4e

SHA256
cf71f98551e10c4cbc48b436706e3607b4fb3c427eb81deef801a63072428eff

SHA512
7ebbf037532a11435e7a595d9c6918ec23d0638742bfec257c716e27b22d69b24dd8305c84371750d24f95ddb815882eff266552fc2d13c442f1be3b493b9629

Download Submit
C:\Windows\SysWOW64\Dhocqigp.exe

Filesize
208KB

MD5
c68633e81cdf0d07a2c87660a5b4cf8b

SHA1
ff003b1c986e6f1ce1c7c78a725ad58f10052fbb

SHA256
3d6182bca396c20449210b01f8adf6e70f2859081ff68a5048f881b8bcda71dd

SHA512
e34450372e0b4b414373173f6705cb9802fe9b4bd948600175dde404ec9ce1ef36deda289a6ca4b22fcad5facc2c9a199daa78896611726629ebe81a0ed911f3

Download Submit
C:\Windows\SysWOW64\Dhqaefng.exe

Filesize
208KB

MD5
7625c899187e87191fcaf017d2dc15d8

SHA1
08ec53ef1607e62624450652da8f1f94baaae6cf

SHA256
35fa15e1e200cc1dec0c09d0d32e28e594829a4ae6cbc534f965008ddc5f5bc7

SHA512
c7925e855bec3ab18bbac0e6fcfebba71f3e3bd12dcf6338bb00a6907193b4281f5d3fb8ff14c6c3239bd8c2fb5be57effee1a6adcd6c781ca03e3aa9b396ba7

Download Submit
C:\Windows\SysWOW64\Djpnohej.exe

Filesize
208KB

MD5
56307393f0a58c854ad2daa160dcb096

SHA1
f5bd3f11bb3a1331c21b90721e18cb54b18fa915

SHA256
0a4b74d58db12e06ba3b2c4dcfd7bf6dfcb6a24154784381b33e06114c147275

SHA512
f34cde4536324fd91a08efb87a28e4061a4668f8247745cbf92642cd89439c42e60e88a54c03d0d7e50925df20de1455a361661089cb162ee3aba5dce8c0e80e

Download Submit
C:\Windows\SysWOW64\Dllmfd32.exe

Filesize
208KB

MD5
53602097e736650884101b1825d08eb0

SHA1
3b2c8434b712c003ce7c096621ffa547094a41a6

SHA256
017d48f94d5413650c8a27c2d4df28bef94e8b6554854adb105b5a92904ce21e

SHA512
259de1cb38819db7501bd13f332c9b3f9528adf15de697143800a95a25b261e06ce7f3c8d71f791c5d8cfdb0326c3ef77553820fea245d0301e2d34eee87f68f

Download Submit
C:\Windows\SysWOW64\Dlojkddn.exe

Filesize
208KB

MD5
9a0ccd174fd91b1a206795c27481b5a9

SHA1
2b81ee19e65894e34ed84abca13046985df1b892

SHA256
5eb9f2938c319069042236b6d2e7dd60290e964e3a3f8411b77a5658e94f8835

SHA512
ef4fffcffde8ee9b38ac1baa091fc0737ec0020eefac88388abda0b310b70e454f756d309113a883b9ff9ffaf7ac0aaaef12464bacfd0a741949c556c303f881

Download Submit
C:\Windows\SysWOW64\Domfgpca.exe

Filesize
208KB

MD5
dfbb425a78e14015f87bca9c94694304

SHA1
0f806494d7f4b4b7ec802d815f264a981c724dd8

SHA256
9a23105b45a757d33eeb2f2fa476315045a754d6221958b02d4eb5797075943a

SHA512
8cf6019c1d910bcb73b39046ae8bc2e41a97d138066f1c782791275a09b7266d5af964bfd820b4b34e8832bd7164d7ced5c979a0b01f786bafb9e4626c67004d

Download Submit
C:\Windows\SysWOW64\Ebbidj32.exe

Filesize
208KB

MD5
d78b76beeebadfa21947c54033cfcaf3

SHA1
7408cb5f1f0b63e4231494647818b2f51abc3dfc

SHA256
68e28953663ac7816558168af141c396a7bf079ae7c65d64e106d3aa31755c02

SHA512
9b96e70ebb0ba53d874a9d3fd69c60432feeec6156be235af28d2fee415df9f1a422f93217c866c1b37632791a9e9e14ff744be9d9e2c0c057215ca29bd552a1

Download Submit
C:\Windows\SysWOW64\Ebeejijj.exe

Filesize
208KB

MD5
ad7df949d90ebd4490ddc4118c39074d

SHA1
7d7c9909d2861fdc2648a6bb1387bebc9f18cfb3

SHA256
5e31b98fc98db6e25eafe5d9550f2f7e7d1dee7109e3560032f4ec77f1cf0a0b

SHA512
087e5023641fe9ee43e1432eac574afe88adcc6288851d101d48a323ccf5d38a8c7a3d4edb04dddeb1a82f35dfe8e3b364296c5aa975b6de45c00c63fcf163ea

Download Submit
C:\Windows\SysWOW64\Ebnoikqb.exe

Filesize
208KB

MD5
373d362cda21f885212b6a4a4743a1ef

SHA1
0eb9ecc0054c349a15802529b8e2aa26ffd1972c

SHA256
ef76df457a3f93a4216de95ff0b6875a2f401849f3a085fd10feb680d0ad9b95

SHA512
dc99c66dea20ae7872e8ab15d029fbcdd2d47ff4f8ffce78289510f9689c38ebf37bf06869a5ef3cba0ef11f1c45c9ceda0d8f38a99cadde7628fc4830171957

Download Submit
C:\Windows\SysWOW64\Ecmlcmhe.exe

Filesize
208KB

MD5
6cfe7147e3e277ebc843615bd0cfd016

SHA1
47eee4451c4728424d1901ed35bce7b04a14be82

SHA256
16019002afe7adf9f4c468c9a1f1d36121321ebac531b437587db30d8681659a

SHA512
88d2a64a5914104e53f64fdf039a94103c784b9a94b69128c27792f5917fbb39db42336bd58cc81902bf54495af647ffb51bbc5cc2b850655978df7a87292e22

Download Submit
C:\Windows\SysWOW64\Ecoangbg.exe

Filesize
208KB

MD5
6ace52863ffc67c8af7ff53f70e12136

SHA1
d99be42db78eba2e67b2580cafab5506f6228374

SHA256
3cdd4b1e2fe035a73c57c018b87c82460dd6d92048f726cc8fc19d98a74f2e91

SHA512
74817db0b9200a0c508e08255d6e1d08fe84194c4f24a92aa7d7754d2fbe3a38ff63b014ef9dee706e9d8a6d5e6b13354af7d2556c53c4b9e02afaa8d587a925

Download Submit
C:\Windows\SysWOW64\Efgodj32.exe

Filesize
208KB

MD5
67846e5b6e41858ba7cddb30000d6d42

SHA1
37a646de93fec3c2f974094eaf0583816274b5ef

SHA256
f6228dcf4f1c6d115f6171fbdb2620fe9636078b65f7920e47c0ff883441dabb

SHA512
1d61c57faa0fade74ed7394ca48ac35332aa81ab7b20f529141114f31f091e503a41f6acd165e8411ace87058bd117941079bde039668b580403c23ede35284b

Download Submit
C:\Windows\SysWOW64\Eflhoigi.exe

Filesize
208KB

MD5
3bfce660fda663c2a3fba5e8216d4db4

SHA1
3b29608d42be31a1cee745ffb7571bfd83c0dbcd

SHA256
3d0ab6147194e38bee495e0d9f5aaae3c9b5837f1d544b9bf8f8acb2c20a2d2e

SHA512
36a46128240298e272db1ae7a34eaab09643fc8f64633191b4a20e394b5396e905e787af3d44878863349d4ecea434f210e2c16935fee808197c11fa76f788ad

Download Submit
C:\Windows\SysWOW64\Ehekqe32.exe

Filesize
208KB

MD5
633c70277b0a038ded14def244452f0e

SHA1
57bd0289a65d04baac862581aa1d860939c05f5a

SHA256
fc4604c527752a0af827067697f49380b68a6dd57057d3414c3423722ade4549

SHA512
c8eec4752f8dc6aeb69ff4b7e26e4dae32e6d2e17235dd6089868fdfa6a826bb9ee6c38b9ac538e11615fc13f43c3a37fbffc22c376dc651fa0c8a712d40560a

Download Submit
C:\Windows\SysWOW64\Ehjdldfl.exe

Filesize
208KB

MD5
729a221cf24214b1ee2353fb252b0ce4

SHA1
9591539dceb480101262fdeb326ebb26db09edcc

SHA256
321705e5ec003544e67218135e417bdb1cf0b2c56d53778925093e530f259964

SHA512
a9b0d968a6efcb49c44f4ee0f5b2b3a9cda0efc0227f9d4313b04a82019d4c1dbc04c112fc9a10f6132ec1bec78d74d255e83c1455de301ddf5ab10fc3d39623

Download Submit
C:\Windows\SysWOW64\Ehonfc32.exe

Filesize
208KB

MD5
8f4d6681b6dfd5ce7420a10546c30694

SHA1
3ba145479096067e89ba152d0034e5e8e4d7a6ab

SHA256
d241963528ac29961b6c11de8fa0127b2a8771b86e12d71289c9df3d6b4b440b

SHA512
1d1b08127ff7e122d01fc1629ce75bbb7a8e61e4126cef1cd3cd002b466297795efef272f88b9d5734f95a806b27d6ed0103925a7559bdda5c9acb4965b472ef

Download Submit
C:\Windows\SysWOW64\Ejegjh32.exe

Filesize
208KB

MD5
a2e71dcc5664cfd9ba18d911ad33bc4e

SHA1
7da9d8859dab7e7eadd51645c4f26ff20fe8ee7f

SHA256
fa9b63e648c2a2314e6668ab2e57aacbf71a13c25b8200711750b3e975dfa61a

SHA512
31b5a6ceb242496fb817de23eeab046c216c611220e36af0ed3746e61a04bc5d0a0bf2a55c5eb23dd4919afdccd7cb63bea122595a3dc42561516054d85a9216

Download Submit
C:\Windows\SysWOW64\Ejjqeg32.exe

Filesize
208KB

MD5
09d1ab261e0d2fc76a20815c10bfc239

SHA1
a18c25e035499b7d1c95a835e3333ab095067cbd

SHA256
48c3c50f488b1e78b6b0e580e8f2e30b985de40b93d6b9e6fc5cb09443a92cb1

SHA512
d8fc012becdbc8748d04308a4531d05bcfec838b67ba394fafa9727123d4c46164ce1244e00e9ff7f469be536304bff00798bc048039a88907d74e021f14ae46

Download Submit
C:\Windows\SysWOW64\Elccfc32.exe

Filesize
208KB

MD5
5ccc195b4d564200f1f7f26d8c710573

SHA1
6ec784d852dc5e55e82e0bb555f74fc1f71621e4

SHA256
c7a822c53beaf112491f6403440f70dc343eb94fc175e854caf02fa5c649559c

SHA512
1076f6a3bfd76e80d67a658cdeff46a2a5e51a90d3fef5cac279eefa1449243118d728c54ae0fd10828874415391a8615fb6af1776f4e6aefe3fb5783761600e

Download Submit
C:\Windows\SysWOW64\Elhmablc.exe

Filesize
208KB

MD5
f35cbb2d936960ea6a3b826875d94b07

SHA1
7cc43557f85127dbb40cd6e3c0c323c2b0535655

SHA256
e8d7f0afec19410810ee3c8a6d9a3d165fba61c7dda8c13c8d416eba05870934

SHA512
3bdc29ed58b59fa51822dd6668bc378484bcb6bef9ee30ca1f66f6ce0be5f2d6a4e0b40354981ac458a04b574d2aa4706c1be076c7ef1a54fa441e07a558e853

Download Submit
C:\Windows\SysWOW64\Eofinnkf.exe

Filesize
208KB

MD5
b67aeb11a2e16cb7e1aee8a76007498e

SHA1
11e102db90dd4e78405d09408976ab8bd1774b19

SHA256
c042062e4b155e8567a843e4278d5cabfdd4337b0fc6e9a555fa7af56b0e241e

SHA512
c139145b9342e3e1da978702f6ebe4fa098f30cb9cd6332b6ef250953d4ac8a462003d0f6681cd0c040627cbbace88790ea80ce19ed1298d2e34d6859fc2d9aa

Download Submit
C:\Windows\SysWOW64\Epmcab32.exe

Filesize
208KB

MD5
4454171fc284e52d8ac7138c6b17a24f

SHA1
44f5647990fff4d079f2c098207d184cce2247cd

SHA256
9489f12d71a7b23e34c69248837e7e6b5d42b8bdb57bf304e2900e2fdd4eede9

SHA512
1e03608a3e892391d6189af2d2c0bfc287b6a37e4d492d50fa9f2c81e3ddeb1e9c53c0fad2f96ae3c3331666afb6e29b462e2fda7dd695df92abb25f7e69e7da

Download Submit
C:\Windows\SysWOW64\Eqalmafo.exe

Filesize
208KB

MD5
efbe40650f1b08ac50447cf90fef22bf

SHA1
0eb50bd40301f2b8211c04af67fd424ae43dae24

SHA256
691ddbd1548e487d6326dc1185353c913c425ee74cda3af9f8240ce6bab27e36

SHA512
79f31c6432ac2ce2cfdec0620b27375569248081f886a35c5655af059a1dc27953e3100f36188ffef943453dc1ce997e7d0de29e33170f44d01a6c5ba0cfe399

Download Submit
C:\Windows\SysWOW64\Eqfeha32.exe

Filesize
208KB

MD5
1e682c087d536b107b95a4eeb0e03fcb

SHA1
ee1888e7d625b2c98ed391b6a9dfdce551e73da8

SHA256
dc83d5304b755f201719395d819fccddcc2b7ad584a6d01ce3354adf6d85c645

SHA512
311a8d2da67d98b27d66eb32cff3b20c592384f8da2241bc1ad5cb7d43d05d29f893bc196faf43a4438c70db4960578d6fdaf51a157f14ed523900ef1e04a300

Download Submit
C:\Windows\SysWOW64\Fbgbpihg.exe

Filesize
208KB

MD5
bd1a3f567e8890fd3ba3824469e3aecf

SHA1
dfb712315f3d90c22421d2fee90928dce73f7a6a

SHA256
192a1cf1be069c8854fd77bf196e09206f905363787e547a95abd80223df247a

SHA512
b9fda50356a4a149b3d5784693e6017e148a22bdc64b2f1e3429a3fc53ec899c80274d883644b8f89fc59ed81d72d2cfa37b28c3dd93ce2e16e1527861ac9819

Download Submit
C:\Windows\SysWOW64\Fbioei32.exe

Filesize
208KB

MD5
66798bb2a14e53844ad8820e273d3009

SHA1
02d25fe161b88a75d046b2107e4cc97b519f695c

SHA256
1aebdb5109841e968ac1a3bfce312f45d2e555ec4281c66b9571aa04e28e6623

SHA512
6cf526d693d9e0b712eb180bf0d2e2b63e2f5c91725c750323245fe6cf6d9aa6325714580c64d8573ae4fa3bbc8a0bf18280397b21b085660785e17a0688fcac

Download Submit
C:\Windows\SysWOW64\Fcikolnh.exe

Filesize
208KB

MD5
7b99c9543604b67e33b1a7115c7f74da

SHA1
1824c623a47c401f4c4208442a12524f1f889f13

SHA256
cab3fe08c447a99a47dd75e627cb19c97e7bbf7b340d43afb9e272851b4551e3

SHA512
47c98a03617dbce00715b2e4ed76c78a7966373400f8adbad295049f28ac1e0f664a0d6d6027ef1a884c786cba8f180862837a1b39f9c671f28322269cac8bd7

Download Submit
C:\Windows\SysWOW64\Fckhdk32.exe

Filesize
208KB

MD5
245223b9c63d23fdf1d904de017eda27

SHA1
e1c3a04a6a11bb9761891fd6def209726fd9b5c5

SHA256
4ff2e83bbcccc09d629bf3a1b566556281a8cf3e942fbe73b1c82cb834f2a62b

SHA512
45c673b42d14d86805d5c5031e8143ee5d15e40fae238e6fc70851dd286202b041a9c7293015c6a2e52cf11bc6303165685999ff59127274894a7c47a29944ec

Download Submit
C:\Windows\SysWOW64\Ffggkgmk.exe

Filesize
208KB

MD5
85edd11aa6c474b10b448a49b76fc578

SHA1
52eed4979e247caae52d0345fb3b241618becb9b

SHA256
abf1920e6cfd3e1b9b79fcf40d7c26d8307550bc5c5f04e9f74cda5ea49de32d

SHA512
9e8231d3ca12c9bebc5a44409ddb6010297d8c082d8ad90583cfbd21a0c6ee2f1e2535aa1ba7a9f140fb6494a64298df2854360c6f38f9572ce6c99e01996122

Download Submit
C:\Windows\SysWOW64\Fhajlc32.exe

Filesize
208KB

MD5
b4b345d3d3462c977c8e3ccc366fbfe1

SHA1
40ae83bd06421eb1e34999225850926d625a83a7

SHA256
f82af07ce893c1afdf663964b8d5f1726374a6fe0c2ba8e7de09c1ae9913d8dd

SHA512
a7c0a038f17daa17b2344c84f261b074bbc619f6b3960ec632f258ff9aac0e935ed164b071422212e2f9f02f2626df06e6b9baf2d754fa2314e8ab641cae2ba2

Download Submit
C:\Windows\SysWOW64\Fkokhc32.dll

Filesize
7KB

MD5
063120cc83e8169c15cfeb93c00afb6f

SHA1
a6f204c696f178c2eba98a0f8f48c7b4c5086f0d

SHA256
6d94f94ec78acfda19bc8f1e2a77788fde0e9ee73bc0672a23ec5b11df8308f8

SHA512
1a127ff7f9f456a2a57c4f914203d52891b7e8a013feb1dd7d353ec739a5a2ed215db6da8db0d48b7b3678ded4c330dce503724a72bbbd6e65c6fe3559d3ef1a

Download Submit
C:\Windows\SysWOW64\Fmocba32.exe

Filesize
208KB

MD5
ba598e58635a2a8bb484759f041d82c8

SHA1
dfd119aff4e77876d2035cb0f0c3608b5d1f22b0

SHA256
244c0e8e0c5d1a78159ae8a3cee6ef2f990822dff5b1271b3c61cbfcbf7981d5

SHA512
1790589a481d4f6e3fb66f3a50ebaaea74343ddda12e494ac9ae8dda4285ecafda754184c85a8eae30859245f9c3d162cf292abf489ba2c85309e70b8767e090

Download Submit
C:\Windows\SysWOW64\Fokbim32.exe

Filesize
208KB

MD5
b9cb6656c077c47148952c678743b919

SHA1
e348789cea22666d0c0ea2892391477d113d29af

SHA256
ce50920e050aad40dfc2ba4a20805d83bdcda4749f4132c8d1f0f6cd36eaeaa6

SHA512
fcd23e120b7d57517f221f52cc793db7f4ef7ef5c105ecd378fa03b23e00881ea98751b273bb5b344c8473723e923ef2ce88edefa58b970176a62eb0256d4958

Download Submit
C:\Windows\SysWOW64\Gqdbiofi.exe

Filesize
208KB

MD5
34dc085dcff7e1e86a98fb5c59c21af3

SHA1
62e2fe67c143fd0a5ed3286bcc2046515042c2e8

SHA256
9d58b8d159d4993b10cdb0a53279a7080868d462ce33191fda4b5f40e6f9a81f

SHA512
559d000b4be27ea6734fae32fbaf46eaa61f4df64d1e5372d5cf05005148d9af3afb7ffe5fc9446b77833be793767de9e65230211cbba92d598c32d1c25f0bcf

Download Submit
C:\Windows\SysWOW64\Helfik32.exe

Filesize
208KB

MD5
94c6b67beeda07ebf14a7faff65616bd

SHA1
add9485621e07114a73fcb9327f54a26a968ee70

SHA256
b44925dee1a53be09371890c248d38f356208e6c09875acfb4eaf125e5ae220e

SHA512
24445041c2f15f6ab38213eb34dc11ae9f8c3076a0442ab42e99e0f76e92f0c5bc903eb31387e73bb7d900839565274c0cac47fdc69cbba016f004ca3b3a19c0

Download Submit
C:\Windows\SysWOW64\Imihfl32.exe

Filesize
208KB

MD5
fa8043959bac489fc1a237e05a3d2303

SHA1
fc317e7ab2cd03308e0e57b252faaf855ad128aa

SHA256
486f1b5668d877608442dcd1125f0601ed2549f29f8efa9f2f1a72a06bb994eb

SHA512
9aea07cb54ff41a159261625fd0211805f79fdf7ff8d87e33fee54f3ac45b31ace0745969c40531bc7de5967fb356ea0d9e6cffa9fe328df0d0f58256aad2e94

Download Submit
C:\Windows\SysWOW64\Jeaikh32.exe

Filesize
208KB

MD5
3b6f2d6464f8d95f959e0055917d2c0e

SHA1
de070a9c3aa79075abed6593f62e43451f27cf64

SHA256
2aaee5a603001ede24769ec122f9a3fc1e5a71206beb4658e87ceaf15bb2f36e

SHA512
71d281be13700dd6ca4d4c5038866ce9bf720536d89921cd8ecd6df6ccb4c8cc69cfbc2579bc0666455600089e5f3b5ff47c20c96a31223e8a1ede79cc44908b

Download Submit
C:\Windows\SysWOW64\Jehokgge.exe

Filesize
208KB

MD5
defb3a6b7de9cd3ca5393226d1018cb5

SHA1
c5dfb2bc512572f48425e650d7e7ac171b8c3e6f

SHA256
2cfaf4b9aef74a3c58c35becf36e9054ba0a260e9a8de7a64d1a1899b54919c3

SHA512
93521e44f57bbd9ea6f495d0d7f9f79c92e3ba3c2e9c31f99fb4883c8116f5be5a2154c35fd9bd05618375dd27233d08c54cbce681ec5ff5e350a114a47c85bb

Download Submit
C:\Windows\SysWOW64\Jlkagbej.exe

Filesize
208KB

MD5
01c680719578efffda38dc52ca58755a

SHA1
93f1c476d9bd09efcf0bc340550be23165917888

SHA256
a8f4661e9a53337364496cc6d5461c232d7d1fbbc5e007230550298329cbaba9

SHA512
f974b7417155267c3c90011eec0846ad24389d7e194b28ce743f7d27d0b2cac0998c40e26a2f5176e663b6c249c1b7f2acee40238b044fd7c3f35c02019621d8

Download Submit
C:\Windows\SysWOW64\Jmbdbd32.exe

Filesize
208KB

MD5
efa423746449f00cd37e9a9de2ca8e65

SHA1
60dfb30baa3084c3f1f6685bdb43eaf19879228d

SHA256
da60713e8f2c84dda9fdd3ba261b81af97f6322916d8a70da283309782b12c17

SHA512
a3b59a5e527aadee7a56c511d163a82581e88191f074f128cfec576102ed6777c16b6dff9db09a8557abe3346e6e49a5514edc81ce351def70f99dbecea9c8af

Download Submit
C:\Windows\SysWOW64\Liddbc32.exe

Filesize
208KB

MD5
a46f32c1924941cfa91764a06b61ac91

SHA1
8bb3609818915ffcb419dbab7b1b407a2f86521b

SHA256
c89fa6f1dd50919d8135e832c707d254e5d8ce837c31704cce8088ff0c35bd06

SHA512
e22163907a881ab169a17556bb54e4281066bff54d1aa2acc80c70bfacdd77448cf5bf5372139be11d48b5a4f42d02e51046ca9010eaaadeed06c2bc99b8627a

Download Submit
C:\Windows\SysWOW64\Ogkcpbam.exe

Filesize
208KB

MD5
83655a156a4c06a7669fc9dff68fc646

SHA1
2eb6d5b0b9e3402296626c872e09bf40d5386a57

SHA256
bb7111a8d949ce77fefca7ebe20724777a02efa25fe22a1285813d2be2e16878

SHA512
2dc640281d3120db1f25311d424d5bc4a1c44d857a05b4bb4495ed41340c67a8995ce46583d8ce2faff275d99d1be181abd5563fd3186e93ec5379e3c644b098

Download Submit
memory/232-104-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/456-112-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/636-374-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1236-322-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1264-148-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1344-295-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1364-240-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1528-132-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1732-316-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1832-382-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2068-310-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2088-274-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2108-286-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2164-224-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2172-380-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2284-304-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2308-416-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2408-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2448-436-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2484-152-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2596-64-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2624-204-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2640-232-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2736-176-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2768-192-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2772-430-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2796-400-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2984-346-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2988-40-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3080-410-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3096-96-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3124-352-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3148-262-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3172-136-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3200-362-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3208-344-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3284-216-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3352-328-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3400-268-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3484-338-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3500-184-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3512-424-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3536-84-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3648-55-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3668-248-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3880-298-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3908-28-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4220-8-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4248-48-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4308-15-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4356-421-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4376-120-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4444-398-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4520-208-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4528-442-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4540-388-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4548-255-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4648-160-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4748-280-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4792-32-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4908-88-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4972-364-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5016-76-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5116-168-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/9652-3634-0x000002D061550000-0x000002D061560000-memory.dmp

Filesize
64KB

Download
memory/9652-3650-0x000002D061650000-0x000002D061660000-memory.dmp

Filesize
64KB

Download
memory/9652-3666-0x000002D0699C0000-0x000002D0699C1000-memory.dmp

Filesize
4KB

Download
memory/9652-3668-0x000002D0699F0000-0x000002D0699F1000-memory.dmp

Filesize
4KB

Download
memory/9652-3670-0x000002D069B00000-0x000002D069B01000-memory.dmp

Filesize
4KB

Download
memory/9652-3669-0x000002D0699F0000-0x000002D0699F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads