5e11e93aa39d899d6e969c60763a3eb4b8a1b396aecf2a8041d533d6b68f843a

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e11e93aa39d899d6e969c60763a3eb4b8a1b396aecf2a8041d533d6b68f843a.exe
Size

98KB
MD5

7161c2ec85085da10dfd1ab5186eb517
SHA1

0ebcc2baff428893191e4b088cca790d41c5e5dc
SHA256

5e11e93aa39d899d6e969c60763a3eb4b8a1b396aecf2a8041d533d6b68f843a
SHA512

802692159b3168e01786c168f40d7b2de94a2419b1ba9cbd55cd7b2a3fa3aa917b401147e039de0297957e39fafa604e94cf49ba1ab2bbb84f9acae431df9d47
SSDEEP

3072:yM7IhhIsdepmES8ZTZE0eFKPD375lHzpa1P:L7IH3LES8XE0eYr75lHzpaF

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqmojd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opbean32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mbhamajc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmkcqn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgcmjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Edhjqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Epcdqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Keqdmihc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fggfnc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmnmgnoh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeaanjkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmgelf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Figgdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhplpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bphgeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hfipbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lehaho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Igqkqiai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kjhcjq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cocacl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Adcjop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ofjqihnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfjjga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjnkcekm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkkeclfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Igedlh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbdlop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gikkfqmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knippe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmpkqqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daediilg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hnnljj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpgmhg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjpjgj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jfgdkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmjkic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdkifmjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckgohf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ebfign32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fecadghc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncmhko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ikaggmii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgknhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnqeqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pojcjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ilibdmgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iehmmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnkcogno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Phedhmhi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbnaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Legben32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhfpbpdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjjahe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caghhk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkgnfhnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lkofdbkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Alqjpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fecadghc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kbpbed32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djklmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdcjlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Allpejfe.exe

Executes dropped EXE 64 IoCs

pid	Process
4916	Beeoaapl.exe
4424	Bjagjhnc.exe
5092	Balpgb32.exe
1964	Bgehcmmm.exe
228	Bnpppgdj.exe
5056	Bfkedibe.exe
4880	Bcoenmao.exe
4076	Cabfga32.exe
1292	Cfpnph32.exe
3536	Chokikeb.exe
4864	Cagobalc.exe
2236	Cnkplejl.exe
804	Ceehho32.exe
3548	Cnnlaehj.exe
2828	Dhfajjoj.exe
1936	Dopigd32.exe
1860	Dhhnpjmh.exe
3500	Dfnjafap.exe
1876	Daconoae.exe
1012	Dfpgffpm.exe
1308	Dmjocp32.exe
3956	Doilmc32.exe
5104	Edfdej32.exe
1476	Eolhbc32.exe
1112	Ehdmlhcj.exe
1044	Eonehbjg.exe
3380	Ekefmc32.exe
4508	Eaonjngh.exe
2860	Emeoooml.exe
3608	Egnchd32.exe
2116	Fhpmgg32.exe
436	Fojedapj.exe
4820	Fdfmlhna.exe
980	Folaiqng.exe
2340	Fefjfked.exe
2092	Fggfnc32.exe
3652	Fehfljca.exe
2604	Fkeodaai.exe
1296	Gaogak32.exe
3248	Ghipne32.exe
3448	Ghklce32.exe
456	Gadqlkep.exe
1220	Ghniielm.exe
3668	Gfbibikg.exe
4536	Gojnko32.exe
1040	Gahjgj32.exe
900	Ggeboaob.exe
3492	Hfipbh32.exe
4872	Hgjljpkm.exe
2416	Hoadkn32.exe
5024	Hdnldd32.exe
4168	Hnfamjqg.exe
3520	Hhlejcpm.exe
4560	Hninbj32.exe
4964	Hkmnln32.exe
3324	Ibffhhek.exe
3024	Igcoqocb.exe
4376	Inmgmijo.exe
3124	Idgojc32.exe
528	Ikaggmii.exe
4524	Ifgldfio.exe
4472	Ibnligoc.exe
3736	Igjeanmj.exe
3864	Ibpiogmp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kgknhl32.exe	Kbnepe32.exe
File created	C:\Windows\SysWOW64\Khpgckkb.exe	Keakgpko.exe
File created	C:\Windows\SysWOW64\Cgbiiion.dll	Dpqodfij.exe
File opened for modification	C:\Windows\SysWOW64\Egened32.exe	Ebifmm32.exe
File created	C:\Windows\SysWOW64\Cfapoa32.dll	Bjicdmmd.exe
File created	C:\Windows\SysWOW64\Jocnlg32.exe	Jifecp32.exe
File created	C:\Windows\SysWOW64\Njedbjej.exe	Nckkfp32.exe
File opened for modification	C:\Windows\SysWOW64\Jkaqnk32.exe	Jeekkafl.exe
File opened for modification	C:\Windows\SysWOW64\Lejnmncd.exe	Lnqeqd32.exe
File created	C:\Windows\SysWOW64\Lljklo32.exe	Kjeiodek.exe
File created	C:\Windows\SysWOW64\Loacdc32.exe	Lhgkgijg.exe
File created	C:\Windows\SysWOW64\Cbokknag.dll	Fkeodaai.exe
File created	C:\Windows\SysWOW64\Dmdonkgc.exe	Dfjgaq32.exe
File opened for modification	C:\Windows\SysWOW64\Bpdnjple.exe	Bmeandma.exe
File created	C:\Windows\SysWOW64\Ojqcnhkl.exe	Objkmkjj.exe
File created	C:\Windows\SysWOW64\Iijaka32.exe	Ibpiogmp.exe
File created	C:\Windows\SysWOW64\Ddfioo32.dll	Pjbkgfej.exe
File created	C:\Windows\SysWOW64\Dpgeee32.exe	Daediilg.exe
File opened for modification	C:\Windows\SysWOW64\Gljgbllj.exe	Gikkfqmf.exe
File created	C:\Windows\SysWOW64\Ljbnfleo.exe	Legben32.exe
File created	C:\Windows\SysWOW64\Objkmkjj.exe	Oqhoeb32.exe
File opened for modification	C:\Windows\SysWOW64\Cnkplejl.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Cjmhfb32.dll	Ooejohhq.exe
File created	C:\Windows\SysWOW64\Amjjnh32.dll	Neafjdkn.exe
File created	C:\Windows\SysWOW64\Kebkgjkg.dll	Nqcejcha.exe
File opened for modification	C:\Windows\SysWOW64\Oqhoeb32.exe	Oiagde32.exe
File created	C:\Windows\SysWOW64\Qjnkcekm.exe	Qgpogili.exe
File created	C:\Windows\SysWOW64\Pgnnnnod.dll	Iqbbpm32.exe
File created	C:\Windows\SysWOW64\Qfmjef32.dll	Phedhmhi.exe
File opened for modification	C:\Windows\SysWOW64\Epndknin.exe	Eidlnd32.exe
File created	C:\Windows\SysWOW64\Mbnnhndk.dll	Pkpmdbfd.exe
File created	C:\Windows\SysWOW64\Gadqlkep.exe	Ghklce32.exe
File created	C:\Windows\SysWOW64\Dbmiag32.dll	Ohiemobf.exe
File created	C:\Windows\SysWOW64\Hikemehi.dll	Chdialdl.exe
File opened for modification	C:\Windows\SysWOW64\Hahokfag.exe	Hnibokbd.exe
File created	C:\Windows\SysWOW64\Plpodked.dll	Mqhfoebo.exe
File created	C:\Windows\SysWOW64\Ogclbn32.dll	Doilmc32.exe
File opened for modification	C:\Windows\SysWOW64\Bfjnjcni.exe	Bmbiamhi.exe
File created	C:\Windows\SysWOW64\Ccchof32.exe	Cimcan32.exe
File created	C:\Windows\SysWOW64\Ieneofbo.dll	Ckfphc32.exe
File opened for modification	C:\Windows\SysWOW64\Njljch32.exe	Ncbafoge.exe
File opened for modification	C:\Windows\SysWOW64\Objkmkjj.exe	Oqhoeb32.exe
File created	C:\Windows\SysWOW64\Icgcab32.dll	Bmkcqn32.exe
File opened for modification	C:\Windows\SysWOW64\Dgejpd32.exe	Dpnbog32.exe
File created	C:\Windows\SysWOW64\Pabblb32.exe	Plejdkmm.exe
File opened for modification	C:\Windows\SysWOW64\Dkndie32.exe	Dhphmj32.exe
File opened for modification	C:\Windows\SysWOW64\Lebijnak.exe	Lcclncbh.exe
File created	C:\Windows\SysWOW64\Ooqqdi32.exe	Olbdhn32.exe
File created	C:\Windows\SysWOW64\Hahqkaaa.dll	Aknifq32.exe
File created	C:\Windows\SysWOW64\Ojqhdcii.dll	Mlofcf32.exe
File opened for modification	C:\Windows\SysWOW64\Djklmo32.exe	Ddadpdmn.exe
File opened for modification	C:\Windows\SysWOW64\Aogbfi32.exe	Afpjel32.exe
File created	C:\Windows\SysWOW64\Jikoopij.exe	Jadgnb32.exe
File opened for modification	C:\Windows\SysWOW64\Khbiello.exe	Jbepme32.exe
File created	C:\Windows\SysWOW64\Iphcjp32.dll	Bjagjhnc.exe
File opened for modification	C:\Windows\SysWOW64\Hgjljpkm.exe	Hfipbh32.exe
File created	C:\Windows\SysWOW64\Ipebnafj.dll	Mfhfhong.exe
File opened for modification	C:\Windows\SysWOW64\Oklkdi32.exe	Oeoblb32.exe
File opened for modification	C:\Windows\SysWOW64\Ganldgib.exe	Gnpphljo.exe
File created	C:\Windows\SysWOW64\Lbfecjhc.dll	Gbpedjnb.exe
File opened for modification	C:\Windows\SysWOW64\Jeapcq32.exe	Jbccge32.exe
File created	C:\Windows\SysWOW64\Keqdmihc.exe	Knflpoqf.exe
File opened for modification	C:\Windows\SysWOW64\Kolabf32.exe	Klndfj32.exe
File created	C:\Windows\SysWOW64\Jendmajn.dll	Qaflgago.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10140	8716	WerFault.exe	751

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngcglo32.dll"	Jlgoek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nckkfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbjklp32.dll"	Djklmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ohkbbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmdkbp32.dll"	Bkafmd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lljklo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Glhimp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pokhnl32.dll"	Lejnmncd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eejlephc.dll"	Dmglcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clomci32.dll"	Jqlefl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nobdbkhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Knnhjcog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofblbapl.dll"	Fgmdec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ghipne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poblig32.dll"	Pjjahe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kjhcjq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Phaahggp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gflonn32.dll"	Ofjqihnn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pkpmdbfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ihkjno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ggfglb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hfipbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kpdboimg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hgjljpkm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfnqklgh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jknfcofa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opjghl32.dll"	Adcjop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jkaqnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Enfckp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ehpadhll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iijfhbhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mbhamajc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Blnoga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hiacacpg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Impjjbmh.dll"	Ajjjocap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgkpdcmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pahpfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjicdmmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qnbidcgp.dll"	Bobabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieppioao.dll"	Ekjded32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpplna32.dll"	Bfjnjcni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Coffgmig.dll"	Glfmgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Panlem32.dll"	Hppeim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Plndcl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hoadkn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lkofdbkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Achegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpabibmg.dll"	Cfnjpfcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nqoloc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	5e11e93aa39d899d6e969c60763a3eb4b8a1b396aecf2a8041d533d6b68f843a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmnbeadp.dll"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eaonjngh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hmpjmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oipgkfab.dll"	Mofmobmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfigmnlg.dll"	Nijqcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkoepmnk.dll"	Cmjemflb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppadmq32.dll"	Onpjichj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogfapnkp.dll"	Boklbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Camfoh32.dll"	Lacdmh32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 4916	1432	5e11e93aa39d899d6e969c60763a3eb4b8a1b396aecf2a8041d533d6b68f843a.exe	88
PID 1432 wrote to memory of 4916	1432	5e11e93aa39d899d6e969c60763a3eb4b8a1b396aecf2a8041d533d6b68f843a.exe	88
PID 1432 wrote to memory of 4916	1432	5e11e93aa39d899d6e969c60763a3eb4b8a1b396aecf2a8041d533d6b68f843a.exe	88
PID 4916 wrote to memory of 4424	4916	Beeoaapl.exe	89
PID 4916 wrote to memory of 4424	4916	Beeoaapl.exe	89
PID 4916 wrote to memory of 4424	4916	Beeoaapl.exe	89
PID 4424 wrote to memory of 5092	4424	Bjagjhnc.exe	90
PID 4424 wrote to memory of 5092	4424	Bjagjhnc.exe	90
PID 4424 wrote to memory of 5092	4424	Bjagjhnc.exe	90
PID 5092 wrote to memory of 1964	5092	Balpgb32.exe	91
PID 5092 wrote to memory of 1964	5092	Balpgb32.exe	91
PID 5092 wrote to memory of 1964	5092	Balpgb32.exe	91
PID 1964 wrote to memory of 228	1964	Bgehcmmm.exe	92
PID 1964 wrote to memory of 228	1964	Bgehcmmm.exe	92
PID 1964 wrote to memory of 228	1964	Bgehcmmm.exe	92
PID 228 wrote to memory of 5056	228	Bnpppgdj.exe	93
PID 228 wrote to memory of 5056	228	Bnpppgdj.exe	93
PID 228 wrote to memory of 5056	228	Bnpppgdj.exe	93
PID 5056 wrote to memory of 4880	5056	Bfkedibe.exe	94
PID 5056 wrote to memory of 4880	5056	Bfkedibe.exe	94
PID 5056 wrote to memory of 4880	5056	Bfkedibe.exe	94
PID 4880 wrote to memory of 4076	4880	Bcoenmao.exe	95
PID 4880 wrote to memory of 4076	4880	Bcoenmao.exe	95
PID 4880 wrote to memory of 4076	4880	Bcoenmao.exe	95
PID 4076 wrote to memory of 1292	4076	Cabfga32.exe	97
PID 4076 wrote to memory of 1292	4076	Cabfga32.exe	97
PID 4076 wrote to memory of 1292	4076	Cabfga32.exe	97
PID 1292 wrote to memory of 3536	1292	Cfpnph32.exe	98
PID 1292 wrote to memory of 3536	1292	Cfpnph32.exe	98
PID 1292 wrote to memory of 3536	1292	Cfpnph32.exe	98
PID 3536 wrote to memory of 4864	3536	Chokikeb.exe	99
PID 3536 wrote to memory of 4864	3536	Chokikeb.exe	99
PID 3536 wrote to memory of 4864	3536	Chokikeb.exe	99
PID 4864 wrote to memory of 2236	4864	Cagobalc.exe	101
PID 4864 wrote to memory of 2236	4864	Cagobalc.exe	101
PID 4864 wrote to memory of 2236	4864	Cagobalc.exe	101
PID 2236 wrote to memory of 804	2236	Cnkplejl.exe	102
PID 2236 wrote to memory of 804	2236	Cnkplejl.exe	102
PID 2236 wrote to memory of 804	2236	Cnkplejl.exe	102
PID 804 wrote to memory of 3548	804	Ceehho32.exe	103
PID 804 wrote to memory of 3548	804	Ceehho32.exe	103
PID 804 wrote to memory of 3548	804	Ceehho32.exe	103
PID 3548 wrote to memory of 2828	3548	Cnnlaehj.exe	104
PID 3548 wrote to memory of 2828	3548	Cnnlaehj.exe	104
PID 3548 wrote to memory of 2828	3548	Cnnlaehj.exe	104
PID 2828 wrote to memory of 1936	2828	Dhfajjoj.exe	105
PID 2828 wrote to memory of 1936	2828	Dhfajjoj.exe	105
PID 2828 wrote to memory of 1936	2828	Dhfajjoj.exe	105
PID 1936 wrote to memory of 1860	1936	Dopigd32.exe	106
PID 1936 wrote to memory of 1860	1936	Dopigd32.exe	106
PID 1936 wrote to memory of 1860	1936	Dopigd32.exe	106
PID 1860 wrote to memory of 3500	1860	Dhhnpjmh.exe	108
PID 1860 wrote to memory of 3500	1860	Dhhnpjmh.exe	108
PID 1860 wrote to memory of 3500	1860	Dhhnpjmh.exe	108
PID 3500 wrote to memory of 1876	3500	Dfnjafap.exe	109
PID 3500 wrote to memory of 1876	3500	Dfnjafap.exe	109
PID 3500 wrote to memory of 1876	3500	Dfnjafap.exe	109
PID 1876 wrote to memory of 1012	1876	Daconoae.exe	110
PID 1876 wrote to memory of 1012	1876	Daconoae.exe	110
PID 1876 wrote to memory of 1012	1876	Daconoae.exe	110
PID 1012 wrote to memory of 1308	1012	Dfpgffpm.exe	111
PID 1012 wrote to memory of 1308	1012	Dfpgffpm.exe	111
PID 1012 wrote to memory of 1308	1012	Dfpgffpm.exe	111
PID 1308 wrote to memory of 3956	1308	Dmjocp32.exe	112

C:\Users\Admin\AppData\Local\Temp\5e11e93aa39d899d6e969c60763a3eb4b8a1b396aecf2a8041d533d6b68f843a.exe
"C:\Users\Admin\AppData\Local\Temp\5e11e93aa39d899d6e969c60763a3eb4b8a1b396aecf2a8041d533d6b68f843a.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\SysWOW64\Beeoaapl.exe
  C:\Windows\system32\Beeoaapl.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\SysWOW64\Bjagjhnc.exe
    C:\Windows\system32\Bjagjhnc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\SysWOW64\Balpgb32.exe
      C:\Windows\system32\Balpgb32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5092
    - - C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1964
      - C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:228
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1292
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3536
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:804
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3548
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1936
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1876
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1012
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1308
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3956
        
        C:\Windows\SysWOW64\Edfdej32.exe
        
        C:\Windows\system32\Edfdej32.exe
        24⤵
        Executes dropped EXE
        
        PID:5104
        
        C:\Windows\SysWOW64\Eolhbc32.exe
        
        C:\Windows\system32\Eolhbc32.exe
        25⤵
        Executes dropped EXE
        
        PID:1476
        
        C:\Windows\SysWOW64\Ehdmlhcj.exe
        
        C:\Windows\system32\Ehdmlhcj.exe
        26⤵
        Executes dropped EXE
        
        PID:1112
        
        C:\Windows\SysWOW64\Eonehbjg.exe
        
        C:\Windows\system32\Eonehbjg.exe
        27⤵
        Executes dropped EXE
        
        PID:1044
        
        C:\Windows\SysWOW64\Ekefmc32.exe
        
        C:\Windows\system32\Ekefmc32.exe
        28⤵
        Executes dropped EXE
        
        PID:3380
        
        C:\Windows\SysWOW64\Eaonjngh.exe
        
        C:\Windows\system32\Eaonjngh.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4508
        
        C:\Windows\SysWOW64\Emeoooml.exe
        
        C:\Windows\system32\Emeoooml.exe
        30⤵
        Executes dropped EXE
        
        PID:2860
        
        C:\Windows\SysWOW64\Egnchd32.exe
        
        C:\Windows\system32\Egnchd32.exe
        31⤵
        Executes dropped EXE
        
        PID:3608
        
        C:\Windows\SysWOW64\Fhpmgg32.exe
        
        C:\Windows\system32\Fhpmgg32.exe
        32⤵
        Executes dropped EXE
        
        PID:2116
        
        C:\Windows\SysWOW64\Fojedapj.exe
        
        C:\Windows\system32\Fojedapj.exe
        33⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Fdfmlhna.exe
        
        C:\Windows\system32\Fdfmlhna.exe
        34⤵
        Executes dropped EXE
        
        PID:4820
        
        C:\Windows\SysWOW64\Folaiqng.exe
        
        C:\Windows\system32\Folaiqng.exe
        35⤵
        Executes dropped EXE
        
        PID:980
        
        C:\Windows\SysWOW64\Fefjfked.exe
        
        C:\Windows\system32\Fefjfked.exe
        36⤵
        Executes dropped EXE
        
        PID:2340
        
        C:\Windows\SysWOW64\Fggfnc32.exe
        
        C:\Windows\system32\Fggfnc32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2092
        
        C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        38⤵
        Executes dropped EXE
        
        PID:3652
        
        C:\Windows\SysWOW64\Fkeodaai.exe
        
        C:\Windows\system32\Fkeodaai.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2604
        
        C:\Windows\SysWOW64\Gaogak32.exe
        
        C:\Windows\system32\Gaogak32.exe
        40⤵
        Executes dropped EXE
        
        PID:1296
        
        C:\Windows\SysWOW64\Ghipne32.exe
        
        C:\Windows\system32\Ghipne32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3248
        
        C:\Windows\SysWOW64\Ghklce32.exe
        
        C:\Windows\system32\Ghklce32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3448
        
        C:\Windows\SysWOW64\Gadqlkep.exe
        
        C:\Windows\system32\Gadqlkep.exe
        43⤵
        Executes dropped EXE
        
        PID:456
        
        C:\Windows\SysWOW64\Ghniielm.exe
        
        C:\Windows\system32\Ghniielm.exe
        44⤵
        Executes dropped EXE
        
        PID:1220
        
        C:\Windows\SysWOW64\Gfbibikg.exe
        
        C:\Windows\system32\Gfbibikg.exe
        45⤵
        Executes dropped EXE
        
        PID:3668
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        46⤵
        Executes dropped EXE
        
        PID:4536
        
        C:\Windows\SysWOW64\Gahjgj32.exe
        
        C:\Windows\system32\Gahjgj32.exe
        47⤵
        Executes dropped EXE
        
        PID:1040
        
        C:\Windows\SysWOW64\Ggeboaob.exe
        
        C:\Windows\system32\Ggeboaob.exe
        48⤵
        Executes dropped EXE
        
        PID:900
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3492
        
        C:\Windows\SysWOW64\Hgjljpkm.exe
        
        C:\Windows\system32\Hgjljpkm.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4872
        
        C:\Windows\SysWOW64\Hoadkn32.exe
        
        C:\Windows\system32\Hoadkn32.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2416
        
        C:\Windows\SysWOW64\Hdnldd32.exe
        
        C:\Windows\system32\Hdnldd32.exe
        52⤵
        Executes dropped EXE
        
        PID:5024
        
        C:\Windows\SysWOW64\Hnfamjqg.exe
        
        C:\Windows\system32\Hnfamjqg.exe
        53⤵
        Executes dropped EXE
        
        PID:4168
        
        C:\Windows\SysWOW64\Hhlejcpm.exe
        
        C:\Windows\system32\Hhlejcpm.exe
        54⤵
        Executes dropped EXE
        
        PID:3520
        
        C:\Windows\SysWOW64\Hninbj32.exe
        
        C:\Windows\system32\Hninbj32.exe
        55⤵
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\SysWOW64\Hkmnln32.exe
        
        C:\Windows\system32\Hkmnln32.exe
        56⤵
        Executes dropped EXE
        
        PID:4964
        
        C:\Windows\SysWOW64\Ibffhhek.exe
        
        C:\Windows\system32\Ibffhhek.exe
        57⤵
        Executes dropped EXE
        
        PID:3324
        
        C:\Windows\SysWOW64\Igcoqocb.exe
        
        C:\Windows\system32\Igcoqocb.exe
        58⤵
        Executes dropped EXE
        
        PID:3024
        
        C:\Windows\SysWOW64\Inmgmijo.exe
        
        C:\Windows\system32\Inmgmijo.exe
        59⤵
        Executes dropped EXE
        
        PID:4376
        
        C:\Windows\SysWOW64\Idgojc32.exe
        
        C:\Windows\system32\Idgojc32.exe
        60⤵
        Executes dropped EXE
        
        PID:3124
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:528
        
        C:\Windows\SysWOW64\Ifgldfio.exe
        
        C:\Windows\system32\Ifgldfio.exe
        62⤵
        Executes dropped EXE
        
        PID:4524
        
        C:\Windows\SysWOW64\Ibnligoc.exe
        
        C:\Windows\system32\Ibnligoc.exe
        63⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Igjeanmj.exe
        
        C:\Windows\system32\Igjeanmj.exe
        64⤵
        Executes dropped EXE
        
        PID:3736
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3864
        
        C:\Windows\SysWOW64\Iijaka32.exe
        
        C:\Windows\system32\Iijaka32.exe
        66⤵
        
        PID:860
        
        C:\Windows\SysWOW64\Jbbfdfkn.exe
        
        C:\Windows\system32\Jbbfdfkn.exe
        67⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        68⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Jkkjmlan.exe
        
        C:\Windows\system32\Jkkjmlan.exe
        69⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Jkmgblok.exe
        
        C:\Windows\system32\Jkmgblok.exe
        70⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Jnkcogno.exe
        
        C:\Windows\system32\Jnkcogno.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5292
        
        C:\Windows\SysWOW64\Jeekkafl.exe
        
        C:\Windows\system32\Jeekkafl.exe
        72⤵
        Drops file in System32 directory
        
        PID:5340
        
        C:\Windows\SysWOW64\Jkaqnk32.exe
        
        C:\Windows\system32\Jkaqnk32.exe
        73⤵
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Jfgdkd32.exe
        
        C:\Windows\system32\Jfgdkd32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5428
        
        C:\Windows\SysWOW64\Kppici32.exe
        
        C:\Windows\system32\Kppici32.exe
        75⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Kbnepe32.exe
        
        C:\Windows\system32\Kbnepe32.exe
        76⤵
        Drops file in System32 directory
        
        PID:5508
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5548
        
        C:\Windows\SysWOW64\Kbpbed32.exe
        
        C:\Windows\system32\Kbpbed32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5588
        
        C:\Windows\SysWOW64\Keonap32.exe
        
        C:\Windows\system32\Keonap32.exe
        79⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Kpdboimg.exe
        
        C:\Windows\system32\Kpdboimg.exe
        80⤵
        Modifies registry class
        
        PID:5668
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        81⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Khpgckkb.exe
        
        C:\Windows\system32\Khpgckkb.exe
        82⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Knippe32.exe
        
        C:\Windows\system32\Knippe32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5800
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        84⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Khbdikip.exe
        
        C:\Windows\system32\Khbdikip.exe
        85⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Kbghfc32.exe
        
        C:\Windows\system32\Kbghfc32.exe
        86⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Lhdqnj32.exe
        
        C:\Windows\system32\Lhdqnj32.exe
        87⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Lpkiph32.exe
        
        C:\Windows\system32\Lpkiph32.exe
        88⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        89⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Lehaho32.exe
        
        C:\Windows\system32\Lehaho32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6112
        
        C:\Windows\SysWOW64\Lnqeqd32.exe
        
        C:\Windows\system32\Lnqeqd32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4444
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        92⤵
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Lldfjh32.exe
        
        C:\Windows\system32\Lldfjh32.exe
        93⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Lfjjga32.exe
        
        C:\Windows\system32\Lfjjga32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5300
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        95⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        96⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Lbchba32.exe
        
        C:\Windows\system32\Lbchba32.exe
        97⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Mfaqhp32.exe
        
        C:\Windows\system32\Mfaqhp32.exe
        98⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Miomdk32.exe
        
        C:\Windows\system32\Miomdk32.exe
        99⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Mlnipg32.exe
        
        C:\Windows\system32\Mlnipg32.exe
        100⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Mbhamajc.exe
        
        C:\Windows\system32\Mbhamajc.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5748
        
        C:\Windows\SysWOW64\Mefmimif.exe
        
        C:\Windows\system32\Mefmimif.exe
        102⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        103⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Mbjnbqhp.exe
        
        C:\Windows\system32\Mbjnbqhp.exe
        104⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Mehjol32.exe
        
        C:\Windows\system32\Mehjol32.exe
        105⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Mhgfkg32.exe
        
        C:\Windows\system32\Mhgfkg32.exe
        106⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Mpnnle32.exe
        
        C:\Windows\system32\Mpnnle32.exe
        107⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\Mfhfhong.exe
        
        C:\Windows\system32\Mfhfhong.exe
        108⤵
        Drops file in System32 directory
        
        PID:5236
        
        C:\Windows\SysWOW64\Mhicpg32.exe
        
        C:\Windows\system32\Mhicpg32.exe
        109⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        110⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Nhlpfgbb.exe
        
        C:\Windows\system32\Nhlpfgbb.exe
        111⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Noehba32.exe
        
        C:\Windows\system32\Noehba32.exe
        112⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        113⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Npedmdab.exe
        
        C:\Windows\system32\Npedmdab.exe
        114⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        115⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Nhpiafnm.exe
        
        C:\Windows\system32\Nhpiafnm.exe
        116⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Ncfmno32.exe
        
        C:\Windows\system32\Ncfmno32.exe
        117⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Nlnbgddc.exe
        
        C:\Windows\system32\Nlnbgddc.exe
        118⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        119⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        120⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Nplkmckj.exe
        
        C:\Windows\system32\Nplkmckj.exe
        121⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        122⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        123⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        124⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        125⤵
        
        PID:3704
        
        C:\Windows\SysWOW64\Oigllh32.exe
        
        C:\Windows\system32\Oigllh32.exe
        126⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\Olehhc32.exe
        
        C:\Windows\system32\Olehhc32.exe
        127⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Ocopdn32.exe
        
        C:\Windows\system32\Ocopdn32.exe
        128⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        129⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\Ookjdn32.exe
        
        C:\Windows\system32\Ookjdn32.exe
        130⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Pedbahod.exe
        
        C:\Windows\system32\Pedbahod.exe
        131⤵
        
        PID:564
        
        C:\Windows\SysWOW64\Ploknb32.exe
        
        C:\Windows\system32\Ploknb32.exe
        132⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Pjbkgfej.exe
        
        C:\Windows\system32\Pjbkgfej.exe
        133⤵
        Drops file in System32 directory
        
        PID:5032
        
        C:\Windows\SysWOW64\Poodpmca.exe
        
        C:\Windows\system32\Poodpmca.exe
        134⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Pgihfj32.exe
        
        C:\Windows\system32\Pgihfj32.exe
        135⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        136⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Pcpikkge.exe
        
        C:\Windows\system32\Pcpikkge.exe
        137⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6384
        
        C:\Windows\SysWOW64\Pqcjepfo.exe
        
        C:\Windows\system32\Pqcjepfo.exe
        139⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Qgnbaj32.exe
        
        C:\Windows\system32\Qgnbaj32.exe
        140⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Qjlnnemp.exe
        
        C:\Windows\system32\Qjlnnemp.exe
        141⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Qljjjqlc.exe
        
        C:\Windows\system32\Qljjjqlc.exe
        142⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Qgpogili.exe
        
        C:\Windows\system32\Qgpogili.exe
        143⤵
        Drops file in System32 directory
        
        PID:6640
        
        C:\Windows\SysWOW64\Qjnkcekm.exe
        
        C:\Windows\system32\Qjnkcekm.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6712
        
        C:\Windows\SysWOW64\Acgolj32.exe
        
        C:\Windows\system32\Acgolj32.exe
        145⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Acilajpk.exe
        
        C:\Windows\system32\Acilajpk.exe
        146⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Ajcdnd32.exe
        
        C:\Windows\system32\Ajcdnd32.exe
        147⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Aopmfk32.exe
        
        C:\Windows\system32\Aopmfk32.exe
        148⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Ackigjmh.exe
        
        C:\Windows\system32\Ackigjmh.exe
        149⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Ajeadd32.exe
        
        C:\Windows\system32\Ajeadd32.exe
        150⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Aqoiqn32.exe
        
        C:\Windows\system32\Aqoiqn32.exe
        151⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Acnemi32.exe
        
        C:\Windows\system32\Acnemi32.exe
        152⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Aflaie32.exe
        
        C:\Windows\system32\Aflaie32.exe
        153⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Aqaffn32.exe
        
        C:\Windows\system32\Aqaffn32.exe
        154⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Aglnbhal.exe
        
        C:\Windows\system32\Aglnbhal.exe
        155⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Ajjjocap.exe
        
        C:\Windows\system32\Ajjjocap.exe
        156⤵
        Modifies registry class
        
        PID:6440
        
        C:\Windows\SysWOW64\Bogcgj32.exe
        
        C:\Windows\system32\Bogcgj32.exe
        157⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        158⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Bjlgdc32.exe
        
        C:\Windows\system32\Bjlgdc32.exe
        159⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Bmkcqn32.exe
        
        C:\Windows\system32\Bmkcqn32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6844
        
        C:\Windows\SysWOW64\Boipmj32.exe
        
        C:\Windows\system32\Boipmj32.exe
        161⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        162⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        163⤵
        Modifies registry class
        
        PID:7072
        
        C:\Windows\SysWOW64\Bfedoc32.exe
        
        C:\Windows\system32\Bfedoc32.exe
        164⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Bmomlnjk.exe
        
        C:\Windows\system32\Bmomlnjk.exe
        165⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Bfhadc32.exe
        
        C:\Windows\system32\Bfhadc32.exe
        166⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Bmbiamhi.exe
        
        C:\Windows\system32\Bmbiamhi.exe
        167⤵
        Drops file in System32 directory
        
        PID:6532
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        168⤵
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Cpbbch32.exe
        
        C:\Windows\system32\Cpbbch32.exe
        169⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Cgjjdf32.exe
        
        C:\Windows\system32\Cgjjdf32.exe
        170⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        171⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Ccqkigkp.exe
        
        C:\Windows\system32\Ccqkigkp.exe
        172⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        173⤵
        Drops file in System32 directory
        
        PID:6176
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        174⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6632
        
        C:\Windows\SysWOW64\Caghhk32.exe
        
        C:\Windows\system32\Caghhk32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6872
        
        C:\Windows\SysWOW64\Cfcqpa32.exe
        
        C:\Windows\system32\Cfcqpa32.exe
        177⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Cgcmjd32.exe
        
        C:\Windows\system32\Cgcmjd32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6380
        
        C:\Windows\SysWOW64\Cidjbmcp.exe
        
        C:\Windows\system32\Cidjbmcp.exe
        179⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        180⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        181⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        182⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Dpqodfij.exe
        
        C:\Windows\system32\Dpqodfij.exe
        183⤵
        Drops file in System32 directory
        
        PID:6580
        
        C:\Windows\SysWOW64\Dfjgaq32.exe
        
        C:\Windows\system32\Dfjgaq32.exe
        184⤵
        Drops file in System32 directory
        
        PID:6492
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        185⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Dhjckcgi.exe
        
        C:\Windows\system32\Dhjckcgi.exe
        186⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Dmglcj32.exe
        
        C:\Windows\system32\Dmglcj32.exe
        187⤵
        Modifies registry class
        
        PID:7256
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        188⤵
        Drops file in System32 directory
        
        PID:7288
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7340
        
        C:\Windows\SysWOW64\Daediilg.exe
        
        C:\Windows\system32\Daediilg.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7376
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        191⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Djmibn32.exe
        
        C:\Windows\system32\Djmibn32.exe
        192⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Eagaoh32.exe
        
        C:\Windows\system32\Eagaoh32.exe
        193⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7544
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        195⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Ealkjh32.exe
        
        C:\Windows\system32\Ealkjh32.exe
        196⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Edjgfcec.exe
        
        C:\Windows\system32\Edjgfcec.exe
        197⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Ejdocm32.exe
        
        C:\Windows\system32\Ejdocm32.exe
        198⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Eangpgcl.exe
        
        C:\Windows\system32\Eangpgcl.exe
        199⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        200⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7868
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        202⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Fpeafcfa.exe
        
        C:\Windows\system32\Fpeafcfa.exe
        203⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Fkkeclfh.exe
        
        C:\Windows\system32\Fkkeclfh.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7992
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8032
        
        C:\Windows\SysWOW64\Fdhcgaic.exe
        
        C:\Windows\system32\Fdhcgaic.exe
        206⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Fhflnpoi.exe
        
        C:\Windows\system32\Fhflnpoi.exe
        207⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Gpaqbbld.exe
        
        C:\Windows\system32\Gpaqbbld.exe
        208⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        209⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\Gpcmga32.exe
        
        C:\Windows\system32\Gpcmga32.exe
        210⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Ghkeio32.exe
        
        C:\Windows\system32\Ghkeio32.exe
        211⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Gilapgqb.exe
        
        C:\Windows\system32\Gilapgqb.exe
        212⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        213⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        214⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Hkpheidp.exe
        
        C:\Windows\system32\Hkpheidp.exe
        215⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        216⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        217⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Hpomcp32.exe
        
        C:\Windows\system32\Hpomcp32.exe
        218⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Hgiepjga.exe
        
        C:\Windows\system32\Hgiepjga.exe
        219⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Hjhalefe.exe
        
        C:\Windows\system32\Hjhalefe.exe
        220⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Haoimcgg.exe
        
        C:\Windows\system32\Haoimcgg.exe
        221⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        222⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Hkgnfhnh.exe
        
        C:\Windows\system32\Hkgnfhnh.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8156
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        224⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        225⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        226⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Igqkqiai.exe
        
        C:\Windows\system32\Igqkqiai.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7528
        
        C:\Windows\SysWOW64\Iafonaao.exe
        
        C:\Windows\system32\Iafonaao.exe
        228⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Ihphkl32.exe
        
        C:\Windows\system32\Ihphkl32.exe
        229⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Igedlh32.exe
        
        C:\Windows\system32\Igedlh32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7864
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        231⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Ijfnmc32.exe
        
        C:\Windows\system32\Ijfnmc32.exe
        232⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Iqpfjnba.exe
        
        C:\Windows\system32\Iqpfjnba.exe
        233⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        234⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Iqbbpm32.exe
        
        C:\Windows\system32\Iqbbpm32.exe
        235⤵
        Drops file in System32 directory
        
        PID:7484
        
        C:\Windows\SysWOW64\Jdpkflfe.exe
        
        C:\Windows\system32\Jdpkflfe.exe
        236⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Jbdlop32.exe
        
        C:\Windows\system32\Jbdlop32.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7500
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        238⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Jjopcb32.exe
        
        C:\Windows\system32\Jjopcb32.exe
        239⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        240⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        241⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Jjamia32.exe
        
        C:\Windows\system32\Jjamia32.exe
        242⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        243⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        244⤵
        Modifies registry class
        
        PID:8288
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        245⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        246⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        247⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        248⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        249⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8560
        
        C:\Windows\SysWOW64\Kndojobi.exe
        
        C:\Windows\system32\Kndojobi.exe
        251⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        252⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        253⤵
        Drops file in System32 directory
        
        PID:8696
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8732
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        255⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Kjmmepfj.exe
        
        C:\Windows\system32\Kjmmepfj.exe
        256⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Kniieo32.exe
        
        C:\Windows\system32\Kniieo32.exe
        257⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        258⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        259⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9000
        
        C:\Windows\SysWOW64\Lalnmiia.exe
        
        C:\Windows\system32\Lalnmiia.exe
        261⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        262⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        263⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        264⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Lgkpdcmi.exe
        
        C:\Windows\system32\Lgkpdcmi.exe
        265⤵
        Modifies registry class
        
        PID:9212
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        266⤵
        Modifies registry class
        
        PID:8248
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        267⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Maeachag.exe
        
        C:\Windows\system32\Maeachag.exe
        268⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Mhafeb32.exe
        
        C:\Windows\system32\Mhafeb32.exe
        269⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        270⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        271⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        272⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        273⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        274⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        275⤵
        Modifies registry class
        
        PID:8904
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        276⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        277⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        278⤵
        Drops file in System32 directory
        
        PID:9120
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        279⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        280⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        281⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        282⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        283⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        284⤵
        Drops file in System32 directory
        
        PID:8372
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        285⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Oekiqccc.exe
        
        C:\Windows\system32\Oekiqccc.exe
        286⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        287⤵
        Drops file in System32 directory
        
        PID:8724
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        288⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        289⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        290⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        291⤵
        Modifies registry class
        
        PID:9160
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        292⤵
        Drops file in System32 directory
        
        PID:764
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        293⤵
        Drops file in System32 directory
        
        PID:8236
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        294⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        295⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        296⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        297⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9076
        
        C:\Windows\SysWOW64\Pahpfc32.exe
        
        C:\Windows\system32\Pahpfc32.exe
        299⤵
        Modifies registry class
        
        PID:5404
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        300⤵
        Modifies registry class
        
        PID:8392
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        301⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        302⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9036
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        304⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        305⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        306⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        307⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        308⤵
        Drops file in System32 directory
        
        PID:2900
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        309⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        310⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        311⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        312⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        313⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        314⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        315⤵
        Drops file in System32 directory
        
        PID:9252
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        316⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9344
        
        C:\Windows\SysWOW64\Aaiimadl.exe
        
        C:\Windows\system32\Aaiimadl.exe
        318⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        319⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Achegd32.exe
        
        C:\Windows\system32\Achegd32.exe
        320⤵
        Modifies registry class
        
        PID:9472
        
        C:\Windows\SysWOW64\Alqjpi32.exe
        
        C:\Windows\system32\Alqjpi32.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9508
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        322⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        323⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        324⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        325⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        326⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9728
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        327⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        328⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        329⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        330⤵
        Modifies registry class
        
        PID:9884
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        331⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        332⤵
        Drops file in System32 directory
        
        PID:9968
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        333⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        334⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        335⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        336⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        337⤵
        Modifies registry class
        
        PID:10172
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        338⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        339⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Cbeapmll.exe
        
        C:\Windows\system32\Cbeapmll.exe
        340⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        341⤵
        Modifies registry class
        
        PID:9332
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        342⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        343⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        344⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        345⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        346⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        347⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        348⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        349⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Djelgied.exe
        
        C:\Windows\system32\Djelgied.exe
        350⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        351⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        352⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        353⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        354⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        355⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        356⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        357⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        358⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        359⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        360⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        361⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        362⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        363⤵
        Drops file in System32 directory
        
        PID:10204
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        364⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        365⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        366⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        367⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9976
        
        C:\Windows\SysWOW64\Gljgbllj.exe
        
        C:\Windows\system32\Gljgbllj.exe
        369⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        370⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9608
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        372⤵
        Modifies registry class
        
        PID:9760
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        373⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        374⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        375⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        376⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        377⤵
        Modifies registry class
        
        PID:9872
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        378⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        379⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        380⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        381⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        382⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        383⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        384⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        385⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        386⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        387⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        388⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        389⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        390⤵
        Modifies registry class
        
        PID:10716
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        391⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        392⤵
        Modifies registry class
        
        PID:10820
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        393⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10860
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        394⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10952
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        396⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        397⤵
        Drops file in System32 directory
        
        PID:11084
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        398⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        399⤵
        Modifies registry class
        
        PID:11188
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11224
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        401⤵
        Modifies registry class
        
        PID:10424
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        402⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        403⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        404⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        405⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        406⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        407⤵
        Modifies registry class
        
        PID:10960
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        408⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        409⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        410⤵
        Drops file in System32 directory
        
        PID:2252
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        411⤵
        Modifies registry class
        
        PID:11164
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        412⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        413⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        414⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        415⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        416⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        417⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        418⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2236
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        420⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        421⤵
        Drops file in System32 directory
        
        PID:1384
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        422⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        423⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        424⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5052
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        425⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        426⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        427⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        428⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        429⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        430⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        431⤵
        Modifies registry class
        
        PID:456
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        432⤵
        Drops file in System32 directory
        
        PID:3668
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        433⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        434⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        435⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        436⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        437⤵
        Modifies registry class
        
        PID:2416
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        438⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        439⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10664
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        440⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3136
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        441⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        442⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        443⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        444⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        445⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        446⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        447⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        448⤵
        Drops file in System32 directory
        
        PID:11032
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        449⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        450⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        451⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4824
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        452⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        453⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        454⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        455⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        456⤵
        
        PID:932
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        457⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1208
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        458⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        459⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        460⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        461⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        462⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        463⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        464⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        465⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        466⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        467⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        468⤵
        Drops file in System32 directory
        
        PID:6120
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        469⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        470⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        471⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        472⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        473⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        474⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        475⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        476⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        477⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        478⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        479⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        480⤵
        Modifies registry class
        
        PID:3548
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        481⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        482⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        483⤵
        Modifies registry class
        
        PID:2308
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        484⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        485⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        486⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        487⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        488⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6572
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        489⤵
        Modifies registry class
        
        PID:1864
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        490⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        491⤵
        Drops file in System32 directory
        
        PID:4172
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        492⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        493⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        494⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        495⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        496⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        497⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3492
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        498⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        499⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        500⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        501⤵
        Modifies registry class
        
        PID:10592
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        502⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        503⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        504⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        505⤵
        
        PID:860
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        506⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6844
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        507⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        508⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        509⤵
        Modifies registry class
        
        PID:7132
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        510⤵
        Drops file in System32 directory
        
        PID:7128
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        511⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        512⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        513⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        514⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        515⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        516⤵
        Modifies registry class
        
        PID:6116
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        517⤵
        Drops file in System32 directory
        
        PID:5720
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        518⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        519⤵
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        520⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        521⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        522⤵
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        523⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        524⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        525⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        526⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        527⤵
        Modifies registry class
        
        PID:10360
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        528⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10408
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        529⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        530⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5140
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        531⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        532⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        533⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        534⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        535⤵
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        536⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4864
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        537⤵
        Modifies registry class
        
        PID:804
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        538⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        539⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        540⤵
        Modifies registry class
        
        PID:7040
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        541⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:984
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        542⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        543⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        544⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        545⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        546⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        547⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        548⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        549⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        550⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        551⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        552⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        553⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        554⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7164
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        555⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        556⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        557⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        558⤵
        Drops file in System32 directory
        
        PID:6612
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        559⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        560⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        561⤵
        Modifies registry class
        
        PID:7968
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        562⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        563⤵
        Drops file in System32 directory
        
        PID:5772
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        564⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        565⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        566⤵
        Drops file in System32 directory
        
        PID:5588
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        567⤵
        
        PID:536
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        568⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5212
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        569⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        570⤵
        Drops file in System32 directory
        
        PID:4444
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        571⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        572⤵
        Drops file in System32 directory
        
        PID:6432
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        573⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        574⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        575⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        576⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        577⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        578⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        579⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        580⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        581⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        582⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        583⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        584⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        585⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        586⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        587⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        588⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        589⤵
        Drops file in System32 directory
        
        PID:1936
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        590⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        591⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        592⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7608
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        593⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        594⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        595⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        596⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        597⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:708
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        598⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        599⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        600⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        601⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        602⤵
        Drops file in System32 directory
        
        PID:6312
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        603⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        604⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        605⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        606⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        607⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        608⤵
        Modifies registry class
        
        PID:5204
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        609⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        610⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        611⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        612⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        613⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        614⤵
        Drops file in System32 directory
        
        PID:5144
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        615⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        616⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6576
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        617⤵
        Drops file in System32 directory
        
        PID:7896
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        618⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        619⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        620⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        621⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8668
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        622⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8148
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        623⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        624⤵
        Modifies registry class
        
        PID:8800
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        625⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5448
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        626⤵
        Modifies registry class
        
        PID:8344
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        627⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        628⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        629⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        630⤵
        Drops file in System32 directory
        
        PID:7440
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        631⤵
        Drops file in System32 directory
        
        PID:9016
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        632⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        633⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        634⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        635⤵
        Drops file in System32 directory
        
        PID:7568
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        636⤵
        Drops file in System32 directory
        
        PID:4440
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        637⤵
        Drops file in System32 directory
        
        PID:7960
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        638⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        639⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        640⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        641⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        642⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        643⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        644⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        645⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8044
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        646⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        647⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8088
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        648⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        649⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        650⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        651⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8716 -s 412
        652⤵
        Program crash
        
        PID:10140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 8716 -ip 8716
1⤵
PID:11040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ajggomog.exe

Filesize
98KB

MD5
cc3fa3de19aafc5e620bbf67441d7433

SHA1
c4d6f23c6f19f945051376130daff1e512fc7106

SHA256
2fa145126d7a258744b6f475f5a160ab045adfe9e22fde553828d12927e56f7c

SHA512
a4b3faec4064a3e79caf9f9a1d0e248c3d8775ed86719978a1925d3549928f8b6206ca75b9350f26ee193f4bf212574aebaaec1806f81802e1174622d6f900a5

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
98KB

MD5
373494cc23c19f7529838b3310b4648c

SHA1
5b8a3ebb3c5de14eecd7ffa5c3d1a457a962868f

SHA256
c26cc8048b6592fe287909e02c93b7a3f5b5f2b8c23be162733e98bbdbe35c30

SHA512
e55849401cf2319c1f6a0cf6a2af09bffc3e956ac98ef9d61917018008116f9447d1dcb23a7ab53bca2c910b46f771b9cba59181fd6a8aa459d7e419d7d137ce

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
98KB

MD5
e5e12e32a43bd9721ce271899a57287f

SHA1
ddf66ab4b91592c53e4f5cc38e3b5e509d8c939a

SHA256
784860929a7f5ca0dc00453a31e67774f3ef34ea086b3fabf1c303a92ea9ecb4

SHA512
e7f16ff857baef1f45f890f365d623c72f0519cd24d5ef076e39393ed1e5e092effeb01ce77aed5725d25930e8fb09db33a9d380dae62a07dc3ea2c6b21e67a4

Download Submit
C:\Windows\SysWOW64\Beeoaapl.exe

Filesize
98KB

MD5
4d41305d3d97099757ffe909112dffe7

SHA1
e00d1fb19c19b23bcd9b4b5e806537072b0acede

SHA256
cfd43a9c56e64a68a6c5d7f78cea777119dd69739316befd05a2f8f3e23c9475

SHA512
7ee2800d302ff40b64f431b6d6ff90b7eea23af1bf71c3dcd4cf844186983fedbd2cc95751d0e014db21e5da8fa5368bb4f2f0911ba9f01d490e59ee10ac1b26

Download Submit
C:\Windows\SysWOW64\Bfkedibe.exe

Filesize
98KB

MD5
d423a75b6d91b286420e3787d01ff30b

SHA1
cc4001e3175c5dd4cae3ca8333facd5d429d4ccf

SHA256
fe825c6f8f1395569a7369dedda7671447dfdbe585507f6afec3849b8c9a66c2

SHA512
083db94f37df388047c952a7ce4ce4c14b3fbcacd2be959ecf0d8ce1120dfbcb1daf9e111a97973578b14a78e71b0edf83d4c6b575c1d97e7e112e0289d3d7fc

Download Submit
C:\Windows\SysWOW64\Bgehcmmm.exe

Filesize
98KB

MD5
a3a2df1e0d33ac387d3f2e4e7685bb77

SHA1
4cf81a8ffdd25a71d270cd54a86e6383c00b2ed6

SHA256
acd2e9a9b287c294bed532fc53ed025b7ea997377ba5d00f84728334e7690093

SHA512
06eec1da6167ff1123d3ef7cd95d9956f0d71b79c50b1404d6bf5185dcdc2cec81e6f04716fdf6035e59217f601cb1f8031fa2e51f8f54f5c2249b26d74e9914

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
98KB

MD5
6b0277da682ad199eb7a0a0024078e6d

SHA1
81ec115da7300f6fb56c1c2faf0cebf43b00cd5a

SHA256
4f9a2afe9ffa601e99ed099d68da2fd27bf925e503769188fd6a33f3194530b6

SHA512
5de4260d2ebdfb9658308055e9b8aca92e4ddf166b193922d62d80a5a719b61cb9bd6fc68949fd16f9107287ffbaf62b44fbe345b963c0b9e9d1a48ff4b51d35

Download Submit
C:\Windows\SysWOW64\Bnpppgdj.exe

Filesize
98KB

MD5
6da7be0fa810cce3583aa92745320ab8

SHA1
ba97cf7337893258ed673f1aac2294d8b00ebdd5

SHA256
74549fc72bdc96c7603f5bc88572dc639d9647bfc3bbaa4351a2740b27469ad3

SHA512
d99cde43d1efd2734d462741122aee5205ce910a7330c181cdac12437576d02cc8a63d6c721a86a660da86309bcf4397138df15a645a7a8c82c3e43e698f2bfd

Download Submit
C:\Windows\SysWOW64\Cabfga32.exe

Filesize
98KB

MD5
6875e5f296c0b5ac9209bc82fa476252

SHA1
dd6846d0d53e557805b4f268c59aa11f65464991

SHA256
f587961d9ca52cd819577cab2b513838f4590c9d0aa4687f6ab59c094787408c

SHA512
7d79d7a90975cc8b43927350bc3ba5da8e83144bd5c152f059d3e3587f21dec219c8a3182026ef0bbc06fe2c21b3ccea2d5bc2b3f9384d3660134438f8aa962d

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
98KB

MD5
6a4db2f8a5347efad12fbe4cce888dbe

SHA1
9381dd5b0817d8ede9395e1579a3e376f7495fc2

SHA256
99cc60e81818f5169e19c4c4b17498814f7d144c81f2be785cb2c3defc0fc432

SHA512
ec549ad665dd4d1d589b83c5b75c636e38891b7a26f2719344f2f34be98649b42f699fe22640654b9fa4fd42fa3807a8e9f66933dfc64d901a212ff11cd71220

Download Submit
C:\Windows\SysWOW64\Ceehho32.exe

Filesize
98KB

MD5
e8af8622fad2d4941d9d82ad69960cee

SHA1
8b07557f72f1f3efb8cec961ac38bfa7cac3aabb

SHA256
168820d62383c45bedba8db80ff067be10638667546c6b4aaca9f6cd6f70e12b

SHA512
c6b28568a4ee9ea285e0a33e84fb98929bcea4c16a74480778ef9f08d4af0b2d7cfb7e8356c670e3e94b6adefbe39c2188bdd01600b54d5e4bdf43bbc8e93568

Download Submit
C:\Windows\SysWOW64\Cfpnph32.exe

Filesize
98KB

MD5
40a46a663b817f3c3719955a7b6316e1

SHA1
b787ebada586f882ada9ebfb7d349b9e99ae31f2

SHA256
e9084e76acb2ee448db94ab027f21162b75237b3bf718af9de2dbd812453be48

SHA512
d2581d0695214224cac83af246851b585a8b19b7c08f2b3a62eac4493d4f3a0e4b353d6907ed756e16db3a2fe138dc75a5341759243ef3653aa6111f4c2a22e3

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
98KB

MD5
8b4bc8b6f288c3dff5e2a302083dce7a

SHA1
289608193ff4e665aac5228fb1733c02b33ddeab

SHA256
d55fae5808afdbd7f70cdce21076f2f17b9ebeeb0b219c783d37ea3597a15d0f

SHA512
d699e7b8aa9c06643c36159dacf8dff0af0db1fcea00a1593e05563f569b25f9e3b4bf582a249d442ee945718fe1d124d33c31d407d1844a7460bef9dda3583c

Download Submit
C:\Windows\SysWOW64\Cnkplejl.exe

Filesize
98KB

MD5
feab91be2833a18c2b610e42b37aee77

SHA1
f324c9d9a75a230f8a4d5a6408e860896579ec13

SHA256
ecfeee2da56a6d306197130cf6a839b10ece2a91b560e1e1e3c5dce27ff9740d

SHA512
6054858d231bb0390a4f0461c6af8c5fbbc7b4eb94ab7ed8b37f07189e8236cbe3377184d7b7eef963e58ec30ac52a96aab184b8b39237dbf565f075b40ccd13

Download Submit
C:\Windows\SysWOW64\Cnnlaehj.exe

Filesize
98KB

MD5
def1a9025f72105f34da2ef56a239a72

SHA1
03847d49d060d82a72cbd74950cb162267eebabd

SHA256
b9e428e63251a75ab352fe9cd0af98d1a173a66df16b9fdffa5cfdd55d26e176

SHA512
1cce24d713a18d627639bddfa1da8629d780ebacdc1c1aa14e67cb1c20e45ff9a80e162372762f266aa507842324905333269ba376bf6654dcddffe7e79264f8

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
98KB

MD5
66b550b7d7c46adc8f78568db0fd1244

SHA1
8c097e814f0ed8360931f111349d8fd20545213d

SHA256
19d839d2d492bfc1d7c3a557de577c75a021fe82fec4452189fb74acdf86c215

SHA512
3823e8b622fd6f19ef7d08d62993ccb4a37f0885f980352012eefcea469e3020561523bbaadbfa686410c822ff0aa2cd84832d5f78677f23832fe8b36cedc0eb

Download Submit
C:\Windows\SysWOW64\Dfnjafap.exe

Filesize
98KB

MD5
9e2eac4464a1a41aaaae570a9951644c

SHA1
dd5f6d89a025a5ff65defa995efe43766496fc8d

SHA256
91386c7c0a2091b9fd778fe1f01e6c1dd6c035cd7c11edcf6f116f99a513e5b3

SHA512
964a3db0d568a575a36dad80c42bb0710d73a429dd395e22933ad41c0840ccb4afbf5501585142e533bc51264964f550a681243df430b4234bc1ed29fc6d8fb7

Download Submit
C:\Windows\SysWOW64\Dfpgffpm.exe

Filesize
98KB

MD5
f1e561c7faaad3c522f21d5829287b4d

SHA1
25a6bdad31c0d6e63681056767063a1b1db76c7c

SHA256
d1e41e58a15b3cc695f5cd5aafcaac7fd5f72ab06bed875bf2805f65d09045ec

SHA512
7fe4787762627bb32b08e5013a1fb4404196426ba9efda0f05f10f820bc7aaad574617e5cf3cc983a3c0f3e9c64c0589199b4b80d47a50c12cb40eb86a25870a

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
98KB

MD5
8202e997470f1ca6c61202172cf62db4

SHA1
9db77f1074b9665c604e2c98a5c15c1eb295281b

SHA256
563e13f1e687881b65fe3dc1c62712d724e3cbb71aa828ead2126dcea7e3d085

SHA512
f0dfea8e20844d86c6f296dcd9d6d4fdb4bec7b204d69e1f5d7cb2b793f72478b50f0d77f357434aacb9babf255bca9f09d90ff537c250501e8356a65ba17cd6

Download Submit
C:\Windows\SysWOW64\Dhhnpjmh.exe

Filesize
98KB

MD5
35598a7643c870c4cae58b08e96d5398

SHA1
026d6bf34fa3aa37b436c6bbf12fef822fcf2037

SHA256
13e8eeb5e17b68e5d02b5afa4a59e80c98064e5f133703759fd4fa1ca89beff9

SHA512
24b5f7ca6a1d2c925b36c1797ea3679bd0ad9ff086d51c696a00abf8d9db27c9d4f6769ff1c1588bf9d459818781b9209548048d5fdfa581898cf0844814318e

Download Submit
C:\Windows\SysWOW64\Dmjocp32.exe

Filesize
98KB

MD5
465faaa3d54a7435d862991be033cd6c

SHA1
6cdc0f31256e337862585912cfd55ef57798edd4

SHA256
93f007e3310d8f5d84e93ca6a8150bcbea806d8555085acf64cca9eef62dcf3f

SHA512
5f89c3cb9e118ed3545d64eee965f444605a4494c033418e91c51a89bd944ca6c10890347e8c094924b5a89a53e08aa44941829d6a4f07cccc50aa86c9d87267

Download Submit
C:\Windows\SysWOW64\Dnajppda.exe

Filesize
98KB

MD5
fed8fb770ab9de021388ce56ddd935b7

SHA1
d49e87765b705b8cf992e50ff811eeec501c7709

SHA256
760b79b2709b7ca17229c39e94e05bcd74bfc2947cfa733e5595d04b309c6f97

SHA512
33c5902d715b5a13d18c0c5d37bb422b85637c03bb73b996b065cdbf82969fe2e61a81e66e49df01de53afb97e516ad8ff1322b8a01380f2bc4b24209e621747

Download Submit
C:\Windows\SysWOW64\Doilmc32.exe

Filesize
98KB

MD5
9d243bbe8114ae7a71edaeeea3d1eab0

SHA1
4ff3ed943d7593f8a96c38649861339a160d0a82

SHA256
4619081ab7d0309b177c60411971fc47413fb2a606a8d5b4659d6f92f0660cd0

SHA512
93e3b44b68bb8f892523ad8a7bea4dbe382b6cb853b836124dbd348335f5175fed251a2d3d306c0b1bd0d2a5984f32c965171f2fbe1355c7bd767902d453e334

Download Submit
C:\Windows\SysWOW64\Dopigd32.exe

Filesize
98KB

MD5
47466ed371a69e002d841953550b1742

SHA1
fafeb7d2968d80322de925128c15dc338b8cb372

SHA256
6a9a56440e936e7a9949f50e3816e065121d82c4bfa7072ba2dac4c25d102510

SHA512
2ebf1e912d952181a0739b1b9517b319385c9e3b8b876c9265b28dd7b229b6a578b0602240b609a5657fc4dab51b0acb1da2fafd04ee3e807085d4b2e38f6437

Download Submit
C:\Windows\SysWOW64\Eaonjngh.exe

Filesize
98KB

MD5
05be71ae5fb032eefc68547e62b09a8a

SHA1
c65d33e91b5426ec7c637a2ad39e94e45878c985

SHA256
4888d845873f15e12a514f2fbe6d2b4f88da20c878f197d366bd999b126fb8a3

SHA512
4dcd3cb8582d49ce0140b62a3fbace1833eee841f28306707c285028500ca1d0a6be34a7056276cf99ea423612494e3081c528bc30b3caf1af30c8015602cba2

Download Submit
C:\Windows\SysWOW64\Edfdej32.exe

Filesize
98KB

MD5
242d8128e1e3c0ea6031696394aea57b

SHA1
5c2b52a3882f38a943311749c853fbe050e40333

SHA256
57155caad6f608cdd415c680e13d441859ad8e934a711ee5b43508406af5eb3e

SHA512
6a1913320ca26cb1f42f4224886c8d9a85a36d04418e6d451effd25f12de9eb02cb87d2655595eb183933939a17d707d64bd71fd87ef44156ffdfd47a19dcb09

Download Submit
C:\Windows\SysWOW64\Egnchd32.exe

Filesize
98KB

MD5
1ebf2ee35059b4fa19d0cbd0e2fd8d02

SHA1
9073975ab050edac08b5c5116c9d73a7c2b5aa0d

SHA256
359e2e63c516a6a7a32c2b5633d847c0fccd8d41bf3036a4f6e79ea827fa0a40

SHA512
3a76ea59738374f45ca7e131508260c0145e185e77c89ba5f2bb21896e2f2edb1c3a34275d34f1b516d9b36f007ca9a4278ca9ad514504cd23b44e0fd972cbd9

Download Submit
C:\Windows\SysWOW64\Ehdmlhcj.exe

Filesize
98KB

MD5
162a2424d54045f8bf44fa50cbcbcf56

SHA1
6d583f118b5e34ad2858dbadb5b9e16b79689af4

SHA256
2f8f8cdcc8088d74e979dfdd7b6d20acca41ca8cbb557a32344576c3cf0fbb9d

SHA512
db33aae1e99c6128ec2e209438fe6bd746291b97960ff3a119eda84ead9ee6149769c2938c7dcf5b0b68b1a87f7cf32c72986dfde0e7c0388e7c5be94610ca0b

Download Submit
C:\Windows\SysWOW64\Ekefmc32.exe

Filesize
98KB

MD5
0cd636cc99cf1f8f6902ae8a7cda3de2

SHA1
2851cb51f92440774f593cee5dca212982da8f47

SHA256
9b01737f4ea24fce5e88056751f2978c6893121b92d2f5ce1490daea472c2ea5

SHA512
94993c77149c1796c72acfa26588c4bec41b7a57b3df2810c400305b1b555c125d696de7ae5fb70d384f108260bff5b88809fa033b188c0ea8c0a137bdb22ea1

Download Submit
C:\Windows\SysWOW64\Emeoooml.exe

Filesize
98KB

MD5
0d4148953654e7187fbc42f90c22bc8a

SHA1
4ce44d27984b60417f4ad1e1180e2ea41fcaa2c6

SHA256
d45e758ed4fe49c4bec863c37920d67a49a0e624500f2026a2c4d7b64c23775a

SHA512
296ae77ab1f9b6cd1ed8358db368072a2b48a422391272362b809cae928383e322a09d28d0118e802a16c9908bc858d754cdae5a60afec64064aaae59815317e

Download Submit
C:\Windows\SysWOW64\Eolhbc32.exe

Filesize
98KB

MD5
164fe63f5a696770e4cc38d127adbcb9

SHA1
d6bf2b89179c34e777d14115e8b994f243c60305

SHA256
b86dcf56bb1232ba77563a74d32fb428532a1dc3622e9b607376a166da1ae7ca

SHA512
83caa0b2952d95239dfdf230cc267f1593ba5b60964183c7c24ff77414dec6aefaabcdd03acf975256143c3b9859959c337bbd6b9dc5c1e0e81572dd112d0f2a

Download Submit
C:\Windows\SysWOW64\Eonehbjg.exe

Filesize
98KB

MD5
94976fdcad7e6b761b175cb315676f07

SHA1
72a5015ddffd1008948e210b0ebff3612b047358

SHA256
3d28debb85f90a8e068a40f6358f5f68a24c139ddef1259d47512eb7abf83162

SHA512
495123bf1145c28f5004b7c44427687e43b03d1637aecda8209af0ec4ade8833fe3c24348d7554296f5fb8b2e607b8b207df12eb6d6d736595c06101898ec06e

Download Submit
C:\Windows\SysWOW64\Fdhcgaic.exe

Filesize
98KB

MD5
303431c02d66e3d3b8ae3d3dfc1a45d5

SHA1
88824972838ce1db3902a88c78cec34c0aff4797

SHA256
dd536d5de0c31331b29fd546309d7feeac9745ea2a079972ee7838e823969556

SHA512
c3cadf2f4c578dc1ea567af2386dfe602e5ae3a0e968bec161595b24952d006942dd59768968a706b9e25cba2bc90ecaafd11880a9bbd490ac827fdc511df2b5

Download Submit
C:\Windows\SysWOW64\Fhpmgg32.exe

Filesize
98KB

MD5
4259a4140e1bed1782aea3c573939a31

SHA1
8eddd50d8c57e9ec98a822839621849298d76c4a

SHA256
d470006a7747099cbaa928901281205c4ba5469b156d20f1397e8e4479be7206

SHA512
4954f8c5341937f90f8d67b17cef5baf1254e004bd6094e73eff90c51e55c1fa5b2047f54aad344c94ce01c03432edc89cefb219e862808ffa8a901882357dca

Download Submit
C:\Windows\SysWOW64\Fojedapj.exe

Filesize
98KB

MD5
533e1038df48f2dbb986b7f8562eddb7

SHA1
dfea2c567e35f289ffb0b0ab1d3440895ef5d8f3

SHA256
a341c8db723c7f14bab55428404344d756a751d63291a013671153921d0d6487

SHA512
2ff8a9a3af946c456abfa3761b0c28a8425a04b012be24240e830e5fd7915677851aa2285dc7c90386430e998af7aa1424438ed7256cb012089309192457542a

Download Submit
C:\Windows\SysWOW64\Gpaqbbld.exe

Filesize
98KB

MD5
5975a148ab0a4501afd604bfea9b3264

SHA1
30dbeed6f0881ea213282e2b12c563bf2477b584

SHA256
92a5c392626d7a03db4214d6c801df3bb6a2f86f9c4589ceca831ac0f4c3df9a

SHA512
b2852ae5b986c0b763136c922f989fa28749781efa13f4692874c5dbe13a0a53405818c0a9d477e816a2786b9f94d6b1f2ceeb728f24e7fb8e7e9fc1ef2e87c7

Download Submit
C:\Windows\SysWOW64\Gphphj32.exe

Filesize
98KB

MD5
c165cd30c4a890277d0f2f6b12af2aeb

SHA1
96944216ee233055055cb0a7bac9e523de1f7dbe

SHA256
0dd440e22b154bc7b4d65742b3370981d5ad8ce6cf76c08e167408bcc0d37a86

SHA512
99832cd57364d27ad32f7687c2e9004519fdc26e75248668b3bfc9b7b39d8d102954e378e0e64a94886d0ee90f667b16fcee6f62bb5dc78e685ab03dfd6fc30c

Download Submit
C:\Windows\SysWOW64\Hfggmg32.dll

Filesize
7KB

MD5
f5ee1cd46449bd9925b8f6f95bc76a0b

SHA1
e8d2fa3a0a089456689dd0f4d36be00cc611a2f3

SHA256
9f55292b50a9383e0be3982993798b3c069522720919e195d199f1aeb5eca894

SHA512
35d5a4b0d4a77683680e20e0222541bf3ff33358de5776d2272306131ab5f04607565b7e7768a3a5f972e8d42621234608b13d37749ab8a11513a20f7bf673f5

Download Submit
C:\Windows\SysWOW64\Ibnligoc.exe

Filesize
98KB

MD5
4cc0e3e7c712c8be7389cdbb8bd3a907

SHA1
72166cc1e718d8534ebe297010895308de37a2dc

SHA256
1c02cb522c82dc6ac15dcc1439653b2ac0aa942270cc3359225619898b01117b

SHA512
586908254db7bcf0f618b3795ebb99937a23cad54d337f0fac7d9894caee20c01fc87cfa8ebce9df1335808d3d582ddd5bf3df9695aee28824a5d2cb0dc47481

Download Submit
C:\Windows\SysWOW64\Iqbbpm32.exe

Filesize
98KB

MD5
9744b40bca5411d40c8e69de9a6396fe

SHA1
23b3cae9fb1059304a33c31c92f8b0d61a16dd0c

SHA256
9a302182ff0f34574bfba6ebc409cc545d5b7dd7e55d95ad8a32bca5404571ab

SHA512
8326ceb97f4168905daaaf628aa51957ff850e9bc26d5cfa107a722ed8198ddf7e2c4a10eb9005ee877bf9d98430d98cb9a60283580306cfa48998e211adaf27

Download Submit
C:\Windows\SysWOW64\Jeekkafl.exe

Filesize
98KB

MD5
8c753de4d58d2fbf96b48a328aa04b8c

SHA1
2c810bc8ceb1196b24db0ce33127c11b7e2fa0eb

SHA256
3c1c11012044b67616a5baa74209293f163c877fc18ab1812a1be809d9544b44

SHA512
fa2846110097fde1f3f0aa4a0ec240a3781426cc22799c0011c38a5119bed3d6ffd3a3b001c317446af66aac7a3bf2e0b10f04de5c2fc04312890b5ff276ae33

Download Submit
C:\Windows\SysWOW64\Jfgdkd32.exe

Filesize
98KB

MD5
2fd618916d7a871eefda12f9e4391b39

SHA1
7e0329d62a10296f4e9aeb3a1573315dd8177623

SHA256
c4c244f7dc257cbd4ecdc7c3fea1a0eb2031afed1fd33eb9182fc501200a8abf

SHA512
97d3de5ac070053d5479a7f5e90afcae97a2257fdad7028a79addcf753cf9e40d739ea9708bbde9407ef306ef843e29d0c1d0212d370fe230324136d84b82e81

Download Submit
C:\Windows\SysWOW64\Kcoccc32.exe

Filesize
98KB

MD5
c0d1d94f7a0d6dc823cfebaaa6f083d3

SHA1
0a9047a139846c8e6961f0dcd3c0b02414851ed0

SHA256
11375d9c85717629973c73e5242ae18eab6f71b5ccd3109242612e928ee5d793

SHA512
465dbfb3deda638a43346a908aafd42167e876728f405fa2ea33accde3dfaee612566e40c9a3bd1a22b4ed14455a131be9f247a780c392b375b6c58a1fd1ba7e

Download Submit
C:\Windows\SysWOW64\Modpib32.exe

Filesize
98KB

MD5
90d5ef40d2d69a9df64540f3a9537a3e

SHA1
0f2a6c4164d757d2ed25e0255bc92b685b3c9c28

SHA256
9429769777b84f0fb4485c5334b1ecb1b84e004b0d2fa86e82ffadf8b9d6cb8c

SHA512
0d5aa7e787c10314e9265403734f77ba9e62867cb23663bf1819fedbb9011522753ee91299b360856bf1695fe52aaf489bfff2fdc971c670251276bb6efb87b8

Download Submit
C:\Windows\SysWOW64\Njfagf32.exe

Filesize
98KB

MD5
0197924316941dafb248a0d78e1c8cf2

SHA1
e7a2f55e3448e4dcbe7ed6b617b8db524db4b63e

SHA256
bbcdd6cf2678c31d3af7bc444282be77f890f61789137ea0bbc303618f868ac5

SHA512
f2b5d4fba6d1618c06adef106c1076a54f3eac9a7b0447862bac579e3afb218c411d76fbb4e9be5a3c3b024bbefff1f1f3952b856670543fdb33cb3e0dbc8fa1

Download Submit
C:\Windows\SysWOW64\Plpjoe32.exe

Filesize
98KB

MD5
24ced61737bac199e11d67610aef383d

SHA1
697bb57ad4033329ec03e293dfd218575c20c86e

SHA256
e09042798eb906839338af8b2b7c7c16291a14ef8486f4c0e285058f6ba4a3fa

SHA512
fd14b96309d6c1c01c96482c097e2f9f13deba6a3a80aa73c3e6a13b04ab719d4b82f362897cf1f6c44c110b4148e43a7b822102d094405adc9e7823e9edb977

Download Submit
memory/228-39-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/436-256-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/456-316-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/528-428-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/804-103-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/900-350-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/980-268-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1012-160-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1040-340-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1044-207-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1112-200-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1220-322-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1292-71-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1296-298-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1308-168-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1432-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1476-191-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1860-135-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1876-152-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1936-128-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1964-36-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2092-280-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2116-248-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2236-96-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2340-278-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2416-364-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2604-292-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2828-120-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2860-231-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3024-406-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3124-418-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3248-304-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3324-400-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3380-216-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3448-310-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3492-357-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3500-143-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3520-382-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3536-79-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3548-111-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3608-244-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3652-286-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3668-328-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3736-446-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3956-176-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4076-64-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4168-376-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4376-412-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4424-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4472-436-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4508-224-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4524-430-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4536-334-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4560-388-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4820-262-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4864-87-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4872-362-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4880-56-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4916-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4964-394-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5024-374-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5056-47-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5092-23-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5104-184-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/8620-1800-0x00000000763D0000-0x00000000764F0000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads