8d0ce4c1fb4d2244af75518b5b9a6f4b14ba1496355d20de8a4450406b65e136

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d0ce4c1fb4d2244af75518b5b9a6f4b14ba1496355d20de8a4450406b65e136.exe
Size

74KB
MD5

21c2af16644b803d1728481470108b0a
SHA1

f5c4a7169b56c4a7110116f8b1ecab1a3fe2a957
SHA256

8d0ce4c1fb4d2244af75518b5b9a6f4b14ba1496355d20de8a4450406b65e136
SHA512

0b3424eab6d241224ca35ea0fe912ff5bcca18a856dd5fa7e5b5ea8e8297d183834c73a5f4d8c3e19911cde91cdde97e3141661469c93b227ea0178ba6282cee
SSDEEP

1536:2M1gMBwuzZrVeIHKLXPl7vOVEAk+lPi9L9GjsNRtsdRpfAjf:FyA9VzK12f1Pi90IHsqjf

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcncpbmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amgapeea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmfkoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbjlfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhgjblfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ipdqba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lbdolh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmoeoidl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjhlml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Angddopp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cbqlfkmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbbkaako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odmgcgbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qnnanphk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Andgoobc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gododflk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okjbpglo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdialn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dceohhja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fcmnpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hopnqdan.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojllan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oqihnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfjhkjle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Febgea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cefoce32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlpkba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgefeajb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clnjjpod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icnpmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpcfkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlnnmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lbmhlihl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Onfbfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjghpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chdkoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lboeaifi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Deokon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcmnpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fhjfhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Leihbeib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Meiaib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njqmepik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Peimil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eoaihhlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jmpgldhg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpnchp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdhdajea.exe

Executes dropped EXE 64 IoCs

pid	Process
1420	Odnnnnfe.exe
4824	Ogljjiei.exe
4644	Onfbfc32.exe
3968	Odpjcm32.exe
5096	Okjbpglo.exe
2780	Obdkma32.exe
2224	Ocegdjij.exe
4700	Ogaceh32.exe
3532	Onklabip.exe
5000	Oqihnn32.exe
4340	Okolkg32.exe
4608	Oqkdcn32.exe
3540	Pgemphmn.exe
1940	Pnpemb32.exe
2916	Peimil32.exe
464	Pghieg32.exe
2632	Pnbbbabh.exe
4868	Pqpnombl.exe
2332	Pcojkhap.exe
2832	Pkfblfab.exe
1364	Pbpjhp32.exe
3636	Pengdk32.exe
672	Pgmcqggf.exe
1144	Pkhoae32.exe
4084	Pjkombfj.exe
2104	Paegjl32.exe
4776	Pcccfh32.exe
4972	Pkjlge32.exe
4356	Pnihcq32.exe
3612	Qecppkdm.exe
1392	Qgallfcq.exe
908	Qkmhlekj.exe
3092	Qbgqio32.exe
2292	Qeemej32.exe
2436	Qloebdig.exe
1240	Qnnanphk.exe
1452	Qbimoo32.exe
1220	Aegikj32.exe
1136	Agffge32.exe
1064	Alabgd32.exe
4420	Anpncp32.exe
4016	Aejfpjne.exe
1924	Ahhblemi.exe
3596	Ajfoiqll.exe
2120	Aaqgek32.exe
3452	Ahkobekf.exe
2608	Ajiknpjj.exe
4612	Andgoobc.exe
3588	Aeopki32.exe
4528	Ahmlgd32.exe
5052	Angddopp.exe
2908	Abbpem32.exe
1004	Aaepqjpd.exe
1476	Ahoimd32.exe
4768	Ajneip32.exe
4348	Bahmfj32.exe
4152	Bdfibe32.exe
2304	Blmacb32.exe
4548	Bbgipldd.exe
5028	Beeflhdh.exe
864	Bhdbhcck.exe
4900	Blpnib32.exe
3352	Balfaiil.exe
3484	Blbknaib.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Egdmkp32.dll	Cknnpm32.exe
File created	C:\Windows\SysWOW64\Iedoeq32.dll	Gdjjckag.exe
File created	C:\Windows\SysWOW64\Mhkngh32.dll	Klqcioba.exe
File created	C:\Windows\SysWOW64\Ckmllpik.dll	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Fmfldb32.dll	Chbnia32.exe
File opened for modification	C:\Windows\SysWOW64\Kdeoemeg.exe	Klngdpdd.exe
File opened for modification	C:\Windows\SysWOW64\Ognpebpj.exe	Ocbddc32.exe
File created	C:\Windows\SysWOW64\Bebblb32.exe	Bnhjohkb.exe
File opened for modification	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Ahhblemi.exe	Aejfpjne.exe
File created	C:\Windows\SysWOW64\Gnchkk32.dll	Iemppiab.exe
File opened for modification	C:\Windows\SysWOW64\Jlbgha32.exe	Jmpgldhg.exe
File created	C:\Windows\SysWOW64\Bnecbhin.dll	Medgncoe.exe
File opened for modification	C:\Windows\SysWOW64\Nljofl32.exe	Nngokoej.exe
File created	C:\Windows\SysWOW64\Njefqo32.exe	Nggjdc32.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Qgallfcq.exe	Qecppkdm.exe
File opened for modification	C:\Windows\SysWOW64\Bahmfj32.exe	Ajneip32.exe
File created	C:\Windows\SysWOW64\Eleiam32.exe	Ednaqo32.exe
File opened for modification	C:\Windows\SysWOW64\Oqkdcn32.exe	Okolkg32.exe
File opened for modification	C:\Windows\SysWOW64\Balfaiil.exe	Blpnib32.exe
File created	C:\Windows\SysWOW64\Ligqhc32.exe	Lekehdgp.exe
File created	C:\Windows\SysWOW64\Ljodkeij.dll	Lboeaifi.exe
File created	C:\Windows\SysWOW64\Iledokkp.dll	Ippggbck.exe
File opened for modification	C:\Windows\SysWOW64\Icnpmp32.exe	Ilghlc32.exe
File created	C:\Windows\SysWOW64\Kdnidn32.exe	Klgqcqkl.exe
File created	C:\Windows\SysWOW64\Ghlcnk32.exe	Gdqgmmjb.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Cjkjpgfi.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Kahdohfm.dll	Daekdooc.exe
File created	C:\Windows\SysWOW64\Colffknh.exe	Clnjjpod.exe
File opened for modification	C:\Windows\SysWOW64\Bchomn32.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Fqjamcpe.dll	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Pmidog32.exe	Pnfdcjkg.exe
File opened for modification	C:\Windows\SysWOW64\Dmgbnq32.exe	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Chbnia32.exe	Cecbmf32.exe
File opened for modification	C:\Windows\SysWOW64\Mibpda32.exe	Mchhggno.exe
File created	C:\Windows\SysWOW64\Pdkcde32.exe	Pnakhkol.exe
File opened for modification	C:\Windows\SysWOW64\Bmbplc32.exe	Bjddphlq.exe
File created	C:\Windows\SysWOW64\Dfnjafap.exe	Dhkjej32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File opened for modification	C:\Windows\SysWOW64\Qecppkdm.exe	Pnihcq32.exe
File created	C:\Windows\SysWOW64\Ckcgkldl.exe	Chdkoa32.exe
File created	C:\Windows\SysWOW64\Gkmlofol.exe	Ghopckpi.exe
File created	C:\Windows\SysWOW64\Nhgaocmg.dll	Kfckahdj.exe
File opened for modification	C:\Windows\SysWOW64\Anmjcieo.exe	Ajanck32.exe
File created	C:\Windows\SysWOW64\Accfbokl.exe	Aadifclh.exe
File created	C:\Windows\SysWOW64\Nnjaqjfh.dll	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Bhnipd32.dll	Dddojq32.exe
File created	C:\Windows\SysWOW64\Fkffog32.exe	Fhgjblfq.exe
File opened for modification	C:\Windows\SysWOW64\Ilghlc32.exe	Imdgqfbd.exe
File created	C:\Windows\SysWOW64\Pejjde32.dll	Ehedfo32.exe
File created	C:\Windows\SysWOW64\Jefbfgig.exe	Jcefno32.exe
File created	C:\Windows\SysWOW64\Agocgbni.dll	Ndokbi32.exe
File opened for modification	C:\Windows\SysWOW64\Ajkaii32.exe	Aglemn32.exe
File opened for modification	C:\Windows\SysWOW64\Pqpnombl.exe	Pnbbbabh.exe
File created	C:\Windows\SysWOW64\Gaelmc32.dll	Angddopp.exe
File created	C:\Windows\SysWOW64\Aecqac32.dll	Cliaoq32.exe
File opened for modification	C:\Windows\SysWOW64\Oqfdnhfk.exe	Olkhmi32.exe
File created	C:\Windows\SysWOW64\Pnakhkol.exe	Pfjcgn32.exe
File created	C:\Windows\SysWOW64\Chbnia32.exe	Cecbmf32.exe
File created	C:\Windows\SysWOW64\Hfcicmqp.exe	Hbgmcnhf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12108	2804	WerFault.exe	575

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jcgbco32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lfkaag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phkjck32.dll"	Lmiciaaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciopbjik.dll"	Pqbdjfln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmnoof32.dll"	Gomakdcp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hmjdjgjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Angddopp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eeidoc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jeklag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kedoge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ocegdjij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qkmhlekj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fkciihgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgldjcmk.dll"	Qmkadgpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	8d0ce4c1fb4d2244af75518b5b9a6f4b14ba1496355d20de8a4450406b65e136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Colffknh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifmafkkf.dll"	Gfembo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gmoeoidl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mlampmdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chfgkj32.dll"	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpamgn32.dll"	Ogljjiei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Conclk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anphnl32.dll"	Gkhbdg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gcagkdba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Imdgqfbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aklmno32.dll"	Aeopki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daolnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnlaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jeaikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdeoemeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oapgek32.dll"	Conclk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpjgop32.dll"	Eocenh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lmiciaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Popodg32.dll"	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaelmc32.dll"	Angddopp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Clnjjpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lbmhlihl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pfjcgn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qmkadgpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ekcpbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bncfnnbj.dll"	Ifjodl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Llemdo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mmlpoqpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jclhkbae.dll"	Olcbmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qdbiedpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hopnqdan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnbcedcn.dll"	Icnpmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ikpaldog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bdolhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjhijoaa.dll"	Lepncd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mpablkhc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnbbbabh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjdkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdmpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anmnemcc.dll"	Aejfpjne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojdamdma.dll"	Cafigg32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1420	1944	8d0ce4c1fb4d2244af75518b5b9a6f4b14ba1496355d20de8a4450406b65e136.exe	87
PID 1944 wrote to memory of 1420	1944	8d0ce4c1fb4d2244af75518b5b9a6f4b14ba1496355d20de8a4450406b65e136.exe	87
PID 1944 wrote to memory of 1420	1944	8d0ce4c1fb4d2244af75518b5b9a6f4b14ba1496355d20de8a4450406b65e136.exe	87
PID 1420 wrote to memory of 4824	1420	Odnnnnfe.exe	88
PID 1420 wrote to memory of 4824	1420	Odnnnnfe.exe	88
PID 1420 wrote to memory of 4824	1420	Odnnnnfe.exe	88
PID 4824 wrote to memory of 4644	4824	Ogljjiei.exe	90
PID 4824 wrote to memory of 4644	4824	Ogljjiei.exe	90
PID 4824 wrote to memory of 4644	4824	Ogljjiei.exe	90
PID 4644 wrote to memory of 3968	4644	Onfbfc32.exe	91
PID 4644 wrote to memory of 3968	4644	Onfbfc32.exe	91
PID 4644 wrote to memory of 3968	4644	Onfbfc32.exe	91
PID 3968 wrote to memory of 5096	3968	Odpjcm32.exe	92
PID 3968 wrote to memory of 5096	3968	Odpjcm32.exe	92
PID 3968 wrote to memory of 5096	3968	Odpjcm32.exe	92
PID 5096 wrote to memory of 2780	5096	Okjbpglo.exe	93
PID 5096 wrote to memory of 2780	5096	Okjbpglo.exe	93
PID 5096 wrote to memory of 2780	5096	Okjbpglo.exe	93
PID 2780 wrote to memory of 2224	2780	Obdkma32.exe	94
PID 2780 wrote to memory of 2224	2780	Obdkma32.exe	94
PID 2780 wrote to memory of 2224	2780	Obdkma32.exe	94
PID 2224 wrote to memory of 4700	2224	Ocegdjij.exe	95
PID 2224 wrote to memory of 4700	2224	Ocegdjij.exe	95
PID 2224 wrote to memory of 4700	2224	Ocegdjij.exe	95
PID 4700 wrote to memory of 3532	4700	Ogaceh32.exe	96
PID 4700 wrote to memory of 3532	4700	Ogaceh32.exe	96
PID 4700 wrote to memory of 3532	4700	Ogaceh32.exe	96
PID 3532 wrote to memory of 5000	3532	Onklabip.exe	97
PID 3532 wrote to memory of 5000	3532	Onklabip.exe	97
PID 3532 wrote to memory of 5000	3532	Onklabip.exe	97
PID 5000 wrote to memory of 4340	5000	Oqihnn32.exe	98
PID 5000 wrote to memory of 4340	5000	Oqihnn32.exe	98
PID 5000 wrote to memory of 4340	5000	Oqihnn32.exe	98
PID 4340 wrote to memory of 4608	4340	Okolkg32.exe	99
PID 4340 wrote to memory of 4608	4340	Okolkg32.exe	99
PID 4340 wrote to memory of 4608	4340	Okolkg32.exe	99
PID 4608 wrote to memory of 3540	4608	Oqkdcn32.exe	100
PID 4608 wrote to memory of 3540	4608	Oqkdcn32.exe	100
PID 4608 wrote to memory of 3540	4608	Oqkdcn32.exe	100
PID 3540 wrote to memory of 1940	3540	Pgemphmn.exe	101
PID 3540 wrote to memory of 1940	3540	Pgemphmn.exe	101
PID 3540 wrote to memory of 1940	3540	Pgemphmn.exe	101
PID 1940 wrote to memory of 2916	1940	Pnpemb32.exe	102
PID 1940 wrote to memory of 2916	1940	Pnpemb32.exe	102
PID 1940 wrote to memory of 2916	1940	Pnpemb32.exe	102
PID 2916 wrote to memory of 464	2916	Peimil32.exe	103
PID 2916 wrote to memory of 464	2916	Peimil32.exe	103
PID 2916 wrote to memory of 464	2916	Peimil32.exe	103
PID 464 wrote to memory of 2632	464	Pghieg32.exe	104
PID 464 wrote to memory of 2632	464	Pghieg32.exe	104
PID 464 wrote to memory of 2632	464	Pghieg32.exe	104
PID 2632 wrote to memory of 4868	2632	Pnbbbabh.exe	105
PID 2632 wrote to memory of 4868	2632	Pnbbbabh.exe	105
PID 2632 wrote to memory of 4868	2632	Pnbbbabh.exe	105
PID 4868 wrote to memory of 2332	4868	Pqpnombl.exe	106
PID 4868 wrote to memory of 2332	4868	Pqpnombl.exe	106
PID 4868 wrote to memory of 2332	4868	Pqpnombl.exe	106
PID 2332 wrote to memory of 2832	2332	Pcojkhap.exe	107
PID 2332 wrote to memory of 2832	2332	Pcojkhap.exe	107
PID 2332 wrote to memory of 2832	2332	Pcojkhap.exe	107
PID 2832 wrote to memory of 1364	2832	Pkfblfab.exe	109
PID 2832 wrote to memory of 1364	2832	Pkfblfab.exe	109
PID 2832 wrote to memory of 1364	2832	Pkfblfab.exe	109
PID 1364 wrote to memory of 3636	1364	Pbpjhp32.exe	110

C:\Users\Admin\AppData\Local\Temp\8d0ce4c1fb4d2244af75518b5b9a6f4b14ba1496355d20de8a4450406b65e136.exe
"C:\Users\Admin\AppData\Local\Temp\8d0ce4c1fb4d2244af75518b5b9a6f4b14ba1496355d20de8a4450406b65e136.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\Odnnnnfe.exe
  C:\Windows\system32\Odnnnnfe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\SysWOW64\Ogljjiei.exe
    C:\Windows\system32\Ogljjiei.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\SysWOW64\Onfbfc32.exe
      C:\Windows\system32\Onfbfc32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4644
    - - C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3968
      - C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3532
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3540
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1364
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        23⤵
        Executes dropped EXE
        
        PID:3636
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        24⤵
        Executes dropped EXE
        
        PID:672
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        25⤵
        Executes dropped EXE
        
        PID:1144
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        26⤵
        Executes dropped EXE
        
        PID:4084
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        27⤵
        Executes dropped EXE
        
        PID:2104
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        28⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        29⤵
        Executes dropped EXE
        
        PID:4972
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4356
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3612
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        32⤵
        Executes dropped EXE
        
        PID:1392
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:908
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        34⤵
        Executes dropped EXE
        
        PID:3092
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        35⤵
        Executes dropped EXE
        
        PID:2292
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        36⤵
        Executes dropped EXE
        
        PID:2436
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1240
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        38⤵
        Executes dropped EXE
        
        PID:1452
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        39⤵
        Executes dropped EXE
        
        PID:1220
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        40⤵
        Executes dropped EXE
        
        PID:1136
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        41⤵
        Executes dropped EXE
        
        PID:1064
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        42⤵
        Executes dropped EXE
        
        PID:4420
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4016
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        44⤵
        Executes dropped EXE
        
        PID:1924
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        45⤵
        Executes dropped EXE
        
        PID:3596
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        46⤵
        Executes dropped EXE
        
        PID:2120
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        47⤵
        Executes dropped EXE
        
        PID:3452
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        48⤵
        Executes dropped EXE
        
        PID:2608
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4612
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3588
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        51⤵
        Executes dropped EXE
        
        PID:4528
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5052
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        53⤵
        Executes dropped EXE
        
        PID:2908
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        54⤵
        Executes dropped EXE
        
        PID:1004
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        55⤵
        Executes dropped EXE
        
        PID:1476
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4768
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        57⤵
        Executes dropped EXE
        
        PID:4348
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        58⤵
        Executes dropped EXE
        
        PID:4152
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        59⤵
        Executes dropped EXE
        
        PID:2304
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        60⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        61⤵
        Executes dropped EXE
        
        PID:5028
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        62⤵
        Executes dropped EXE
        
        PID:864
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4900
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        64⤵
        Executes dropped EXE
        
        PID:3352
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        65⤵
        Executes dropped EXE
        
        PID:3484
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        66⤵
        Modifies registry class
        
        PID:4496
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        67⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        68⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4940
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        70⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        71⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        72⤵
        Modifies registry class
        
        PID:4552
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        73⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1636
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        75⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        76⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        77⤵
        Drops file in System32 directory
        
        PID:2564
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        78⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        79⤵
        Modifies registry class
        
        PID:4616
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        80⤵
        
        PID:932
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        81⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        82⤵
        Drops file in System32 directory
        
        PID:5180
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        83⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        84⤵
        Drops file in System32 directory
        
        PID:5264
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        85⤵
        Drops file in System32 directory
        
        PID:5304
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5352
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        87⤵
        Modifies registry class
        
        PID:5392
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        88⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5484
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5524
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        91⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        92⤵
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        93⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        94⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        95⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        96⤵
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        97⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        98⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        99⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        100⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        101⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        102⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        103⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        104⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        105⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        106⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        107⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        108⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        109⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        110⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        111⤵
        Drops file in System32 directory
        
        PID:5600
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        112⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        113⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5848
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        115⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        116⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        117⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        118⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        119⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        120⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        121⤵
        Drops file in System32 directory
        
        PID:5384
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        122⤵
        Modifies registry class
        
        PID:5496
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        123⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        124⤵
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        125⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        126⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6064
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        128⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        129⤵
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        130⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        131⤵
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        132⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        133⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        134⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        135⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        136⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        137⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        138⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        139⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        140⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        141⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6168
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        143⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        144⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        145⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        146⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        147⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        148⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6476
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        150⤵
        Modifies registry class
        
        PID:6520
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        151⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        152⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6648
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        154⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6736
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        156⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        157⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6860
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        159⤵
        Modifies registry class
        
        PID:6900
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6940
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6984
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        162⤵
        Drops file in System32 directory
        
        PID:7032
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        163⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        164⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        165⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        166⤵
        Modifies registry class
        
        PID:6180
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        167⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        168⤵
        Drops file in System32 directory
        
        PID:6300
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        169⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        170⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        171⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        172⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        173⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        174⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        175⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        176⤵
        Modifies registry class
        
        PID:6844
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6916
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        178⤵
        Modifies registry class
        
        PID:6972
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        179⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        180⤵
        Drops file in System32 directory
        
        PID:7108
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        181⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6252
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        183⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        184⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        185⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        186⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        187⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7020
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        189⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        190⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        191⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        192⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        193⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        194⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        195⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        196⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        197⤵
        Modifies registry class
        
        PID:7060
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        198⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        199⤵
        Drops file in System32 directory
        
        PID:6152
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        200⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        201⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        202⤵
        Modifies registry class
        
        PID:7220
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        203⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        204⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        205⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        206⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        207⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        208⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        209⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        210⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        211⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        212⤵
        Drops file in System32 directory
        
        PID:7652
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        213⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        214⤵
        Modifies registry class
        
        PID:7732
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        215⤵
        Drops file in System32 directory
        
        PID:7776
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        216⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7816
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        217⤵
        Drops file in System32 directory
        
        PID:7856
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7892
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        219⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        220⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        221⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8064
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        223⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        224⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        225⤵
        Modifies registry class
        
        PID:7172
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        226⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        227⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        228⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        229⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7592
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        231⤵
        Drops file in System32 directory
        
        PID:7676
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        232⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        233⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7968
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        235⤵
        Modifies registry class
        
        PID:8032
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        236⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        237⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7380
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        239⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7660
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        241⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        242⤵
        Modifies registry class
        
        PID:7964
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        243⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        244⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7516
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        246⤵
        Drops file in System32 directory
        
        PID:7604
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        247⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        248⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        249⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        250⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        251⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        252⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        253⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        254⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        255⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        256⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        257⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        258⤵
        Modifies registry class
        
        PID:8452
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        259⤵
        Drops file in System32 directory
        
        PID:8504
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        260⤵
        Modifies registry class
        
        PID:8548
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        261⤵
        Drops file in System32 directory
        
        PID:8588
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        262⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        263⤵
        Drops file in System32 directory
        
        PID:8676
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        264⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8764
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8816
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        267⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        268⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8952
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        270⤵
        Drops file in System32 directory
        
        PID:8996
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        271⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        272⤵
        Modifies registry class
        
        PID:9084
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9124
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        274⤵
        Modifies registry class
        
        PID:9160
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        275⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        276⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8280
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        278⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        279⤵
        Modifies registry class
        
        PID:8420
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        280⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        281⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8608
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        283⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        284⤵
        Modifies registry class
        
        PID:8752
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        285⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        286⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        287⤵
        Drops file in System32 directory
        
        PID:8960
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        288⤵
        Modifies registry class
        
        PID:9016
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        289⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        290⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        291⤵
        Drops file in System32 directory
        
        PID:8072
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        292⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        293⤵
        Modifies registry class
        
        PID:8404
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8492
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8600
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        296⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        297⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        298⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        299⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        300⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        301⤵
        Modifies registry class
        
        PID:8216
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        302⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        303⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        304⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        305⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        306⤵
        Drops file in System32 directory
        
        PID:9200
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        307⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        308⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        309⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8916
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        310⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        311⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        312⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        313⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        314⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        315⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        316⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        317⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9388
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        319⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        320⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        321⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        322⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        323⤵
        Drops file in System32 directory
        
        PID:9604
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        324⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        325⤵
        Modifies registry class
        
        PID:9684
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        326⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        327⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        328⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        329⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9948
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        331⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        332⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        333⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        334⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        335⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        336⤵
        Drops file in System32 directory
        
        PID:10192
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        337⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9272
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        339⤵
        Drops file in System32 directory
        
        PID:9360
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        340⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9492
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        342⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        343⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        344⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        345⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        346⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        347⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        348⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        349⤵
        Modifies registry class
        
        PID:10080
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        350⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        351⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9252
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        353⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        354⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        355⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        356⤵
        Modifies registry class
        
        PID:9720
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        357⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        358⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9992
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        359⤵
        Drops file in System32 directory
        
        PID:10112
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        360⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9380
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9612
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        363⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        364⤵
        Modifies registry class
        
        PID:10016
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        365⤵
        Modifies registry class
        
        PID:10144
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        366⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        367⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        368⤵
        Drops file in System32 directory
        
        PID:10064
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        369⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        370⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        371⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        372⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        373⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        374⤵
        Modifies registry class
        
        PID:10328
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        375⤵
        Modifies registry class
        
        PID:10372
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10416
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        377⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        378⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10540
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        380⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        381⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        382⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10656
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        383⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        384⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        385⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        386⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        387⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        388⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        389⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        390⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        391⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        392⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        393⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        394⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        395⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        396⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        397⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10268
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        398⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        399⤵
        Drops file in System32 directory
        
        PID:10400
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        400⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        401⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        402⤵
        Drops file in System32 directory
        
        PID:10616
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        403⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        404⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        405⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        406⤵
        Drops file in System32 directory
        
        PID:10856
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10940
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        408⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11072
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11132
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        411⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11200
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        412⤵
        Drops file in System32 directory
        
        PID:9552
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        413⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        414⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        415⤵
        Drops file in System32 directory
        
        PID:10532
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        416⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        417⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        418⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        419⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        420⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        421⤵
        Drops file in System32 directory
        
        PID:11168
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10276
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        423⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        424⤵
        Drops file in System32 directory
        
        PID:10628
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        425⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        426⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        427⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        428⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        429⤵
        Modifies registry class
        
        PID:10688
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        430⤵
        Drops file in System32 directory
        
        PID:11152
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        431⤵
        Drops file in System32 directory
        
        PID:10752
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        432⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        433⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        434⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        435⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        436⤵
        Drops file in System32 directory
        
        PID:11344
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        437⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        438⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        439⤵
        
        PID:11472
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        440⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11516
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        441⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11600
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        443⤵
        Drops file in System32 directory
        
        PID:11640
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        444⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11732
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        446⤵
        Modifies registry class
        
        PID:11768
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        447⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        448⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11872
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        449⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        450⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        451⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        452⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12076
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        453⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        454⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        455⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        456⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        457⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11332
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        458⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        459⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        460⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        461⤵
        
        PID:11368
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        462⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        463⤵
        
        PID:11776
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        464⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11888
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        465⤵
        Drops file in System32 directory
        
        PID:11952
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        466⤵
        Drops file in System32 directory
        
        PID:12072
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        467⤵
        Modifies registry class
        
        PID:12168
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        468⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        469⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10520
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        470⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        471⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        472⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11828
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        474⤵
        Drops file in System32 directory
        
        PID:11912
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        475⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        476⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        477⤵
        
        PID:11288
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        478⤵
        Drops file in System32 directory
        
        PID:11540
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        479⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 416
        480⤵
        Program crash
        
        PID:12108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2804 -ip 2804
1⤵
PID:11968

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:12168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bahmfj32.exe

Filesize
74KB

MD5
fc17de09ebe3c9dc875dd12bfc42409e

SHA1
775d09bdcfb7fee34b260152a91606b5897eb6c0

SHA256
81e1ea1f627678290506b3f740744d6599ac109982c634d22cd11adc781a997c

SHA512
ac6cbff3bd43c445439ac57b5b41b5ef7c6267a0c11a1791a7e84d3a9682bba7af4c0aec55635aa42709eba877ea6134f1db9aec21b98d127f51096b99ca2a34

Download Submit
C:\Windows\SysWOW64\Bapiabak.exe

Filesize
74KB

MD5
e09a4a44eefe10f4bb03d7cd2c105a29

SHA1
2d1216b8dfc1a50d8ffc93ba59e6f81ae8bf75e9

SHA256
07c33b2296d5d49cc9d2b4836be5961dca9674f17bc16063df61ce997bf29bf3

SHA512
776889f3b216d1a798cf5298441e3771942dce53bdcfc3dfa055b8eb43b377b15666f08ac266f46d9fe286e3b584c111dfb7a53232bd83c56d21542a27565bb8

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
74KB

MD5
12e4a4d6bea5b358d4fe70a620aed72c

SHA1
a9c148df38aa414c4bb21c7d413c337269f21841

SHA256
71f2730407916f6e3f03b5c7637aca1fc972ae5801fb42f9b56a5e59bb5ce8ac

SHA512
01e54dd117b5ada271e1c24113709812ea645bb25b97ad5b672f34f8722aeefbf7dab6a2ab8baef924fa3f4f4b00c70cdeaf4ace9a52750ac93432bdd347a949

Download Submit
C:\Windows\SysWOW64\Cjkjpgfi.exe

Filesize
74KB

MD5
8734a0b780789bd0f77169c941492b50

SHA1
5f73b8be29d91f64e27d96a8f74245817a0bd033

SHA256
4ac3d70bf0d8cee9c9c70996034ee20a7645d33a507f06d0fee439bb6c092eec

SHA512
fe33f8b1f1c61d7576dba7b8f872b7696cd602dce12f639c4813bc27017c36b22543da31b8fd07e292d6e85731f7600cb45901a25abcc1b298404f60d9df3f0b

Download Submit
C:\Windows\SysWOW64\Cndikf32.exe

Filesize
74KB

MD5
46ae7727cdd0a2b8f81869f831f0806d

SHA1
39a0593adb53a7fa334bcdc037405093b5aa852a

SHA256
c89ff90ce9c5e6d5be2b55ba78562e1c196e9f029f737c2344d988c80d5d8ff0

SHA512
c8cf1b9bcebb060e179400ea0251464405bb54447b0ad657b7c7e82e5a4858081a0981325952015b38220163e5f2b8fddaba40b41371ce75c6180bdc5078bc29

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
74KB

MD5
a2c427660fb0100d2a525dcbc34c9597

SHA1
d39fec78bbb05236a76a52cb3c69e6a016fceecc

SHA256
900b56ccd67d3797ce971e9097feedaf00b932ca4e46da728032cf9bfb19b78a

SHA512
2a3bf442569cb8e21000f75826e99771027206f8a360f52876eec4c969af5b9cc530c203cb4eb2b1e743b78e492cca7c2c97065adb9569f348fc530b326c9950

Download Submit
C:\Windows\SysWOW64\Dhhnpjmh.exe

Filesize
74KB

MD5
5ffc2ed3179994d7cd2a57eef26b80fe

SHA1
49bd3ed62039b39701ce2c398b73ddfde35836ae

SHA256
fbbc31d2f0fb663f8bbc702e99da4cfdb449797b25b384886803f45778d13a99

SHA512
e5ab1658d4d41da4f1d0e73b18615ba8a7e7efa12a23b0d54b7c9b27310691b4cd9e8d6785dd6db364f9a1eaf84fa859c0f3b63d50c02c107ec8906111ffe7eb

Download Submit
C:\Windows\SysWOW64\Echmafdm.dll

Filesize
7KB

MD5
cda2e08e7ffe297d05a0fb7d5c10c12e

SHA1
2d595dd67638a08dfebc94dde3a9e61ab3f7f885

SHA256
65b73e427f8909c58bf7bfe5e1b010d8472232e0e02fced1c2f0bdd04086bf5a

SHA512
1b4e8330dadd9d71891d49fee53d9513e78f9f0951ed6c89b45d8cfa5862c457749095cddafafa435421bc962fc0508bdf874916ec34d167180b08e6229d22e6

Download Submit
C:\Windows\SysWOW64\Helfik32.exe

Filesize
74KB

MD5
13647b54366e5711ea6551c30173a91a

SHA1
b4489e3f69f2e9e148109697fa87cc9795d89b7e

SHA256
2e93f6e8c7ab0956664f21c3b95cba070dd31b891113162e9bd48f53dace1dbc

SHA512
3364e87668a94ef4c89010c993e78b2ec49309e59ed582b34764aaad62f2649be7e04a6a1c2c2c62f77ae73dc30cfc793bd8a92deb3c16b51c1cb0f2191336b5

Download Submit
C:\Windows\SysWOW64\Jpnchp32.exe

Filesize
74KB

MD5
16c42ffb46c81306fd8d9d20c47c3919

SHA1
1e0d22bddc938528383306fb316c6ede867a4ec5

SHA256
b8d05be415268acbb2b6a6390e715f8d1bd43dfa4669cfed7491db0fa04759d5

SHA512
2b3f959e2debb91a714b5f1714a26a715ef94c40baec93778b114828235306a306b3b78f738ea5e64215e98a816136b351357a5b51e144ae73c4e9332702ce06

Download Submit
C:\Windows\SysWOW64\Obdkma32.exe

Filesize
74KB

MD5
5494a2d5e668f6236945fd61832d39b6

SHA1
0a46fcb7eb1339abea43d247e360c56435089fd0

SHA256
bdbbc466e5e49a7118e111ac889590b3db5b3061c58de0dde7c632cd97edf35d

SHA512
7b5b2b703a55d42d4801b2a1a70fa432a5f5949459e0d870f636b7b0ae0d37189754d2db6fe142dd70090138dee1f09cf00109c03b8d46b43f6ac751883946cb

Download Submit
C:\Windows\SysWOW64\Ocegdjij.exe

Filesize
74KB

MD5
ddbdaaa9f50c69d0af1811938ca295e3

SHA1
3f84b70a43e4650412e5eb7a22c07961827e34f4

SHA256
a776b746f474b0aa7766653ada010aad6f8bcf04316c26bbee33d75bdc101db2

SHA512
0ed23a218de57717762e27a2e83d7e39fb4ce269aec54a2d397e397a2c58d2592d7c005a879223c8a0ac162d0aca29c94656e8c4b310687acc0a53bab2f26fc0

Download Submit
C:\Windows\SysWOW64\Odnnnnfe.exe

Filesize
74KB

MD5
91f6abf4e1485879a78b6db3977821ca

SHA1
3d9cb92661476ed872e2ab36a6e972d016e819be

SHA256
665343bf6ded67dd3e0b136de57f616d3535342419584fd025cfde859c5aee85

SHA512
0221e90f1403145621ea963f8fb3b7e5930cc4f96e303b3d2ee275fb8b952460e427b226cb41197e3db1486938897dea2cdeca06e11ce46ad108c496a829b6bd

Download Submit
C:\Windows\SysWOW64\Odpjcm32.exe

Filesize
74KB

MD5
368c3c3c3cbc501d1bb88262f2f45f65

SHA1
0c1adaa3fc9e95f79117b347b50ec69f0347bfb4

SHA256
ebaf7f4b1a683e7a6e9f7dec8a31c0169db6ac860168c01dae0c60bdb9aae072

SHA512
d1ea406965c9eccf49e3fe00023b91fea5caabd2f9037bc5bb5bb3a7cc91d1d8d8b14d9570cf40bd3e2d12aaabc3e43112ce9e486f52075d24b3559356bd35e9

Download Submit
C:\Windows\SysWOW64\Ogaceh32.exe

Filesize
74KB

MD5
45197bc40ee76a5de2b989a7619722bd

SHA1
036d2b7ad746fa5510969fb0befd56dac48c77fe

SHA256
2ece6315579c7441e950915743d9be7faf81029e39f7bcf406250170b652e751

SHA512
ee193107655c552103dcf47bea0329e0581b6b4cdb65545660abb6105919bb0e6796d1e469493d6f8c8ce754f5e6f69733721de1cbf1fb1e628bb2936c02630d

Download Submit
C:\Windows\SysWOW64\Ogljjiei.exe

Filesize
74KB

MD5
26f580b7f15b956133fc2023a2e77bf7

SHA1
3875eeb65bdaf7a1ad30654c47cc629ccc62265f

SHA256
7af2bfe248206ef91b4aac3e50dd41e7f5f0d206236a9a1e9e675edb007a0bbe

SHA512
f17f8e1153676be8b5edc6362a69b179ad82a7fc6177bf52a136d825701fde9955ecc088ec76c3a0317cf3ce7f9f71afec5d6f1694a3f42280632ef7ab585ae8

Download Submit
C:\Windows\SysWOW64\Okjbpglo.exe

Filesize
74KB

MD5
40fc504bc3d97552436dcf747fa9b008

SHA1
11e3addfd07fd1daebd321846d46422196bc448b

SHA256
857825b0060ef9228eec4669a00c170ee6741e61b2b934d6fea90ab909b675e2

SHA512
ba9e4b59542104770062d7d0b0727f038d08d197536609f159a95740fd82781c551211813245259af5bfd98b0c89542db0b185400c77152d7fbcbbf5a1b6622c

Download Submit
C:\Windows\SysWOW64\Okolkg32.exe

Filesize
74KB

MD5
bcf7032dfe6fa5a2ea2b9135c933ad76

SHA1
6affa5cec0c1cdcdd4d0c9e366d67d5bffd90365

SHA256
9a85fe73d71c007b56025324e4e5ab67a375127200b116cd33d43e1d3efa53ef

SHA512
51cc476df55fa5cbb78185572b867c5c8c2617caf7017f02f5f2a24550f5eb6bb69194f10f798f6a76d1215cf7eba849ac4c8cd6e07533dee7796dedda09591c

Download Submit
C:\Windows\SysWOW64\Onfbfc32.exe

Filesize
74KB

MD5
90e7806b879e1619f84d4bd312b1e089

SHA1
777a8ecd6f9853ec20e823accd4eaf4fdbbc7d10

SHA256
55ade843115910fc04cda5bc7b970d7c8f2d6de93409c206fdb6873970f958ee

SHA512
289799ab93c4c542b789e09f704201d243de458af5aa835c820cc25a48795d743c9ce5c261c0c946e60ebff039432fb6b7219f733e5453b889bd8b38047d5275

Download Submit
C:\Windows\SysWOW64\Onklabip.exe

Filesize
74KB

MD5
8c4404c5c81fe0516acd7dea3e625f9e

SHA1
9cb36247ee85f35fd5179cc88a2b073ab557a16d

SHA256
e64dad083e150aef190ebfcd2c3ec44fe2c4dd6941385133f92ff32c8e71d591

SHA512
746eb9a9ba18cd002ae5f5da3baeaadf549785d4d0a6bf54584d5f8e9759625614c6e699937a0d8ce1acda8cb2cbefa18f1d6f2d12d40f3c9a6349f169778e76

Download Submit
C:\Windows\SysWOW64\Oqihnn32.exe

Filesize
74KB

MD5
8d74ebc9b195ee7ac195a3956ca21e7e

SHA1
8a1a3e1aa9089f7d40be2819e46146bf3f56599e

SHA256
7d33fc194d99bdc88d8e679a05d13bf0a3850db226c6b3d53d5ce9f537bcf881

SHA512
6f2af6bd08bd838f8cbecf7e509bb55333569d8fb87d5c47556a046fbacc7eeef734e1bf92ee6d7c3f732b46db1733a058ae75911e77291aaddadc5d78c628cc

Download Submit
C:\Windows\SysWOW64\Oqkdcn32.exe

Filesize
74KB

MD5
9e2998df8efbef330ab34d7b9bfe63bf

SHA1
3caed3edfd15a5b88298fe26e364c312eebdb58a

SHA256
bcef0c355de1fc9bb8c4f17e41bb861c61cb3f522ce5f864f391f24938878d2d

SHA512
a302ba9648afee3780b81174a12be3aece652c32d177d7d556ab8d0b1328ad04c1359347c90141efa97a54ad671ad862396ca6823888fdeb04c9f13897bcd343

Download Submit
C:\Windows\SysWOW64\Paegjl32.exe

Filesize
74KB

MD5
b2200159b909cb547170319dddabeb63

SHA1
41fce25ace348d6d8e3a1dca67bc1489003daebd

SHA256
612c918b6a6cf429145b72dcca5df747fd9101eac5740f718d88df999b583303

SHA512
ee357747d741b3e18b711bbdcfd59b15b0647ad389bee7900ef6dfa77a65be1907ac547a5aaa8a16bc7ee500857c25e818bea2cc99793d1b650112fab8f3c079

Download Submit
C:\Windows\SysWOW64\Pbpjhp32.exe

Filesize
74KB

MD5
7a198944f3c91a48f49b7c66b2a0a6ab

SHA1
b2fc54a61510c28e63059f1847be6eeaa48d9dea

SHA256
6b5599980510776e6d8c253a3780d0cc522bac506d08cebd881b41ccde425269

SHA512
1a8e773e1bc7883977b450ce9dcb694778300e721c47d2f0a52ed5146ec473a53bcbf487c27e300e5123d82fd12405a9614f7df042ddf88e1963250ce4f5c409

Download Submit
C:\Windows\SysWOW64\Pbpjhp32.exe

Filesize
68KB

MD5
5c3028c824f8699cbf547bf41d4c6a96

SHA1
e00658ac15f399acde75489b4558dce73672e9bf

SHA256
267f2f52610bc475ecafe3b151dd1312e443446ed0fd574f928c04e738030ddb

SHA512
ce5a2eb1803c42df4d163f92a43ffbc1dcfee70135af923f4af001d214184e2f03630967b192d58fb968577cb7593f403b09bfab212ac2402af552a7129833c6

Download Submit
C:\Windows\SysWOW64\Pcccfh32.exe

Filesize
74KB

MD5
e4d61409e14ee1b0bf51695f81eaad0b

SHA1
f33302abb866001531be0598d8bcf3c458d77f4a

SHA256
b7b9239653508acbeba76a07c4bd29178793b08a8e0daaa92754af72fe1f1aaf

SHA512
2308004c73c5473c2e2f904df8b28657621ccb93b4805b8d1096943786420013511614145b7ac281dd108b8e36b838d376f207d9e431ead4d6aaaf7d6470f457

Download Submit
C:\Windows\SysWOW64\Pcojkhap.exe

Filesize
74KB

MD5
84b9d06c467f3e3cedf8599223c40c17

SHA1
2679d4959d2868513fee4d1f43fd3dc53ba42890

SHA256
37d1502f3e1f60e1eb462a0848aabfc2a13ac0ec8f5314ab43a94831a8a27dc4

SHA512
c137cee70df02825057fd8caf4b9a34c58448b6cba02ea0735551b7531182af4f6118fd1928db9cb8061699f555389d330901958a46818af97a414f22e98d2a0

Download Submit
C:\Windows\SysWOW64\Peimil32.exe

Filesize
74KB

MD5
4b2384227be59c234292190792fadf0a

SHA1
46b070f10e753ffe9526f75ee22db371805b82d3

SHA256
6335bb12e9364ab2cddf7dd378c179cef3af4aa0101e49c34da1ad03ff6d303c

SHA512
031d671d19b54efc4bb27e1dad2fb65532194c44967bc64e7c76f7779b93afb57717c0ace4e91353ee67cf109039fde763ff327a3cc73b8c3674b79a07a64df0

Download Submit
C:\Windows\SysWOW64\Pengdk32.exe

Filesize
43KB

MD5
b07246d6aeab529009dd7fd3cf86372e

SHA1
0a9decc5f0d3988191aef6c554310181a35c4e95

SHA256
325c07c12062fa6b4af10c55e6213d0186918099a46396085b29f150a4017187

SHA512
499b618e17b8b20f121afcdbef1c9df2007e286dd1d446176dadd833b42c2142dcdb34082154eaac79009f797681af0071d2cd66515417d620226ec8983ca571

Download Submit
C:\Windows\SysWOW64\Pengdk32.exe

Filesize
38KB

MD5
61a8eda649e84560cc2ea6ac20c0be16

SHA1
7dec69e10fe55032569e316f49fab551e724a9a6

SHA256
33dd9a3ba5ee91402e041641314724edd5e148124c2a7833b5e3807e575044f4

SHA512
ef5f54d1f1de875ee062e850e052f170123eda580057e901752f2944ca4ed674e663fdf5e736fae775ff34ad53c9c7e3611fa2b30f5a71891ce935f2afd0ed0f

Download Submit
C:\Windows\SysWOW64\Pgemphmn.exe

Filesize
74KB

MD5
394aee15d6611974e405d8733dcf2448

SHA1
c0b95eb0dc2f293787a30977f2eaa1dbac4d7df2

SHA256
5a209aec86b323541a2ca0ec74949befab23118fa1019285a44fcdcc731d277b

SHA512
ccaabeeadf1c664a44641801c42937c2a65c37f88926dfecbc2e8d872e85ec817454275c5ad026ac4d669e97fc32bd2255c024e6bf47fe2c2a07be8b3934b38f

Download Submit
C:\Windows\SysWOW64\Pghieg32.exe

Filesize
74KB

MD5
d3ea2e6b4014eca2272b59d1543d70d8

SHA1
eb68d389111c19fd06d18d186d21899721934961

SHA256
c2b7a91a06cb9a90ca0c8ac4a87e113cceadfc19a11c7922252b3ab85a6c51ac

SHA512
7b35b209dc2075bedfac6a23acefac4602d6b18b371aa5e34b13fc480f3fc5577d91d8e037503f626499dd11aa9e828baafaa792ca96d81fbb29d1ee41f5ce37

Download Submit
C:\Windows\SysWOW64\Pgmcqggf.exe

Filesize
28KB

MD5
d9b85ae8dda2e6256f37105a84119045

SHA1
5aabbc9e84ab54be05f3b3d657cbd68994eab62f

SHA256
e95fdab3d57dc815f35efdb7f9585f7a88a4f058d3666afd8f76dfb12439b86c

SHA512
ee6cdfe341d80c571579dd7e459e9ff10032fb83f46ffe673d04c36d212fad0c0f7d6b6c08a8469aa4cb0440706190c16923482eeb551237bf498d849054976e

Download Submit
C:\Windows\SysWOW64\Pgmcqggf.exe

Filesize
17KB

MD5
30e8e47ede3db5950f3c9b1cdba5d508

SHA1
40de2dbf7291205194379715375367d033bf8fe0

SHA256
56bc36f6ab6a85ad19b034bc8442d3168e475729fa64dbcc50ce0ce053712775

SHA512
a6ebdb56301bf7ed724f326cde38103ab4194807d7292f661ac9010f3d590a7bc2bd80ce30344b8d35329fc6d6a49cbb2c4afec545ed1fd19262623612468fa3

Download Submit
C:\Windows\SysWOW64\Pjkombfj.exe

Filesize
1KB

MD5
ba661e2169f07416de9f00d29257920c

SHA1
e85cd2cf6adb516b9348263d06cc1db659f0b5d8

SHA256
45bbdf46dda6fa050a01341458fb83d6f5e0c5a4e66d60456821cf4ac9cdec34

SHA512
bc160cbd814f50e3fcc7f2b864da3c576a433af07cd17352b88d2d72af6195ae38809f39a6907260371d13a9e8b1b6e98cfd7a870923b86640997e8f221da18e

Download Submit
C:\Windows\SysWOW64\Pjkombfj.exe

Filesize
15KB

MD5
910e4a9e3cf3424dbc55e1dc30cdef3e

SHA1
bd732412a4376901ece6081f9e6ca0506695b4eb

SHA256
eebaee0ed56621465997076765214e07cec4560a6a7a454265f60a923f6ddb37

SHA512
7da3f42b52227a1552838185babdb52f19c74fcd215fc30647201e2a64a039abfa861777a57512d168f42be90d0005d7d066e1dcf886674bfba81e44f3a54229

Download Submit
C:\Windows\SysWOW64\Pkfblfab.exe

Filesize
74KB

MD5
70187c0c9089bd90c410c201e748f142

SHA1
b9fa7ea775abf28854dc170463aa09a3fe12c4eb

SHA256
66bec66330c13ba24c284a85815ec63f7e9628cb13a262786883a25183446b86

SHA512
698f30f07be3e38af0cde78bc9d015e9b0ae3b0f0b3c847c62266feeaec32ce2b3ab70a178a5ada1104fba7ffddd0617ab5d06d5f9228ea4a741196e7205502b

Download Submit
C:\Windows\SysWOW64\Pkhoae32.exe

Filesize
74KB

MD5
2d04e0591aaa346b03c6c57cfe89f785

SHA1
779a173dc4eff21d1a90d8d0eec8c9db033c681b

SHA256
6505acb01143bdb379c71a85d61b22f157e07cdfa782f48dab7c6e09a25244c8

SHA512
92ca93b7c3011a2a74251a96c84d7e60c2c2fecd76899859fc2db4505eb383dcc45aff1b12b77cf23e168d1b56c155aa4a88928c425b28cd524d057c03c34755

Download Submit
C:\Windows\SysWOW64\Pkjlge32.exe

Filesize
74KB

MD5
eaa015188b5cbc5bf557906c7201d63c

SHA1
9b99057e35f57f924b4c33f49bce319034863704

SHA256
13458dbedc4dccc5a29976b8ebf2da234c966c03d3010194e3f12ab67b616f58

SHA512
491c748b6384df1710820d1b72b43008b9461672ce77728ddae86f78dec61373131e05bf5e56234a97acfdde54054bad9a71a6b6d88adfe8c55f721878019629

Download Submit
C:\Windows\SysWOW64\Pnbbbabh.exe

Filesize
74KB

MD5
ad53ca70235fc1799dd9ad53d5c79fcf

SHA1
8ea3731023cac4721c3ca4afb6762619919b73e8

SHA256
37ecb86967fc1854c2d67e1d661bc60630fb412e9884ed308f9d1ec6e60b8ba2

SHA512
94a7faa8ab722910bbe016cde7ace6256ade800ab6966f7e59249540553ce8107cb253f5e9f4ffe4b11b76f54a66d5c4fcf724b79310f94dba6be736bfde8975

Download Submit
C:\Windows\SysWOW64\Pnihcq32.exe

Filesize
74KB

MD5
a2fda15a68dd64eb2519563d25c801c7

SHA1
2e65e542f82ab03718176faa23eb8240bcc3fbc6

SHA256
2cb19f7505f9e774da4dc829d5862e04f6aef647b73166dc378b1b04a99dd012

SHA512
49ddebeb78f874155420286dfad821596b7f072bdb7690d5e41d03a8a303c94acbf3cb2efcc37f615a54d28e2f32825857df05e207a7fafdc28c9997414f8077

Download Submit
C:\Windows\SysWOW64\Pnpemb32.exe

Filesize
74KB

MD5
2f04352dad6866ce3bcd101ad1e4b670

SHA1
b07c99a24ef3f508b809bed3955901c568b0c742

SHA256
2d29c084fa8b478f12bb768c3151eb1a68ec7c26af6140e0cbcad3dfaaf2fdd6

SHA512
0a2a8b5393dc618c7655231bd2d7ef19ed66f2c8577a89d29744d842b34ef515a478e4ac42e8e6141ee28cc135812dd21be0f4b48137ca42a9e08540e489cec0

Download Submit
C:\Windows\SysWOW64\Pqpnombl.exe

Filesize
74KB

MD5
c80bb11fc9e229dbdf2dfca2a8c141c9

SHA1
a8303005181852c2a58af3db3e67a2535b062add

SHA256
27b8d52619635af9b9dff0c9d26e325f874cb81232e0b9e1bdd1b9a8ca9f3668

SHA512
a702f90a842f0b0b2634b586812e89cd93826acaf8c4792b6426e6fbf2d7c399c73b7bb502cdc0f121ab42f6eb559839ddbb8326e364b92a9b383de5634ef037

Download Submit
C:\Windows\SysWOW64\Qbgqio32.exe

Filesize
74KB

MD5
02a8725d2083bc52f9a6e28dab8b03a7

SHA1
4085a8ae927c058d2ffd5d72ade3a33fc3f1e85c

SHA256
6820683796d9a18a1119383a1b82a6356b9cd8fe5d5f49f26e0cd818fc21bb58

SHA512
8321ff5d18704634b9b7e20cbfeee493c963c36cb73f8a9200934eb4fa7560fc83eb21e15e8cc87d5cde0927c28a21e31c147140c3332d52a5e4061db78136e7

Download Submit
C:\Windows\SysWOW64\Qecppkdm.exe

Filesize
74KB

MD5
0e63fb956c97dc408ad3631f923675d0

SHA1
f6d2a2fe8cb15c588e4d0bf44d1c1dda5bf7e809

SHA256
daf6636517f241bb1715ba5b9a780dd8b681e37e035744b1165466c1926d43ba

SHA512
249382233f851cef5d3cc661c571ba07057c9350c4fd2fe0d54b4d59a82466832888daaac1f9e9fb95ec6e93b7a1c0bfc176d9abba9f47659a1075e47f8df45d

Download Submit
C:\Windows\SysWOW64\Qgallfcq.exe

Filesize
74KB

MD5
7e105d036c6908df50c72bb074d90108

SHA1
86c398a4a781f47fbaf73ddb5dc25d04673f01a4

SHA256
af763205080bf96f3214b48a9ff153d7fc384b59406f09e5dcd669c8c8311b6a

SHA512
05ea01e5329cac8275e740b4290e4ef1ba069ed78851787775e5eca5c598c24b3b74f82b7849ae5d2be0127cf826807ac76cd1e7de92058481b684b921d24f9f

Download Submit
C:\Windows\SysWOW64\Qkmhlekj.exe

Filesize
74KB

MD5
5015771b1d89153e271d47831b94f2d5

SHA1
cab467243d4436fcea1638c127cdcc1a29d881be

SHA256
d99df2639829aadc21b54e54d5e4c80531520f72b6889c80273e931ce12df7bc

SHA512
2a705dd201258fc2c9c93fbf882788c9fc7e4b03c86414c232ea38fa044555dc6d8f3281f8077cec882e256de2f6acef0fa2872e4adaab728d14de4997f7eacf

Download Submit
memory/464-127-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/672-184-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/864-434-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/908-256-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1004-382-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1064-308-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1136-298-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1144-198-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1220-296-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1240-280-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1364-168-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1392-248-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1420-12-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1452-286-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1476-392-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1924-326-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1940-112-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1944-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2104-212-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2120-334-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2224-56-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2292-268-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2304-417-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2332-152-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2436-274-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2608-346-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2632-136-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2780-52-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2832-164-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2908-380-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2916-120-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3092-262-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3352-442-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3452-344-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3532-71-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3540-103-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3588-358-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3596-332-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3612-240-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3636-179-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3968-32-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4016-316-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4084-200-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4152-406-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4340-88-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4348-400-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4356-232-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4420-310-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4528-364-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4548-422-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4608-96-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4612-356-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4644-23-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4700-77-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4768-394-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4776-216-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4824-16-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4868-143-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4900-436-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4972-224-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5000-84-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5028-427-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5052-375-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5096-40-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads