9249336d6e94ef438b78946e5d06d35b05972d7737d078cc3c09bb6aead1581c

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9249336d6e94ef438b78946e5d06d35b05972d7737d078cc3c09bb6aead1581c.exe
Size 224KB
Sample240326-2afwlsgh7w
SHA256 9249336d6e94ef438b78946e5d06d35b05972d7737d078cc3c09bb6aead1581c
MD5 0a5ada8c2244d20ffc3334f9567454e1
SHA1 d7e5fccbd9620f45f0ec3144414dacdcfa6e88b8
SHA512 bb068f53517cf35d97fbb2c17704603e7e09d0c29ee3cbf60cb8d0b30e341dceb4100e248aa105f0339b5672b52eaefd37bb5eea728b346671bd44bf85553710
SSDEEP 3072:zty7cLLIobVoZedIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgt:ASfbGZe74s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkoemhao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndfanlpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgoigcip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfehpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dolmodpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enhpao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pafkgphl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mohbjkgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnmebblf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbbeml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edlann32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Elaobdmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iacngdgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmhijd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edihdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkalbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Johggfha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecgodpgb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjcmpepm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfpqap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbagbebm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofgdcipq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifihdi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnaffdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfaigclq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gglpgd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmnnlk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ileflmpb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jihbip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejiiippb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjmekgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlcmgqdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnckooob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdaqhf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iacngdgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfniikha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phkaqqoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgfmeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Deagoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ioppho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gojgkl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elaobdmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llpchaqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngifef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfehpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djmima32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeolckne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhekaejj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cegnol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkcdfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbgbnkfm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhmgfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfjjpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Babcil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggdbmoho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgmebnpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clbmfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dilmeida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apeknk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gqnejaff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbncbpqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmkeekag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gimoce32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfagighf.exe

Executes dropped EXE 64 IoCs

pid	Process
5396	Baegibae.exe
4532	Bkphhgfc.exe
1796	Coqncejg.exe
5948	Chkobkod.exe
5880	Cgqlcg32.exe
5824	Dgcihgaj.exe
5560	Dolmodpi.exe
3732	Dqpfmlce.exe
5532	Dbocfo32.exe
4528	Doccpcja.exe
5876	Enhpao32.exe
5804	Enkmfolf.exe
4036	Eojiqb32.exe
2160	Ekajec32.exe
2164	Eghkjdoa.exe
3752	Fdlkdhnk.exe
888	Fbplml32.exe
2052	Feqeog32.exe
2640	Fgoakc32.exe
5184	Fbgbnkfm.exe
3872	Gnnccl32.exe
3748	Ggfglb32.exe
2912	Gpolbo32.exe
2192	Gndick32.exe
5180	Ggmmlamj.exe
1864	Hahokfag.exe
1640	Hnlodjpa.exe
404	Iacngdgj.exe
4108	Iafkld32.exe
5100	Ihbponja.exe
4196	Iialhaad.exe
4376	Ibjqaf32.exe
5424	Jaonbc32.exe
5372	Jihbip32.exe
5324	Jbagbebm.exe
2196	Johggfha.exe
5944	Jeapcq32.exe
4956	Kiphjo32.exe
5520	Kakmna32.exe
3080	Kamjda32.exe
5528	Koajmepf.exe
3460	Khiofk32.exe
1380	Kofdhd32.exe
5256	Lhnhajba.exe
6064	Lafmjp32.exe
4012	Lpjjmg32.exe
5540	Legben32.exe
4352	Lplfcf32.exe
2208	Llcghg32.exe
4716	Mapppn32.exe
1540	Mlhqcgnk.exe
3744	Mbdiknlb.exe
3604	Mpeiie32.exe
2932	Mhanngbl.exe
4444	Mcfbkpab.exe
2204	Mlofcf32.exe
5160	Nblolm32.exe
4964	Nmaciefp.exe
3192	Njedbjej.exe
2484	Nqoloc32.exe
3596	Nqaiecjd.exe
5380	Nbbeml32.exe
4408	Nmhijd32.exe
4640	Niojoeel.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gdgdeppb.exe	Gjaphgpl.exe
File created	C:\Windows\SysWOW64\Ngifef32.exe	Namnmp32.exe
File created	C:\Windows\SysWOW64\Gllajf32.exe	Ggoiap32.exe
File opened for modification	C:\Windows\SysWOW64\Enkmfolf.exe	Enhpao32.exe
File created	C:\Windows\SysWOW64\Fbkcnp32.dll	Khfkfedn.exe
File opened for modification	C:\Windows\SysWOW64\Ciefek32.exe	Cnpbgajc.exe
File opened for modification	C:\Windows\SysWOW64\Ceehcc32.exe	Cnlpgibd.exe
File opened for modification	C:\Windows\SysWOW64\Paomog32.exe	Pgihanii.exe
File opened for modification	C:\Windows\SysWOW64\Aohfdnil.exe	Aecbge32.exe
File opened for modification	C:\Windows\SysWOW64\Hkaqgjme.exe	Hojpbigq.exe
File created	C:\Windows\SysWOW64\Oiikeffm.dll	Dolmodpi.exe
File opened for modification	C:\Windows\SysWOW64\Khiofk32.exe	Koajmepf.exe
File created	C:\Windows\SysWOW64\Likndk32.dll	Ngifef32.exe
File opened for modification	C:\Windows\SysWOW64\Koajmepf.exe	Kamjda32.exe
File created	C:\Windows\SysWOW64\Mcfbkpab.exe	Mhanngbl.exe
File created	C:\Windows\SysWOW64\Cifiamoa.dll	Mohbjkgp.exe
File opened for modification	C:\Windows\SysWOW64\Gglpgd32.exe	Gnckooob.exe
File created	C:\Windows\SysWOW64\Elkbhbeb.exe	Eaenkj32.exe
File opened for modification	C:\Windows\SysWOW64\Jhjcbljf.exe	Jbpkfa32.exe
File created	C:\Windows\SysWOW64\Oiccje32.exe	Ocgkan32.exe
File created	C:\Windows\SysWOW64\Lfpiamoj.dll	Ebnddn32.exe
File created	C:\Windows\SysWOW64\Qcncodki.exe	Qihoak32.exe
File opened for modification	C:\Windows\SysWOW64\Fgkfqgce.exe	Fpandm32.exe
File created	C:\Windows\SysWOW64\Aeflknmj.dll	Jjcqffkm.exe
File created	C:\Windows\SysWOW64\Ddmlgm32.dll	Bjcmpepm.exe
File created	C:\Windows\SysWOW64\Khjeei32.dll	Gkqhpmkg.exe
File created	C:\Windows\SysWOW64\Cnokmj32.dll	Mlofcf32.exe
File created	C:\Windows\SysWOW64\Glkkmjeh.dll	Edihdb32.exe
File opened for modification	C:\Windows\SysWOW64\Gggfme32.exe	Gnoacp32.exe
File opened for modification	C:\Windows\SysWOW64\Hpaqqdjj.exe	Geklckkd.exe
File opened for modification	C:\Windows\SysWOW64\Kcbkpj32.exe	Kmhccpci.exe
File opened for modification	C:\Windows\SysWOW64\Jjpmfpid.exe	Jcfejfag.exe
File created	C:\Windows\SysWOW64\Mbdiknlb.exe	Mlhqcgnk.exe
File created	C:\Windows\SysWOW64\Mdghhb32.exe	Mkocol32.exe
File created	C:\Windows\SysWOW64\Leffdi32.dll	Agnkck32.exe
File created	C:\Windows\SysWOW64\Phfmod32.dll	Ikejbjip.exe
File opened for modification	C:\Windows\SysWOW64\Jbkbkbfo.exe	Jkajnh32.exe
File created	C:\Windows\SysWOW64\Fghcqq32.exe	Fpnkdfko.exe
File created	C:\Windows\SysWOW64\Qdflaa32.exe	Pddokabk.exe
File opened for modification	C:\Windows\SysWOW64\Kmbfiokn.exe	Kgemahmg.exe
File created	C:\Windows\SysWOW64\Eakcie32.dll	Eecfah32.exe
File created	C:\Windows\SysWOW64\Gelfeh32.dll	Cgqlcg32.exe
File opened for modification	C:\Windows\SysWOW64\Hjabdo32.exe	Hddilh32.exe
File opened for modification	C:\Windows\SysWOW64\Jbnopbdl.exe	Joobdfei.exe
File opened for modification	C:\Windows\SysWOW64\Ajdbac32.exe	Aalmimfd.exe
File opened for modification	C:\Windows\SysWOW64\Inagpm32.exe	Hqmggi32.exe
File created	C:\Windows\SysWOW64\Ojnfihmo.exe	Niojoeel.exe
File created	C:\Windows\SysWOW64\Nkhlin32.dll	Gggfme32.exe
File created	C:\Windows\SysWOW64\Pgeogb32.exe	Pnmjomlg.exe
File opened for modification	C:\Windows\SysWOW64\Dehgejep.exe	Djbbhafj.exe
File opened for modification	C:\Windows\SysWOW64\Kjcccm32.exe	Kkabefqp.exe
File created	C:\Windows\SysWOW64\Eojiqb32.exe	Enkmfolf.exe
File opened for modification	C:\Windows\SysWOW64\Hnpaec32.exe	Halaloif.exe
File created	C:\Windows\SysWOW64\Pklkbl32.exe	Pdbbfadn.exe
File opened for modification	C:\Windows\SysWOW64\Ieqpbm32.exe	Ibbcfa32.exe
File created	C:\Windows\SysWOW64\Qpmmfbfl.exe	Qkqdnkge.exe
File created	C:\Windows\SysWOW64\Ianfdf32.dll	Lmfodn32.exe
File opened for modification	C:\Windows\SysWOW64\Fblpflfg.exe	Flbhia32.exe
File created	C:\Windows\SysWOW64\Niojoeel.exe	Nmhijd32.exe
File created	C:\Windows\SysWOW64\Pmjhlklg.exe	Pfppoa32.exe
File opened for modification	C:\Windows\SysWOW64\Lhbkac32.exe	Lojfin32.exe
File opened for modification	C:\Windows\SysWOW64\Bikeni32.exe	Bbalaoda.exe
File created	C:\Windows\SysWOW64\Oejcki32.dll	Oafacn32.exe
File created	C:\Windows\SysWOW64\Qnpgdmjd.exe	Pgeogb32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6512	6464	WerFault.exe	729

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eahobg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlidpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kaioidkh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dinjjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iiceol32.dll"	Epjhcnbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Flhoinbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpeidj32.dll"	Gglpgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pafkgphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Japjfm32.dll"	Khdoqefq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cibkohef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aeeomegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lfodmdni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omlkmign.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kilphk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Docpdpol.dll"	Jnmglk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nefmgogl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okcncdkp.dll"	Nhkpdi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	9249336d6e94ef438b78946e5d06d35b05972d7737d078cc3c09bb6aead1581c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jihbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjcol32.dll"	Lkiiee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkbgjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdaleh32.dll"	Eaceghcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gcngafol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbnjicfj.dll"	Ahngmnnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijkdkq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjhfif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qihoak32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cblebgfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfmpaf32.dll"	Oophlo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Celhnb32.dll"	Fdbkja32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Inagpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lbnggpfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojemig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jeolckne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjqinamq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nopkoobi.dll"	Deejpjgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncbegn32.dll"	Lplfcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjabdo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Paomog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfcinq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iialhaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fiplni32.dll"	Ccppmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmmppdij.dll"	Qcncodki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgemahmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omgabj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddmlgm32.dll"	Bjcmpepm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phfmod32.dll"	Ikejbjip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdlkdhnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihbponja.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kiphjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfhmjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kigmon32.dll"	Midoph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Baegibae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dalofi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohkijc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Poagma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Blkgen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpklql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hembndee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlhqcgnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqaiecjd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cemeoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndmpddfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lenjfn32.dll"	Ijkdkq32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 5396	3204	9249336d6e94ef438b78946e5d06d35b05972d7737d078cc3c09bb6aead1581c.exe	96
PID 3204 wrote to memory of 5396	3204	9249336d6e94ef438b78946e5d06d35b05972d7737d078cc3c09bb6aead1581c.exe	96
PID 3204 wrote to memory of 5396	3204	9249336d6e94ef438b78946e5d06d35b05972d7737d078cc3c09bb6aead1581c.exe	96
PID 5396 wrote to memory of 4532	5396	Baegibae.exe	97
PID 5396 wrote to memory of 4532	5396	Baegibae.exe	97
PID 5396 wrote to memory of 4532	5396	Baegibae.exe	97
PID 4532 wrote to memory of 1796	4532	Bkphhgfc.exe	98
PID 4532 wrote to memory of 1796	4532	Bkphhgfc.exe	98
PID 4532 wrote to memory of 1796	4532	Bkphhgfc.exe	98
PID 1796 wrote to memory of 5948	1796	Coqncejg.exe	99
PID 1796 wrote to memory of 5948	1796	Coqncejg.exe	99
PID 1796 wrote to memory of 5948	1796	Coqncejg.exe	99
PID 5948 wrote to memory of 5880	5948	Chkobkod.exe	101
PID 5948 wrote to memory of 5880	5948	Chkobkod.exe	101
PID 5948 wrote to memory of 5880	5948	Chkobkod.exe	101
PID 5880 wrote to memory of 5824	5880	Cgqlcg32.exe	102
PID 5880 wrote to memory of 5824	5880	Cgqlcg32.exe	102
PID 5880 wrote to memory of 5824	5880	Cgqlcg32.exe	102
PID 5824 wrote to memory of 5560	5824	Dgcihgaj.exe	103
PID 5824 wrote to memory of 5560	5824	Dgcihgaj.exe	103
PID 5824 wrote to memory of 5560	5824	Dgcihgaj.exe	103
PID 5560 wrote to memory of 3732	5560	Dolmodpi.exe	104
PID 5560 wrote to memory of 3732	5560	Dolmodpi.exe	104
PID 5560 wrote to memory of 3732	5560	Dolmodpi.exe	104
PID 3732 wrote to memory of 5532	3732	Dqpfmlce.exe	105
PID 3732 wrote to memory of 5532	3732	Dqpfmlce.exe	105
PID 3732 wrote to memory of 5532	3732	Dqpfmlce.exe	105
PID 5532 wrote to memory of 4528	5532	Dbocfo32.exe	106
PID 5532 wrote to memory of 4528	5532	Dbocfo32.exe	106
PID 5532 wrote to memory of 4528	5532	Dbocfo32.exe	106
PID 4528 wrote to memory of 5876	4528	Doccpcja.exe	107
PID 4528 wrote to memory of 5876	4528	Doccpcja.exe	107
PID 4528 wrote to memory of 5876	4528	Doccpcja.exe	107
PID 5876 wrote to memory of 5804	5876	Enhpao32.exe	108
PID 5876 wrote to memory of 5804	5876	Enhpao32.exe	108
PID 5876 wrote to memory of 5804	5876	Enhpao32.exe	108
PID 5804 wrote to memory of 4036	5804	Enkmfolf.exe	109
PID 5804 wrote to memory of 4036	5804	Enkmfolf.exe	109
PID 5804 wrote to memory of 4036	5804	Enkmfolf.exe	109
PID 4036 wrote to memory of 2160	4036	Eojiqb32.exe	110
PID 4036 wrote to memory of 2160	4036	Eojiqb32.exe	110
PID 4036 wrote to memory of 2160	4036	Eojiqb32.exe	110
PID 2160 wrote to memory of 2164	2160	Ekajec32.exe	111
PID 2160 wrote to memory of 2164	2160	Ekajec32.exe	111
PID 2160 wrote to memory of 2164	2160	Ekajec32.exe	111
PID 2164 wrote to memory of 3752	2164	Eghkjdoa.exe	112
PID 2164 wrote to memory of 3752	2164	Eghkjdoa.exe	112
PID 2164 wrote to memory of 3752	2164	Eghkjdoa.exe	112
PID 3752 wrote to memory of 888	3752	Fdlkdhnk.exe	113
PID 3752 wrote to memory of 888	3752	Fdlkdhnk.exe	113
PID 3752 wrote to memory of 888	3752	Fdlkdhnk.exe	113
PID 888 wrote to memory of 2052	888	Fbplml32.exe	114
PID 888 wrote to memory of 2052	888	Fbplml32.exe	114
PID 888 wrote to memory of 2052	888	Fbplml32.exe	114
PID 2052 wrote to memory of 2640	2052	Feqeog32.exe	115
PID 2052 wrote to memory of 2640	2052	Feqeog32.exe	115
PID 2052 wrote to memory of 2640	2052	Feqeog32.exe	115
PID 2640 wrote to memory of 5184	2640	Fgoakc32.exe	116
PID 2640 wrote to memory of 5184	2640	Fgoakc32.exe	116
PID 2640 wrote to memory of 5184	2640	Fgoakc32.exe	116
PID 5184 wrote to memory of 3872	5184	Fbgbnkfm.exe	117
PID 5184 wrote to memory of 3872	5184	Fbgbnkfm.exe	117
PID 5184 wrote to memory of 3872	5184	Fbgbnkfm.exe	117
PID 3872 wrote to memory of 3748	3872	Gnnccl32.exe	118

C:\Users\Admin\AppData\Local\Temp\9249336d6e94ef438b78946e5d06d35b05972d7737d078cc3c09bb6aead1581c.exe
"C:\Users\Admin\AppData\Local\Temp\9249336d6e94ef438b78946e5d06d35b05972d7737d078cc3c09bb6aead1581c.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SysWOW64\Baegibae.exe
  C:\Windows\system32\Baegibae.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5396
- - C:\Windows\SysWOW64\Bkphhgfc.exe
    C:\Windows\system32\Bkphhgfc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\SysWOW64\Coqncejg.exe
      C:\Windows\system32\Coqncejg.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1796
    - - C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5948
      - C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5880
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5824
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5560
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5532
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5876
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5804
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4036
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2160
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:888
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5184
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        23⤵
        Executes dropped EXE
        
        PID:3748
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        24⤵
        Executes dropped EXE
        
        PID:2912
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        25⤵
        Executes dropped EXE
        
        PID:2192
        
        C:\Windows\SysWOW64\Ggmmlamj.exe
        
        C:\Windows\system32\Ggmmlamj.exe
        26⤵
        Executes dropped EXE
        
        PID:5180
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        27⤵
        Executes dropped EXE
        
        PID:1864
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        28⤵
        Executes dropped EXE
        
        PID:1640
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:404
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        30⤵
        Executes dropped EXE
        
        PID:4108
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5100
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4196
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        33⤵
        Executes dropped EXE
        
        PID:4376
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        34⤵
        Executes dropped EXE
        
        PID:5424
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5324
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2196
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        38⤵
        Executes dropped EXE
        
        PID:5944
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4956
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        40⤵
        Executes dropped EXE
        
        PID:5520
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3080
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5528
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        43⤵
        Executes dropped EXE
        
        PID:3460
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        44⤵
        Executes dropped EXE
        
        PID:1380
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        45⤵
        Executes dropped EXE
        
        PID:5256
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        46⤵
        Executes dropped EXE
        
        PID:6064
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        47⤵
        Executes dropped EXE
        
        PID:4012
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        48⤵
        Executes dropped EXE
        
        PID:5540
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4352
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        50⤵
        Executes dropped EXE
        
        PID:2208
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        51⤵
        Executes dropped EXE
        
        PID:4716
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1540
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        53⤵
        Executes dropped EXE
        
        PID:3744
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        54⤵
        Executes dropped EXE
        
        PID:3604
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2932
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        56⤵
        Executes dropped EXE
        
        PID:4444
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2204
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        58⤵
        Executes dropped EXE
        
        PID:5160
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        59⤵
        Executes dropped EXE
        
        PID:4964
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        60⤵
        Executes dropped EXE
        
        PID:3192
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        61⤵
        Executes dropped EXE
        
        PID:2484
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3596
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5380
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4408
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4640
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        66⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        67⤵
        Drops file in System32 directory
        
        PID:4020
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        68⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4200
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        70⤵
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        71⤵
        Modifies registry class
        
        PID:2964
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        72⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        73⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        74⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        75⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        76⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6140
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6100
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        79⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        80⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        81⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        82⤵
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        83⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5116
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        85⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        86⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2376
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        88⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Aadghn32.exe
        
        C:\Windows\system32\Aadghn32.exe
        89⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\Ajmladbl.exe
        
        C:\Windows\system32\Ajmladbl.exe
        90⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\Adepji32.exe
        
        C:\Windows\system32\Adepji32.exe
        91⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\Aibibp32.exe
        
        C:\Windows\system32\Aibibp32.exe
        92⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        93⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        94⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Aalmimfd.exe
        
        C:\Windows\system32\Aalmimfd.exe
        95⤵
        Drops file in System32 directory
        
        PID:4952
        
        C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        96⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        97⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Babcil32.exe
        
        C:\Windows\system32\Babcil32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5764
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        99⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Bfaigclq.exe
        
        C:\Windows\system32\Bfaigclq.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:864
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        101⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        102⤵
        Modifies registry class
        
        PID:4004
        
        C:\Windows\SysWOW64\Ciihjmcj.exe
        
        C:\Windows\system32\Ciihjmcj.exe
        103⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        104⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Cmgqpkip.exe
        
        C:\Windows\system32\Cmgqpkip.exe
        105⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        106⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2840
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        108⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Dcibca32.exe
        
        C:\Windows\system32\Dcibca32.exe
        109⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Dajbaika.exe
        
        C:\Windows\system32\Dajbaika.exe
        110⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Dkbgjo32.exe
        
        C:\Windows\system32\Dkbgjo32.exe
        111⤵
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Dalofi32.exe
        
        C:\Windows\system32\Dalofi32.exe
        112⤵
        Modifies registry class
        
        PID:6340
        
        C:\Windows\SysWOW64\Dgihop32.exe
        
        C:\Windows\system32\Dgihop32.exe
        113⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Dpalgenf.exe
        
        C:\Windows\system32\Dpalgenf.exe
        114⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Enemaimp.exe
        
        C:\Windows\system32\Enemaimp.exe
        115⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Ecbeip32.exe
        
        C:\Windows\system32\Ecbeip32.exe
        116⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Eaceghcg.exe
        
        C:\Windows\system32\Eaceghcg.exe
        117⤵
        Modifies registry class
        
        PID:6568
        
        C:\Windows\SysWOW64\Ecdbop32.exe
        
        C:\Windows\system32\Ecdbop32.exe
        118⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Ejojljqa.exe
        
        C:\Windows\system32\Ejojljqa.exe
        119⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Ecgodpgb.exe
        
        C:\Windows\system32\Ecgodpgb.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6704
        
        C:\Windows\SysWOW64\Eahobg32.exe
        
        C:\Windows\system32\Eahobg32.exe
        121⤵
        Modifies registry class
        
        PID:6744
        
        C:\Windows\SysWOW64\Egegjn32.exe
        
        C:\Windows\system32\Egegjn32.exe
        122⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Edihdb32.exe
        
        C:\Windows\system32\Edihdb32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6824
        
        C:\Windows\SysWOW64\Famhmfkl.exe
        
        C:\Windows\system32\Famhmfkl.exe
        124⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Fkemfl32.exe
        
        C:\Windows\system32\Fkemfl32.exe
        125⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Fboecfii.exe
        
        C:\Windows\system32\Fboecfii.exe
        126⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        127⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        128⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Fkjfakng.exe
        
        C:\Windows\system32\Fkjfakng.exe
        129⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        130⤵
        Modifies registry class
        
        PID:7128
        
        C:\Windows\SysWOW64\Fklcgk32.exe
        
        C:\Windows\system32\Fklcgk32.exe
        131⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\Fbfkceca.exe
        
        C:\Windows\system32\Fbfkceca.exe
        132⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Gjaphgpl.exe
        
        C:\Windows\system32\Gjaphgpl.exe
        133⤵
        Drops file in System32 directory
        
        PID:6280
        
        C:\Windows\SysWOW64\Gdgdeppb.exe
        
        C:\Windows\system32\Gdgdeppb.exe
        134⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Gkalbj32.exe
        
        C:\Windows\system32\Gkalbj32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6420
        
        C:\Windows\SysWOW64\Gqnejaff.exe
        
        C:\Windows\system32\Gqnejaff.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6512
        
        C:\Windows\SysWOW64\Gjficg32.exe
        
        C:\Windows\system32\Gjficg32.exe
        137⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Gdknpp32.exe
        
        C:\Windows\system32\Gdknpp32.exe
        138⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Gjhfif32.exe
        
        C:\Windows\system32\Gjhfif32.exe
        139⤵
        Modifies registry class
        
        PID:6692
        
        C:\Windows\SysWOW64\Gglfbkin.exe
        
        C:\Windows\system32\Gglfbkin.exe
        140⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Hcedmkmp.exe
        
        C:\Windows\system32\Hcedmkmp.exe
        141⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Hjolie32.exe
        
        C:\Windows\system32\Hjolie32.exe
        142⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Heepfn32.exe
        
        C:\Windows\system32\Heepfn32.exe
        143⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Halaloif.exe
        
        C:\Windows\system32\Halaloif.exe
        144⤵
        Drops file in System32 directory
        
        PID:7040
        
        C:\Windows\SysWOW64\Hnpaec32.exe
        
        C:\Windows\system32\Hnpaec32.exe
        145⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Hcljmj32.exe
        
        C:\Windows\system32\Hcljmj32.exe
        146⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Hnbnjc32.exe
        
        C:\Windows\system32\Hnbnjc32.exe
        147⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Icogcjde.exe
        
        C:\Windows\system32\Icogcjde.exe
        148⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Ilfodgeg.exe
        
        C:\Windows\system32\Ilfodgeg.exe
        149⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Igmoih32.exe
        
        C:\Windows\system32\Igmoih32.exe
        150⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Ibbcfa32.exe
        
        C:\Windows\system32\Ibbcfa32.exe
        151⤵
        Drops file in System32 directory
        
        PID:6668
        
        C:\Windows\SysWOW64\Ieqpbm32.exe
        
        C:\Windows\system32\Ieqpbm32.exe
        152⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Ibdplaho.exe
        
        C:\Windows\system32\Ibdplaho.exe
        153⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Inkaqb32.exe
        
        C:\Windows\system32\Inkaqb32.exe
        154⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Ihceigec.exe
        
        C:\Windows\system32\Ihceigec.exe
        155⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Jbijgp32.exe
        
        C:\Windows\system32\Jbijgp32.exe
        156⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Jdjfohjg.exe
        
        C:\Windows\system32\Jdjfohjg.exe
        157⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Jdmcdhhe.exe
        
        C:\Windows\system32\Jdmcdhhe.exe
        158⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Jbncbpqd.exe
        
        C:\Windows\system32\Jbncbpqd.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6920
        
        C:\Windows\SysWOW64\Jdopjh32.exe
        
        C:\Windows\system32\Jdopjh32.exe
        160⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Jnedgq32.exe
        
        C:\Windows\system32\Jnedgq32.exe
        161⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Jeolckne.exe
        
        C:\Windows\system32\Jeolckne.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6548
        
        C:\Windows\SysWOW64\Jlidpe32.exe
        
        C:\Windows\system32\Jlidpe32.exe
        163⤵
        Modifies registry class
        
        PID:7032
        
        C:\Windows\SysWOW64\Khdoqefq.exe
        
        C:\Windows\system32\Khdoqefq.exe
        164⤵
        Modifies registry class
        
        PID:6336
        
        C:\Windows\SysWOW64\Kbjbnnfg.exe
        
        C:\Windows\system32\Kbjbnnfg.exe
        165⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Khfkfedn.exe
        
        C:\Windows\system32\Khfkfedn.exe
        166⤵
        Drops file in System32 directory
        
        PID:6900
        
        C:\Windows\SysWOW64\Kdmlkfjb.exe
        
        C:\Windows\system32\Kdmlkfjb.exe
        167⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Kocphojh.exe
        
        C:\Windows\system32\Kocphojh.exe
        168⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Kemhei32.exe
        
        C:\Windows\system32\Kemhei32.exe
        169⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Leoejh32.exe
        
        C:\Windows\system32\Leoejh32.exe
        170⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Llimgb32.exe
        
        C:\Windows\system32\Llimgb32.exe
        171⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Laffpi32.exe
        
        C:\Windows\system32\Laffpi32.exe
        172⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Lhpnlclc.exe
        
        C:\Windows\system32\Lhpnlclc.exe
        173⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Lojfin32.exe
        
        C:\Windows\system32\Lojfin32.exe
        174⤵
        Drops file in System32 directory
        
        PID:7428
        
        C:\Windows\SysWOW64\Lhbkac32.exe
        
        C:\Windows\system32\Lhbkac32.exe
        175⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Lolcnman.exe
        
        C:\Windows\system32\Lolcnman.exe
        176⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Llpchaqg.exe
        
        C:\Windows\system32\Llpchaqg.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7568
        
        C:\Windows\SysWOW64\Lehhqg32.exe
        
        C:\Windows\system32\Lehhqg32.exe
        178⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Moalil32.exe
        
        C:\Windows\system32\Moalil32.exe
        179⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Mekdffee.exe
        
        C:\Windows\system32\Mekdffee.exe
        180⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Mlemcq32.exe
        
        C:\Windows\system32\Mlemcq32.exe
        181⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Mhknhabf.exe
        
        C:\Windows\system32\Mhknhabf.exe
        182⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Moefdljc.exe
        
        C:\Windows\system32\Moefdljc.exe
        183⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Mhnjna32.exe
        
        C:\Windows\system32\Mhnjna32.exe
        184⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Mohbjkgp.exe
        
        C:\Windows\system32\Mohbjkgp.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7976
        
        C:\Windows\SysWOW64\Mddkbbfg.exe
        
        C:\Windows\system32\Mddkbbfg.exe
        186⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Mkocol32.exe
        
        C:\Windows\system32\Mkocol32.exe
        187⤵
        Drops file in System32 directory
        
        PID:8088
        
        C:\Windows\SysWOW64\Mdghhb32.exe
        
        C:\Windows\system32\Mdghhb32.exe
        188⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Nkapelka.exe
        
        C:\Windows\system32\Nkapelka.exe
        189⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Nefdbekh.exe
        
        C:\Windows\system32\Nefdbekh.exe
        190⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Nkcmjlio.exe
        
        C:\Windows\system32\Nkcmjlio.exe
        191⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Namegfql.exe
        
        C:\Windows\system32\Namegfql.exe
        192⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Nkeipk32.exe
        
        C:\Windows\system32\Nkeipk32.exe
        193⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Nocbfjmc.exe
        
        C:\Windows\system32\Nocbfjmc.exe
        194⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Nlgbon32.exe
        
        C:\Windows\system32\Nlgbon32.exe
        195⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Nbdkhe32.exe
        
        C:\Windows\system32\Nbdkhe32.exe
        196⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Ocdgahag.exe
        
        C:\Windows\system32\Ocdgahag.exe
        197⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Odedipge.exe
        
        C:\Windows\system32\Odedipge.exe
        198⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Ocfdgg32.exe
        
        C:\Windows\system32\Ocfdgg32.exe
        199⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Oomelheh.exe
        
        C:\Windows\system32\Oomelheh.exe
        200⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Ofgmib32.exe
        
        C:\Windows\system32\Ofgmib32.exe
        201⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Oooaah32.exe
        
        C:\Windows\system32\Oooaah32.exe
        202⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Odljjo32.exe
        
        C:\Windows\system32\Odljjo32.exe
        203⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Obpkcc32.exe
        
        C:\Windows\system32\Obpkcc32.exe
        204⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Pmeoqlpl.exe
        
        C:\Windows\system32\Pmeoqlpl.exe
        205⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Pfncia32.exe
        
        C:\Windows\system32\Pfncia32.exe
        206⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Pmhkflnj.exe
        
        C:\Windows\system32\Pmhkflnj.exe
        207⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Pfppoa32.exe
        
        C:\Windows\system32\Pfppoa32.exe
        208⤵
        Drops file in System32 directory
        
        PID:8000
        
        C:\Windows\SysWOW64\Pmjhlklg.exe
        
        C:\Windows\system32\Pmjhlklg.exe
        209⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Pbgqdb32.exe
        
        C:\Windows\system32\Pbgqdb32.exe
        210⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Pkoemhao.exe
        
        C:\Windows\system32\Pkoemhao.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7380
        
        C:\Windows\SysWOW64\Pbimjb32.exe
        
        C:\Windows\system32\Pbimjb32.exe
        212⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Pcijce32.exe
        
        C:\Windows\system32\Pcijce32.exe
        213⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Qmanljfo.exe
        
        C:\Windows\system32\Qmanljfo.exe
        214⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Qckfid32.exe
        
        C:\Windows\system32\Qckfid32.exe
        215⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Qihoak32.exe
        
        C:\Windows\system32\Qihoak32.exe
        216⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7732
        
        C:\Windows\SysWOW64\Qcncodki.exe
        
        C:\Windows\system32\Qcncodki.exe
        217⤵
        Modifies registry class
        
        PID:8116
        
        C:\Windows\SysWOW64\Aijlgkjq.exe
        
        C:\Windows\system32\Aijlgkjq.exe
        218⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Apddce32.exe
        
        C:\Windows\system32\Apddce32.exe
        219⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Aimhmkgn.exe
        
        C:\Windows\system32\Aimhmkgn.exe
        220⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Apgqie32.exe
        
        C:\Windows\system32\Apgqie32.exe
        221⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Afqifo32.exe
        
        C:\Windows\system32\Afqifo32.exe
        222⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Almanf32.exe
        
        C:\Windows\system32\Almanf32.exe
        223⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Acdioc32.exe
        
        C:\Windows\system32\Acdioc32.exe
        224⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Aiabhj32.exe
        
        C:\Windows\system32\Aiabhj32.exe
        225⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Acgfec32.exe
        
        C:\Windows\system32\Acgfec32.exe
        226⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Aidomjaf.exe
        
        C:\Windows\system32\Aidomjaf.exe
        227⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Apngjd32.exe
        
        C:\Windows\system32\Apngjd32.exe
        228⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Bifkcioc.exe
        
        C:\Windows\system32\Bifkcioc.exe
        229⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Bboplo32.exe
        
        C:\Windows\system32\Bboplo32.exe
        230⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Bmddihfj.exe
        
        C:\Windows\system32\Bmddihfj.exe
        231⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Bbalaoda.exe
        
        C:\Windows\system32\Bbalaoda.exe
        232⤵
        Drops file in System32 directory
        
        PID:8692
        
        C:\Windows\SysWOW64\Bikeni32.exe
        
        C:\Windows\system32\Bikeni32.exe
        233⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Bcpika32.exe
        
        C:\Windows\system32\Bcpika32.exe
        234⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Bpgjpb32.exe
        
        C:\Windows\system32\Bpgjpb32.exe
        235⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Bipnihgi.exe
        
        C:\Windows\system32\Bipnihgi.exe
        236⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Cbhbbn32.exe
        
        C:\Windows\system32\Cbhbbn32.exe
        237⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Cibkohef.exe
        
        C:\Windows\system32\Cibkohef.exe
        238⤵
        Modifies registry class
        
        PID:8936
        
        C:\Windows\SysWOW64\Cffkhl32.exe
        
        C:\Windows\system32\Cffkhl32.exe
        239⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Clbdpc32.exe
        
        C:\Windows\system32\Clbdpc32.exe
        240⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Cfhhml32.exe
        
        C:\Windows\system32\Cfhhml32.exe
        241⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Cmbpjfij.exe
        
        C:\Windows\system32\Cmbpjfij.exe
        242⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Cdlhgpag.exe
        
        C:\Windows\system32\Cdlhgpag.exe
        243⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Cemeoh32.exe
        
        C:\Windows\system32\Cemeoh32.exe
        244⤵
        Modifies registry class
        
        PID:9180
        
        C:\Windows\SysWOW64\Cpcila32.exe
        
        C:\Windows\system32\Cpcila32.exe
        245⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Cfmahknh.exe
        
        C:\Windows\system32\Cfmahknh.exe
        246⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Cmgjee32.exe
        
        C:\Windows\system32\Cmgjee32.exe
        247⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Dbcbnlcl.exe
        
        C:\Windows\system32\Dbcbnlcl.exe
        248⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Dinjjf32.exe
        
        C:\Windows\system32\Dinjjf32.exe
        249⤵
        Modifies registry class
        
        PID:8472
        
        C:\Windows\SysWOW64\Dpgbgpbe.exe
        
        C:\Windows\system32\Dpgbgpbe.exe
        250⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Dmkcpdao.exe
        
        C:\Windows\system32\Dmkcpdao.exe
        251⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Dbhlikpf.exe
        
        C:\Windows\system32\Dbhlikpf.exe
        252⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Dibdeegc.exe
        
        C:\Windows\system32\Dibdeegc.exe
        253⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Dpllbp32.exe
        
        C:\Windows\system32\Dpllbp32.exe
        254⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Deidjf32.exe
        
        C:\Windows\system32\Deidjf32.exe
        255⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Dlcmgqdd.exe
        
        C:\Windows\system32\Dlcmgqdd.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8968
        
        C:\Windows\SysWOW64\Dghadidj.exe
        
        C:\Windows\system32\Dghadidj.exe
        257⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Dmbiackg.exe
        
        C:\Windows\system32\Dmbiackg.exe
        258⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Edlann32.exe
        
        C:\Windows\system32\Edlann32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9160
        
        C:\Windows\SysWOW64\Eennefib.exe
        
        C:\Windows\system32\Eennefib.exe
        260⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Elhfbp32.exe
        
        C:\Windows\system32\Elhfbp32.exe
        261⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Egmjpi32.exe
        
        C:\Windows\system32\Egmjpi32.exe
        262⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Emgblc32.exe
        
        C:\Windows\system32\Emgblc32.exe
        263⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Edakimoo.exe
        
        C:\Windows\system32\Edakimoo.exe
        264⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Eincadmf.exe
        
        C:\Windows\system32\Eincadmf.exe
        265⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Egbdjhlp.exe
        
        C:\Windows\system32\Egbdjhlp.exe
        266⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Epjhcnbp.exe
        
        C:\Windows\system32\Epjhcnbp.exe
        267⤵
        Modifies registry class
        
        PID:9048
        
        C:\Windows\SysWOW64\Eibmlc32.exe
        
        C:\Windows\system32\Eibmlc32.exe
        268⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Fgfmeg32.exe
        
        C:\Windows\system32\Fgfmeg32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8300
        
        C:\Windows\SysWOW64\Flcfnn32.exe
        
        C:\Windows\system32\Flcfnn32.exe
        270⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Fpandm32.exe
        
        C:\Windows\system32\Fpandm32.exe
        271⤵
        Drops file in System32 directory
        
        PID:8676
        
        C:\Windows\SysWOW64\Fgkfqgce.exe
        
        C:\Windows\system32\Fgkfqgce.exe
        272⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Flhoinbl.exe
        
        C:\Windows\system32\Flhoinbl.exe
        273⤵
        Modifies registry class
        
        PID:9012
        
        C:\Windows\SysWOW64\Fjlpbb32.exe
        
        C:\Windows\system32\Fjlpbb32.exe
        274⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Ffcpgcfj.exe
        
        C:\Windows\system32\Ffcpgcfj.exe
        275⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Gddqejni.exe
        
        C:\Windows\system32\Gddqejni.exe
        276⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Gjqinamq.exe
        
        C:\Windows\system32\Gjqinamq.exe
        277⤵
        Modifies registry class
        
        PID:9016
        
        C:\Windows\SysWOW64\Gdfmkjlg.exe
        
        C:\Windows\system32\Gdfmkjlg.exe
        278⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Gnoacp32.exe
        
        C:\Windows\system32\Gnoacp32.exe
        279⤵
        Drops file in System32 directory
        
        PID:9288
        
        C:\Windows\SysWOW64\Gggfme32.exe
        
        C:\Windows\system32\Gggfme32.exe
        280⤵
        Drops file in System32 directory
        
        PID:9352
        
        C:\Windows\SysWOW64\Gcngafol.exe
        
        C:\Windows\system32\Gcngafol.exe
        281⤵
        Modifies registry class
        
        PID:9404
        
        C:\Windows\SysWOW64\Gnckooob.exe
        
        C:\Windows\system32\Gnckooob.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9468
        
        C:\Windows\SysWOW64\Gglpgd32.exe
        
        C:\Windows\system32\Gglpgd32.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9520
        
        C:\Windows\SysWOW64\Hmhhpkcj.exe
        
        C:\Windows\system32\Hmhhpkcj.exe
        284⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Hgnlmdcp.exe
        
        C:\Windows\system32\Hgnlmdcp.exe
        285⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Hmkeekag.exe
        
        C:\Windows\system32\Hmkeekag.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9644
        
        C:\Windows\SysWOW64\Hfcinq32.exe
        
        C:\Windows\system32\Hfcinq32.exe
        287⤵
        Modifies registry class
        
        PID:9684
        
        C:\Windows\SysWOW64\Hddilh32.exe
        
        C:\Windows\system32\Hddilh32.exe
        288⤵
        Drops file in System32 directory
        
        PID:9736
        
        C:\Windows\SysWOW64\Hjabdo32.exe
        
        C:\Windows\system32\Hjabdo32.exe
        289⤵
        Modifies registry class
        
        PID:9780
        
        C:\Windows\SysWOW64\Hdffah32.exe
        
        C:\Windows\system32\Hdffah32.exe
        290⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Hfhbipdb.exe
        
        C:\Windows\system32\Hfhbipdb.exe
        291⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Hqmggi32.exe
        
        C:\Windows\system32\Hqmggi32.exe
        292⤵
        Drops file in System32 directory
        
        PID:9908
        
        C:\Windows\SysWOW64\Inagpm32.exe
        
        C:\Windows\system32\Inagpm32.exe
        293⤵
        Modifies registry class
        
        PID:9952
        
        C:\Windows\SysWOW64\Icnphd32.exe
        
        C:\Windows\system32\Icnphd32.exe
        294⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Incdem32.exe
        
        C:\Windows\system32\Incdem32.exe
        295⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Ijjekn32.exe
        
        C:\Windows\system32\Ijjekn32.exe
        296⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Iqdmghnp.exe
        
        C:\Windows\system32\Iqdmghnp.exe
        297⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Ifaepolg.exe
        
        C:\Windows\system32\Ifaepolg.exe
        298⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Imknli32.exe
        
        C:\Windows\system32\Imknli32.exe
        299⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Igqbiacj.exe
        
        C:\Windows\system32\Igqbiacj.exe
        300⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Inkjfk32.exe
        
        C:\Windows\system32\Inkjfk32.exe
        301⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Icgbob32.exe
        
        C:\Windows\system32\Icgbob32.exe
        302⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Jnmglk32.exe
        
        C:\Windows\system32\Jnmglk32.exe
        303⤵
        Modifies registry class
        
        PID:9400
        
        C:\Windows\SysWOW64\Jcjodbgl.exe
        
        C:\Windows\system32\Jcjodbgl.exe
        304⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Jjdgal32.exe
        
        C:\Windows\system32\Jjdgal32.exe
        305⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Janpnfee.exe
        
        C:\Windows\system32\Janpnfee.exe
        306⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Jjfdfl32.exe
        
        C:\Windows\system32\Jjfdfl32.exe
        307⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Jelhcd32.exe
        
        C:\Windows\system32\Jelhcd32.exe
        308⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Jjhalkjc.exe
        
        C:\Windows\system32\Jjhalkjc.exe
        309⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Jabiie32.exe
        
        C:\Windows\system32\Jabiie32.exe
        310⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Jjknakhq.exe
        
        C:\Windows\system32\Jjknakhq.exe
        311⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Jepbodhg.exe
        
        C:\Windows\system32\Jepbodhg.exe
        312⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Kfanflne.exe
        
        C:\Windows\system32\Kfanflne.exe
        313⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Kmlgcf32.exe
        
        C:\Windows\system32\Kmlgcf32.exe
        314⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Kceoppmo.exe
        
        C:\Windows\system32\Kceoppmo.exe
        315⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Kjpgmj32.exe
        
        C:\Windows\system32\Kjpgmj32.exe
        316⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Kaioidkh.exe
        
        C:\Windows\system32\Kaioidkh.exe
        317⤵
        Modifies registry class
        
        PID:9576
        
        C:\Windows\SysWOW64\Khcgfo32.exe
        
        C:\Windows\system32\Khcgfo32.exe
        318⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\Kmppneal.exe
        
        C:\Windows\system32\Kmppneal.exe
        319⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Kdjhkp32.exe
        
        C:\Windows\system32\Kdjhkp32.exe
        320⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Knpmhh32.exe
        
        C:\Windows\system32\Knpmhh32.exe
        321⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Kejeebpl.exe
        
        C:\Windows\system32\Kejeebpl.exe
        322⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Knbinhfl.exe
        
        C:\Windows\system32\Knbinhfl.exe
        323⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Lfmnbjcg.exe
        
        C:\Windows\system32\Lfmnbjcg.exe
        324⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Mhppik32.exe
        
        C:\Windows\system32\Mhppik32.exe
        325⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Moiheebb.exe
        
        C:\Windows\system32\Moiheebb.exe
        326⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Ndfanlpi.exe
        
        C:\Windows\system32\Ndfanlpi.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10028
        
        C:\Windows\SysWOW64\Nkpijfgf.exe
        
        C:\Windows\system32\Nkpijfgf.exe
        328⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Nefmgogl.exe
        
        C:\Windows\system32\Nefmgogl.exe
        329⤵
        Modifies registry class
        
        PID:5432
        
        C:\Windows\SysWOW64\Nggjog32.exe
        
        C:\Windows\system32\Nggjog32.exe
        330⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Namnmp32.exe
        
        C:\Windows\system32\Namnmp32.exe
        331⤵
        Drops file in System32 directory
        
        PID:9928
        
        C:\Windows\SysWOW64\Ngifef32.exe
        
        C:\Windows\system32\Ngifef32.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9248
        
        C:\Windows\SysWOW64\Nncoaq32.exe
        
        C:\Windows\system32\Nncoaq32.exe
        333⤵
        
        PID:448
        
        C:\Windows\SysWOW64\Nglcjfie.exe
        
        C:\Windows\system32\Nglcjfie.exe
        334⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Naaghoik.exe
        
        C:\Windows\system32\Naaghoik.exe
        335⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Nhkpdi32.exe
        
        C:\Windows\system32\Nhkpdi32.exe
        336⤵
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Ohnljine.exe
        
        C:\Windows\system32\Ohnljine.exe
        337⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Oklifdmi.exe
        
        C:\Windows\system32\Oklifdmi.exe
        338⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Oafacn32.exe
        
        C:\Windows\system32\Oafacn32.exe
        339⤵
        Drops file in System32 directory
        
        PID:10324
        
        C:\Windows\SysWOW64\Ohpiphlb.exe
        
        C:\Windows\system32\Ohpiphlb.exe
        340⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Oojalb32.exe
        
        C:\Windows\system32\Oojalb32.exe
        341⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Odgjdibf.exe
        
        C:\Windows\system32\Odgjdibf.exe
        342⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Oolnabal.exe
        
        C:\Windows\system32\Oolnabal.exe
        343⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Oeffnl32.exe
        
        C:\Windows\system32\Oeffnl32.exe
        344⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Oggbfdog.exe
        
        C:\Windows\system32\Oggbfdog.exe
        345⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Onakco32.exe
        
        C:\Windows\system32\Onakco32.exe
        346⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Ohgopgfj.exe
        
        C:\Windows\system32\Ohgopgfj.exe
        347⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Poagma32.exe
        
        C:\Windows\system32\Poagma32.exe
        348⤵
        Modifies registry class
        
        PID:10728
        
        C:\Windows\SysWOW64\Pdnpeh32.exe
        
        C:\Windows\system32\Pdnpeh32.exe
        349⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Pkhhbbck.exe
        
        C:\Windows\system32\Pkhhbbck.exe
        350⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Pfmlok32.exe
        
        C:\Windows\system32\Pfmlok32.exe
        351⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Pgoigcip.exe
        
        C:\Windows\system32\Pgoigcip.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10892
        
        C:\Windows\SysWOW64\Pnhacn32.exe
        
        C:\Windows\system32\Pnhacn32.exe
        353⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Phneqf32.exe
        
        C:\Windows\system32\Phneqf32.exe
        354⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Pohnnqgo.exe
        
        C:\Windows\system32\Pohnnqgo.exe
        355⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Phpbffnp.exe
        
        C:\Windows\system32\Phpbffnp.exe
        356⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Pnmjomlg.exe
        
        C:\Windows\system32\Pnmjomlg.exe
        357⤵
        Drops file in System32 directory
        
        PID:11116
        
        C:\Windows\SysWOW64\Pgeogb32.exe
        
        C:\Windows\system32\Pgeogb32.exe
        358⤵
        Drops file in System32 directory
        
        PID:11164
        
        C:\Windows\SysWOW64\Qnpgdmjd.exe
        
        C:\Windows\system32\Qnpgdmjd.exe
        359⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Qhekaejj.exe
        
        C:\Windows\system32\Qhekaejj.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11252
        
        C:\Windows\SysWOW64\Qdllffpo.exe
        
        C:\Windows\system32\Qdllffpo.exe
        361⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Ailabddb.exe
        
        C:\Windows\system32\Ailabddb.exe
        362⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Aofjoo32.exe
        
        C:\Windows\system32\Aofjoo32.exe
        363⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Aecbge32.exe
        
        C:\Windows\system32\Aecbge32.exe
        364⤵
        Drops file in System32 directory
        
        PID:10476
        
        C:\Windows\SysWOW64\Aohfdnil.exe
        
        C:\Windows\system32\Aohfdnil.exe
        365⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Aeeomegd.exe
        
        C:\Windows\system32\Aeeomegd.exe
        366⤵
        Modifies registry class
        
        PID:10612
        
        C:\Windows\SysWOW64\Bnppkj32.exe
        
        C:\Windows\system32\Bnppkj32.exe
        367⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Biedhclh.exe
        
        C:\Windows\system32\Biedhclh.exe
        368⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Bpomem32.exe
        
        C:\Windows\system32\Bpomem32.exe
        369⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Bkfmjnii.exe
        
        C:\Windows\system32\Bkfmjnii.exe
        370⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Bpdfpmoo.exe
        
        C:\Windows\system32\Bpdfpmoo.exe
        371⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Bfnnmg32.exe
        
        C:\Windows\system32\Bfnnmg32.exe
        372⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Blkgen32.exe
        
        C:\Windows\system32\Blkgen32.exe
        373⤵
        Modifies registry class
        
        PID:11088
        
        C:\Windows\SysWOW64\Bfpkbfdi.exe
        
        C:\Windows\system32\Bfpkbfdi.exe
        374⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Cgagjo32.exe
        
        C:\Windows\system32\Cgagjo32.exe
        375⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Cnlpgibd.exe
        
        C:\Windows\system32\Cnlpgibd.exe
        376⤵
        Drops file in System32 directory
        
        PID:7412
        
        C:\Windows\SysWOW64\Ceehcc32.exe
        
        C:\Windows\system32\Ceehcc32.exe
        377⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Cpklql32.exe
        
        C:\Windows\system32\Cpklql32.exe
        378⤵
        Modifies registry class
        
        PID:10432
        
        C:\Windows\SysWOW64\Cfedmfqd.exe
        
        C:\Windows\system32\Cfedmfqd.exe
        379⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Clbmfm32.exe
        
        C:\Windows\system32\Clbmfm32.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10664
        
        C:\Windows\SysWOW64\Cblebgfh.exe
        
        C:\Windows\system32\Cblebgfh.exe
        381⤵
        Modifies registry class
        
        PID:10760
        
        C:\Windows\SysWOW64\Cldjkl32.exe
        
        C:\Windows\system32\Cldjkl32.exe
        382⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Cbnbhfde.exe
        
        C:\Windows\system32\Cbnbhfde.exe
        383⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Cihjeq32.exe
        
        C:\Windows\system32\Cihjeq32.exe
        384⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Cbqonf32.exe
        
        C:\Windows\system32\Cbqonf32.exe
        385⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Dhmgfm32.exe
        
        C:\Windows\system32\Dhmgfm32.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7400
        
        C:\Windows\SysWOW64\Dngobghg.exe
        
        C:\Windows\system32\Dngobghg.exe
        387⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Deagoa32.exe
        
        C:\Windows\system32\Deagoa32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10580
        
        C:\Windows\SysWOW64\Dlkplk32.exe
        
        C:\Windows\system32\Dlkplk32.exe
        389⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Dfqdid32.exe
        
        C:\Windows\system32\Dfqdid32.exe
        390⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Dlnlak32.exe
        
        C:\Windows\system32\Dlnlak32.exe
        391⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Defajqko.exe
        
        C:\Windows\system32\Defajqko.exe
        392⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Dpkehi32.exe
        
        C:\Windows\system32\Dpkehi32.exe
        393⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Dehnpp32.exe
        
        C:\Windows\system32\Dehnpp32.exe
        394⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Efhjjcpo.exe
        
        C:\Windows\system32\Efhjjcpo.exe
        395⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Eppobi32.exe
        
        C:\Windows\system32\Eppobi32.exe
        396⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Eemgkpef.exe
        
        C:\Windows\system32\Eemgkpef.exe
        397⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Elgohj32.exe
        
        C:\Windows\system32\Elgohj32.exe
        398⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Eikpan32.exe
        
        C:\Windows\system32\Eikpan32.exe
        399⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Epehnhbj.exe
        
        C:\Windows\system32\Epehnhbj.exe
        400⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Eeaqfo32.exe
        
        C:\Windows\system32\Eeaqfo32.exe
        401⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Ellicihn.exe
        
        C:\Windows\system32\Ellicihn.exe
        402⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Eipilmgh.exe
        
        C:\Windows\system32\Eipilmgh.exe
        403⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Epiaig32.exe
        
        C:\Windows\system32\Epiaig32.exe
        404⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Fhefmjlp.exe
        
        C:\Windows\system32\Fhefmjlp.exe
        405⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Fpnkdfko.exe
        
        C:\Windows\system32\Fpnkdfko.exe
        406⤵
        Drops file in System32 directory
        
        PID:10292
        
        C:\Windows\SysWOW64\Fghcqq32.exe
        
        C:\Windows\system32\Fghcqq32.exe
        407⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Fljedg32.exe
        
        C:\Windows\system32\Fljedg32.exe
        408⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Ggoiap32.exe
        
        C:\Windows\system32\Ggoiap32.exe
        409⤵
        Drops file in System32 directory
        
        PID:11112
        
        C:\Windows\SysWOW64\Gllajf32.exe
        
        C:\Windows\system32\Gllajf32.exe
        410⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Gedfblql.exe
        
        C:\Windows\system32\Gedfblql.exe
        411⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Gpjjpe32.exe
        
        C:\Windows\system32\Gpjjpe32.exe
        412⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Ggdbmoho.exe
        
        C:\Windows\system32\Ggdbmoho.exe
        413⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9656
        
        C:\Windows\SysWOW64\Glqkefff.exe
        
        C:\Windows\system32\Glqkefff.exe
        414⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Gckcap32.exe
        
        C:\Windows\system32\Gckcap32.exe
        415⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Ghgljg32.exe
        
        C:\Windows\system32\Ghgljg32.exe
        416⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Gcmpgpkp.exe
        
        C:\Windows\system32\Gcmpgpkp.exe
        417⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\Geklckkd.exe
        
        C:\Windows\system32\Geklckkd.exe
        418⤵
        Drops file in System32 directory
        
        PID:2104
        
        C:\Windows\SysWOW64\Hpaqqdjj.exe
        
        C:\Windows\system32\Hpaqqdjj.exe
        419⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\Hfniikha.exe
        
        C:\Windows\system32\Hfniikha.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1796
        
        C:\Windows\SysWOW64\Hpcmfchg.exe
        
        C:\Windows\system32\Hpcmfchg.exe
        421⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Hgmebnpd.exe
        
        C:\Windows\system32\Hgmebnpd.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4508
        
        C:\Windows\SysWOW64\Hljnkdnk.exe
        
        C:\Windows\system32\Hljnkdnk.exe
        423⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\Hhaope32.exe
        
        C:\Windows\system32\Hhaope32.exe
        424⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\Hokgmpkl.exe
        
        C:\Windows\system32\Hokgmpkl.exe
        425⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\Hjpkjh32.exe
        
        C:\Windows\system32\Hjpkjh32.exe
        426⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Homcbo32.exe
        
        C:\Windows\system32\Homcbo32.exe
        427⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\Hfgloiqf.exe
        
        C:\Windows\system32\Hfgloiqf.exe
        428⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\Ioppho32.exe
        
        C:\Windows\system32\Ioppho32.exe
        429⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3392
        
        C:\Windows\SysWOW64\Ifihdi32.exe
        
        C:\Windows\system32\Ifihdi32.exe
        430⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3516
        
        C:\Windows\SysWOW64\Imcqacfq.exe
        
        C:\Windows\system32\Imcqacfq.exe
        431⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\Ihjafd32.exe
        
        C:\Windows\system32\Ihjafd32.exe
        432⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Iodjcnca.exe
        
        C:\Windows\system32\Iodjcnca.exe
        433⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Ifnbph32.exe
        
        C:\Windows\system32\Ifnbph32.exe
        434⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\Imhjlb32.exe
        
        C:\Windows\system32\Imhjlb32.exe
        435⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Icbbimih.exe
        
        C:\Windows\system32\Icbbimih.exe
        436⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Ijlkfg32.exe
        
        C:\Windows\system32\Ijlkfg32.exe
        437⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Icdoolge.exe
        
        C:\Windows\system32\Icdoolge.exe
        438⤵
        
        PID:11384
        
        C:\Windows\SysWOW64\Ijngkf32.exe
        
        C:\Windows\system32\Ijngkf32.exe
        439⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Jqhphq32.exe
        
        C:\Windows\system32\Jqhphq32.exe
        440⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\Jfehpg32.exe
        
        C:\Windows\system32\Jfehpg32.exe
        441⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11508
        
        C:\Windows\SysWOW64\Jqklnp32.exe
        
        C:\Windows\system32\Jqklnp32.exe
        442⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Jjcqffkm.exe
        
        C:\Windows\system32\Jjcqffkm.exe
        443⤵
        Drops file in System32 directory
        
        PID:11592
        
        C:\Windows\SysWOW64\Jopiom32.exe
        
        C:\Windows\system32\Jopiom32.exe
        444⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Jjemle32.exe
        
        C:\Windows\system32\Jjemle32.exe
        445⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\Jfokff32.exe
        
        C:\Windows\system32\Jfokff32.exe
        446⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Kmhccpci.exe
        
        C:\Windows\system32\Kmhccpci.exe
        447⤵
        Drops file in System32 directory
        
        PID:11764
        
        C:\Windows\SysWOW64\Kcbkpj32.exe
        
        C:\Windows\system32\Kcbkpj32.exe
        448⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Kiodha32.exe
        
        C:\Windows\system32\Kiodha32.exe
        449⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Kfcdaehf.exe
        
        C:\Windows\system32\Kfcdaehf.exe
        450⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\Kmmmnp32.exe
        
        C:\Windows\system32\Kmmmnp32.exe
        451⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Kfeagefd.exe
        
        C:\Windows\system32\Kfeagefd.exe
        452⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\Kmpido32.exe
        
        C:\Windows\system32\Kmpido32.exe
        453⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Kgemahmg.exe
        
        C:\Windows\system32\Kgemahmg.exe
        454⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12072
        
        C:\Windows\SysWOW64\Kmbfiokn.exe
        
        C:\Windows\system32\Kmbfiokn.exe
        455⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Kppbejka.exe
        
        C:\Windows\system32\Kppbejka.exe
        456⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Liifnp32.exe
        
        C:\Windows\system32\Liifnp32.exe
        457⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Lfmghdpl.exe
        
        C:\Windows\system32\Lfmghdpl.exe
        458⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\Lmfodn32.exe
        
        C:\Windows\system32\Lmfodn32.exe
        459⤵
        Drops file in System32 directory
        
        PID:9748
        
        C:\Windows\SysWOW64\Lfodmdni.exe
        
        C:\Windows\system32\Lfodmdni.exe
        460⤵
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Ladhkmno.exe
        
        C:\Windows\system32\Ladhkmno.exe
        461⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Lhopgg32.exe
        
        C:\Windows\system32\Lhopgg32.exe
        462⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Lcealh32.exe
        
        C:\Windows\system32\Lcealh32.exe
        463⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Lplaaiqd.exe
        
        C:\Windows\system32\Lplaaiqd.exe
        464⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Mmpbkm32.exe
        
        C:\Windows\system32\Mmpbkm32.exe
        465⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\Mdlgmgdh.exe
        
        C:\Windows\system32\Mdlgmgdh.exe
        466⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\Mjiloqjb.exe
        
        C:\Windows\system32\Mjiloqjb.exe
        467⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\Mdaqhf32.exe
        
        C:\Windows\system32\Mdaqhf32.exe
        468⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11680
        
        C:\Windows\SysWOW64\Mmiealgc.exe
        
        C:\Windows\system32\Mmiealgc.exe
        469⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Mdcmnfop.exe
        
        C:\Windows\system32\Mdcmnfop.exe
        470⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Npjnbg32.exe
        
        C:\Windows\system32\Npjnbg32.exe
        471⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\Nmnnlk32.exe
        
        C:\Windows\system32\Nmnnlk32.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11892
        
        C:\Windows\SysWOW64\Nkboeobh.exe
        
        C:\Windows\system32\Nkboeobh.exe
        473⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Nhfoocaa.exe
        
        C:\Windows\system32\Nhfoocaa.exe
        474⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\Nmbhgjoi.exe
        
        C:\Windows\system32\Nmbhgjoi.exe
        475⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Ndmpddfe.exe
        
        C:\Windows\system32\Ndmpddfe.exe
        476⤵
        Modifies registry class
        
        PID:12096
        
        C:\Windows\SysWOW64\Nkghqo32.exe
        
        C:\Windows\system32\Nkghqo32.exe
        477⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Npcaie32.exe
        
        C:\Windows\system32\Npcaie32.exe
        478⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\Ohkijc32.exe
        
        C:\Windows\system32\Ohkijc32.exe
        479⤵
        Modifies registry class
        
        PID:12240
        
        C:\Windows\SysWOW64\Omgabj32.exe
        
        C:\Windows\system32\Omgabj32.exe
        480⤵
        Modifies registry class
        
        PID:2832
        
        C:\Windows\SysWOW64\Ohmepbki.exe
        
        C:\Windows\system32\Ohmepbki.exe
        481⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\Omjnhiiq.exe
        
        C:\Windows\system32\Omjnhiiq.exe
        482⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Ohobebig.exe
        
        C:\Windows\system32\Ohobebig.exe
        483⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Omlkmign.exe
        
        C:\Windows\system32\Omlkmign.exe
        484⤵
        Modifies registry class
        
        PID:1380
        
        C:\Windows\SysWOW64\Odfcjc32.exe
        
        C:\Windows\system32\Odfcjc32.exe
        485⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\Okpkgm32.exe
        
        C:\Windows\system32\Okpkgm32.exe
        486⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\Odhppclh.exe
        
        C:\Windows\system32\Odhppclh.exe
        487⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\Oalpigkb.exe
        
        C:\Windows\system32\Oalpigkb.exe
        488⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Pgihanii.exe
        
        C:\Windows\system32\Pgihanii.exe
        489⤵
        Drops file in System32 directory
        
        PID:1852
        
        C:\Windows\SysWOW64\Paomog32.exe
        
        C:\Windows\system32\Paomog32.exe
        490⤵
        Modifies registry class
        
        PID:11712
        
        C:\Windows\SysWOW64\Phiekaql.exe
        
        C:\Windows\system32\Phiekaql.exe
        491⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\Pkgaglpp.exe
        
        C:\Windows\system32\Pkgaglpp.exe
        492⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Phkaqqoi.exe
        
        C:\Windows\system32\Phkaqqoi.exe
        493⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11888
        
        C:\Windows\SysWOW64\Pjlnhi32.exe
        
        C:\Windows\system32\Pjlnhi32.exe
        494⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\Pdbbfadn.exe
        
        C:\Windows\system32\Pdbbfadn.exe
        495⤵
        Drops file in System32 directory
        
        PID:12036
        
        C:\Windows\SysWOW64\Pklkbl32.exe
        
        C:\Windows\system32\Pklkbl32.exe
        496⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Pddokabk.exe
        
        C:\Windows\system32\Pddokabk.exe
        497⤵
        Drops file in System32 directory
        
        PID:4956
        
        C:\Windows\SysWOW64\Qdflaa32.exe
        
        C:\Windows\system32\Qdflaa32.exe
        498⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Qkqdnkge.exe
        
        C:\Windows\system32\Qkqdnkge.exe
        499⤵
        Drops file in System32 directory
        
        PID:1712
        
        C:\Windows\SysWOW64\Qpmmfbfl.exe
        
        C:\Windows\system32\Qpmmfbfl.exe
        500⤵
        
        PID:12236
        
        C:\Windows\SysWOW64\Qjeaog32.exe
        
        C:\Windows\system32\Qjeaog32.exe
        501⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\Aamipe32.exe
        
        C:\Windows\system32\Aamipe32.exe
        502⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\Ahgamo32.exe
        
        C:\Windows\system32\Ahgamo32.exe
        503⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Ancjef32.exe
        
        C:\Windows\system32\Ancjef32.exe
        504⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Ahinbo32.exe
        
        C:\Windows\system32\Ahinbo32.exe
        505⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Anffje32.exe
        
        C:\Windows\system32\Anffje32.exe
        506⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\Agnkck32.exe
        
        C:\Windows\system32\Agnkck32.exe
        507⤵
        Drops file in System32 directory
        
        PID:5080
        
        C:\Windows\SysWOW64\Anhcpeon.exe
        
        C:\Windows\system32\Anhcpeon.exe
        508⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Ahngmnnd.exe
        
        C:\Windows\system32\Ahngmnnd.exe
        509⤵
        Modifies registry class
        
        PID:4600
        
        C:\Windows\SysWOW64\Addhbo32.exe
        
        C:\Windows\system32\Addhbo32.exe
        510⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Anmmkd32.exe
        
        C:\Windows\system32\Anmmkd32.exe
        511⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Bdgehobe.exe
        
        C:\Windows\system32\Bdgehobe.exe
        512⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\Bjcmpepm.exe
        
        C:\Windows\system32\Bjcmpepm.exe
        513⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Bqnemp32.exe
        
        C:\Windows\system32\Bqnemp32.exe
        514⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Bggnijof.exe
        
        C:\Windows\system32\Bggnijof.exe
        515⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Bnaffdfc.exe
        
        C:\Windows\system32\Bnaffdfc.exe
        516⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4820
        
        C:\Windows\SysWOW64\Bhgjcmfi.exe
        
        C:\Windows\system32\Bhgjcmfi.exe
        517⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Bndblcdq.exe
        
        C:\Windows\system32\Bndblcdq.exe
        518⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Bdnkhn32.exe
        
        C:\Windows\system32\Bdnkhn32.exe
        519⤵
        
        PID:12168
        
        C:\Windows\SysWOW64\Bkhceh32.exe
        
        C:\Windows\system32\Bkhceh32.exe
        520⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Bbbkbbkg.exe
        
        C:\Windows\system32\Bbbkbbkg.exe
        521⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Bilcol32.exe
        
        C:\Windows\system32\Bilcol32.exe
        522⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\Bjmpfdhb.exe
        
        C:\Windows\system32\Bjmpfdhb.exe
        523⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Cgaqphgl.exe
        
        C:\Windows\system32\Cgaqphgl.exe
        524⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Cnmebblf.exe
        
        C:\Windows\system32\Cnmebblf.exe
        525⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5760
        
        C:\Windows\SysWOW64\Cegnol32.exe
        
        C:\Windows\system32\Cegnol32.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1900
        
        C:\Windows\SysWOW64\Cnpbgajc.exe
        
        C:\Windows\system32\Cnpbgajc.exe
        527⤵
        Drops file in System32 directory
        
        PID:6064
        
        C:\Windows\SysWOW64\Ciefek32.exe
        
        C:\Windows\system32\Ciefek32.exe
        528⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Cjfclcpg.exe
        
        C:\Windows\system32\Cjfclcpg.exe
        529⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Celgjlpn.exe
        
        C:\Windows\system32\Celgjlpn.exe
        530⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Dndlba32.exe
        
        C:\Windows\system32\Dndlba32.exe
        531⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Dgmpkg32.exe
        
        C:\Windows\system32\Dgmpkg32.exe
        532⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Dbbdip32.exe
        
        C:\Windows\system32\Dbbdip32.exe
        533⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\Dilmeida.exe
        
        C:\Windows\system32\Dilmeida.exe
        534⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5952
        
        C:\Windows\SysWOW64\Djmima32.exe
        
        C:\Windows\system32\Djmima32.exe
        535⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1484
        
        C:\Windows\SysWOW64\Dbdano32.exe
        
        C:\Windows\system32\Dbdano32.exe
        536⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Dgaiffii.exe
        
        C:\Windows\system32\Dgaiffii.exe
        537⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Deejpjgc.exe
        
        C:\Windows\system32\Deejpjgc.exe
        538⤵
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Djbbhafj.exe
        
        C:\Windows\system32\Djbbhafj.exe
        539⤵
        Drops file in System32 directory
        
        PID:12216
        
        C:\Windows\SysWOW64\Dehgejep.exe
        
        C:\Windows\system32\Dehgejep.exe
        540⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Elaobdmm.exe
        
        C:\Windows\system32\Elaobdmm.exe
        541⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11356
        
        C:\Windows\SysWOW64\Eangjkkd.exe
        
        C:\Windows\system32\Eangjkkd.exe
        542⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Ehhpge32.exe
        
        C:\Windows\system32\Ehhpge32.exe
        543⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Ebnddn32.exe
        
        C:\Windows\system32\Ebnddn32.exe
        544⤵
        Drops file in System32 directory
        
        PID:3160
        
        C:\Windows\SysWOW64\Eihlahjd.exe
        
        C:\Windows\system32\Eihlahjd.exe
        545⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\Ejiiippb.exe
        
        C:\Windows\system32\Ejiiippb.exe
        546⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1056
        
        C:\Windows\SysWOW64\Eijigg32.exe
        
        C:\Windows\system32\Eijigg32.exe
        547⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\Eaenkj32.exe
        
        C:\Windows\system32\Eaenkj32.exe
        548⤵
        Drops file in System32 directory
        
        PID:3520
        
        C:\Windows\SysWOW64\Elkbhbeb.exe
        
        C:\Windows\system32\Elkbhbeb.exe
        549⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Eecfah32.exe
        
        C:\Windows\system32\Eecfah32.exe
        550⤵
        Drops file in System32 directory
        
        PID:11996
        
        C:\Windows\SysWOW64\Flmonbbp.exe
        
        C:\Windows\system32\Flmonbbp.exe
        551⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\Fajgfiag.exe
        
        C:\Windows\system32\Fajgfiag.exe
        552⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Fehplggn.exe
        
        C:\Windows\system32\Fehplggn.exe
        553⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Flbhia32.exe
        
        C:\Windows\system32\Flbhia32.exe
        554⤵
        Drops file in System32 directory
        
        PID:6412
        
        C:\Windows\SysWOW64\Fblpflfg.exe
        
        C:\Windows\system32\Fblpflfg.exe
        555⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Fkgejncb.exe
        
        C:\Windows\system32\Fkgejncb.exe
        556⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Fiheheka.exe
        
        C:\Windows\system32\Fiheheka.exe
        557⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Facjlhil.exe
        
        C:\Windows\system32\Facjlhil.exe
        558⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Ghmbib32.exe
        
        C:\Windows\system32\Ghmbib32.exe
        559⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Gklnem32.exe
        
        C:\Windows\system32\Gklnem32.exe
        560⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\Gimoce32.exe
        
        C:\Windows\system32\Gimoce32.exe
        561⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3016
        
        C:\Windows\SysWOW64\Gojgkl32.exe
        
        C:\Windows\system32\Gojgkl32.exe
        562⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6316
        
        C:\Windows\SysWOW64\Giokid32.exe
        
        C:\Windows\system32\Giokid32.exe
        563⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\Gkqhpmkg.exe
        
        C:\Windows\system32\Gkqhpmkg.exe
        564⤵
        Drops file in System32 directory
        
        PID:3848
        
        C:\Windows\SysWOW64\Gajpmg32.exe
        
        C:\Windows\system32\Gajpmg32.exe
        565⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Gkcdfl32.exe
        
        C:\Windows\system32\Gkcdfl32.exe
        566⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2260
        
        C:\Windows\SysWOW64\Glbapoqh.exe
        
        C:\Windows\system32\Glbapoqh.exe
        567⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Gclimi32.exe
        
        C:\Windows\system32\Gclimi32.exe
        568⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Hifaic32.exe
        
        C:\Windows\system32\Hifaic32.exe
        569⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Hembndee.exe
        
        C:\Windows\system32\Hembndee.exe
        570⤵
        Modifies registry class
        
        PID:7020
        
        C:\Windows\SysWOW64\Hkjjfkcm.exe
        
        C:\Windows\system32\Hkjjfkcm.exe
        571⤵
        
        PID:784
        
        C:\Windows\SysWOW64\Hadcce32.exe
        
        C:\Windows\system32\Hadcce32.exe
        572⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Hligqnjp.exe
        
        C:\Windows\system32\Hligqnjp.exe
        573⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Hccomh32.exe
        
        C:\Windows\system32\Hccomh32.exe
        574⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Hhpheo32.exe
        
        C:\Windows\system32\Hhpheo32.exe
        575⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Hojpbigq.exe
        
        C:\Windows\system32\Hojpbigq.exe
        576⤵
        Drops file in System32 directory
        
        PID:3284
        
        C:\Windows\SysWOW64\Hkaqgjme.exe
        
        C:\Windows\system32\Hkaqgjme.exe
        577⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\Iefedcmk.exe
        
        C:\Windows\system32\Iefedcmk.exe
        578⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Iheaqolo.exe
        
        C:\Windows\system32\Iheaqolo.exe
        579⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Icjengld.exe
        
        C:\Windows\system32\Icjengld.exe
        580⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Ihgnfnjl.exe
        
        C:\Windows\system32\Ihgnfnjl.exe
        581⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Ikejbjip.exe
        
        C:\Windows\system32\Ikejbjip.exe
        582⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2184
        
        C:\Windows\SysWOW64\Iapbodql.exe
        
        C:\Windows\system32\Iapbodql.exe
        583⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Ileflmpb.exe
        
        C:\Windows\system32\Ileflmpb.exe
        584⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2588
        
        C:\Windows\SysWOW64\Iabodcnj.exe
        
        C:\Windows\system32\Iabodcnj.exe
        585⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Ihlgan32.exe
        
        C:\Windows\system32\Ihlgan32.exe
        586⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Iofpnhmc.exe
        
        C:\Windows\system32\Iofpnhmc.exe
        587⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\Ijkdkq32.exe
        
        C:\Windows\system32\Ijkdkq32.exe
        588⤵
        Modifies registry class
        
        PID:6656
        
        C:\Windows\SysWOW64\Iohlcg32.exe
        
        C:\Windows\system32\Iohlcg32.exe
        589⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Jhqqlmba.exe
        
        C:\Windows\system32\Jhqqlmba.exe
        590⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Jcfejfag.exe
        
        C:\Windows\system32\Jcfejfag.exe
        591⤵
        Drops file in System32 directory
        
        PID:6892
        
        C:\Windows\SysWOW64\Jjpmfpid.exe
        
        C:\Windows\system32\Jjpmfpid.exe
        592⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Jkajnh32.exe
        
        C:\Windows\system32\Jkajnh32.exe
        593⤵
        Drops file in System32 directory
        
        PID:6776
        
        C:\Windows\SysWOW64\Jbkbkbfo.exe
        
        C:\Windows\system32\Jbkbkbfo.exe
        594⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Jhejgl32.exe
        
        C:\Windows\system32\Jhejgl32.exe
        595⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Joobdfei.exe
        
        C:\Windows\system32\Joobdfei.exe
        596⤵
        Drops file in System32 directory
        
        PID:224
        
        C:\Windows\SysWOW64\Jbnopbdl.exe
        
        C:\Windows\system32\Jbnopbdl.exe
        597⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\Jmccnk32.exe
        
        C:\Windows\system32\Jmccnk32.exe
        598⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\Jbpkfa32.exe
        
        C:\Windows\system32\Jbpkfa32.exe
        599⤵
        Drops file in System32 directory
        
        PID:2816
        
        C:\Windows\SysWOW64\Jhjcbljf.exe
        
        C:\Windows\system32\Jhjcbljf.exe
        600⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Kcphpdil.exe
        
        C:\Windows\system32\Kcphpdil.exe
        601⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Kilphk32.exe
        
        C:\Windows\system32\Kilphk32.exe
        602⤵
        Modifies registry class
        
        PID:6492
        
        C:\Windows\SysWOW64\Kofheeoq.exe
        
        C:\Windows\system32\Kofheeoq.exe
        603⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Kfpqap32.exe
        
        C:\Windows\system32\Kfpqap32.exe
        604⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6600
        
        C:\Windows\SysWOW64\Kkmijf32.exe
        
        C:\Windows\system32\Kkmijf32.exe
        605⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\Kfbmgo32.exe
        
        C:\Windows\system32\Kfbmgo32.exe
        606⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Kkofofbb.exe
        
        C:\Windows\system32\Kkofofbb.exe
        607⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Kfejmobh.exe
        
        C:\Windows\system32\Kfejmobh.exe
        608⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Kkabefqp.exe
        
        C:\Windows\system32\Kkabefqp.exe
        609⤵
        Drops file in System32 directory
        
        PID:7016
        
        C:\Windows\SysWOW64\Kjcccm32.exe
        
        C:\Windows\system32\Kjcccm32.exe
        610⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\Kkdoje32.exe
        
        C:\Windows\system32\Kkdoje32.exe
        611⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Lbnggpfj.exe
        
        C:\Windows\system32\Lbnggpfj.exe
        612⤵
        Modifies registry class
        
        PID:6452
        
        C:\Windows\SysWOW64\Lobhqdec.exe
        
        C:\Windows\system32\Lobhqdec.exe
        613⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Lbqdmodg.exe
        
        C:\Windows\system32\Lbqdmodg.exe
        614⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Lkiiee32.exe
        
        C:\Windows\system32\Lkiiee32.exe
        615⤵
        Modifies registry class
        
        PID:6848
        
        C:\Windows\SysWOW64\Lbcabo32.exe
        
        C:\Windows\system32\Lbcabo32.exe
        616⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Lmheph32.exe
        
        C:\Windows\system32\Lmheph32.exe
        617⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Lmkbeg32.exe
        
        C:\Windows\system32\Lmkbeg32.exe
        618⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Lbgjmnno.exe
        
        C:\Windows\system32\Lbgjmnno.exe
        619⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Llpofd32.exe
        
        C:\Windows\system32\Llpofd32.exe
        620⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\Mbjgcnll.exe
        
        C:\Windows\system32\Mbjgcnll.exe
        621⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Midoph32.exe
        
        C:\Windows\system32\Midoph32.exe
        622⤵
        Modifies registry class
        
        PID:4300
        
        C:\Windows\SysWOW64\Mbldhn32.exe
        
        C:\Windows\system32\Mbldhn32.exe
        623⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6464 -s 400
        624⤵
        Program crash
        
        PID:6512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4028 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 6464 -ip 6464
1⤵
PID:6336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Baegibae.exe

Path C:\Windows\SysWOW64\Baegibae.exe
Size 224KB
SHA256 daba8bb4c0717539e2135eb01f3994a713d0fc15206903bd8f235cbca5069a91
MD5 0941bbc4c5cb1e0bbe836076b278be20
SHA1 764de62cd6c3e8b2bcd88316749b8fb450e7513e
SHA512 debd5d80591eb8b13e4713ffe22566f5acb8f06fb0adaebcb88e5011efe534b740df0a4ff5fcc7c79172dd3545046d0b49ab23228574f4ad48159ec79984f032
SSDEEP 3072:SiyVba66610GKHIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtf:DT6661fKd4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bkphhgfc.exe

Path C:\Windows\SysWOW64\Bkphhgfc.exe
Size 224KB
SHA256 b55d2bc41e3deaa74b4f86b5d3b45096c88f54aa272030f2f3e1de2b8e9cdd25
MD5 8f998c980178d2a7eab7299fce8e2920
SHA1 f3b7a58b0be872c27d449fb8813225f83008a35c
SHA512 6f45a968abd927a8f1bf18697a05b1053a1b54b00abe68d0bc96e69ecf2aa016679f07422f9d89cbefad5b5f4784fabeea9d170c09ec9ba1bf00e117386ea951
SSDEEP 6144:nk3hGklf9OzUInpKyUjrE1y4s5tTDUZNSN58VU5tTtf:oz4s5t6NSN6G5th
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cgqlcg32.exe

Path C:\Windows\SysWOW64\Cgqlcg32.exe
Size 224KB
SHA256 fa07729239c54edefaa69408a4fb1bf18d6c0af989d629d2d3f541e888f38c4d
MD5 5a12e9d5f6b5f74622d553cb04a98437
SHA1 a7f3dc5bd748cb663d5de84d3599068874ac14ed
SHA512 cc1d2372af34205064954104abef4914ce1d9fdd7e7a3ee254b7f7bca9b6d20ea26a0a4d46b21ef1e0054722557b5e6ff0cf26240c41e33653a2134d4d8a8859
SSDEEP 3072:/1JCnuEcaPevxWhBIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOa:/1JFEc6qohn4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chkobkod.exe

Path C:\Windows\SysWOW64\Chkobkod.exe
Size 224KB
SHA256 c11352b7cda139bfbf35bfa4cab5428e09ec74285be3e19024a440990abbedcf
MD5 9c152153fd7ce5d3cfd91e3cfabeea47
SHA1 01f47ff120f90bfc09cf4d3a18de5dd01b777283
SHA512 45b3ff1162247258fbaf8c624686b5a40000f5efdac265d6c8a97920f0f7e47b33e674a626f9b66dc05452c3ae5ff5aecb02445678c5fa3d858697959b8411e3
SSDEEP 3072:8Xdsn0jsnJuHv2XcKDmaIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDl:ln0RmLmy4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Coqncejg.exe

Path C:\Windows\SysWOW64\Coqncejg.exe
Size 224KB
SHA256 865ac8f07364afa45fabe98aa867694690640eb18a9d7a32391a0dfe77cf6731
MD5 02b1111b5ac15a154d7c6cd36c72fd3f
SHA1 5fe04b1e53b7183fa0c945fe2cf0440bdf224ad1
SHA512 7cb5b27dadd2b4d803240d48987de21f0e1008a8aeb887d006db8f834f281d1c1f3063782035003d761ed5e2e5c529410a9e383f9a697e8b94556bb282ac851e
SSDEEP 3072:MEmxq+cnAbHIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:48+bd4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dbocfo32.exe

Path C:\Windows\SysWOW64\Dbocfo32.exe
Size 224KB
SHA256 a613e607c4d65c7f0acfc9728f5e4fca8d82f3645a07628960c064587f5404e0
MD5 0f41a546715fbe49e98e11538d286d18
SHA1 b3763bf403a2668d29e56ab7a285c4e2e0822e6d
SHA512 16a3bb029179b0ebea8dd99f71dfe4a2d248f74b3feaec6e35ddd4c602fa18f5efe33259bb6cb71c3d2b6c776e53e4e2c76d425b5eed6fbba783e908e9343963
SSDEEP 3072:r0yaTI3HmUIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:rDkM4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dgcihgaj.exe

Path C:\Windows\SysWOW64\Dgcihgaj.exe
Size 224KB
SHA256 ea7bb47362e996296b16169216bccf70ac95ab9d6879603d084cec9cc32e95ea
MD5 67571121cfe3d275eb69ec3f355d2f8e
SHA1 a85cabf47f1bbca656ab023e24593d1f0e5d7de3
SHA512 22c95a2c1fcdf36541b422398444e251c1f9254fee4d58f4dd6eb18b3595565f52eb768f6ab9bd5bdac0c32d9ee86d764a27eba658178ad1a478c0386979a274
SSDEEP 3072:IlnDs81dYifJ7IuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:IlnvfJ54s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Doccpcja.exe

Path C:\Windows\SysWOW64\Doccpcja.exe
Size 224KB
SHA256 642faad202f0cc4fef2625deea91b25d868fef44f4e4fac1954383f78a554f45
MD5 da98a613281ee3b41dba217792ca876b
SHA1 8897866a092310c0b50b49e9014b7df4dd2d0713
SHA512 92bedf7f81cfbcf0d15ed8ae25dcf22ae7fec0417a48513748dc3934252331e863cc8f473439befab55a12e61c4c2d3a1e32871953297fa24bd1de83a0403462
SSDEEP 3072:KSgT6IuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:1gTS4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dolmodpi.exe

Path C:\Windows\SysWOW64\Dolmodpi.exe
Size 224KB
SHA256 268ef78ffe047cc6c88270325373195d7bba736dce2cc0225432dc56f4292fe3
MD5 4f19d223da8a5507d2d8f90040ba7cc5
SHA1 9355cad9aa473b7b243d327363ba81ad0d6a93f3
SHA512 60291bd787d58e59842f2759cdcc79c04e5ee95e4063827f48b3f6170b92e381256a76bd54e6a6146e48402f42242843a6e13bba4e0b96589c91c49095746832
SSDEEP 3072:vyiUPZC88bvGt+LizIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZth:vyidix4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dpalgenf.exe

Path C:\Windows\SysWOW64\Dpalgenf.exe
Size 224KB
SHA256 60de18aa4fb5fcf5352593aa36758493aef9422fa7a579bdb37233108252ff08
MD5 8c25ddfb8d45ad2c5de74fb419b15235
SHA1 9607f817508d2ad903d3dd26a59befac84a652c1
SHA512 6b38b11734d925fa41047e0c13c43d7ef2f78981bba01e41cd2a355424abe8f54ac922676ba3881d3b7c58c008f1ece6eaba647c140e9f05deffebb9c31b4e67
SSDEEP 6144:9JF0qeQ2GiSJj4s5tTDUZNSN58VU5tTtf:9JCfMxZ4s5t6NSN6G5th
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dqpfmlce.exe

Path C:\Windows\SysWOW64\Dqpfmlce.exe
Size 224KB
SHA256 d39b54b43079b88dc92f0299fae7efb3377e82992924d63bedff933a010413aa
MD5 4aefe11466219648290767ec2bf4b44a
SHA1 e5fd40c69a167f7fa6ca3037819e8ab9c7a585b3
SHA512 95767d08a3f1e0e9c9b9dfe25309442b2b2311c879cb2a12e423fe7a1387935f4f6c21b2d63c3712ecd08acbf43fab7780be581cafc89e84d89b011dbd986329
SSDEEP 3072:29Vop9IzFAeQyQLCFIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZth:V/xCj4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eghkjdoa.exe

Path C:\Windows\SysWOW64\Eghkjdoa.exe
Size 224KB
SHA256 6cfe6222016c06ab8ea8f1528f9db5dca9581c6e8a79726389351faf19cf6fdc
MD5 0e4d28aa816c78e55eee58de68adf944
SHA1 4c25b6995dccd7985b57d2de7e5b98c814b19917
SHA512 a315f4bcf82e2046c469513e3bca84bcd509ded71acb0acbac0e4e3ebfdccf09c7d835b59cfa5094fdec607eec75a7c9e4517eff9dd0662812caa4a13c377305
SSDEEP 3072:iQkHc8xAOSp3333vkoQeAIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFR:iQk3ig4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ekajec32.exe

Path C:\Windows\SysWOW64\Ekajec32.exe
Size 224KB
SHA256 037ddea441c70f4927a74313ab061d189539bd4824d399aad4e0445c71d892ed
MD5 d278a6fb4dfc9a9069642784a1754041
SHA1 2711f496295f668127975487b3fa64beab30a761
SHA512 3f06c8d4a3949d8f9cc6548c70a4d126f8930c6f292a72d2b09496ca017b336a1bd39fe8972a1fc7d5f5e67012b5043222c11e01774834962d796dc9020df7b9
SSDEEP 3072:oPG5o9MyF0+IuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:kG5qMy+e4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Enhpao32.exe

Path C:\Windows\SysWOW64\Enhpao32.exe
Size 224KB
SHA256 8be47b906670b53a61aa02550d4814f19924e5f2954c62a98e9844285b020b7b
MD5 1bb1345e19c3ce870a0e733f631fe968
SHA1 820911b158aa2b191f5f53759ebb2e98fcafe29f
SHA512 ec9a74ea24b704061cfad8d1afc096ef2ba15595439b94120f4e20c807a6a3962230442261efe77cdedd5aba81b8a7b59a226eabd5eb7722616c3e78450326be
SSDEEP 3072:gj60c5+2d+MBexm14VG2sIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFR:gj6X5+QHgE4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Enkmfolf.exe

Path C:\Windows\SysWOW64\Enkmfolf.exe
Size 224KB
SHA256 007e91e450a64b43b98708a4ffea7fc092cb76d67b3bd9f2bfd7b43b22754146
MD5 0ee0072d72badd23226df5ae17e7b1c4
SHA1 c060fd4ec217c2d2f9d4e5c9a4af57ddc49118ab
SHA512 09f0646fd4a963bf3e13aa4f96a9f153120db0e1ca9776a6c7c702eb44bbd1ad4856f9f6e6042efc65ec7c6c3c6ed248a5147987338ec159443aa7fc6cfc5961
SSDEEP 3072:QXoKG3QSJeHPguIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtf:QX72Qhvgu4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eojiqb32.exe

Path C:\Windows\SysWOW64\Eojiqb32.exe
Size 224KB
SHA256 84f770191791acdea71aee2800df0f3fc526e426e44b2c2c634232aad42555b8
MD5 01a857a4098dfdacdfa84459716f49e8
SHA1 b39857a979ce3f653f585092619b2dec24900db9
SHA512 8b37f167e414c2b996ef07f233eb668e40442923299cd8cf5d67fbcff5d5bbe4b5c196870e87c857ea04ce0817bfa243ec364bf8ef8ffe61b3fb12ba6bbe79fa
SSDEEP 3072:9FZRz1XMIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:9FZl1Xk4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fbgbnkfm.exe

Path C:\Windows\SysWOW64\Fbgbnkfm.exe
Size 224KB
SHA256 d460a9d49a2f39a5012b2060219fc33ffb2eefb543276cbbe0f34cf61884502a
MD5 aaa0fb0a72b2a072290834e2e4404327
SHA1 afad2a590bb772845816b37e6672fbf93b754db4
SHA512 295fb200ffe663ebf7dbec1aff5869368796c68176f4a1c9d458392cfd24f4f115fca301f18da87ff2a76f793831e9a33d62c9b442202f9f244c90f143893a7c
SSDEEP 3072:jFWT75T2GaXEIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:xWTd2lc4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fbplml32.exe

Path C:\Windows\SysWOW64\Fbplml32.exe
Size 224KB
SHA256 b0c138cbdcc340189460b03351070528f05ecfc408d3d7f6bfb304996f25fd37
MD5 8c99f8379d91338f239637cf0c7f024d
SHA1 cd4a010a4b60de12f969a00679d42b4bdd77bba1
SHA512 d975b471e674a236b76418bbd2e2d9c1f3c9e06f7dd66fd2eb22b9d9f162f3ad07f614d2be163848636f5ef78293b32014a64d4b9c7af791073c03cd0f9b1f76
SSDEEP 3072:HrMCY41vloT+IuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:HrMCpwe4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fdlkdhnk.exe

Path C:\Windows\SysWOW64\Fdlkdhnk.exe
Size 224KB
SHA256 d5db7492826732a5a7470330bad774bdee13797f3135f49ce659d9399355e081
MD5 06a6fba4e73990fe971a10e62bc6943b
SHA1 0b250fd1331c636f4573875bc722fb2a23a4cf79
SHA512 f33f07d7420b7c7a8ed188911944668f8cd37c7be92800f9536bb0aacd8fb349a48ca114567dd90ff0b8aae0bdea03de675b2a3505665b76f4f7c67a752f6494
SSDEEP 3072:KDU7UqZBIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:Rrn4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Feqeog32.exe

Path C:\Windows\SysWOW64\Feqeog32.exe
Size 224KB
SHA256 1945a2b2430028905b5466e78f4ca796fc37a48342a154db404646562fb3c868
MD5 50eec502f8f1a6e8786acfd35c393ab0
SHA1 527fceef893bef08cfb5d29eb265a4df98aca3c4
SHA512 7068db082a13d6235b0466488a5b5beb86f4843ba9c2fc912a600dc4c7fb92d3e3634b27c578131274155bd5c90169e725928ae5977aff651887fe86c7b543e2
SSDEEP 3072:ahIhrAzizMIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:ahIhrAmk4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fgoakc32.exe

Path C:\Windows\SysWOW64\Fgoakc32.exe
Size 224KB
SHA256 66e680504cb30a8f72d59f7a4d98512896ecf6d04e80bb38338a05ed1694032f
MD5 408b07384ec3d6f902b947cf42a3bcf5
SHA1 55c9042ecd5d047a13b15b5752d796ed9f40f64f
SHA512 8b646d73605685ce87d7ddb9a24831d0b3ed210a2d5f41bcb30ffb1aa4f4cda87b3b0591ac1abc5040acbf2664400af0cd7de19c87355517be112ca969badacf
SSDEEP 3072:ExcV7Vj1GIHEIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:BVxlHc4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fkgejncb.exe

Path C:\Windows\SysWOW64\Fkgejncb.exe
Size 224KB
SHA256 9b5681b9ea4001f98d98e933fc44eb58bbb81c91b6f2ac2a2b0a01c49a21ad11
MD5 bd7c256a313cf6bb02a28a917b545183
SHA1 48042d32bfefa3417c93204c8773d2777f0e56af
SHA512 89a075fa7960f832aa66f5065244ebcee7ead2c2f920b903670689852d9023aff0ce73f61030ee27a409f98465a3470aa9c7c240e10d1977f5521da7657bd654
SSDEEP 3072:TR0uv+2E4rL/PSIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtf:TR0ulPq4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gddqejni.exe

Path C:\Windows\SysWOW64\Gddqejni.exe
Size 224KB
SHA256 a0a6a6fa58da3fabd66607eda75e6c2455dee6f2f7f1770c5bd70377c17d740e
MD5 c435bfa86fc8f4e0c4861897277b3ad2
SHA1 cfd6ee7a475c88a3b89224f630367d546a0127d3
SHA512 d95bc8c0d5ea7914dda8904d5028ad5e6ee471acd4ad16716ff1bdb5e874b1cc098ee0100884ec9a73b8791f08dbec9d48ee762400815a7e8c6666112349a7c3
SSDEEP 3072:lMThOYt4/3IuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:5Yu/t4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ggfglb32.exe

Path C:\Windows\SysWOW64\Ggfglb32.exe
Size 224KB
SHA256 a520b29e194dbc344b0f98bf96f38968938810c80866763823a728610fbff1db
MD5 64118b9875f352dcac94882ea7de4aa0
SHA1 99899ab5b4a580a3bd6531cdcf6181e1d502d541
SHA512 1cc84190a022bf21397d148b6b6dbaa08bd89fb2fd0f6cdfa585bb78be586240e3de467fcef83f37ba301ad7bc97e92ae181f52605667ca927ca0c3449b492da
SSDEEP 3072:ml33mrDIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:e+h4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ggmmlamj.exe

Path C:\Windows\SysWOW64\Ggmmlamj.exe
Size 224KB
SHA256 0b925ebf31dfaf1bbc5c0c623933fd3bc080c96a9a8a5cbcdfeec0263c9452c8
MD5 a0d7a6f5e961e969cdab50a12df4b2b8
SHA1 a5c332f6835d6cfcf176dd19e8b7664e6dbf6174
SHA512 6e31d6717b8994a586a29292062ba5ab489623d0c70465f7c3f3e2687a6d8ef8153f22f157ae5d8b4087a9f4887c2bedb30cd61acf44d09652610e27149435ac
SSDEEP 3072:eZm2dYqKCBtjzJkXksETQjIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrn:e8FqKCBtj69B4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gndick32.exe

Path C:\Windows\SysWOW64\Gndick32.exe
Size 224KB
SHA256 effa7c52c4084acff365a4d7f8d1fb7db4a1b8144c6cdff0cab5a5554d484ee7
MD5 8041039807be19d9646d8b66aeb380ba
SHA1 7cfeb3b6f1335482259fa63b4e4f6d5bd7791bd2
SHA512 dee84d95d658de7b5fdfab23ab288ec9945a5b3e03b48bee343374b27703293d152e47c8efaedf36ce468396e272d10a30aea82ceb10e9413fa4b232256ca972
SSDEEP 3072:sdlehTjCFbNIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:MlehTjebL4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gnnccl32.exe

Path C:\Windows\SysWOW64\Gnnccl32.exe
Size 224KB
SHA256 578ba911e45f04b08eec37871ee7038dc14e35568e468df048e32cbab08e9438
MD5 e122088afe42fa1f085098799d0bf42b
SHA1 18b6cb2615b8e5aba8fa66ed71d948027dda1848
SHA512 1603a03ac2099fd29a830ec4cce774bd44f9d215b8661bb3e05d92f7a74af604888df9242355156cd8b35308a7853486b3e4c48b242f43312a9c318dd0ac6287
SSDEEP 3072:S2VWPleGlKMwEZAD1IuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZth:S3WxDz4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gpolbo32.exe

Path C:\Windows\SysWOW64\Gpolbo32.exe
Size 224KB
SHA256 f069cb86cba22c83406c8a0c6daba506724cd99295ba7df01ded92d88675905c
MD5 861e9a992cf289d2c8d05e8139445609
SHA1 ca4259a1f6c6a252922dcc82b5f97456a5a9d517
SHA512 038ee87d817e7616f2b0f75e768c1454a520791212e96e12d423609620eb99f725db3b1810db1fcd7503de9246aeed91546d1bbd999c8a98c3e232827e79a302
SSDEEP 3072:vx09Ms30Ev6vMlvcrYcIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHF:oEZMU4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hahokfag.exe

Path C:\Windows\SysWOW64\Hahokfag.exe
Size 224KB
SHA256 c286e91cf54c1b994e3dd49dfbacea1209868a7d968a9c71d6bf92fddd414cfe
MD5 70f35ecb2efa563a8e6c7ffbd4951f6a
SHA1 9590dd025f8556cce55ea9457650166eb775e9b9
SHA512 5d07b49548ea8a42da57eaf2c99069f5cbb0371082e8e67e252df1975879bc78add40d0938b6794fa68185961be971b8c376e7be57faef61ab99039cf39e032f
SSDEEP 3072:y1txxsL4LIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:Qtxxskp4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hnlodjpa.exe

Path C:\Windows\SysWOW64\Hnlodjpa.exe
Size 224KB
SHA256 ecda0c0476fffd29a71db927e8695a0b0842e3a657936fce5e68cb594ea7c08c
MD5 59d6618f50bab172795ca15ee6a52357
SHA1 48f1b3b6910d6eef1606967096150765566e0e5d
SHA512 8d6aa41192a2c1bfc82483b7bebf69dbe28b6c425b77b38286e9833f69c16150442b185fe7260e338b342a5784b0a0706eb776cb36f28b25c84a059ccb2ed939
SSDEEP 3072:CSZQAbIo6j9kW0IuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtf:jZdzO9Rs4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iacngdgj.exe

Path C:\Windows\SysWOW64\Iacngdgj.exe
Size 224KB
SHA256 4b500050d843270f77725c4908bac15784650ffcab530ad8805f534c96c0baa8
MD5 905aca3e5e1be9847593e6f3969370ae
SHA1 386726d68e9048dce37efa4e170e38a88c070636
SHA512 2e8e3eb965466b46a98177418dc215cc70310bd902fd71aad7ec594cfe1905d28a5864e017b147f56a662c8745a0ff3557a51b14905447664acc2c588aef369b
SSDEEP 3072:dGC7rXT0GYnbZIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:j7rXAGgf4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iafkld32.exe

Path C:\Windows\SysWOW64\Iafkld32.exe
Size 224KB
SHA256 8e6dfde7d82661b33b1595d3a10ae4f4f1246a347db121a617340c25384a107e
MD5 b83ac5837eb678b4c3c5ae8446d02b8a
SHA1 a339544d882fe640312a6064b006671ffadf4764
SHA512 43c5b46af65c19b8954a97d638c51941d2f3f88760c00d577f1a0175cfde828502e9dc60f4fd5689636ec5861ef195ca6f6dd41f6d718e402f13b0671358243d
SSDEEP 3072:qiE6rgunn2nysvBvIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOa:5ngKWPvBF4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ibjqaf32.exe

Path C:\Windows\SysWOW64\Ibjqaf32.exe
Size 224KB
SHA256 78051109768692e3719b37768dbc31881e88ee8512884c26e249dbf26d2174b7
MD5 a7a6d7ea65619452ed0cb6e825832ac3
SHA1 bd957de461e7ec254378512c2c689e7d0bcf00dc
SHA512 c554097daf6af56ea48b93aea2b375a4401c9b7699ed6d7bb473c06f044f449d1a9eede8dcc019f737caf693968b0aaa8cc6d0e4346436497da82885643ef07d
SSDEEP 3072:L2d4JiNTtMLFIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:L2DTtMLj4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ihbponja.exe

Path C:\Windows\SysWOW64\Ihbponja.exe
Size 128KB
SHA256 a4f7918b6f9de6c35cc9bb65de0536b30545e2f106a39ca4485e0fa3ac1f7836
MD5 0a3ec3430e2212bf7767fc049cddaf85
SHA1 b240e83d640c0eee55faeb9a9960f9156292f3f3
SHA512 9fc533224412c34401fca1ed5a45f2e4a073464587fd594f37e76af0920c191244c99f3bda0552be02a9c959ca44a390cbf6e5436f808022c032f9344b4b40e8
SSDEEP 3072:KcdrY2TPL/zvrSbXTPLHD/73zvrnjfbXTPLHD/73zvrnjfbXTPLHD/73rnPLfby4:Vd02TPL/zvrSbXTPLHD/73zvrnjfbXTj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ihbponja.exe

Path C:\Windows\SysWOW64\Ihbponja.exe
Size 224KB
SHA256 c80593783b6f568d0c0e64eff00c8d394792df36f71fb1a9b6ad9ec75ba1351f
MD5 ceaa6173d86998d5a16a80282ae8564f
SHA1 1bd25db349b8f1452df9fb955b0e9395090f3fbe
SHA512 94804bee424262e3fba5482c672251efa9bb82a71b8e360c6b86a1ec1a7f4850c3b40ab0032e27c8dd52bc8424088d61d4315fa3e06401d75d76f1f0a9bad4e1
SSDEEP 6144:Vd02TPL/zvrSbXTPLHD/73zvrnjfbXTPLHD/73zvrnjfbXTPLHD/73rnjfbyGq+s:Q2TPL/zvrSbXTPLHD/73zvrnjfbXTPLQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iialhaad.exe

Path C:\Windows\SysWOW64\Iialhaad.exe
Size 224KB
SHA256 af41505d10cee9ee41ec675cad31c0a7b7e5d6265fb118cb34998f480aa5730d
MD5 162818d58a01e91da976d478d12b1a6a
SHA1 7768f266eb7a95ecc9d04e777eae58d0624fe9e7
SHA512 ecf7f1e7c44f56a2ddc751730a47168a6cbcf0f9b0fda0da1d2d8d54ad2f5bfdd0373891edb263468fcc00c9a12a683703db9503ef5fdda68fc95356a2ab05db
SSDEEP 3072:hxo8ecDyLIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:heXp4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oophlo32.exe

Path C:\Windows\SysWOW64\Oophlo32.exe
Size 224KB
SHA256 8d0bfbce0d94bd5b2af27be8db768be7328e5afec3cd5411923b2c33232a624b
MD5 3f2a7304bc606e75bf7f958a921e38b7
SHA1 fa5b5ce3d73eb5f70c16af2f7a44e7e0eb23b52b
SHA512 84ab494415cde178c0deed56c24339f3a7447593256ffd645172402788c821d68957873c0c4ed8f48108523841fb28353cdea23b6e557324e7afac19250cdcfc
SSDEEP 3072:3EHTkCnKyFd4LVwIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgt:3Ez6oaw4s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pcijce32.exe

Path C:\Windows\SysWOW64\Pcijce32.exe
Size 224KB
SHA256 11adc860f55edeb77cdeef181ea4f8c1712d1929dc561470d9d99236962eae7e
MD5 47fc99d499329f92d3448d23f1f698ac
SHA1 2d89fb494677a9feb0b7898850106f48d3ca7648
SHA512 b9ff17d77731a5a2cab97ed4271e24e2fc80460854bac5df3295d86459a3bf251de628599ef15adfec21ffb44e4dd65d318caf325926f95f905c6454cb78522e
SSDEEP 3072:jRDbsiHxIuYUvIMDrFDHZtOgxBOXXwwfBoD6N3h8N5G2qVUDrFDHZtOgtSU:xX34s5tTDUZNSN58VU5tTtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/404-223-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/888-135-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1380-326-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1540-370-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1640-220-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1796-23-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1864-208-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2052-143-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2160-112-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2164-120-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2192-196-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2196-285-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2204-400-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2208-361-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2484-424-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2640-151-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2912-183-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2932-388-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3080-304-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3192-418-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3204-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3460-316-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3596-430-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3604-382-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3732-64-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3744-380-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3748-175-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3752-128-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3872-167-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4012-340-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4036-103-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4108-232-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4196-248-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4352-352-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4376-256-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4408-446-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4444-394-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4528-84-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4532-15-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4716-364-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4956-292-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4964-412-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5100-240-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5160-406-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5180-200-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5184-159-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5256-328-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5324-278-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5372-268-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5380-436-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5396-7-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5424-262-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5520-298-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5528-310-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5532-71-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5540-346-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5560-55-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5804-96-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5824-48-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5876-88-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5880-40-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5944-286-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5948-31-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/6064-334-0x0000000000400000-0x0000000000440000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads