6f4b4e5838e07c0aa203c2af401247af4d9ba679b2db0a7d7d16ca97a682b09f

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f4b4e5838e07c0aa203c2af401247af4d9ba679b2db0a7d7d16ca97a682b09f.exe
Size

256KB
MD5

4cffc3707bdbeba3f8730a310316da51
SHA1

d6bd536fd4eb89123a8fe01d1dce6f05061f9ce7
SHA256

6f4b4e5838e07c0aa203c2af401247af4d9ba679b2db0a7d7d16ca97a682b09f
SHA512

afbce94cc4f984b730c88c0feff37ba8d5091e951d7c32518a4a873572bb25488edbd5a7800e204778c93ab443e1fecd35f76f0fc8aed4082fa08753a9592702
SSDEEP

6144:sNJj5BBRK0WrjlpmmxieQbWGRdA6sQc/Yp7TVX3J/1awbWGRdA6sQc/YRU:25EflpJxifbWGRdA6sQhPbWGRdA6sQxU

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paoollik.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mokmdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcaipa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epffbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdebfago.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Heepfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hegmlnbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Naecop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Addaif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loighj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkhgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdgdeppb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkhnjk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjcngpjh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Noppeaed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncqlkemc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehndnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ieeimlep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbaehl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Plkpcfal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hblkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afbgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgpcliao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Enmjlojd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kiikpnmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjolie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kongmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Enpfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqbeoc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eofgpikj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmfdj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Namegfql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckbncapd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Plpjoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekjded32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gaebef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbnaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okailj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bflham32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaonbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kplmliko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijkled32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkpmdbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnqfcbnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gggmgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nodiqp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cidgdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alpbecod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omopjcjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icogcjde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clijablo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmnqjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmfcok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iholohii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chnlgjlb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hldiinke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjhfif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klmnkdal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lddble32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ammnhilb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnffhgon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mebkge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oldjcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdpagc32.exe

Executes dropped EXE 64 IoCs

pid	Process
3952	Knchpiom.exe
4692	Kjmfjj32.exe
1676	Lgqfdnah.exe
1460	Lgccinoe.exe
3792	Ljclki32.exe
736	Lekmnajj.exe
1988	Lenicahg.exe
3696	Mnfnlf32.exe
748	Mebcop32.exe
3672	Megljppl.exe
2916	Napjdpcn.exe
3428	Njinmf32.exe
2652	Naecop32.exe
4420	Njmhhefi.exe
4528	Nmnqjp32.exe
2884	Ohcegi32.exe
1856	Ohfami32.exe
2732	Omcjep32.exe
4012	Oldjcg32.exe
4308	Odalmibl.exe
4432	Plkpcfal.exe
3156	Pkpmdbfd.exe
2356	Plpjoe32.exe
2632	Pdkoch32.exe
4132	Paoollik.exe
4200	Qhkdof32.exe
1648	Qeodhjmo.exe
4372	Addaif32.exe
2604	Alpbecod.exe
3632	Akepfpcl.exe
5024	Alelqb32.exe
3988	Bnhenj32.exe
4620	Bheplb32.exe
3212	Camddhoi.exe
1568	Cfkmkf32.exe
4228	Cocacl32.exe
2412	Cofnik32.exe
3836	Cdbfab32.exe
1064	Cohkokgj.exe
2160	Chqogq32.exe
220	Dnmhpg32.exe
396	Dhclmp32.exe
4820	Ddjmba32.exe
2276	Dfiildio.exe
4664	Doaneiop.exe
3580	Dflfac32.exe
4396	Dkhnjk32.exe
4700	Deqcbpld.exe
4252	Eofgpikj.exe
4636	Ekmhejao.exe
3232	Efblbbqd.exe
4108	Ennqfenp.exe
3628	Eicedn32.exe
2724	Eblimcdf.exe
2040	Eppjfgcp.exe
4240	Fneggdhg.exe
2792	Ffnknafg.exe
1604	Fimhjl32.exe
1776	Ffqhcq32.exe
3752	Fmmmfj32.exe
3556	Gidnkkpc.exe
3956	Gnqfcbnj.exe
4604	Gifkpknp.exe
4680	Gppcmeem.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dgpeha32.exe	Cacmpj32.exe
File created	C:\Windows\SysWOW64\Cmkmlmnl.dll	Gnqfcbnj.exe
File created	C:\Windows\SysWOW64\Ncpgam32.dll	Llmhaold.exe
File created	C:\Windows\SysWOW64\Mhckcgpj.exe	Mbibfm32.exe
File opened for modification	C:\Windows\SysWOW64\Ofegni32.exe	Oiagde32.exe
File created	C:\Windows\SysWOW64\Qiiflaoo.exe	Qppaclio.exe
File created	C:\Windows\SysWOW64\Likhem32.exe	Kofdhd32.exe
File created	C:\Windows\SysWOW64\Kehojiej.exe	Kongmo32.exe
File created	C:\Windows\SysWOW64\Acibndof.dll	Kocphojh.exe
File opened for modification	C:\Windows\SysWOW64\Mociol32.exe	Mhiabbdi.exe
File opened for modification	C:\Windows\SysWOW64\Ofbdncaj.exe	Nofoki32.exe
File created	C:\Windows\SysWOW64\Bcpika32.exe	Bflham32.exe
File created	C:\Windows\SysWOW64\Cfmidc32.dll	Bfabmmhe.exe
File opened for modification	C:\Windows\SysWOW64\Efblbbqd.exe	Ekmhejao.exe
File created	C:\Windows\SysWOW64\Ebggoi32.dll	Bgpcliao.exe
File created	C:\Windows\SysWOW64\Kiikpnmj.exe	Kocgbend.exe
File opened for modification	C:\Windows\SysWOW64\Likhem32.exe	Kofdhd32.exe
File created	C:\Windows\SysWOW64\Mpaifo32.dll	Hbknebqi.exe
File created	C:\Windows\SysWOW64\Qodeajbg.exe	Qdoacabq.exe
File created	C:\Windows\SysWOW64\Mmdaih32.dll	Kocgbend.exe
File opened for modification	C:\Windows\SysWOW64\Affikdfn.exe	Amnebo32.exe
File created	C:\Windows\SysWOW64\Defheg32.exe	Ddekmo32.exe
File created	C:\Windows\SysWOW64\Naefjl32.dll	Defheg32.exe
File created	C:\Windows\SysWOW64\Gokfdpdo.dll	Fqbeoc32.exe
File created	C:\Windows\SysWOW64\Odalmibl.exe	Oldjcg32.exe
File created	C:\Windows\SysWOW64\Qhkdof32.exe	Paoollik.exe
File created	C:\Windows\SysWOW64\Okddnh32.dll	Qobhkjdi.exe
File created	C:\Windows\SysWOW64\Dbmdml32.dll	Qdoacabq.exe
File created	C:\Windows\SysWOW64\Nfgklkoc.exe	Mhckcgpj.exe
File opened for modification	C:\Windows\SysWOW64\Gggmgk32.exe	Gbkdod32.exe
File created	C:\Windows\SysWOW64\Dhclmp32.exe	Dnmhpg32.exe
File created	C:\Windows\SysWOW64\Loighj32.exe	Kfpcoefj.exe
File created	C:\Windows\SysWOW64\Hlmchoan.exe	Hpfbcn32.exe
File opened for modification	C:\Windows\SysWOW64\Oqoefand.exe	Ockdmmoj.exe
File opened for modification	C:\Windows\SysWOW64\Qpbnhl32.exe	Qiiflaoo.exe
File opened for modification	C:\Windows\SysWOW64\Mbgeqmjp.exe	Mjlalkmd.exe
File created	C:\Windows\SysWOW64\Hkaeih32.exe	Hegmlnbp.exe
File created	C:\Windows\SysWOW64\Oodlnfco.dll	Naecop32.exe
File opened for modification	C:\Windows\SysWOW64\Dcffnbee.exe	Dmjmekgn.exe
File created	C:\Windows\SysWOW64\Ddhomdje.exe	Dcibca32.exe
File created	C:\Windows\SysWOW64\Jjdokb32.exe	Jbijgp32.exe
File created	C:\Windows\SysWOW64\Hpiecd32.exe	Hedafk32.exe
File created	C:\Windows\SysWOW64\Adkqoohc.exe	Aonhghjl.exe
File created	C:\Windows\SysWOW64\Nofefp32.exe	Njjmni32.exe
File opened for modification	C:\Windows\SysWOW64\Cmnnimak.exe	Bdeiqgkj.exe
File opened for modification	C:\Windows\SysWOW64\Ofgmib32.exe	Okailj32.exe
File created	C:\Windows\SysWOW64\Gdknpp32.exe	Gggmgk32.exe
File created	C:\Windows\SysWOW64\Hqghqpnl.exe	Hjmodffo.exe
File created	C:\Windows\SysWOW64\Aojbfccl.dll	Madbagif.exe
File created	C:\Windows\SysWOW64\Efblbbqd.exe	Ekmhejao.exe
File opened for modification	C:\Windows\SysWOW64\Nnhmnn32.exe	Nadleilm.exe
File created	C:\Windows\SysWOW64\Ddnobj32.exe	Doagjc32.exe
File created	C:\Windows\SysWOW64\Ebdoljdi.dll	Mcaipa32.exe
File opened for modification	C:\Windows\SysWOW64\Egbken32.exe	Enjfli32.exe
File created	C:\Windows\SysWOW64\Cibkohef.exe	Cdebfago.exe
File created	C:\Windows\SysWOW64\Cleqfb32.exe	Cfhhml32.exe
File created	C:\Windows\SysWOW64\Dpkmal32.exe	Dkndie32.exe
File created	C:\Windows\SysWOW64\Mbgeqmjp.exe	Mjlalkmd.exe
File opened for modification	C:\Windows\SysWOW64\Heepfn32.exe	Hjolie32.exe
File opened for modification	C:\Windows\SysWOW64\Jjgkab32.exe	Janghmia.exe
File created	C:\Windows\SysWOW64\Okailj32.exe	Odgqopeb.exe
File created	C:\Windows\SysWOW64\Lkjaaljm.dll	Jeapcq32.exe
File created	C:\Windows\SysWOW64\Emcnmpcj.dll	Gbalopbn.exe
File created	C:\Windows\SysWOW64\Kodnmkap.exe	Kjgeedch.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11080	10892	WerFault.exe	540

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qhkdof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnocia32.dll"	Moipoh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phcgcqab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qppaclio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eecgicmp.dll"	Fecadghc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kamjda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kongmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Namegfql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gifkpknp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jpenfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chnpamkc.dll"	Adhdjpjf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kplmliko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dcffnbee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Geldkfpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jaonbc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nodiqp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afeban32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjmfjj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lenicahg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfipab32.dll"	Eofgpikj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dohnnkjk.dll"	Acqgojmb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dcffnbee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jaepkejo.dll"	Clgmkbna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbfnjgdn.dll"	Paeelgnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Panlem32.dll"	Hldiinke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pncmdhlq.dll"	Hccggl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlefjnno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qpiidi32.dll"	Bblcfo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dgpeha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gqbneq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlkjom32.dll"	Qmanljfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fldqdebb.dll"	Qihoak32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ppahmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eohmkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iondqhpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmladm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkpjjj32.dll"	Cboibm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohfami32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjjkejin.dll"	Jhnojl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glkkmjeh.dll"	Fclhpo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lekmnajj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olekop32.dll"	Hbnaeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oonlfo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icogcjde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbfndd32.dll"	Odgqopeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pciqnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iojnef32.dll"	Ibpgqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcpika32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdbfab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baaelkfn.dll"	Ffnknafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enmjlojd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mbibfm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmcpoedn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqpdko32.dll"	Cofnik32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfiildio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfqdbl32.dll"	Nheqnpjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihjoke32.dll"	Iialhaad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odgqopeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fimhjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhgonidg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncjakdno.dll"	Kiikpnmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Piceflpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjfaml32.dll"	Loopdmpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mociol32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 3952	4492	6f4b4e5838e07c0aa203c2af401247af4d9ba679b2db0a7d7d16ca97a682b09f.exe	93
PID 4492 wrote to memory of 3952	4492	6f4b4e5838e07c0aa203c2af401247af4d9ba679b2db0a7d7d16ca97a682b09f.exe	93
PID 4492 wrote to memory of 3952	4492	6f4b4e5838e07c0aa203c2af401247af4d9ba679b2db0a7d7d16ca97a682b09f.exe	93
PID 3952 wrote to memory of 4692	3952	Knchpiom.exe	94
PID 3952 wrote to memory of 4692	3952	Knchpiom.exe	94
PID 3952 wrote to memory of 4692	3952	Knchpiom.exe	94
PID 4692 wrote to memory of 1676	4692	Kjmfjj32.exe	95
PID 4692 wrote to memory of 1676	4692	Kjmfjj32.exe	95
PID 4692 wrote to memory of 1676	4692	Kjmfjj32.exe	95
PID 1676 wrote to memory of 1460	1676	Lgqfdnah.exe	97
PID 1676 wrote to memory of 1460	1676	Lgqfdnah.exe	97
PID 1676 wrote to memory of 1460	1676	Lgqfdnah.exe	97
PID 1460 wrote to memory of 3792	1460	Lgccinoe.exe	98
PID 1460 wrote to memory of 3792	1460	Lgccinoe.exe	98
PID 1460 wrote to memory of 3792	1460	Lgccinoe.exe	98
PID 3792 wrote to memory of 736	3792	Ljclki32.exe	99
PID 3792 wrote to memory of 736	3792	Ljclki32.exe	99
PID 3792 wrote to memory of 736	3792	Ljclki32.exe	99
PID 736 wrote to memory of 1988	736	Lekmnajj.exe	100
PID 736 wrote to memory of 1988	736	Lekmnajj.exe	100
PID 736 wrote to memory of 1988	736	Lekmnajj.exe	100
PID 1988 wrote to memory of 3696	1988	Lenicahg.exe	101
PID 1988 wrote to memory of 3696	1988	Lenicahg.exe	101
PID 1988 wrote to memory of 3696	1988	Lenicahg.exe	101
PID 3696 wrote to memory of 748	3696	Mnfnlf32.exe	102
PID 3696 wrote to memory of 748	3696	Mnfnlf32.exe	102
PID 3696 wrote to memory of 748	3696	Mnfnlf32.exe	102
PID 748 wrote to memory of 3672	748	Mebcop32.exe	103
PID 748 wrote to memory of 3672	748	Mebcop32.exe	103
PID 748 wrote to memory of 3672	748	Mebcop32.exe	103
PID 3672 wrote to memory of 2916	3672	Megljppl.exe	104
PID 3672 wrote to memory of 2916	3672	Megljppl.exe	104
PID 3672 wrote to memory of 2916	3672	Megljppl.exe	104
PID 2916 wrote to memory of 3428	2916	Napjdpcn.exe	105
PID 2916 wrote to memory of 3428	2916	Napjdpcn.exe	105
PID 2916 wrote to memory of 3428	2916	Napjdpcn.exe	105
PID 3428 wrote to memory of 2652	3428	Njinmf32.exe	106
PID 3428 wrote to memory of 2652	3428	Njinmf32.exe	106
PID 3428 wrote to memory of 2652	3428	Njinmf32.exe	106
PID 2652 wrote to memory of 4420	2652	Naecop32.exe	107
PID 2652 wrote to memory of 4420	2652	Naecop32.exe	107
PID 2652 wrote to memory of 4420	2652	Naecop32.exe	107
PID 4420 wrote to memory of 4528	4420	Njmhhefi.exe	108
PID 4420 wrote to memory of 4528	4420	Njmhhefi.exe	108
PID 4420 wrote to memory of 4528	4420	Njmhhefi.exe	108
PID 4528 wrote to memory of 2884	4528	Nmnqjp32.exe	109
PID 4528 wrote to memory of 2884	4528	Nmnqjp32.exe	109
PID 4528 wrote to memory of 2884	4528	Nmnqjp32.exe	109
PID 2884 wrote to memory of 1856	2884	Ohcegi32.exe	110
PID 2884 wrote to memory of 1856	2884	Ohcegi32.exe	110
PID 2884 wrote to memory of 1856	2884	Ohcegi32.exe	110
PID 1856 wrote to memory of 2732	1856	Ohfami32.exe	111
PID 1856 wrote to memory of 2732	1856	Ohfami32.exe	111
PID 1856 wrote to memory of 2732	1856	Ohfami32.exe	111
PID 2732 wrote to memory of 4012	2732	Omcjep32.exe	112
PID 2732 wrote to memory of 4012	2732	Omcjep32.exe	112
PID 2732 wrote to memory of 4012	2732	Omcjep32.exe	112
PID 4012 wrote to memory of 4308	4012	Oldjcg32.exe	113
PID 4012 wrote to memory of 4308	4012	Oldjcg32.exe	113
PID 4012 wrote to memory of 4308	4012	Oldjcg32.exe	113
PID 4308 wrote to memory of 4432	4308	Odalmibl.exe	114
PID 4308 wrote to memory of 4432	4308	Odalmibl.exe	114
PID 4308 wrote to memory of 4432	4308	Odalmibl.exe	114
PID 4432 wrote to memory of 3156	4432	Plkpcfal.exe	115

C:\Users\Admin\AppData\Local\Temp\6f4b4e5838e07c0aa203c2af401247af4d9ba679b2db0a7d7d16ca97a682b09f.exe
"C:\Users\Admin\AppData\Local\Temp\6f4b4e5838e07c0aa203c2af401247af4d9ba679b2db0a7d7d16ca97a682b09f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\SysWOW64\Knchpiom.exe
  C:\Windows\system32\Knchpiom.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\SysWOW64\Kjmfjj32.exe
    C:\Windows\system32\Kjmfjj32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\Windows\SysWOW64\Lgqfdnah.exe
      C:\Windows\system32\Lgqfdnah.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1676
    - - C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1460
      - C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:736
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3696
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:748
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2652
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4012
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3156
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2356
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        25⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4132
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4200
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        28⤵
        Executes dropped EXE
        
        PID:1648
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4372
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2604
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        31⤵
        Executes dropped EXE
        
        PID:3632
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        32⤵
        Executes dropped EXE
        
        PID:5024
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        33⤵
        Executes dropped EXE
        
        PID:3988
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        34⤵
        Executes dropped EXE
        
        PID:4620
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        35⤵
        Executes dropped EXE
        
        PID:3212
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        36⤵
        Executes dropped EXE
        
        PID:1568
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        37⤵
        Executes dropped EXE
        
        PID:4228
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2412
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3836
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        40⤵
        Executes dropped EXE
        
        PID:1064
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        41⤵
        Executes dropped EXE
        
        PID:2160
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:220
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        43⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        44⤵
        Executes dropped EXE
        
        PID:4820
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2276
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        46⤵
        Executes dropped EXE
        
        PID:4664
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        47⤵
        Executes dropped EXE
        
        PID:3580
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4396
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        49⤵
        Executes dropped EXE
        
        PID:4700
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4252
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4636
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        52⤵
        Executes dropped EXE
        
        PID:3232
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        53⤵
        Executes dropped EXE
        
        PID:4108
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        54⤵
        Executes dropped EXE
        
        PID:3628
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        55⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        56⤵
        Executes dropped EXE
        
        PID:2040
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        57⤵
        Executes dropped EXE
        
        PID:4240
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2792
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1604
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        60⤵
        Executes dropped EXE
        
        PID:1776
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        61⤵
        Executes dropped EXE
        
        PID:3752
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        62⤵
        Executes dropped EXE
        
        PID:3556
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3956
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4604
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        65⤵
        Executes dropped EXE
        
        PID:4680
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        66⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        67⤵
        Drops file in System32 directory
        
        PID:3616
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        68⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        69⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        70⤵
        Drops file in System32 directory
        
        PID:5180
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        71⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        72⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        73⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        74⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5388
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        76⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        77⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        78⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        79⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        80⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        81⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        82⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        83⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        84⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        85⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        86⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        87⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        88⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        89⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        90⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        91⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        92⤵
        Modifies registry class
        
        PID:5128
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        93⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        94⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        95⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        96⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        97⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        98⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        99⤵
        Drops file in System32 directory
        
        PID:5724
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        100⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        101⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        102⤵
        Drops file in System32 directory
        
        PID:5936
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6004
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        104⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        105⤵
        Drops file in System32 directory
        
        PID:5172
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        106⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        107⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        108⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        109⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        110⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        111⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        112⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        113⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        114⤵
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4504
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        116⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        117⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5784
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5572
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        120⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        121⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6288
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6328
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        124⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        125⤵
        Drops file in System32 directory
        
        PID:6424
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        126⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        127⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        128⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        129⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        130⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        131⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        132⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        133⤵
        Modifies registry class
        
        PID:6776
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        134⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        135⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        136⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        137⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        138⤵
        Modifies registry class
        
        PID:6984
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        139⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        140⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        141⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        142⤵
        Modifies registry class
        
        PID:7164
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        143⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        144⤵
        Drops file in System32 directory
        
        PID:6276
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        145⤵
        Drops file in System32 directory
        
        PID:6316
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        146⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        147⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6600
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        149⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        150⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        151⤵
        Modifies registry class
        
        PID:6812
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        152⤵
        Drops file in System32 directory
        
        PID:6260
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        153⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        154⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        155⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7160
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        157⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        158⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        159⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        160⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        161⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        162⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        163⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        164⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        165⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        166⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        167⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6612
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        169⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        170⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        171⤵
        Drops file in System32 directory
        
        PID:7096
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        172⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        173⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        174⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        175⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        176⤵
        Modifies registry class
        
        PID:6384
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        177⤵
        Drops file in System32 directory
        
        PID:7064
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        178⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7104
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        180⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7204
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7240
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        183⤵
        Modifies registry class
        
        PID:7288
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        184⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7368
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        186⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        187⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7492
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        189⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        190⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        191⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        192⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        193⤵
        Modifies registry class
        
        PID:7780
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        194⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        195⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        196⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        197⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        198⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        199⤵
        Modifies registry class
        
        PID:8084
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8136
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        201⤵
        Drops file in System32 directory
        
        PID:8176
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        202⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        203⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        204⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        205⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        206⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        207⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7560
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7664
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        210⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        211⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        212⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        213⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        214⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        215⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        216⤵
        Modifies registry class
        
        PID:3900
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        217⤵
        Modifies registry class
        
        PID:1432
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7400
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        219⤵
        Modifies registry class
        
        PID:7532
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        220⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        221⤵
        Drops file in System32 directory
        
        PID:7772
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        222⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        223⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        224⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        225⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7416
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        227⤵
        Modifies registry class
        
        PID:7108
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        228⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        229⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        230⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        231⤵
        Drops file in System32 directory
        
        PID:7616
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7892
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        233⤵
        Drops file in System32 directory
        
        PID:8184
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        234⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        235⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        236⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        237⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        238⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        239⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        240⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        241⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8364
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        243⤵
        Drops file in System32 directory
        
        PID:8404
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        244⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        245⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        246⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8536
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        247⤵
        Drops file in System32 directory
        
        PID:8580
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        248⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8668
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        250⤵
        Modifies registry class
        
        PID:8708
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        251⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8796
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        253⤵
        Drops file in System32 directory
        
        PID:8836
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        254⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        255⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        256⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        257⤵
        Drops file in System32 directory
        
        PID:9004
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        258⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9100
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        260⤵
        Modifies registry class
        
        PID:9132
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        261⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        262⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        263⤵
        Drops file in System32 directory
        
        PID:8240
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        264⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        265⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        266⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        267⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        268⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        269⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        270⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        271⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        272⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        273⤵
        Modifies registry class
        
        PID:8860
        
        C:\Windows\SysWOW64\Pmbegqjk.exe
        
        C:\Windows\system32\Pmbegqjk.exe
        274⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Qppaclio.exe
        
        C:\Windows\system32\Qppaclio.exe
        275⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9012
        
        C:\Windows\SysWOW64\Qiiflaoo.exe
        
        C:\Windows\system32\Qiiflaoo.exe
        276⤵
        Drops file in System32 directory
        
        PID:9084
        
        C:\Windows\SysWOW64\Qpbnhl32.exe
        
        C:\Windows\system32\Qpbnhl32.exe
        277⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        278⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        279⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        280⤵
        Modifies registry class
        
        PID:8400
        
        C:\Windows\SysWOW64\Aimogakj.exe
        
        C:\Windows\system32\Aimogakj.exe
        281⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        282⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Aiplmq32.exe
        
        C:\Windows\system32\Aiplmq32.exe
        283⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        284⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Amnebo32.exe
        
        C:\Windows\system32\Amnebo32.exe
        285⤵
        Drops file in System32 directory
        
        PID:8828
        
        C:\Windows\SysWOW64\Affikdfn.exe
        
        C:\Windows\system32\Affikdfn.exe
        286⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        287⤵
        
        PID:648
        
        C:\Windows\SysWOW64\Bjfogbjb.exe
        
        C:\Windows\system32\Bjfogbjb.exe
        288⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        289⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        290⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        291⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Bphqji32.exe
        
        C:\Windows\system32\Bphqji32.exe
        292⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Bfaigclq.exe
        
        C:\Windows\system32\Bfaigclq.exe
        293⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Bmladm32.exe
        
        C:\Windows\system32\Bmladm32.exe
        294⤵
        Modifies registry class
        
        PID:9128
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        295⤵
        Drops file in System32 directory
        
        PID:8208
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        296⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Cdhffg32.exe
        
        C:\Windows\system32\Cdhffg32.exe
        297⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Ckbncapd.exe
        
        C:\Windows\system32\Ckbncapd.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5684
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        299⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Caqpkjcl.exe
        
        C:\Windows\system32\Caqpkjcl.exe
        300⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        301⤵
        Drops file in System32 directory
        
        PID:8924
        
        C:\Windows\SysWOW64\Dgpeha32.exe
        
        C:\Windows\system32\Dgpeha32.exe
        302⤵
        Modifies registry class
        
        PID:8288
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        303⤵
        Drops file in System32 directory
        
        PID:8920
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        304⤵
        Modifies registry class
        
        PID:8664
        
        C:\Windows\SysWOW64\Dcibca32.exe
        
        C:\Windows\system32\Dcibca32.exe
        305⤵
        Drops file in System32 directory
        
        PID:8896
        
        C:\Windows\SysWOW64\Ddhomdje.exe
        
        C:\Windows\system32\Ddhomdje.exe
        306⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Dkedonpo.exe
        
        C:\Windows\system32\Dkedonpo.exe
        307⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Ekgqennl.exe
        
        C:\Windows\system32\Ekgqennl.exe
        308⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Egnajocq.exe
        
        C:\Windows\system32\Egnajocq.exe
        309⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Epffbd32.exe
        
        C:\Windows\system32\Epffbd32.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9472
        
        C:\Windows\SysWOW64\Enjfli32.exe
        
        C:\Windows\system32\Enjfli32.exe
        311⤵
        Drops file in System32 directory
        
        PID:9524
        
        C:\Windows\SysWOW64\Egbken32.exe
        
        C:\Windows\system32\Egbken32.exe
        312⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Eqkondfl.exe
        
        C:\Windows\system32\Eqkondfl.exe
        313⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Ekqckmfb.exe
        
        C:\Windows\system32\Ekqckmfb.exe
        314⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Fclhpo32.exe
        
        C:\Windows\system32\Fclhpo32.exe
        315⤵
        Modifies registry class
        
        PID:9700
        
        C:\Windows\SysWOW64\Famhmfkl.exe
        
        C:\Windows\system32\Famhmfkl.exe
        316⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Fgiaemic.exe
        
        C:\Windows\system32\Fgiaemic.exe
        317⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Fqbeoc32.exe
        
        C:\Windows\system32\Fqbeoc32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9828
        
        C:\Windows\SysWOW64\Fglnkm32.exe
        
        C:\Windows\system32\Fglnkm32.exe
        319⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Fnffhgon.exe
        
        C:\Windows\system32\Fnffhgon.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9912
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        321⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        322⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        323⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Gdgdeppb.exe
        
        C:\Windows\system32\Gdgdeppb.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10100
        
        C:\Windows\SysWOW64\Gbkdod32.exe
        
        C:\Windows\system32\Gbkdod32.exe
        325⤵
        Drops file in System32 directory
        
        PID:10144
        
        C:\Windows\SysWOW64\Gggmgk32.exe
        
        C:\Windows\system32\Gggmgk32.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10192
        
        C:\Windows\SysWOW64\Gdknpp32.exe
        
        C:\Windows\system32\Gdknpp32.exe
        327⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Gjhfif32.exe
        
        C:\Windows\system32\Gjhfif32.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9256
        
        C:\Windows\SysWOW64\Gqbneq32.exe
        
        C:\Windows\system32\Gqbneq32.exe
        329⤵
        Modifies registry class
        
        PID:4988
        
        C:\Windows\SysWOW64\Gkhbbi32.exe
        
        C:\Windows\system32\Gkhbbi32.exe
        330⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Gbbkocid.exe
        
        C:\Windows\system32\Gbbkocid.exe
        331⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Hccggl32.exe
        
        C:\Windows\system32\Hccggl32.exe
        332⤵
        Modifies registry class
        
        PID:9512
        
        C:\Windows\SysWOW64\Hjmodffo.exe
        
        C:\Windows\system32\Hjmodffo.exe
        333⤵
        Drops file in System32 directory
        
        PID:9592
        
        C:\Windows\SysWOW64\Hqghqpnl.exe
        
        C:\Windows\system32\Hqghqpnl.exe
        334⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Hjolie32.exe
        
        C:\Windows\system32\Hjolie32.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8724
        
        C:\Windows\SysWOW64\Heepfn32.exe
        
        C:\Windows\system32\Heepfn32.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9764
        
        C:\Windows\SysWOW64\Hegmlnbp.exe
        
        C:\Windows\system32\Hegmlnbp.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9840
        
        C:\Windows\SysWOW64\Hkaeih32.exe
        
        C:\Windows\system32\Hkaeih32.exe
        338⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Hbknebqi.exe
        
        C:\Windows\system32\Hbknebqi.exe
        339⤵
        Drops file in System32 directory
        
        PID:9972
        
        C:\Windows\SysWOW64\Hcljmj32.exe
        
        C:\Windows\system32\Hcljmj32.exe
        340⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Hnbnjc32.exe
        
        C:\Windows\system32\Hnbnjc32.exe
        341⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Icogcjde.exe
        
        C:\Windows\system32\Icogcjde.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10176
        
        C:\Windows\SysWOW64\Ibpgqa32.exe
        
        C:\Windows\system32\Ibpgqa32.exe
        343⤵
        Modifies registry class
        
        PID:5376
        
        C:\Windows\SysWOW64\Ijkled32.exe
        
        C:\Windows\system32\Ijkled32.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9332
        
        C:\Windows\SysWOW64\Iholohii.exe
        
        C:\Windows\system32\Iholohii.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9416
        
        C:\Windows\SysWOW64\Ijpepcfj.exe
        
        C:\Windows\system32\Ijpepcfj.exe
        346⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Ieeimlep.exe
        
        C:\Windows\system32\Ieeimlep.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9660
        
        C:\Windows\SysWOW64\Jbijgp32.exe
        
        C:\Windows\system32\Jbijgp32.exe
        348⤵
        Drops file in System32 directory
        
        PID:9736
        
        C:\Windows\SysWOW64\Jjdokb32.exe
        
        C:\Windows\system32\Jjdokb32.exe
        349⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Janghmia.exe
        
        C:\Windows\system32\Janghmia.exe
        350⤵
        Drops file in System32 directory
        
        PID:9944
        
        C:\Windows\SysWOW64\Jjgkab32.exe
        
        C:\Windows\system32\Jjgkab32.exe
        351⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Jelonkph.exe
        
        C:\Windows\system32\Jelonkph.exe
        352⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Jjihfbno.exe
        
        C:\Windows\system32\Jjihfbno.exe
        353⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\Jbbmmo32.exe
        
        C:\Windows\system32\Jbbmmo32.exe
        354⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Jddiegbm.exe
        
        C:\Windows\system32\Jddiegbm.exe
        355⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Jlkafdco.exe
        
        C:\Windows\system32\Jlkafdco.exe
        356⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Kbeibo32.exe
        
        C:\Windows\system32\Kbeibo32.exe
        357⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Klmnkdal.exe
        
        C:\Windows\system32\Klmnkdal.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10212
        
        C:\Windows\SysWOW64\Kbgfhnhi.exe
        
        C:\Windows\system32\Kbgfhnhi.exe
        359⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Kdhbpf32.exe
        
        C:\Windows\system32\Kdhbpf32.exe
        360⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Kongmo32.exe
        
        C:\Windows\system32\Kongmo32.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9952
        
        C:\Windows\SysWOW64\Kehojiej.exe
        
        C:\Windows\system32\Kehojiej.exe
        362⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Kkegbpca.exe
        
        C:\Windows\system32\Kkegbpca.exe
        363⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Kaopoj32.exe
        
        C:\Windows\system32\Kaopoj32.exe
        364⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Kocphojh.exe
        
        C:\Windows\system32\Kocphojh.exe
        365⤵
        Drops file in System32 directory
        
        PID:9504
        
        C:\Windows\SysWOW64\Klgqabib.exe
        
        C:\Windows\system32\Klgqabib.exe
        366⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Ldbefe32.exe
        
        C:\Windows\system32\Ldbefe32.exe
        367⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\Llimgb32.exe
        
        C:\Windows\system32\Llimgb32.exe
        368⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Lbcedmnl.exe
        
        C:\Windows\system32\Lbcedmnl.exe
        369⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Lddble32.exe
        
        C:\Windows\system32\Lddble32.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10356
        
        C:\Windows\SysWOW64\Llngbabj.exe
        
        C:\Windows\system32\Llngbabj.exe
        371⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Loopdmpk.exe
        
        C:\Windows\system32\Loopdmpk.exe
        372⤵
        Modifies registry class
        
        PID:10444
        
        C:\Windows\SysWOW64\Mhiabbdi.exe
        
        C:\Windows\system32\Mhiabbdi.exe
        373⤵
        Drops file in System32 directory
        
        PID:10488
        
        C:\Windows\SysWOW64\Mociol32.exe
        
        C:\Windows\system32\Mociol32.exe
        374⤵
        Modifies registry class
        
        PID:10524
        
        C:\Windows\SysWOW64\Mdpagc32.exe
        
        C:\Windows\system32\Mdpagc32.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10568
        
        C:\Windows\SysWOW64\Madbagif.exe
        
        C:\Windows\system32\Madbagif.exe
        376⤵
        Drops file in System32 directory
        
        PID:10616
        
        C:\Windows\SysWOW64\Mebkge32.exe
        
        C:\Windows\system32\Mebkge32.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10660
        
        C:\Windows\SysWOW64\Mllccpfj.exe
        
        C:\Windows\system32\Mllccpfj.exe
        378⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Mcfkpjng.exe
        
        C:\Windows\system32\Mcfkpjng.exe
        379⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Medglemj.exe
        
        C:\Windows\system32\Medglemj.exe
        380⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Nkapelka.exe
        
        C:\Windows\system32\Nkapelka.exe
        381⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Nheqnpjk.exe
        
        C:\Windows\system32\Nheqnpjk.exe
        382⤵
        Modifies registry class
        
        PID:10868
        
        C:\Windows\SysWOW64\Namegfql.exe
        
        C:\Windows\system32\Namegfql.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10916
        
        C:\Windows\SysWOW64\Nlcidopb.exe
        
        C:\Windows\system32\Nlcidopb.exe
        384⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Nlefjnno.exe
        
        C:\Windows\system32\Nlefjnno.exe
        385⤵
        Modifies registry class
        
        PID:11004
        
        C:\Windows\SysWOW64\Nfnjbdep.exe
        
        C:\Windows\system32\Nfnjbdep.exe
        386⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Nofoki32.exe
        
        C:\Windows\system32\Nofoki32.exe
        387⤵
        Drops file in System32 directory
        
        PID:11084
        
        C:\Windows\SysWOW64\Ofbdncaj.exe
        
        C:\Windows\system32\Ofbdncaj.exe
        388⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Ocfdgg32.exe
        
        C:\Windows\system32\Ocfdgg32.exe
        389⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Odgqopeb.exe
        
        C:\Windows\system32\Odgqopeb.exe
        390⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11212
        
        C:\Windows\SysWOW64\Okailj32.exe
        
        C:\Windows\system32\Okailj32.exe
        391⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11248
        
        C:\Windows\SysWOW64\Ofgmib32.exe
        
        C:\Windows\system32\Ofgmib32.exe
        392⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Oooaah32.exe
        
        C:\Windows\system32\Oooaah32.exe
        393⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\Ofijnbkb.exe
        
        C:\Windows\system32\Ofijnbkb.exe
        394⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Okfbgiij.exe
        
        C:\Windows\system32\Okfbgiij.exe
        395⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Pdngpo32.exe
        
        C:\Windows\system32\Pdngpo32.exe
        396⤵
        
        PID:944
        
        C:\Windows\SysWOW64\Pfncia32.exe
        
        C:\Windows\system32\Pfncia32.exe
        397⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\Pmhkflnj.exe
        
        C:\Windows\system32\Pmhkflnj.exe
        398⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Pecpknke.exe
        
        C:\Windows\system32\Pecpknke.exe
        399⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Poidhg32.exe
        
        C:\Windows\system32\Poidhg32.exe
        400⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Pkoemhao.exe
        
        C:\Windows\system32\Pkoemhao.exe
        401⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Pbimjb32.exe
        
        C:\Windows\system32\Pbimjb32.exe
        402⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Piceflpi.exe
        
        C:\Windows\system32\Piceflpi.exe
        403⤵
        Modifies registry class
        
        PID:1988
        
        C:\Windows\SysWOW64\Pcijce32.exe
        
        C:\Windows\system32\Pcijce32.exe
        404⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Qfgfpp32.exe
        
        C:\Windows\system32\Qfgfpp32.exe
        405⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Qmanljfo.exe
        
        C:\Windows\system32\Qmanljfo.exe
        406⤵
        Modifies registry class
        
        PID:2488
        
        C:\Windows\SysWOW64\Qbngeadf.exe
        
        C:\Windows\system32\Qbngeadf.exe
        407⤵
        
        PID:836
        
        C:\Windows\SysWOW64\Qihoak32.exe
        
        C:\Windows\system32\Qihoak32.exe
        408⤵
        Modifies registry class
        
        PID:11028
        
        C:\Windows\SysWOW64\Qcncodki.exe
        
        C:\Windows\system32\Qcncodki.exe
        409⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\Aflpkpjm.exe
        
        C:\Windows\system32\Aflpkpjm.exe
        410⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Akihcfid.exe
        
        C:\Windows\system32\Akihcfid.exe
        411⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Abcppq32.exe
        
        C:\Windows\system32\Abcppq32.exe
        412⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Abemep32.exe
        
        C:\Windows\system32\Abemep32.exe
        413⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Amkabind.exe
        
        C:\Windows\system32\Amkabind.exe
        414⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\Acdioc32.exe
        
        C:\Windows\system32\Acdioc32.exe
        415⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Ammnhilb.exe
        
        C:\Windows\system32\Ammnhilb.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10124
        
        C:\Windows\SysWOW64\Afeban32.exe
        
        C:\Windows\system32\Afeban32.exe
        417⤵
        Modifies registry class
        
        PID:940
        
        C:\Windows\SysWOW64\Bblcfo32.exe
        
        C:\Windows\system32\Bblcfo32.exe
        418⤵
        Modifies registry class
        
        PID:1856
        
        C:\Windows\SysWOW64\Bmagch32.exe
        
        C:\Windows\system32\Bmagch32.exe
        419⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Bboplo32.exe
        
        C:\Windows\system32\Bboplo32.exe
        420⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Bihhhi32.exe
        
        C:\Windows\system32\Bihhhi32.exe
        421⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Bflham32.exe
        
        C:\Windows\system32\Bflham32.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10696
        
        C:\Windows\SysWOW64\Bcpika32.exe
        
        C:\Windows\system32\Bcpika32.exe
        423⤵
        Modifies registry class
        
        PID:3916
        
        C:\Windows\SysWOW64\Bfabmmhe.exe
        
        C:\Windows\system32\Bfabmmhe.exe
        424⤵
        Drops file in System32 directory
        
        PID:10852
        
        C:\Windows\SysWOW64\Cdebfago.exe
        
        C:\Windows\system32\Cdebfago.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10940
        
        C:\Windows\SysWOW64\Cibkohef.exe
        
        C:\Windows\system32\Cibkohef.exe
        426⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Cbjogmlf.exe
        
        C:\Windows\system32\Cbjogmlf.exe
        427⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\Cidgdg32.exe
        
        C:\Windows\system32\Cidgdg32.exe
        428⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2028
        
        C:\Windows\SysWOW64\Cfhhml32.exe
        
        C:\Windows\system32\Cfhhml32.exe
        429⤵
        Drops file in System32 directory
        
        PID:2560
        
        C:\Windows\SysWOW64\Cleqfb32.exe
        
        C:\Windows\system32\Cleqfb32.exe
        430⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Cboibm32.exe
        
        C:\Windows\system32\Cboibm32.exe
        431⤵
        Modifies registry class
        
        PID:4608
        
        C:\Windows\SysWOW64\Clgmkbna.exe
        
        C:\Windows\system32\Clgmkbna.exe
        432⤵
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\Cbaehl32.exe
        
        C:\Windows\system32\Cbaehl32.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2944
        
        C:\Windows\SysWOW64\Clijablo.exe
        
        C:\Windows\system32\Clijablo.exe
        434⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4212
        
        C:\Windows\SysWOW64\Dfonnk32.exe
        
        C:\Windows\system32\Dfonnk32.exe
        435⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Dllffa32.exe
        
        C:\Windows\system32\Dllffa32.exe
        436⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Dfakcj32.exe
        
        C:\Windows\system32\Dfakcj32.exe
        437⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\Ddekmo32.exe
        
        C:\Windows\system32\Ddekmo32.exe
        438⤵
        Drops file in System32 directory
        
        PID:2604
        
        C:\Windows\SysWOW64\Defheg32.exe
        
        C:\Windows\system32\Defheg32.exe
        439⤵
        Drops file in System32 directory
        
        PID:3632
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        440⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10892 -s 408
        441⤵
        Program crash
        
        PID:11080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 10892 -ip 10892
1⤵
PID:10996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acccdj32.exe

Filesize
256KB

MD5
ab7e2d3e9ea3f371fc4c5cb31acdf525

SHA1
26b42e975c412d92504330817205386d88f3794e

SHA256
ace6e72351ad8e4c0ec3c80cc8d6cd1bdf925ce6489eabde3246e21490a6acef

SHA512
907babf0fae5909fdfbd90173e351b3a1854ff04d4d12b8ec78e99270e6a488fd4e6899027942aab466dd8e0f687c6184614f6730279e6869452269b58cd8c5f

Download Submit
C:\Windows\SysWOW64\Addaif32.exe

Filesize
256KB

MD5
7ddec9ece51789bffc6eb5fbe3fb313c

SHA1
f7bdb73ad3830024277c625fcfba6df5303b188c

SHA256
680b671cc87d714e260fa0fa892f376f7415e179d87253efa0abcfc4129e5b8a

SHA512
017e0aa01523598ab6da798f158ab0762a8e990c59ede51be3e4fc5c5fbdd3cffb3a7c60a1cd73c22196df0e253a62716c08c41e00d09eba3f5910e7ca726936

Download Submit
C:\Windows\SysWOW64\Akepfpcl.exe

Filesize
256KB

MD5
09a7771dffd8792ba8280e01e1ea9d09

SHA1
006a8fe05fd423e59d3dee4af8181ce185ab32de

SHA256
804a29b9eb37afea36ddb1910180b88ef19d7454dd2a26a083d71697afc5203e

SHA512
6e0460d6750bc83a61861d018a4fbf56a863f1c5ff662f1b595831467092b137a9842b58460d3df9aa2096335cf2dc9c37537b2cf91c56a34dbaa8b3e95f449a

Download Submit
C:\Windows\SysWOW64\Alelqb32.exe

Filesize
256KB

MD5
e621a17769e4c81d7c5ead69c963f4b8

SHA1
93073afa37acf42ad28b69a7af2fdef38f4f89ef

SHA256
0cf80d68de0c4818341219aac7d3fdabba418c39ea9bc093b5519d06450f6a6f

SHA512
1267109b531d2d1c99e3ed70413807036799858ff8ba52d8b1ec4b11e59ee19824de25e4e4a2b78bf91d9cffe8c6108468382669d76f251230f503baec40d189

Download Submit
C:\Windows\SysWOW64\Alpbecod.exe

Filesize
256KB

MD5
e6507930ff8b986213b2717101f91883

SHA1
dd36ebe8514525427b0310fd971962185c2fe8b4

SHA256
4a1585beadfecb8e2a0cf1d5947e0b77619ba502b3c006381c85e3309ace7557

SHA512
9754e649ce89d2d750405c81dbcc10f063549a26051ed70d73e32f9a68beb36e40a0531ab6f6fde8b2cca070cbff682d2ceef607aa29fbf842942167f9e2aff2

Download Submit
C:\Windows\SysWOW64\Bnhenj32.exe

Filesize
256KB

MD5
5bc48b90c767f1fa854f5538e56ec8f0

SHA1
d085c86e1b7ad9a66ac3ef003240a61cd24bdbb7

SHA256
edce8302f7539d0fbf26f79d6fa40b6b9be6c3febf0569b0a3ac196f75dcca68

SHA512
6ba4dd6982185c562504db1518edae9c1d827e34c94f5670b526cda190bb951d83dd7129cbbf68caf630253a483d31429e87f446a482aaeba250955f6f822582

Download Submit
C:\Windows\SysWOW64\Ccmcgcmp.exe

Filesize
256KB

MD5
c99a5c0a1e9dbfaa9c449542645b65ec

SHA1
0571dd206d2d5c0bee318cc7d371211007612ca7

SHA256
9e3f0aef0ba4253b8bb8b821c3a026530daec37aff50752a7866bd1cfeba1b12

SHA512
301b91b65cbf600d8c7d4d0855f2ba9e2a8b32323dcff53e9d034f40b1b25864f2102e64738dd524ce176f9fcfacd16b0880d6a33726bebec71898d0736525cb

Download Submit
C:\Windows\SysWOW64\Dgeenfog.exe

Filesize
256KB

MD5
5b43547029136c6ba83582c57c772c1a

SHA1
b9dff9e5bd6234753e65a9983a8fbf287af08c8a

SHA256
7f4e77f789758f03cd95954b87b7ff37062864fa3622a5c16a7ee4e3432da0f9

SHA512
28d4112496e2ebc089091d5437b5d56274ec1c1b815d33c912e83f2db881db30b0a921b4ee3ea6d636708ff734a95b5c1b31dd92b630a973ed0a9119a88670d1

Download Submit
C:\Windows\SysWOW64\Dhclmp32.exe

Filesize
256KB

MD5
99b85be42ba970323854a7968edd3b23

SHA1
82f4393b3a27827642064832d888181fa1aaac49

SHA256
5447eab9e04c8e986ca2f5195005d5190c470a4dabd02f0b529805cdf4c2ed98

SHA512
55bbc010df3e25b5c268526a18ee5f1d1b942694b545b2a33559ab403a12ae58a367c2929e8af32d262bc495a02e76ffcadeb23428fa5f0c64123f80d88287b9

Download Submit
C:\Windows\SysWOW64\Ekjded32.exe

Filesize
256KB

MD5
41d759ee2a0eec718a35e673eb836be4

SHA1
6f794d843c31d82ecc185b76687adecedebbe2e2

SHA256
bd1b6eb0c16686b39308c4f8ab43a032008ede2350d134f57bad3004609a5927

SHA512
55f97ce4c3a340b00a189db1a0c5765ab6d69ef1819c523cacb2592c32f78a6e0b6d01fdf0e0e3df31c2162f22960a96c9e5fce08fd989cd2bbdf09f0c35207c

Download Submit
C:\Windows\SysWOW64\Figgdg32.exe

Filesize
256KB

MD5
7968d6892e74317a0e0c2ca40b004d28

SHA1
492ea759cbab9c2d122df135f1f04c894e9a4c90

SHA256
5842a4cc81b0cf5ea78369bdffb671730b2c9a460e5824e264b12cf7be8869ae

SHA512
0b1c6552a64810acdf3f8479a6f352d2d7e540730699a8c82d80dc05001964db62cb3352b7b32c46ca97deb181d60e662a0527c9c69b0f31b5207ff6e82523ef

Download Submit
C:\Windows\SysWOW64\Fmmmfj32.exe

Filesize
256KB

MD5
9633109ba49ff47a714611e987c223a2

SHA1
482c8a4f2175f42f9380512099db30d15e4514cf

SHA256
6487b3e00eb0e1699ea1730664f47ae348c8d532f2d5b1f2addb02edd458ad8a

SHA512
803027cde860eae41aee039c00c2d5fb7a37d2f29ba3019172ad117e85b6ba99869622077e7a863e97342cd1ba277be4825087b66df4e790f29dd196537ddda0

Download Submit
C:\Windows\SysWOW64\Fqeioiam.exe

Filesize
256KB

MD5
84f6bf96589eac143dc0653f8beedd15

SHA1
ff9c82368f4099a13ed3148d47772d01f617bb6f

SHA256
8e4749d0aad2a7c2c7d7968c9a849eca265f35fb3a510d4da28064092b13e824

SHA512
779f210fea742c69a18553d3782dd201341f3418b16445b8073ece55faeac9b6521606e16eaea78da01f1bd1f7f02ed7ab089552599cca40660045d7886d136e

Download Submit
C:\Windows\SysWOW64\Gemkelcd.exe

Filesize
256KB

MD5
486a21d246a604affaacea489fd91980

SHA1
6aa2724a7ba871800ae63e2a0988c1b4ce92ab91

SHA256
d4e4b79e47fb908700fc7b6f51c47ddc30450f9136d35b349d690194365adf92

SHA512
84d43a1223150e250f34a46ecfea1c6f34130f9c425de43d646d94f561cc669fe80e693a06a38ed6bace707f42bbf23a1a4d8c75dc164434fafd3def98730bfe

Download Submit
C:\Windows\SysWOW64\Gggmgk32.exe

Filesize
256KB

MD5
88c6f1236fd9f5136502360b9d666305

SHA1
17f6580e66d66a179e8276f38b8dd0deb9d4a3b9

SHA256
9bf48cc8b7a6f2528d759e46b76cb908fdd335d6c6bce6050667a168c61902e9

SHA512
02089e5588bd7585955cfb6645c7de0987e5b00cffceac8de229b408f5c4b20831f3d5ed2287ffb5ab20262a1fb48820dac1437504594bc45972b6e53ea7d96b

Download Submit
C:\Windows\SysWOW64\Gnnccl32.exe

Filesize
256KB

MD5
eb45b32be8a6aea0bf21f0b2e4c2c2eb

SHA1
6c197145ee822e2ea0eee82460ddef957c3b18c2

SHA256
3e4fcc784952223f1fbd9f9ec92ac26f4bad02911c340cd60697422d1aa2602f

SHA512
6fbc4d6a8c5edcc971fd86610ebb5fd5a76dc32f4fef8d6a2c41fca4165146e80da2d5a6a51563e0bec45d4b49ce0a60c2ed0d0f54ca072847e5fd6da075b4c5

Download Submit
C:\Windows\SysWOW64\Iahgad32.exe

Filesize
256KB

MD5
56171dde164a0107addbc0482b4abd7b

SHA1
75cde1dac99f66a22be9fb36b01c1af5f754e6c6

SHA256
efabb6beb6aa953cdbcb2da32a347678009d1a9306b60d501b150ba6abc3601a

SHA512
4b4d048cb3cd3e737d8deb376459f834f7cf27f813bc378c5245ee551356977f12d82c461df8d9ad7e9f681502d7d184183ba7abfa2a4ee230895bd1c53fd76b

Download Submit
C:\Windows\SysWOW64\Iholohii.exe

Filesize
256KB

MD5
22c0793ad865d764bbc48466a4080b73

SHA1
63bb8b7423e7f7ea58faa66e63b9439343d818b1

SHA256
13fe5dbb54b1a1b39d5b9c53995efa6ae9940dd101c703255dac7af6dce2b6f7

SHA512
dc9ba6950348e136598c9a9f06894fec6bdda872756b5148c701c639f91a3f98a0ae493c05930ef28939cb755c55f2725246c1d49669f2ec23534b8aae0fc8a5

Download Submit
C:\Windows\SysWOW64\Jaonbc32.exe

Filesize
256KB

MD5
0205d2e25c0aba16a1b779bbe71b9356

SHA1
332a1d2a146a27eaecf15eb6842cfb12191bd961

SHA256
2bff78e9639d0ecc59526bd05ce3acb076234ea24801260af05e186e460e965d

SHA512
ae6dbdf2e4a468efa9dc6730e22c3295324ec1e606882e41a546afcb7b4392b8a096b7d9067b90ebb8535684c6dd749b471f50b0dbfb492a05f8436eeacb9ebe

Download Submit
C:\Windows\SysWOW64\Kjmfjj32.exe

Filesize
256KB

MD5
817dff5eeac0ad96656ed0ced60af4f4

SHA1
4f260c938bdd967e29af5441c86bcd1f9f820999

SHA256
d5f2974e07f0ec2d9574e78fb01f3da2b9afb7180a467e933a95860622fc206c

SHA512
20770f76ed8edced9f63daf0ca33032ff0be1f7674ff5859a50b2cb23cf4e5087b9abeded5ff70bce27d25338c7e03d1b02de958ac3c477aba1ab408b50bae12

Download Submit
C:\Windows\SysWOW64\Knchpiom.exe

Filesize
256KB

MD5
d9641bf8711d1b5aed9a515ecc895db8

SHA1
fb16f2880a7299ec04f5dc221ac35925a49f14d6

SHA256
ee635811637353399a157964b226fb65b70ce5c660fdbbe447a9d42a7651ece5

SHA512
318da7fe13c87211d7a5e8a87a4b9092433a660677a0b5b5766cd759d99ab7b030e57a06f97a4e6f98d643e85e406f57beff10038b8c6b23d0ff7943e86fbf10

Download Submit
C:\Windows\SysWOW64\Lekmnajj.exe

Filesize
256KB

MD5
ef3aef424a867afd3afcfe1b928f718e

SHA1
70faeae855060699caa6f70a7743d815979a65c5

SHA256
c58e813db7def396188a1e0235b5ab238d5d0019ca6969a79aff538e201dcbb2

SHA512
ad26f62bb99df9f9f2e54841a5153028aed6f6b79135d4e7009c7660da825f0354483762847e5ac4c9efa08d51c30e41964c7b13a0361f924aebce15c54dbe1f

Download Submit
C:\Windows\SysWOW64\Lenicahg.exe

Filesize
256KB

MD5
e12d978e22e8c0bae2eae976277c5906

SHA1
38580235107cabfd6a78d7a7648cbfdfbe31775c

SHA256
9af92ac819815f3b62282c153cc750e6c4eb549a74f6ed446279348331de3104

SHA512
ccefc5cca36966a4000f3c8e7ea0ec585d790efd0d04c95ab2934a0bf679391809373a8e942b97a948e2d31ce9fa250086a5b29b5dad4c0ee9e6be1bffcc15b7

Download Submit
C:\Windows\SysWOW64\Lgccinoe.exe

Filesize
256KB

MD5
a8d393cf8f95c3e22b82600b8dd2f3d5

SHA1
d7cd246562aee8bbd1373dc51456ef3697cc6f03

SHA256
a00dcfe1e1e3699dbdb8b97b34aea598486b86c9ccb6635824f48b1963b89de0

SHA512
66294d4a8efbbb85aeef754cd1dfd099a11112dbe1a0287b4e503d528e30f0b085545a2feb7cf128591671a8be44b99089ead192f15ac82036a408c04163bafe

Download Submit
C:\Windows\SysWOW64\Lgqfdnah.exe

Filesize
256KB

MD5
d106bb2b5f16448f3ce7bae5e2ff38ad

SHA1
ce0295d8f84affcd63b2063bf93924d197b8828a

SHA256
9771e701e19b0014699f955d852544e5754422e024f6754848124b8ba4d02455

SHA512
d5be234197b55d78d8447ea34e0b692370e4a861aac5490271abed59fb083f6351f1b646d333a451328416bf0ff004335b5516ed7a2c24fc5ead0a066195bed2

Download Submit
C:\Windows\SysWOW64\Ljclki32.exe

Filesize
256KB

MD5
6516267379d292b729062fba7f375d9b

SHA1
294b2d73edfc1cc897ddab3b50b4ff29decf333d

SHA256
410db6a323aa0cf34ead464c9c8428a9660a11453f019045d05e52ec61052320

SHA512
49b514d2216dbe059a878d03751f3f5071efc504000dc95343dc13edc98ea76f95cf19def911ba37c6fdf2a0454fd42aa5b94011ea219f91b8c92a6227f9f99a

Download Submit
C:\Windows\SysWOW64\Madbagif.exe

Filesize
256KB

MD5
0088e1f1a06dfc01ee8f8c5635a40627

SHA1
b510ec2ad84aff92a2ef819306db431dbff538f7

SHA256
5e0b466fd764c7d01ce9a41c6d00fdd65cc011d74a11756123aeb73e86a45d6b

SHA512
cf10c881a73fb955fdca607035ecb4714c3e36004b25807fc2be92216687af47607f2679501f5bc1a22e7b0deaa5b105ecea443de458d0a099f560e2cd15746b

Download Submit
C:\Windows\SysWOW64\Mebcop32.exe

Filesize
256KB

MD5
07ac40eb16572bf726236041f7b877ac

SHA1
a9f5c0f2ed57b632a8964d4d2342ccd4fb677010

SHA256
376a9d9388bb72f7447d2841749f1bab658d40c086ee2b461a77b884b467b0d2

SHA512
48a8bde8368f4ec97b00e7b81b8c9f1db62af342f6845ae559f9a2333ab9844c6fc84ec5cff54ff520cd93492d9c180f38b5176452599bd3b1327c962aa5c508

Download Submit
C:\Windows\SysWOW64\Megljppl.exe

Filesize
256KB

MD5
32938ac00c319fe9ec7857fe7f16d52c

SHA1
00e538c7b8cfc66bb591ecd5f2dabc2949bb3812

SHA256
22ad49be7a22027f6d57561521d8edafec968946d33306f739faa03e7efa4a28

SHA512
1d81079f31c434763727ef7f824733b7980f78653e0f22fda95a3dadf74a12579dd22fd9f588dd426d80cb144bae2a58615d27614636167397b5e450de0a9fb9

Download Submit
C:\Windows\SysWOW64\Mnfnlf32.exe

Filesize
256KB

MD5
5411831132806043b93f42c0b5c10b6f

SHA1
2bf1fa5c6cee5b5b4e9ae71626a08d7128c43e26

SHA256
5e47b51a8d0d042357b9bced57d77712287bb11ebc7541a94a7b813335cd947a

SHA512
cb3c64da2705db3e2e50f2e54b0c152b20e6d39ae22f3d2287f90949d80d6495ed9a72b881503820427e1cb10cac2d72a145509dc37123d7391a73421f189b38

Download Submit
C:\Windows\SysWOW64\Naecop32.exe

Filesize
256KB

MD5
3681f90e7d674e36f26f48fcd68f26d2

SHA1
bd309135f66772d4390b1647b85eb4ec09125cfb

SHA256
f84b8c4ba47e401c5f084c7f200931ec137cc41b72ddebc382c60938f73d8292

SHA512
133102fd06679e876e319c843ccdc7e22745e1ae32b1f2ed92d5a34324401c276bb8b8a9f4f15630e1d5f98cbd210fb058411b2e270497ce7c335a40e1ebf5b8

Download Submit
C:\Windows\SysWOW64\Napjdpcn.exe

Filesize
256KB

MD5
d11e2f23fe6a7d8138e11084319ce624

SHA1
9213d7b7eb25475f0460db76a091a7fd1573520c

SHA256
d48f0a783c68353ab9a79a9ebea4ec950455d8d0734976f2b7ac9e647f530d33

SHA512
c088960c4edfe29e2881aa3820c436b4e91500f7765448eeceaf35b2d433ad6e732c755f9292bf11c76b3835d6e36c0db0acc9be03cfb985514c7a9dfedf7c72

Download Submit
C:\Windows\SysWOW64\Njinmf32.exe

Filesize
256KB

MD5
9ff0d1d4c7fc3b93130272b45f5a28f9

SHA1
d3a86cf606970294b5c5375cdd5bc9efb48dd26f

SHA256
c410d2248b52d3caf30ea06a5c5728ae9d64167776e2839226fb100c10590dcb

SHA512
3aba75335aa503c4365b4fec6ac9f85ad72dedeaa2723fdc272c7406d27bfdfde1904490c7d60ae81a17d2442296386d85ededbd09cb21f45c6c9af3b2c9d23c

Download Submit
C:\Windows\SysWOW64\Njmhhefi.exe

Filesize
256KB

MD5
2491502c21932052de9d212ae9d687cd

SHA1
b9752753504440272d525be5a98b99a0a869a4eb

SHA256
a19facf4d2e42e48652bb111fbc158301cbbf9fe51caf77f34c9bc54c8dd0c13

SHA512
cb32715f2ef34982a2e9345f091145ef369adeb2ec0d5c532985b5c6a8109763392ec90e14d06780949fad8790050cbb5ad1f8afdcff2d0df53847cdbd9a37a8

Download Submit
C:\Windows\SysWOW64\Nmnqjp32.exe

Filesize
256KB

MD5
b94fe2f43bb70c2cbf44093c02dbd808

SHA1
d3b8d55126279005b99e3661a16565787c4021e7

SHA256
e66ce91e19c5f9b93646d362e234f23638dd1686f502af53db92efbb4138feaf

SHA512
42ff6e75be035d66d43bded37227c9d6f4efd8a6afa95af662c5a3c37f1037984a902cb4e9651e257c1ae95aaee3100f026c2d64f5b0fa0c06007d3d6be1c5ce

Download Submit
C:\Windows\SysWOW64\Odalmibl.exe

Filesize
256KB

MD5
4a7b8e56899609e6f4ce202af529a843

SHA1
edaa09e275993b4ed80bd0ff7bcd2f5d3f2dbccc

SHA256
494ebc2ba85a1df45c2a4be788042c678b6cb83de6d1aaeaebf0ea92b02206ab

SHA512
4d846e18857d1cfba0f06e5237331bd103a211525ca397274d9ce69239344c4baab565823b238bde5cbb94138dcbcd813e0e539f571729d4cd3bbab963a16637

Download Submit
C:\Windows\SysWOW64\Ofbdncaj.exe

Filesize
256KB

MD5
5a87695978af36f8d2cca2e0f19a3f26

SHA1
0207d0c080b27b01156487c65246ceef2e4df0c6

SHA256
3682e0046d08ae31e8738a3fbe6d7ffb2bc353d6a2867381c35d63572b763250

SHA512
9891de549420908442e4d0ca7b173f086d18880db91f83123a33897a9d12a6163f8a551f0d2c461f5dfc95f073872d11a4b691e6c6baf1de482b79b84a1b1767

Download Submit
C:\Windows\SysWOW64\Ohcegi32.exe

Filesize
256KB

MD5
e24078bf49f34b8f5eefbc3ac3072a27

SHA1
dc36b9e617bd1a21b5498ce4bdb0b4cc403b6171

SHA256
3c89ca24306c2dd60febe2b53d6c5cf7dcd107695089229e77dcade88143b268

SHA512
c26fbcee32a1fb23de86a300bc6208f378db4823c9a3941de03db5c8f480d963156d4dba43c5974c4371f699d0ed49d184eb999f8c09cf5706f3b2feb7fccb30

Download Submit
C:\Windows\SysWOW64\Ohfami32.exe

Filesize
256KB

MD5
35f912c63d2601d1950554cb72508854

SHA1
b762bc089c3845a8cc8e6ed4aaa64d443fea46b5

SHA256
e36faadc834128b03292f46e12325fa361de6a624ff47bfb1769dd18240fb806

SHA512
8ad858773c7dc9052b7514157d0a039a04f0cf75db8de336f31db316e1a8b22393047939d8e2ab87e7c6e97e8e1dc207cb0ae2b01b8fed1c79b461e553392298

Download Submit
C:\Windows\SysWOW64\Oldjcg32.exe

Filesize
256KB

MD5
09b6ba2d7a5340a60774af4c363e38f7

SHA1
d3cac5bc2c3d2f2e90ed0abf4a8ca4f187d876f5

SHA256
b97ce6f1981cbf5c27686549481bc44a4e474c33a5399b8c8962e26460751e47

SHA512
3843e22fcc3f8e6da2f80226cee0d5074380b48a2ffad165cb78e9c34baf8da4aa59c2259fb4fe1dc962b25fc452a8278d69984d98d69a775e0ee96c0391dfb1

Download Submit
C:\Windows\SysWOW64\Omcjep32.exe

Filesize
256KB

MD5
db0a5e9538a33ebeb2052ac5f934ec2a

SHA1
3f0318c998b58f0d5fb8abd8b37d0178c350ef9b

SHA256
ddc963fee50761a7ab09af05c82fb36fbc5752825afbd847c697f20eafd96644

SHA512
b851ee04b4558630ef7bdcb70f1c66aacafcf5d0a229a3529cc16df0749a12f22c81d6b892f72ab5d47a3809ddc882803c1b637a03ec7d4eaca9f9e6c9708c26

Download Submit
C:\Windows\SysWOW64\Onapdl32.exe

Filesize
256KB

MD5
c49588f4b69d7b7c193c01afdd26eca4

SHA1
d52cd7f2e5ada98126b186a86b563a9c86a09f06

SHA256
fb6086358236d3b49f1c472a4d9d07e96c6a554b12884522a412941265c715fb

SHA512
b115849ad9567bf1eb28ed99908c10cc2688d9bb4adbf72815cd521c0ab34f1b9151ae7126aced41b68588b0ca8b2eba83543bd80460c8b140544bb1fae44342

Download Submit
C:\Windows\SysWOW64\Paoollik.exe

Filesize
256KB

MD5
00bf61a063496016d769138a0b848f27

SHA1
4cd657299e9417fdd78042add89117ad24c76a80

SHA256
93f291cd4c4dc4f98363b52360c3ac4e35734c73dfa706b82cd15ed9c43c438d

SHA512
2dc39d93e5fb1a22ba0798d99914922f11ae830ca1a32165bb4683fa86c1222062fa9d44dbaef77242d8892f603caa847c78fb912780c8aea389e92baff088a4

Download Submit
C:\Windows\SysWOW64\Pdkoch32.exe

Filesize
256KB

MD5
733e89a588b6c0d7e859c7c7d3b98043

SHA1
fa77cdcaec5bc33341747f918d3f75a42fcd1c5e

SHA256
afaf59cd64e038de6aad6c269541528bc0dd1d4ef80ee276a6be57c88f2c5277

SHA512
8e36b8a2217025933b1294cee7d7aa29157c9c864ed1cbe337493f0b8509ef5fba0762ce418a3ac71af51d0e8fb19980d35f1d33bb5a5c8ad44039b252346905

Download Submit
C:\Windows\SysWOW64\Pkpmdbfd.exe

Filesize
256KB

MD5
4a4012e43052c64199f30eb0ce8d63ef

SHA1
f2df4f075b89aef29de7e172571fa643f30bf3cb

SHA256
963a7fc9cdd07fa084533fad3e78cb7feb0020ea5a33334cc205f95edef3a059

SHA512
f280300f49deb37651a446ac89853862bf1ebc8f1b923c54ee5f2c5ff16af901b872ba2fd1b28a2ca97c2998d48558d884ec121e30100a58adae573dc7ae223d

Download Submit
C:\Windows\SysWOW64\Plkpcfal.exe

Filesize
256KB

MD5
b6f567ea48d4a50b285dbe0476047c37

SHA1
79243435ae8fd22fb63920f3004691e37c26a4fd

SHA256
c7594f01bf4a2abaddb05b1e6922996da28c65babb938b68ec9098057af729dc

SHA512
f01c87f7524ee8dcd218db8a7424bee27890cf21e1da3fe779ba76c8710311444c0ddbda632a386a72f696c927433a0f3ae503a9e4b2b7a31caf969628e29e01

Download Submit
C:\Windows\SysWOW64\Plpjoe32.exe

Filesize
256KB

MD5
c766e3165edadf11b234b70132eced13

SHA1
fcc9f72554e53890c5288bf9e98eea29ce13bcfa

SHA256
43ca78b0f9072a9e9cc6608c82d91ab5a7c244d8af5ba163df12239ac2e1f8d9

SHA512
ce9446d1d1647f90a3f4630fe2008526b3b1eae9bafd38f3dac0bfe50f5610b274de8571261267a27d19fac0f8330a2b60ee065b4231662b4d557085e84b81eb

Download Submit
C:\Windows\SysWOW64\Qeodhjmo.exe

Filesize
256KB

MD5
2e7a3b30d7b3a945984d4f45b42b1789

SHA1
dd7d3050a4ef95fa71877632fc1f23d7eaddbf84

SHA256
1434788ea4428310dead1e5ff548d93f73c909de41bd571d0ba926e3c90f77b1

SHA512
0e352586adcc17fde1789532a176cace8b3ff6ddf3da3e346e97739df98b1af91e8153aa33deb04bf28e0b7e80b0d0d7cd75b38f09a19cd94b92be9fef131a7c

Download Submit
C:\Windows\SysWOW64\Qhkdof32.exe

Filesize
256KB

MD5
9dc6eddda1232f61369a2963e83d0451

SHA1
8bb5bdbd9008d177a11fce9cfc34a4d65c43a3d0

SHA256
60c8a554fff329527e478491c06a9901c797bc5c692adb1028310639968509f3

SHA512
60fbae335dcbe0bf2100e3c5449590c7ae45cd04689893caed3eab9b0b1cd1758298c1cdd541ec7b60d7220cfd320c94d7a87940aa8cfcd29590b33542036a36

Download Submit
memory/220-312-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/396-318-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/736-48-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/748-72-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1064-300-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1460-33-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1568-276-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1604-414-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1648-217-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1676-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1776-420-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1856-138-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1988-57-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2040-396-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2160-306-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2276-330-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2356-186-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2412-288-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2604-233-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2632-194-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2652-106-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2724-390-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2732-146-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2792-408-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2884-130-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2916-90-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3156-178-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3212-270-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3232-372-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3428-97-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3556-432-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3580-342-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3628-388-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3632-241-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3672-82-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3696-65-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3752-426-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3792-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3836-294-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3952-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3988-258-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4012-153-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4108-378-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4132-201-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4200-210-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4228-282-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4240-402-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4252-360-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4308-166-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4372-226-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4396-348-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4420-113-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4432-169-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4492-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4492-1-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4492-80-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4528-122-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4620-264-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4636-370-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4664-336-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4692-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4700-358-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4820-324-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5024-249-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads