1a275f81d429555fe3c0329a7dd5bedab66f86f8b627a25f5109e70d61cb7176

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2024 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a275f81d429555fe3c0329a7dd5bedab66f86f8b627a25f5109e70d61cb7176.exe
Size

80KB
MD5

009c799cd63111cb3126a88cfecaad01
SHA1

88bd62fcd96698bfa70ff83772abc2ccdf7dea58
SHA256

1a275f81d429555fe3c0329a7dd5bedab66f86f8b627a25f5109e70d61cb7176
SHA512

76bdf6b88be6c97c9042f831f2eba900bcdd1d589e49756ea334a402bb743f214240cae477fe2b703597492dab0ae6651332c31113098a5d69ed124a16eaf74f
SSDEEP

1536:vCnSRstxS7O33ew09iy/t2L2J9VqDlzVxyh+CbxMa:au8xS75wm7+2J9IDlRxyhTb7

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okkalnjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jeolckne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kefbdjgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gohapb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gebimmco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlogfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gggmgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eegqldqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfgahikm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lplaaiqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Migcpneb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilphdlqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhgkgijg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbijgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Liifnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klpakj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ielfgmnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kanbjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lojfin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acppddig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Niihlkdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhmhpfmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpomem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndejcemn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhcbidcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjmjdm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iloajfml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeolckne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfodmdni.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agqhik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aidehpea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdcmkgmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hejjanpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agcdnjcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fajbjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Haodle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igpkok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbhbbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbhlikpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akenij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejdonq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojnfihmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eqkondfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhgdmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmlafk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqikob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hqdkkp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbklli32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npognfpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckbncapd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kejloi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpbbak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nooikj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bliajd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lechkaga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnabladg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Padnaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpjfgf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jejbhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agqhik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Diamko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qnopjfgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqilaplo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haaaaeim.exe

Executes dropped EXE 64 IoCs

pid	Process
2628	Pjmjdm32.exe
3572	Ppahmb32.exe
4148	Afpjel32.exe
220	Apmhiq32.exe
3276	Bpdnjple.exe
876	Boihcf32.exe
2968	Cponen32.exe
2384	Caageq32.exe
4244	Dojqjdbl.exe
1244	Damfao32.exe
4440	Doccpcja.exe
3140	Edeeci32.exe
4752	Enpfan32.exe
832	Ekcgkb32.exe
4704	Fdnhih32.exe
4356	Fkjmlaac.exe
4068	Fajbjh32.exe
4904	Gicgpelg.exe
3776	Ggkqgaol.exe
3812	Gijmad32.exe
4432	Gpdennml.exe
4320	Giljfddl.exe
3596	Hnlodjpa.exe
2564	Hpkknmgd.exe
3724	Hlblcn32.exe
1748	Haodle32.exe
2140	Haaaaeim.exe
2688	Iogopi32.exe
1092	Ibegfglj.exe
1084	Ilnlom32.exe
3104	Ilphdlqh.exe
5008	Jidinqpb.exe
3148	Jblmgf32.exe
5068	Jldbpl32.exe
4056	Jemfhacc.exe
3136	Joekag32.exe
4292	Jlikkkhn.exe
916	Jafdcbge.exe
1892	Jpgdai32.exe
964	Klndfj32.exe
2332	Klpakj32.exe
404	Kcjjhdjb.exe
2348	Kabcopmg.exe
3580	Lepleocn.exe
1884	Lafmjp32.exe
4692	Lpgmhg32.exe
3696	Lhcali32.exe
2180	Loofnccf.exe
3548	Lhgkgijg.exe
1476	Mapppn32.exe
212	Modpib32.exe
2196	Mpeiie32.exe
3940	Mbgeqmjp.exe
4120	Mjpjgj32.exe
3800	Njbgmjgl.exe
3872	Nckkfp32.exe
996	Noblkqca.exe
4824	Njgqhicg.exe
4888	Ncpeaoih.exe
4628	Nimmifgo.exe
1712	Nbebbk32.exe
4424	Ojnfihmo.exe
4548	Ocgkan32.exe
3988	Oiccje32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Iqfcbahb.exe	Ijlkfg32.exe
File created	C:\Windows\SysWOW64\Odaiodbp.exe	Omgabj32.exe
File created	C:\Windows\SysWOW64\Ajmgof32.exe	Adpogp32.exe
File created	C:\Windows\SysWOW64\Dijppjfd.exe	Dabhomea.exe
File opened for modification	C:\Windows\SysWOW64\Cbnbhfde.exe	Cldjkl32.exe
File created	C:\Windows\SysWOW64\Oklifdmi.exe	Onhhmpoo.exe
File created	C:\Windows\SysWOW64\Alcolgqi.dll	Ehkcgkdj.exe
File created	C:\Windows\SysWOW64\Kcjael32.dll	Qgehml32.exe
File created	C:\Windows\SysWOW64\Foolmeif.dll	Dpjfgf32.exe
File created	C:\Windows\SysWOW64\Midbjmkg.dll	Cbhbbn32.exe
File created	C:\Windows\SysWOW64\Icminm32.exe	Hlogfd32.exe
File created	C:\Windows\SysWOW64\Bmbnnn32.exe	Abmjqe32.exe
File created	C:\Windows\SysWOW64\Nejgbn32.exe	Ngifef32.exe
File created	C:\Windows\SysWOW64\Fgmeobin.dll	Iqfcbahb.exe
File created	C:\Windows\SysWOW64\Nmbhgjoi.exe	Npognfpo.exe
File created	C:\Windows\SysWOW64\Nlgbon32.exe	Nfnjbdep.exe
File created	C:\Windows\SysWOW64\Holhmcgf.dll	Gkhbbi32.exe
File opened for modification	C:\Windows\SysWOW64\Bboplo32.exe	Bmagch32.exe
File created	C:\Windows\SysWOW64\Jmlbab32.dll	Lechkaga.exe
File created	C:\Windows\SysWOW64\Affgmbdd.dll	Phfhfa32.exe
File created	C:\Windows\SysWOW64\Kconbh32.dll	Kiodha32.exe
File created	C:\Windows\SysWOW64\Eneilj32.dll	Okkalnjm.exe
File created	C:\Windows\SysWOW64\Lhgkgijg.exe	Loofnccf.exe
File opened for modification	C:\Windows\SysWOW64\Fdbkja32.exe	Fbdnne32.exe
File opened for modification	C:\Windows\SysWOW64\Apgqie32.exe	Aimhmkgn.exe
File created	C:\Windows\SysWOW64\Mnjellfo.dll	Bbalaoda.exe
File created	C:\Windows\SysWOW64\Eegqldqg.exe	Ecidpiad.exe
File created	C:\Windows\SysWOW64\Popdldep.dll	Qfilkj32.exe
File opened for modification	C:\Windows\SysWOW64\Fcneeo32.exe	Fggdpnkf.exe
File created	C:\Windows\SysWOW64\Ggiipk32.dll	Cmdmpe32.exe
File created	C:\Windows\SysWOW64\Nffopp32.dll	Dbhlikpf.exe
File created	C:\Windows\SysWOW64\Efopjbjg.exe	Elilmi32.exe
File created	C:\Windows\SysWOW64\Cancekeo.exe	Ccmcgcmp.exe
File created	C:\Windows\SysWOW64\Abohmm32.dll	Nocbfjmc.exe
File opened for modification	C:\Windows\SysWOW64\Hjnndime.exe	Gipbck32.exe
File opened for modification	C:\Windows\SysWOW64\Ijlkfg32.exe	Icbbimih.exe
File created	C:\Windows\SysWOW64\Ieicjl32.dll	Jldbpl32.exe
File created	C:\Windows\SysWOW64\Kcpcgc32.dll	Dickplko.exe
File opened for modification	C:\Windows\SysWOW64\Iloajfml.exe	Iajmmm32.exe
File created	C:\Windows\SysWOW64\Ammnhilb.exe	Abgjkpll.exe
File opened for modification	C:\Windows\SysWOW64\Jhhodg32.exe	Jejbhk32.exe
File opened for modification	C:\Windows\SysWOW64\Lfmnbjcg.exe	Kaqejcep.exe
File opened for modification	C:\Windows\SysWOW64\Nkgoke32.exe	Nejgbn32.exe
File created	C:\Windows\SysWOW64\Ankgpk32.exe	Ainnhdbp.exe
File created	C:\Windows\SysWOW64\Hlogfd32.exe	Hfeoijbi.exe
File created	C:\Windows\SysWOW64\Ipimhnjc.dll	Qpbnhl32.exe
File created	C:\Windows\SysWOW64\Klpjad32.exe	Kefbdjgm.exe
File created	C:\Windows\SysWOW64\Mmdlflki.exe	Mfkcibdl.exe
File created	C:\Windows\SysWOW64\Ioaegj32.dll	Mdodbf32.exe
File opened for modification	C:\Windows\SysWOW64\Dijppjfd.exe	Dabhomea.exe
File created	C:\Windows\SysWOW64\Iloajfml.exe	Iajmmm32.exe
File created	C:\Windows\SysWOW64\Balfdi32.dll	Jejbhk32.exe
File created	C:\Windows\SysWOW64\Mgeengon.dll	Ijhhenhf.exe
File created	C:\Windows\SysWOW64\Bihancje.exe	Bbniai32.exe
File opened for modification	C:\Windows\SysWOW64\Didjqoae.exe	Dbjade32.exe
File opened for modification	C:\Windows\SysWOW64\Efampahd.exe	Epgdch32.exe
File created	C:\Windows\SysWOW64\Fncnpk32.dll	Keceoj32.exe
File opened for modification	C:\Windows\SysWOW64\Fplnogmb.exe	Fibfbm32.exe
File created	C:\Windows\SysWOW64\Ghlbcolh.dll	Ppamjcpj.exe
File created	C:\Windows\SysWOW64\Bipohh32.dll	Hddilh32.exe
File created	C:\Windows\SysWOW64\Ploloqjj.dll	Ngnppfgb.exe
File created	C:\Windows\SysWOW64\Ainnhdbp.exe	Abdfkj32.exe
File opened for modification	C:\Windows\SysWOW64\Fempbm32.exe	Fpqgjf32.exe
File opened for modification	C:\Windows\SysWOW64\Pkinmlnm.exe	Pjjaci32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12396	5720	WerFault.exe	719

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bkadoo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjoknhbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dabhomea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Liifnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lfodmdni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbfnjgdn.dll"	1a275f81d429555fe3c0329a7dd5bedab66f86f8b627a25f5109e70d61cb7176.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dblnid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dcffnbee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eddnic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojimfh32.dll"	Ekqckmfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmlafk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fajbjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngcglo32.dll"	Jemfhacc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkohchko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgeengon.dll"	Ijhhenhf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgcbbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajjicg32.dll"	Dpkehi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eoladdeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nibbklke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aafjpc32.dll"	Aidehpea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aimhmkgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mphamg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecoaijio.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bpaikm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgkkij32.dll"	Nolekd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nphnbpql.dll"	Kcjjhdjb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dncpkjoc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hokgmpkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbhgkfkg.dll"	Koimbpbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkgoke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jicdlc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bggnijof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djipbbne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggkqgaol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Modpib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Efampahd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jihngboe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bggnijof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfkklk32.dll"	Gbhhieao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfdbpjmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mociol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eegqldqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfljnejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pggnnqmk.dll"	Fidbgm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pacfjfej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjnbdofa.dll"	Dabhomea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjhkmbho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgqaip32.dll"	Ckidcpjl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gllajf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndejcemn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkeoha32.dll"	Bimach32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Flhoinbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmmbbodp.dll"	Aglnnkid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqhqndlf.dll"	Cibkohef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iehkefih.dll"	Kcehejic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fplnogmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kabcopmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aflpkpjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbjade32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fcbgfhii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iqbpahpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjcjmclj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clbcll32.dll"	Djipbbne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Haodle32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2628	2076	1a275f81d429555fe3c0329a7dd5bedab66f86f8b627a25f5109e70d61cb7176.exe	92
PID 2076 wrote to memory of 2628	2076	1a275f81d429555fe3c0329a7dd5bedab66f86f8b627a25f5109e70d61cb7176.exe	92
PID 2076 wrote to memory of 2628	2076	1a275f81d429555fe3c0329a7dd5bedab66f86f8b627a25f5109e70d61cb7176.exe	92
PID 2628 wrote to memory of 3572	2628	Pjmjdm32.exe	93
PID 2628 wrote to memory of 3572	2628	Pjmjdm32.exe	93
PID 2628 wrote to memory of 3572	2628	Pjmjdm32.exe	93
PID 3572 wrote to memory of 4148	3572	Ppahmb32.exe	94
PID 3572 wrote to memory of 4148	3572	Ppahmb32.exe	94
PID 3572 wrote to memory of 4148	3572	Ppahmb32.exe	94
PID 4148 wrote to memory of 220	4148	Afpjel32.exe	96
PID 4148 wrote to memory of 220	4148	Afpjel32.exe	96
PID 4148 wrote to memory of 220	4148	Afpjel32.exe	96
PID 220 wrote to memory of 3276	220	Apmhiq32.exe	97
PID 220 wrote to memory of 3276	220	Apmhiq32.exe	97
PID 220 wrote to memory of 3276	220	Apmhiq32.exe	97
PID 3276 wrote to memory of 876	3276	Bpdnjple.exe	98
PID 3276 wrote to memory of 876	3276	Bpdnjple.exe	98
PID 3276 wrote to memory of 876	3276	Bpdnjple.exe	98
PID 876 wrote to memory of 2968	876	Boihcf32.exe	99
PID 876 wrote to memory of 2968	876	Boihcf32.exe	99
PID 876 wrote to memory of 2968	876	Boihcf32.exe	99
PID 2968 wrote to memory of 2384	2968	Cponen32.exe	100
PID 2968 wrote to memory of 2384	2968	Cponen32.exe	100
PID 2968 wrote to memory of 2384	2968	Cponen32.exe	100
PID 2384 wrote to memory of 4244	2384	Caageq32.exe	101
PID 2384 wrote to memory of 4244	2384	Caageq32.exe	101
PID 2384 wrote to memory of 4244	2384	Caageq32.exe	101
PID 4244 wrote to memory of 1244	4244	Dojqjdbl.exe	102
PID 4244 wrote to memory of 1244	4244	Dojqjdbl.exe	102
PID 4244 wrote to memory of 1244	4244	Dojqjdbl.exe	102
PID 1244 wrote to memory of 4440	1244	Damfao32.exe	103
PID 1244 wrote to memory of 4440	1244	Damfao32.exe	103
PID 1244 wrote to memory of 4440	1244	Damfao32.exe	103
PID 4440 wrote to memory of 3140	4440	Doccpcja.exe	104
PID 4440 wrote to memory of 3140	4440	Doccpcja.exe	104
PID 4440 wrote to memory of 3140	4440	Doccpcja.exe	104
PID 3140 wrote to memory of 4752	3140	Edeeci32.exe	105
PID 3140 wrote to memory of 4752	3140	Edeeci32.exe	105
PID 3140 wrote to memory of 4752	3140	Edeeci32.exe	105
PID 4752 wrote to memory of 832	4752	Enpfan32.exe	106
PID 4752 wrote to memory of 832	4752	Enpfan32.exe	106
PID 4752 wrote to memory of 832	4752	Enpfan32.exe	106
PID 832 wrote to memory of 4704	832	Ekcgkb32.exe	107
PID 832 wrote to memory of 4704	832	Ekcgkb32.exe	107
PID 832 wrote to memory of 4704	832	Ekcgkb32.exe	107
PID 4704 wrote to memory of 4356	4704	Fdnhih32.exe	108
PID 4704 wrote to memory of 4356	4704	Fdnhih32.exe	108
PID 4704 wrote to memory of 4356	4704	Fdnhih32.exe	108
PID 4356 wrote to memory of 4068	4356	Fkjmlaac.exe	109
PID 4356 wrote to memory of 4068	4356	Fkjmlaac.exe	109
PID 4356 wrote to memory of 4068	4356	Fkjmlaac.exe	109
PID 4068 wrote to memory of 4904	4068	Fajbjh32.exe	110
PID 4068 wrote to memory of 4904	4068	Fajbjh32.exe	110
PID 4068 wrote to memory of 4904	4068	Fajbjh32.exe	110
PID 4904 wrote to memory of 3776	4904	Gicgpelg.exe	112
PID 4904 wrote to memory of 3776	4904	Gicgpelg.exe	112
PID 4904 wrote to memory of 3776	4904	Gicgpelg.exe	112
PID 3776 wrote to memory of 3812	3776	Ggkqgaol.exe	113
PID 3776 wrote to memory of 3812	3776	Ggkqgaol.exe	113
PID 3776 wrote to memory of 3812	3776	Ggkqgaol.exe	113
PID 3812 wrote to memory of 4432	3812	Gijmad32.exe	114
PID 3812 wrote to memory of 4432	3812	Gijmad32.exe	114
PID 3812 wrote to memory of 4432	3812	Gijmad32.exe	114
PID 4432 wrote to memory of 4320	4432	Gpdennml.exe	115

C:\Users\Admin\AppData\Local\Temp\1a275f81d429555fe3c0329a7dd5bedab66f86f8b627a25f5109e70d61cb7176.exe
"C:\Users\Admin\AppData\Local\Temp\1a275f81d429555fe3c0329a7dd5bedab66f86f8b627a25f5109e70d61cb7176.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\Pjmjdm32.exe
  C:\Windows\system32\Pjmjdm32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\Ppahmb32.exe
    C:\Windows\system32\Ppahmb32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\Windows\SysWOW64\Afpjel32.exe
      C:\Windows\system32\Afpjel32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4148
    - - C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:220
      - C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:876
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2968
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\SysWOW64\Damfao32.exe
        
        C:\Windows\system32\Damfao32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1244
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3140
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:832
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4356
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3776
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        23⤵
        Executes dropped EXE
        
        PID:4320
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        24⤵
        Executes dropped EXE
        
        PID:3596
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        25⤵
        Executes dropped EXE
        
        PID:2564
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        26⤵
        Executes dropped EXE
        
        PID:3724
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1748
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2140
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        29⤵
        Executes dropped EXE
        
        PID:2688
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        30⤵
        Executes dropped EXE
        
        PID:1092
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        31⤵
        Executes dropped EXE
        
        PID:1084
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        33⤵
        Executes dropped EXE
        
        PID:5008
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        34⤵
        Executes dropped EXE
        
        PID:3148
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5068
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4056
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        37⤵
        Executes dropped EXE
        
        PID:3136
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        38⤵
        Executes dropped EXE
        
        PID:4292
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        39⤵
        Executes dropped EXE
        
        PID:916
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        40⤵
        Executes dropped EXE
        
        PID:1892
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        41⤵
        Executes dropped EXE
        
        PID:964
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2332
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:404
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2348
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        45⤵
        Executes dropped EXE
        
        PID:3580
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        46⤵
        Executes dropped EXE
        
        PID:1884
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        47⤵
        Executes dropped EXE
        
        PID:4692
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        48⤵
        Executes dropped EXE
        
        PID:3696
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2180
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3548
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        51⤵
        Executes dropped EXE
        
        PID:1476
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:212
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        53⤵
        Executes dropped EXE
        
        PID:2196
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        54⤵
        Executes dropped EXE
        
        PID:3940
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        55⤵
        Executes dropped EXE
        
        PID:4120
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        56⤵
        Executes dropped EXE
        
        PID:3800
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        57⤵
        Executes dropped EXE
        
        PID:3872
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        58⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        59⤵
        Executes dropped EXE
        
        PID:996
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        60⤵
        Executes dropped EXE
        
        PID:4824
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        61⤵
        Executes dropped EXE
        
        PID:4888
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        62⤵
        Executes dropped EXE
        
        PID:4628
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        63⤵
        Executes dropped EXE
        
        PID:1712
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4424
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        65⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        66⤵
        Executes dropped EXE
        
        PID:3988
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        67⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        68⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        69⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        70⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        71⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        72⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5320
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        74⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        75⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        76⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        77⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        78⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Qjffpe32.exe
        
        C:\Windows\system32\Qjffpe32.exe
        79⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Qpbnhl32.exe
        
        C:\Windows\system32\Qpbnhl32.exe
        80⤵
        Drops file in System32 directory
        
        PID:5604
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        81⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Aabkbono.exe
        
        C:\Windows\system32\Aabkbono.exe
        82⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        83⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Aadghn32.exe
        
        C:\Windows\system32\Aadghn32.exe
        84⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Afappe32.exe
        
        C:\Windows\system32\Afappe32.exe
        85⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Aagdnn32.exe
        
        C:\Windows\system32\Aagdnn32.exe
        86⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Ajohfcpj.exe
        
        C:\Windows\system32\Ajohfcpj.exe
        87⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Aplaoj32.exe
        
        C:\Windows\system32\Aplaoj32.exe
        88⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Aidehpea.exe
        
        C:\Windows\system32\Aidehpea.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6048
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        90⤵
        Drops file in System32 directory
        
        PID:6092
        
        C:\Windows\SysWOW64\Bmbnnn32.exe
        
        C:\Windows\system32\Bmbnnn32.exe
        91⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Bfkbfd32.exe
        
        C:\Windows\system32\Bfkbfd32.exe
        92⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        93⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Bjhkmbho.exe
        
        C:\Windows\system32\Bjhkmbho.exe
        94⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Bdcmkgmm.exe
        
        C:\Windows\system32\Bdcmkgmm.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5392
        
        C:\Windows\SysWOW64\Bpjmph32.exe
        
        C:\Windows\system32\Bpjmph32.exe
        96⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        97⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Ckbncapd.exe
        
        C:\Windows\system32\Ckbncapd.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5600
        
        C:\Windows\SysWOW64\Calfpk32.exe
        
        C:\Windows\system32\Calfpk32.exe
        99⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        100⤵
        Drops file in System32 directory
        
        PID:5752
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        101⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Ciihjmcj.exe
        
        C:\Windows\system32\Ciihjmcj.exe
        102⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Caqpkjcl.exe
        
        C:\Windows\system32\Caqpkjcl.exe
        103⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Ckidcpjl.exe
        
        C:\Windows\system32\Ckidcpjl.exe
        104⤵
        Modifies registry class
        
        PID:6100
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        105⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        106⤵
        Modifies registry class
        
        PID:736
        
        C:\Windows\SysWOW64\Dpjfgf32.exe
        
        C:\Windows\system32\Dpjfgf32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5316
        
        C:\Windows\SysWOW64\Dickplko.exe
        
        C:\Windows\system32\Dickplko.exe
        108⤵
        Drops file in System32 directory
        
        PID:5348
        
        C:\Windows\SysWOW64\Dcnlnaom.exe
        
        C:\Windows\system32\Dcnlnaom.exe
        109⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Dncpkjoc.exe
        
        C:\Windows\system32\Dncpkjoc.exe
        110⤵
        Modifies registry class
        
        PID:5668
        
        C:\Windows\SysWOW64\Enhifi32.exe
        
        C:\Windows\system32\Enhifi32.exe
        111⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Ejojljqa.exe
        
        C:\Windows\system32\Ejojljqa.exe
        112⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        113⤵
        Modifies registry class
        
        PID:6112
        
        C:\Windows\SysWOW64\Eqkondfl.exe
        
        C:\Windows\system32\Eqkondfl.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3088
        
        C:\Windows\SysWOW64\Ekqckmfb.exe
        
        C:\Windows\system32\Ekqckmfb.exe
        115⤵
        Modifies registry class
        
        PID:2796
        
        C:\Windows\SysWOW64\Eqmlccdi.exe
        
        C:\Windows\system32\Eqmlccdi.exe
        116⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Fggdpnkf.exe
        
        C:\Windows\system32\Fggdpnkf.exe
        117⤵
        Drops file in System32 directory
        
        PID:5896
        
        C:\Windows\SysWOW64\Fcneeo32.exe
        
        C:\Windows\system32\Fcneeo32.exe
        118⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\Fncibg32.exe
        
        C:\Windows\system32\Fncibg32.exe
        119⤵
        
        PID:752
        
        C:\Windows\SysWOW64\Fkgillpj.exe
        
        C:\Windows\system32\Fkgillpj.exe
        120⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Fdpnda32.exe
        
        C:\Windows\system32\Fdpnda32.exe
        121⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        122⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        123⤵
        Drops file in System32 directory
        
        PID:5808
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        124⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Fklcgk32.exe
        
        C:\Windows\system32\Fklcgk32.exe
        125⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Fqikob32.exe
        
        C:\Windows\system32\Fqikob32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6284
        
        C:\Windows\SysWOW64\Gkoplk32.exe
        
        C:\Windows\system32\Gkoplk32.exe
        127⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Gbhhieao.exe
        
        C:\Windows\system32\Gbhhieao.exe
        128⤵
        Modifies registry class
        
        PID:6376
        
        C:\Windows\SysWOW64\Ggepalof.exe
        
        C:\Windows\system32\Ggepalof.exe
        129⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Gjcmngnj.exe
        
        C:\Windows\system32\Gjcmngnj.exe
        130⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Gqnejaff.exe
        
        C:\Windows\system32\Gqnejaff.exe
        131⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Gggmgk32.exe
        
        C:\Windows\system32\Gggmgk32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6564
        
        C:\Windows\SysWOW64\Gdnjfojj.exe
        
        C:\Windows\system32\Gdnjfojj.exe
        133⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Gkhbbi32.exe
        
        C:\Windows\system32\Gkhbbi32.exe
        134⤵
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Hqdkkp32.exe
        
        C:\Windows\system32\Hqdkkp32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6696
        
        C:\Windows\SysWOW64\Hgocgjgk.exe
        
        C:\Windows\system32\Hgocgjgk.exe
        136⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Hqghqpnl.exe
        
        C:\Windows\system32\Hqghqpnl.exe
        137⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Hgapmj32.exe
        
        C:\Windows\system32\Hgapmj32.exe
        138⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Hnkhjdle.exe
        
        C:\Windows\system32\Hnkhjdle.exe
        139⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Heepfn32.exe
        
        C:\Windows\system32\Heepfn32.exe
        140⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Hkohchko.exe
        
        C:\Windows\system32\Hkohchko.exe
        141⤵
        Modifies registry class
        
        PID:6960
        
        C:\Windows\SysWOW64\Hcjmhk32.exe
        
        C:\Windows\system32\Hcjmhk32.exe
        142⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Hjdedepg.exe
        
        C:\Windows\system32\Hjdedepg.exe
        143⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Hejjanpm.exe
        
        C:\Windows\system32\Hejjanpm.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7084
        
        C:\Windows\SysWOW64\Hghfnioq.exe
        
        C:\Windows\system32\Hghfnioq.exe
        145⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Hnbnjc32.exe
        
        C:\Windows\system32\Hnbnjc32.exe
        146⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Ielfgmnj.exe
        
        C:\Windows\system32\Ielfgmnj.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6180
        
        C:\Windows\SysWOW64\Ilfodgeg.exe
        
        C:\Windows\system32\Ilfodgeg.exe
        148⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Icachjbb.exe
        
        C:\Windows\system32\Icachjbb.exe
        149⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Ijkled32.exe
        
        C:\Windows\system32\Ijkled32.exe
        150⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Ieqpbm32.exe
        
        C:\Windows\system32\Ieqpbm32.exe
        151⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Iholohii.exe
        
        C:\Windows\system32\Iholohii.exe
        152⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Ibdplaho.exe
        
        C:\Windows\system32\Ibdplaho.exe
        153⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Icfmci32.exe
        
        C:\Windows\system32\Icfmci32.exe
        154⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Ijpepcfj.exe
        
        C:\Windows\system32\Ijpepcfj.exe
        155⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Iajmmm32.exe
        
        C:\Windows\system32\Iajmmm32.exe
        156⤵
        Drops file in System32 directory
        
        PID:6876
        
        C:\Windows\SysWOW64\Iloajfml.exe
        
        C:\Windows\system32\Iloajfml.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6948
        
        C:\Windows\SysWOW64\Jbijgp32.exe
        
        C:\Windows\system32\Jbijgp32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7032
        
        C:\Windows\SysWOW64\Jdjfohjg.exe
        
        C:\Windows\system32\Jdjfohjg.exe
        159⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Jjdokb32.exe
        
        C:\Windows\system32\Jjdokb32.exe
        160⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Jejbhk32.exe
        
        C:\Windows\system32\Jejbhk32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6244
        
        C:\Windows\SysWOW64\Jhhodg32.exe
        
        C:\Windows\system32\Jhhodg32.exe
        162⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Jbncbpqd.exe
        
        C:\Windows\system32\Jbncbpqd.exe
        163⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Jdopjh32.exe
        
        C:\Windows\system32\Jdopjh32.exe
        164⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Jnedgq32.exe
        
        C:\Windows\system32\Jnedgq32.exe
        165⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Jeolckne.exe
        
        C:\Windows\system32\Jeolckne.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6852
        
        C:\Windows\SysWOW64\Jhmhpfmi.exe
        
        C:\Windows\system32\Jhmhpfmi.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6968
        
        C:\Windows\SysWOW64\Jogqlpde.exe
        
        C:\Windows\system32\Jogqlpde.exe
        168⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Jaemilci.exe
        
        C:\Windows\system32\Jaemilci.exe
        169⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Jhoeef32.exe
        
        C:\Windows\system32\Jhoeef32.exe
        170⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Koimbpbc.exe
        
        C:\Windows\system32\Koimbpbc.exe
        171⤵
        Modifies registry class
        
        PID:6412
        
        C:\Windows\SysWOW64\Keceoj32.exe
        
        C:\Windows\system32\Keceoj32.exe
        172⤵
        Drops file in System32 directory
        
        PID:6600
        
        C:\Windows\SysWOW64\Klmnkdal.exe
        
        C:\Windows\system32\Klmnkdal.exe
        173⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Kbgfhnhi.exe
        
        C:\Windows\system32\Kbgfhnhi.exe
        174⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Kefbdjgm.exe
        
        C:\Windows\system32\Kefbdjgm.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5760
        
        C:\Windows\SysWOW64\Klpjad32.exe
        
        C:\Windows\system32\Klpjad32.exe
        176⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Kbjbnnfg.exe
        
        C:\Windows\system32\Kbjbnnfg.exe
        177⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Khfkfedn.exe
        
        C:\Windows\system32\Khfkfedn.exe
        178⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Kopcbo32.exe
        
        C:\Windows\system32\Kopcbo32.exe
        179⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Kejloi32.exe
        
        C:\Windows\system32\Kejloi32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6592
        
        C:\Windows\SysWOW64\Kaaldjil.exe
        
        C:\Windows\system32\Kaaldjil.exe
        181⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Khkdad32.exe
        
        C:\Windows\system32\Khkdad32.exe
        182⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Loemnnhe.exe
        
        C:\Windows\system32\Loemnnhe.exe
        183⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Ldbefe32.exe
        
        C:\Windows\system32\Ldbefe32.exe
        184⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Lklnconj.exe
        
        C:\Windows\system32\Lklnconj.exe
        185⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Laffpi32.exe
        
        C:\Windows\system32\Laffpi32.exe
        186⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Lhpnlclc.exe
        
        C:\Windows\system32\Lhpnlclc.exe
        187⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Lojfin32.exe
        
        C:\Windows\system32\Lojfin32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7340
        
        C:\Windows\SysWOW64\Lhbkac32.exe
        
        C:\Windows\system32\Lhbkac32.exe
        189⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Lhgdmb32.exe
        
        C:\Windows\system32\Lhgdmb32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7428
        
        C:\Windows\SysWOW64\Mclhjkfa.exe
        
        C:\Windows\system32\Mclhjkfa.exe
        191⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Mdnebc32.exe
        
        C:\Windows\system32\Mdnebc32.exe
        192⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Mociol32.exe
        
        C:\Windows\system32\Mociol32.exe
        193⤵
        Modifies registry class
        
        PID:7544
        
        C:\Windows\SysWOW64\Mdpagc32.exe
        
        C:\Windows\system32\Mdpagc32.exe
        194⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Mepnaf32.exe
        
        C:\Windows\system32\Mepnaf32.exe
        195⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Mlifnphl.exe
        
        C:\Windows\system32\Mlifnphl.exe
        196⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Mebkge32.exe
        
        C:\Windows\system32\Mebkge32.exe
        197⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Mkocol32.exe
        
        C:\Windows\system32\Mkocol32.exe
        198⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Mcfkpjng.exe
        
        C:\Windows\system32\Mcfkpjng.exe
        199⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Mdghhb32.exe
        
        C:\Windows\system32\Mdghhb32.exe
        200⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Nkapelka.exe
        
        C:\Windows\system32\Nkapelka.exe
        201⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Nheqnpjk.exe
        
        C:\Windows\system32\Nheqnpjk.exe
        202⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Nooikj32.exe
        
        C:\Windows\system32\Nooikj32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7976
        
        C:\Windows\SysWOW64\Nlcidopb.exe
        
        C:\Windows\system32\Nlcidopb.exe
        204⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Napameoi.exe
        
        C:\Windows\system32\Napameoi.exe
        205⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Nocbfjmc.exe
        
        C:\Windows\system32\Nocbfjmc.exe
        206⤵
        Drops file in System32 directory
        
        PID:8096
        
        C:\Windows\SysWOW64\Nfnjbdep.exe
        
        C:\Windows\system32\Nfnjbdep.exe
        207⤵
        Drops file in System32 directory
        
        PID:8136
        
        C:\Windows\SysWOW64\Nlgbon32.exe
        
        C:\Windows\system32\Nlgbon32.exe
        208⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Ncaklhdi.exe
        
        C:\Windows\system32\Ncaklhdi.exe
        209⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Ohncdobq.exe
        
        C:\Windows\system32\Ohncdobq.exe
        210⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Ocdgahag.exe
        
        C:\Windows\system32\Ocdgahag.exe
        211⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Obidcdfo.exe
        
        C:\Windows\system32\Obidcdfo.exe
        212⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Ohcmpn32.exe
        
        C:\Windows\system32\Ohcmpn32.exe
        213⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Ochamg32.exe
        
        C:\Windows\system32\Ochamg32.exe
        214⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Odjmdocp.exe
        
        C:\Windows\system32\Odjmdocp.exe
        215⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Oooaah32.exe
        
        C:\Windows\system32\Oooaah32.exe
        216⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Ofijnbkb.exe
        
        C:\Windows\system32\Ofijnbkb.exe
        217⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Ooangh32.exe
        
        C:\Windows\system32\Ooangh32.exe
        218⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Pijcpmhc.exe
        
        C:\Windows\system32\Pijcpmhc.exe
        219⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Pcpgmf32.exe
        
        C:\Windows\system32\Pcpgmf32.exe
        220⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Pdqcenmg.exe
        
        C:\Windows\system32\Pdqcenmg.exe
        221⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Pkklbh32.exe
        
        C:\Windows\system32\Pkklbh32.exe
        222⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Pbddobla.exe
        
        C:\Windows\system32\Pbddobla.exe
        223⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Piolkm32.exe
        
        C:\Windows\system32\Piolkm32.exe
        224⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Pkmhgh32.exe
        
        C:\Windows\system32\Pkmhgh32.exe
        225⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Pbgqdb32.exe
        
        C:\Windows\system32\Pbgqdb32.exe
        226⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Peempn32.exe
        
        C:\Windows\system32\Peempn32.exe
        227⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Pkoemhao.exe
        
        C:\Windows\system32\Pkoemhao.exe
        228⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Pehjfm32.exe
        
        C:\Windows\system32\Pehjfm32.exe
        229⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Pomncfge.exe
        
        C:\Windows\system32\Pomncfge.exe
        230⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Qfgfpp32.exe
        
        C:\Windows\system32\Qfgfpp32.exe
        231⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Qmanljfo.exe
        
        C:\Windows\system32\Qmanljfo.exe
        232⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Qbngeadf.exe
        
        C:\Windows\system32\Qbngeadf.exe
        233⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Qihoak32.exe
        
        C:\Windows\system32\Qihoak32.exe
        234⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Qpbgnecp.exe
        
        C:\Windows\system32\Qpbgnecp.exe
        235⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Aflpkpjm.exe
        
        C:\Windows\system32\Aflpkpjm.exe
        236⤵
        Modifies registry class
        
        PID:7364
        
        C:\Windows\SysWOW64\Amfhgj32.exe
        
        C:\Windows\system32\Amfhgj32.exe
        237⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Acppddig.exe
        
        C:\Windows\system32\Acppddig.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7772
        
        C:\Windows\SysWOW64\Aimhmkgn.exe
        
        C:\Windows\system32\Aimhmkgn.exe
        239⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7284
        
        C:\Windows\SysWOW64\Apgqie32.exe
        
        C:\Windows\system32\Apgqie32.exe
        240⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Afqifo32.exe
        
        C:\Windows\system32\Afqifo32.exe
        241⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Amkabind.exe
        
        C:\Windows\system32\Amkabind.exe
        242⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Abgjkpll.exe
        
        C:\Windows\system32\Abgjkpll.exe
        243⤵
        Drops file in System32 directory
        
        PID:8360
        
        C:\Windows\SysWOW64\Ammnhilb.exe
        
        C:\Windows\system32\Ammnhilb.exe
        244⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Abjfqpji.exe
        
        C:\Windows\system32\Abjfqpji.exe
        245⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Aidomjaf.exe
        
        C:\Windows\system32\Aidomjaf.exe
        246⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Apngjd32.exe
        
        C:\Windows\system32\Apngjd32.exe
        247⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Bfhofnpp.exe
        
        C:\Windows\system32\Bfhofnpp.exe
        248⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Bmagch32.exe
        
        C:\Windows\system32\Bmagch32.exe
        249⤵
        Drops file in System32 directory
        
        PID:8608
        
        C:\Windows\SysWOW64\Bboplo32.exe
        
        C:\Windows\system32\Bboplo32.exe
        250⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Blgddd32.exe
        
        C:\Windows\system32\Blgddd32.exe
        251⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Bbalaoda.exe
        
        C:\Windows\system32\Bbalaoda.exe
        252⤵
        Drops file in System32 directory
        
        PID:8732
        
        C:\Windows\SysWOW64\Bikeni32.exe
        
        C:\Windows\system32\Bikeni32.exe
        253⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Bliajd32.exe
        
        C:\Windows\system32\Bliajd32.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8820
        
        C:\Windows\SysWOW64\Bbcignbo.exe
        
        C:\Windows\system32\Bbcignbo.exe
        255⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Bimach32.exe
        
        C:\Windows\system32\Bimach32.exe
        256⤵
        Modifies registry class
        
        PID:8904
        
        C:\Windows\SysWOW64\Bpgjpb32.exe
        
        C:\Windows\system32\Bpgjpb32.exe
        257⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Bfabmmhe.exe
        
        C:\Windows\system32\Bfabmmhe.exe
        258⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Cpifeb32.exe
        
        C:\Windows\system32\Cpifeb32.exe
        259⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Cbhbbn32.exe
        
        C:\Windows\system32\Cbhbbn32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9084
        
        C:\Windows\SysWOW64\Cibkohef.exe
        
        C:\Windows\system32\Cibkohef.exe
        261⤵
        Modifies registry class
        
        PID:9128
        
        C:\Windows\SysWOW64\Cbjogmlf.exe
        
        C:\Windows\system32\Cbjogmlf.exe
        262⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Cidgdg32.exe
        
        C:\Windows\system32\Cidgdg32.exe
        263⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Cfhhml32.exe
        
        C:\Windows\system32\Cfhhml32.exe
        264⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Cmbpjfij.exe
        
        C:\Windows\system32\Cmbpjfij.exe
        265⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Cpqlfa32.exe
        
        C:\Windows\system32\Cpqlfa32.exe
        266⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Cfjeckpj.exe
        
        C:\Windows\system32\Cfjeckpj.exe
        267⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Cmdmpe32.exe
        
        C:\Windows\system32\Cmdmpe32.exe
        268⤵
        Drops file in System32 directory
        
        PID:8520
        
        C:\Windows\SysWOW64\Cdnelpod.exe
        
        C:\Windows\system32\Cdnelpod.exe
        269⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Clijablo.exe
        
        C:\Windows\system32\Clijablo.exe
        270⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Ddqbbo32.exe
        
        C:\Windows\system32\Ddqbbo32.exe
        271⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Dmifkecb.exe
        
        C:\Windows\system32\Dmifkecb.exe
        272⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Ddcogo32.exe
        
        C:\Windows\system32\Ddcogo32.exe
        273⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Dipgpf32.exe
        
        C:\Windows\system32\Dipgpf32.exe
        274⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Dlncla32.exe
        
        C:\Windows\system32\Dlncla32.exe
        275⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Dbhlikpf.exe
        
        C:\Windows\system32\Dbhlikpf.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9036
        
        C:\Windows\SysWOW64\Dibdeegc.exe
        
        C:\Windows\system32\Dibdeegc.exe
        277⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Dpllbp32.exe
        
        C:\Windows\system32\Dpllbp32.exe
        278⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Eleimp32.exe
        
        C:\Windows\system32\Eleimp32.exe
        279⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Ecoaijio.exe
        
        C:\Windows\system32\Ecoaijio.exe
        280⤵
        Modifies registry class
        
        PID:8336
        
        C:\Windows\SysWOW64\Elhfbp32.exe
        
        C:\Windows\system32\Elhfbp32.exe
        281⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Edoncm32.exe
        
        C:\Windows\system32\Edoncm32.exe
        282⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Eepkkefp.exe
        
        C:\Windows\system32\Eepkkefp.exe
        283⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Eljchpnl.exe
        
        C:\Windows\system32\Eljchpnl.exe
        284⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Ecdkdj32.exe
        
        C:\Windows\system32\Ecdkdj32.exe
        285⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Emioab32.exe
        
        C:\Windows\system32\Emioab32.exe
        286⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Ecfhji32.exe
        
        C:\Windows\system32\Ecfhji32.exe
        287⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Eeddfe32.exe
        
        C:\Windows\system32\Eeddfe32.exe
        288⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Elolco32.exe
        
        C:\Windows\system32\Elolco32.exe
        289⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Ecidpiad.exe
        
        C:\Windows\system32\Ecidpiad.exe
        290⤵
        Drops file in System32 directory
        
        PID:7524
        
        C:\Windows\SysWOW64\Eegqldqg.exe
        
        C:\Windows\system32\Eegqldqg.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8728
        
        C:\Windows\SysWOW64\Fpmeimpn.exe
        
        C:\Windows\system32\Fpmeimpn.exe
        292⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Fckaeioa.exe
        
        C:\Windows\system32\Fckaeioa.exe
        293⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Flcfnn32.exe
        
        C:\Windows\system32\Flcfnn32.exe
        294⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Fdjnolfd.exe
        
        C:\Windows\system32\Fdjnolfd.exe
        295⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Flfbcndo.exe
        
        C:\Windows\system32\Flfbcndo.exe
        296⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Fcpkph32.exe
        
        C:\Windows\system32\Fcpkph32.exe
        297⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Ffnglc32.exe
        
        C:\Windows\system32\Ffnglc32.exe
        298⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Flhoinbl.exe
        
        C:\Windows\system32\Flhoinbl.exe
        299⤵
        Modifies registry class
        
        PID:9148
        
        C:\Windows\SysWOW64\Fcbgfhii.exe
        
        C:\Windows\system32\Fcbgfhii.exe
        300⤵
        Modifies registry class
        
        PID:8428
        
        C:\Windows\SysWOW64\Fjlpbb32.exe
        
        C:\Windows\system32\Fjlpbb32.exe
        301⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Fljlom32.exe
        
        C:\Windows\system32\Fljlom32.exe
        302⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Fgpplf32.exe
        
        C:\Windows\system32\Fgpplf32.exe
        303⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Gnjhhpgl.exe
        
        C:\Windows\system32\Gnjhhpgl.exe
        304⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Gcgqag32.exe
        
        C:\Windows\system32\Gcgqag32.exe
        305⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Gnlenp32.exe
        
        C:\Windows\system32\Gnlenp32.exe
        306⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Gdfmkjlg.exe
        
        C:\Windows\system32\Gdfmkjlg.exe
        307⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Gfgjbb32.exe
        
        C:\Windows\system32\Gfgjbb32.exe
        308⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Gjhonp32.exe
        
        C:\Windows\system32\Gjhonp32.exe
        309⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Gdmcki32.exe
        
        C:\Windows\system32\Gdmcki32.exe
        310⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Gglpgd32.exe
        
        C:\Windows\system32\Gglpgd32.exe
        311⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Hnehdo32.exe
        
        C:\Windows\system32\Hnehdo32.exe
        312⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Hdppaidl.exe
        
        C:\Windows\system32\Hdppaidl.exe
        313⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Hfamia32.exe
        
        C:\Windows\system32\Hfamia32.exe
        314⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Hnhdjn32.exe
        
        C:\Windows\system32\Hnhdjn32.exe
        315⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Hdbmfhbi.exe
        
        C:\Windows\system32\Hdbmfhbi.exe
        316⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Hfcinq32.exe
        
        C:\Windows\system32\Hfcinq32.exe
        317⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Hnjaonij.exe
        
        C:\Windows\system32\Hnjaonij.exe
        318⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Hddilh32.exe
        
        C:\Windows\system32\Hddilh32.exe
        319⤵
        Drops file in System32 directory
        
        PID:9728
        
        C:\Windows\SysWOW64\Hfefdpfe.exe
        
        C:\Windows\system32\Hfefdpfe.exe
        320⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Hqkjaifk.exe
        
        C:\Windows\system32\Hqkjaifk.exe
        321⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Hgebnc32.exe
        
        C:\Windows\system32\Hgebnc32.exe
        322⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Hjcojo32.exe
        
        C:\Windows\system32\Hjcojo32.exe
        323⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Hqmggi32.exe
        
        C:\Windows\system32\Hqmggi32.exe
        324⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Iggocbke.exe
        
        C:\Windows\system32\Iggocbke.exe
        325⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Inagpm32.exe
        
        C:\Windows\system32\Inagpm32.exe
        326⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Idkpmgjo.exe
        
        C:\Windows\system32\Idkpmgjo.exe
        327⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Ijhhenhf.exe
        
        C:\Windows\system32\Ijhhenhf.exe
        328⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10124
        
        C:\Windows\SysWOW64\Iqbpahpc.exe
        
        C:\Windows\system32\Iqbpahpc.exe
        329⤵
        Modifies registry class
        
        PID:10176
        
        C:\Windows\SysWOW64\Iglhob32.exe
        
        C:\Windows\system32\Iglhob32.exe
        330⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Imiagi32.exe
        
        C:\Windows\system32\Imiagi32.exe
        331⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Iepihf32.exe
        
        C:\Windows\system32\Iepihf32.exe
        332⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Ifaepolg.exe
        
        C:\Windows\system32\Ifaepolg.exe
        333⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Imknli32.exe
        
        C:\Windows\system32\Imknli32.exe
        334⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Igqbiacj.exe
        
        C:\Windows\system32\Igqbiacj.exe
        335⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Imnjbhaa.exe
        
        C:\Windows\system32\Imnjbhaa.exe
        336⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Icgbob32.exe
        
        C:\Windows\system32\Icgbob32.exe
        337⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Jjakkmpk.exe
        
        C:\Windows\system32\Jjakkmpk.exe
        338⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Jgekdq32.exe
        
        C:\Windows\system32\Jgekdq32.exe
        339⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Jjdgal32.exe
        
        C:\Windows\system32\Jjdgal32.exe
        340⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Janpnfee.exe
        
        C:\Windows\system32\Janpnfee.exe
        341⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Jghhjq32.exe
        
        C:\Windows\system32\Jghhjq32.exe
        342⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Jnapgjdo.exe
        
        C:\Windows\system32\Jnapgjdo.exe
        343⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Jcoioabf.exe
        
        C:\Windows\system32\Jcoioabf.exe
        344⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Jjhalkjc.exe
        
        C:\Windows\system32\Jjhalkjc.exe
        345⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\Jabiie32.exe
        
        C:\Windows\system32\Jabiie32.exe
        346⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Jnfjbj32.exe
        
        C:\Windows\system32\Jnfjbj32.exe
        347⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Kaioidkh.exe
        
        C:\Windows\system32\Kaioidkh.exe
        348⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Kfidgk32.exe
        
        C:\Windows\system32\Kfidgk32.exe
        349⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Kmbmdeoj.exe
        
        C:\Windows\system32\Kmbmdeoj.exe
        350⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Kdmeqo32.exe
        
        C:\Windows\system32\Kdmeqo32.exe
        351⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Kjfmminc.exe
        
        C:\Windows\system32\Kjfmminc.exe
        352⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Kaqejcep.exe
        
        C:\Windows\system32\Kaqejcep.exe
        353⤵
        Drops file in System32 directory
        
        PID:10112
        
        C:\Windows\SysWOW64\Lfmnbjcg.exe
        
        C:\Windows\system32\Lfmnbjcg.exe
        354⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\Lmgfod32.exe
        
        C:\Windows\system32\Lmgfod32.exe
        355⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Lfpkhjae.exe
        
        C:\Windows\system32\Lfpkhjae.exe
        356⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Lmjcdd32.exe
        
        C:\Windows\system32\Lmjcdd32.exe
        357⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Ldckan32.exe
        
        C:\Windows\system32\Ldckan32.exe
        358⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Ljncnhhk.exe
        
        C:\Windows\system32\Ljncnhhk.exe
        359⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Lechkaga.exe
        
        C:\Windows\system32\Lechkaga.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8356
        
        C:\Windows\SysWOW64\Lkppchfi.exe
        
        C:\Windows\system32\Lkppchfi.exe
        361⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Lfgahikm.exe
        
        C:\Windows\system32\Lfgahikm.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10000
        
        C:\Windows\SysWOW64\Loniiflo.exe
        
        C:\Windows\system32\Loniiflo.exe
        363⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Mhfmbl32.exe
        
        C:\Windows\system32\Mhfmbl32.exe
        364⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Mmcfkc32.exe
        
        C:\Windows\system32\Mmcfkc32.exe
        365⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Mdmngm32.exe
        
        C:\Windows\system32\Mdmngm32.exe
        366⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Mmebpbod.exe
        
        C:\Windows\system32\Mmebpbod.exe
        367⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Mhkgnkoj.exe
        
        C:\Windows\system32\Mhkgnkoj.exe
        368⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Mmhofbma.exe
        
        C:\Windows\system32\Mmhofbma.exe
        369⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Mklpof32.exe
        
        C:\Windows\system32\Mklpof32.exe
        370⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Maehlqch.exe
        
        C:\Windows\system32\Maehlqch.exe
        371⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Mgbpdgap.exe
        
        C:\Windows\system32\Mgbpdgap.exe
        372⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Moiheebb.exe
        
        C:\Windows\system32\Moiheebb.exe
        373⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Ndfanlpi.exe
        
        C:\Windows\system32\Ndfanlpi.exe
        374⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Nolekd32.exe
        
        C:\Windows\system32\Nolekd32.exe
        375⤵
        Modifies registry class
        
        PID:10576
        
        C:\Windows\SysWOW64\Nefmgogl.exe
        
        C:\Windows\system32\Nefmgogl.exe
        376⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Nggjog32.exe
        
        C:\Windows\system32\Nggjog32.exe
        377⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Nnabladg.exe
        
        C:\Windows\system32\Nnabladg.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10704
        
        C:\Windows\SysWOW64\Nehjmnei.exe
        
        C:\Windows\system32\Nehjmnei.exe
        379⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Ngifef32.exe
        
        C:\Windows\system32\Ngifef32.exe
        380⤵
        Drops file in System32 directory
        
        PID:10788
        
        C:\Windows\SysWOW64\Nejgbn32.exe
        
        C:\Windows\system32\Nejgbn32.exe
        381⤵
        Drops file in System32 directory
        
        PID:10828
        
        C:\Windows\SysWOW64\Nkgoke32.exe
        
        C:\Windows\system32\Nkgoke32.exe
        382⤵
        Modifies registry class
        
        PID:10872
        
        C:\Windows\SysWOW64\Nnfkgp32.exe
        
        C:\Windows\system32\Nnfkgp32.exe
        383⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Ngnppfgb.exe
        
        C:\Windows\system32\Ngnppfgb.exe
        384⤵
        Drops file in System32 directory
        
        PID:10972
        
        C:\Windows\SysWOW64\Onhhmpoo.exe
        
        C:\Windows\system32\Onhhmpoo.exe
        385⤵
        Drops file in System32 directory
        
        PID:11020
        
        C:\Windows\SysWOW64\Oklifdmi.exe
        
        C:\Windows\system32\Oklifdmi.exe
        386⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Oafacn32.exe
        
        C:\Windows\system32\Oafacn32.exe
        387⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Ohpiphlb.exe
        
        C:\Windows\system32\Ohpiphlb.exe
        388⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Okneldkf.exe
        
        C:\Windows\system32\Okneldkf.exe
        389⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Oahnhncc.exe
        
        C:\Windows\system32\Oahnhncc.exe
        390⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Ohbfeh32.exe
        
        C:\Windows\system32\Ohbfeh32.exe
        391⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Okqbac32.exe
        
        C:\Windows\system32\Okqbac32.exe
        392⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\Oakjnnap.exe
        
        C:\Windows\system32\Oakjnnap.exe
        393⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Pndhhnda.exe
        
        C:\Windows\system32\Pndhhnda.exe
        394⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Pohnnqgo.exe
        
        C:\Windows\system32\Pohnnqgo.exe
        395⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Pfbfjk32.exe
        
        C:\Windows\system32\Pfbfjk32.exe
        396⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Pgcbbc32.exe
        
        C:\Windows\system32\Pgcbbc32.exe
        397⤵
        Modifies registry class
        
        PID:10644
        
        C:\Windows\SysWOW64\Pojjcp32.exe
        
        C:\Windows\system32\Pojjcp32.exe
        398⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Pfdbpjmi.exe
        
        C:\Windows\system32\Pfdbpjmi.exe
        399⤵
        Modifies registry class
        
        PID:10776
        
        C:\Windows\SysWOW64\Qkakhakq.exe
        
        C:\Windows\system32\Qkakhakq.exe
        400⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Qkchna32.exe
        
        C:\Windows\system32\Qkchna32.exe
        401⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Qfilkj32.exe
        
        C:\Windows\system32\Qfilkj32.exe
        402⤵
        Drops file in System32 directory
        
        PID:10968
        
        C:\Windows\SysWOW64\Akfdcq32.exe
        
        C:\Windows\system32\Akfdcq32.exe
        403⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Abpmpkoh.exe
        
        C:\Windows\system32\Abpmpkoh.exe
        404⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Agmehamp.exe
        
        C:\Windows\system32\Agmehamp.exe
        405⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Abdfkj32.exe
        
        C:\Windows\system32\Abdfkj32.exe
        406⤵
        Drops file in System32 directory
        
        PID:11248
        
        C:\Windows\SysWOW64\Ainnhdbp.exe
        
        C:\Windows\system32\Ainnhdbp.exe
        407⤵
        Drops file in System32 directory
        
        PID:10252
        
        C:\Windows\SysWOW64\Ankgpk32.exe
        
        C:\Windows\system32\Ankgpk32.exe
        408⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Agckiqgg.exe
        
        C:\Windows\system32\Agckiqgg.exe
        409⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Anncek32.exe
        
        C:\Windows\system32\Anncek32.exe
        410⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Bichcc32.exe
        
        C:\Windows\system32\Bichcc32.exe
        411⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Bkadoo32.exe
        
        C:\Windows\system32\Bkadoo32.exe
        412⤵
        Modifies registry class
        
        PID:10820
        
        C:\Windows\SysWOW64\Bbklli32.exe
        
        C:\Windows\system32\Bbklli32.exe
        413⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10952
        
        C:\Windows\SysWOW64\Biedhclh.exe
        
        C:\Windows\system32\Biedhclh.exe
        414⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Bpomem32.exe
        
        C:\Windows\system32\Bpomem32.exe
        415⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11100
        
        C:\Windows\SysWOW64\Bbniai32.exe
        
        C:\Windows\system32\Bbniai32.exe
        416⤵
        Drops file in System32 directory
        
        PID:11220
        
        C:\Windows\SysWOW64\Bihancje.exe
        
        C:\Windows\system32\Bihancje.exe
        417⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Bpaikm32.exe
        
        C:\Windows\system32\Bpaikm32.exe
        418⤵
        Modifies registry class
        
        PID:10340
        
        C:\Windows\SysWOW64\Bijncb32.exe
        
        C:\Windows\system32\Bijncb32.exe
        419⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Bpdfpmoo.exe
        
        C:\Windows\system32\Bpdfpmoo.exe
        420⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Beaohcmf.exe
        
        C:\Windows\system32\Beaohcmf.exe
        421⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Blkgen32.exe
        
        C:\Windows\system32\Blkgen32.exe
        422⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Bbeobhlp.exe
        
        C:\Windows\system32\Bbeobhlp.exe
        423⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Ciogobcm.exe
        
        C:\Windows\system32\Ciogobcm.exe
        424⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Cpipkl32.exe
        
        C:\Windows\system32\Cpipkl32.exe
        425⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Cbglgg32.exe
        
        C:\Windows\system32\Cbglgg32.exe
        426⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Ciaddaaj.exe
        
        C:\Windows\system32\Ciaddaaj.exe
        427⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Cpklql32.exe
        
        C:\Windows\system32\Cpklql32.exe
        428⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\Cfedmfqd.exe
        
        C:\Windows\system32\Cfedmfqd.exe
        429⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Chfaenfb.exe
        
        C:\Windows\system32\Chfaenfb.exe
        430⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Cnpibh32.exe
        
        C:\Windows\system32\Cnpibh32.exe
        431⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\Cejaobel.exe
        
        C:\Windows\system32\Cejaobel.exe
        432⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Cldjkl32.exe
        
        C:\Windows\system32\Cldjkl32.exe
        433⤵
        Drops file in System32 directory
        
        PID:10816
        
        C:\Windows\SysWOW64\Cbnbhfde.exe
        
        C:\Windows\system32\Cbnbhfde.exe
        434⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Cihjeq32.exe
        
        C:\Windows\system32\Cihjeq32.exe
        435⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\Cpbbak32.exe
        
        C:\Windows\system32\Cpbbak32.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10584
        
        C:\Windows\SysWOW64\Cfljnejl.exe
        
        C:\Windows\system32\Cfljnejl.exe
        437⤵
        Modifies registry class
        
        PID:4000
        
        C:\Windows\SysWOW64\Dhmgfm32.exe
        
        C:\Windows\system32\Dhmgfm32.exe
        438⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Dngobghg.exe
        
        C:\Windows\system32\Dngobghg.exe
        439⤵
        
        PID:872
        
        C:\Windows\SysWOW64\Dfngcdhi.exe
        
        C:\Windows\system32\Dfngcdhi.exe
        440⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Dhpdkm32.exe
        
        C:\Windows\system32\Dhpdkm32.exe
        441⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Dojlhg32.exe
        
        C:\Windows\system32\Dojlhg32.exe
        442⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Decdeama.exe
        
        C:\Windows\system32\Decdeama.exe
        443⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Dlnlak32.exe
        
        C:\Windows\system32\Dlnlak32.exe
        444⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Dbgdnelk.exe
        
        C:\Windows\system32\Dbgdnelk.exe
        445⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Diamko32.exe
        
        C:\Windows\system32\Diamko32.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11468
        
        C:\Windows\SysWOW64\Dpkehi32.exe
        
        C:\Windows\system32\Dpkehi32.exe
        447⤵
        Modifies registry class
        
        PID:11508
        
        C:\Windows\SysWOW64\Dbjade32.exe
        
        C:\Windows\system32\Dbjade32.exe
        448⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11552
        
        C:\Windows\SysWOW64\Didjqoae.exe
        
        C:\Windows\system32\Didjqoae.exe
        449⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Dpnbmi32.exe
        
        C:\Windows\system32\Dpnbmi32.exe
        450⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\Dblnid32.exe
        
        C:\Windows\system32\Dblnid32.exe
        451⤵
        Modifies registry class
        
        PID:11672
        
        C:\Windows\SysWOW64\Eifffoob.exe
        
        C:\Windows\system32\Eifffoob.exe
        452⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Eppobi32.exe
        
        C:\Windows\system32\Eppobi32.exe
        453⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Eemgkpef.exe
        
        C:\Windows\system32\Eemgkpef.exe
        454⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Ehkcgkdj.exe
        
        C:\Windows\system32\Ehkcgkdj.exe
        455⤵
        Drops file in System32 directory
        
        PID:11836
        
        C:\Windows\SysWOW64\Ebagdddp.exe
        
        C:\Windows\system32\Ebagdddp.exe
        456⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Eeodqocd.exe
        
        C:\Windows\system32\Eeodqocd.exe
        457⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\Elilmi32.exe
        
        C:\Windows\system32\Elilmi32.exe
        458⤵
        Drops file in System32 directory
        
        PID:11960
        
        C:\Windows\SysWOW64\Efopjbjg.exe
        
        C:\Windows\system32\Efopjbjg.exe
        459⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Eimlgnij.exe
        
        C:\Windows\system32\Eimlgnij.exe
        460⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\Epgdch32.exe
        
        C:\Windows\system32\Epgdch32.exe
        461⤵
        Drops file in System32 directory
        
        PID:12096
        
        C:\Windows\SysWOW64\Efampahd.exe
        
        C:\Windows\system32\Efampahd.exe
        462⤵
        Modifies registry class
        
        PID:12136
        
        C:\Windows\SysWOW64\Ehbihj32.exe
        
        C:\Windows\system32\Ehbihj32.exe
        463⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Eoladdeo.exe
        
        C:\Windows\system32\Eoladdeo.exe
        464⤵
        Modifies registry class
        
        PID:12212
        
        C:\Windows\SysWOW64\Fibfbm32.exe
        
        C:\Windows\system32\Fibfbm32.exe
        465⤵
        Drops file in System32 directory
        
        PID:12252
        
        C:\Windows\SysWOW64\Fplnogmb.exe
        
        C:\Windows\system32\Fplnogmb.exe
        466⤵
        Modifies registry class
        
        PID:4100
        
        C:\Windows\SysWOW64\Fidbgm32.exe
        
        C:\Windows\system32\Fidbgm32.exe
        467⤵
        Modifies registry class
        
        PID:11316
        
        C:\Windows\SysWOW64\Fpnkdfko.exe
        
        C:\Windows\system32\Fpnkdfko.exe
        468⤵
        
        PID:11368
        
        C:\Windows\SysWOW64\Fekclnif.exe
        
        C:\Windows\system32\Fekclnif.exe
        469⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Fpqgjf32.exe
        
        C:\Windows\system32\Fpqgjf32.exe
        470⤵
        Drops file in System32 directory
        
        PID:3888
        
        C:\Windows\SysWOW64\Fempbm32.exe
        
        C:\Windows\system32\Fempbm32.exe
        471⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Fpcdof32.exe
        
        C:\Windows\system32\Fpcdof32.exe
        472⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\Fgmllpng.exe
        
        C:\Windows\system32\Fgmllpng.exe
        473⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Fhnichde.exe
        
        C:\Windows\system32\Fhnichde.exe
        474⤵
        
        PID:11748
        
        C:\Windows\SysWOW64\Gohapb32.exe
        
        C:\Windows\system32\Gohapb32.exe
        475⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11820
        
        C:\Windows\SysWOW64\Gebimmco.exe
        
        C:\Windows\system32\Gebimmco.exe
        476⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11876
        
        C:\Windows\SysWOW64\Gllajf32.exe
        
        C:\Windows\system32\Gllajf32.exe
        477⤵
        Modifies registry class
        
        PID:11936
        
        C:\Windows\SysWOW64\Gcfjfqah.exe
        
        C:\Windows\system32\Gcfjfqah.exe
        478⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Gipbck32.exe
        
        C:\Windows\system32\Gipbck32.exe
        479⤵
        Drops file in System32 directory
        
        PID:12052
        
        C:\Windows\SysWOW64\Hjnndime.exe
        
        C:\Windows\system32\Hjnndime.exe
        480⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Hokgmpkl.exe
        
        C:\Windows\system32\Hokgmpkl.exe
        481⤵
        Modifies registry class
        
        PID:12184
        
        C:\Windows\SysWOW64\Hfeoijbi.exe
        
        C:\Windows\system32\Hfeoijbi.exe
        482⤵
        Drops file in System32 directory
        
        PID:3884
        
        C:\Windows\SysWOW64\Hlogfd32.exe
        
        C:\Windows\system32\Hlogfd32.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12284
        
        C:\Windows\SysWOW64\Icminm32.exe
        
        C:\Windows\system32\Icminm32.exe
        484⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Ijgakgej.exe
        
        C:\Windows\system32\Ijgakgej.exe
        485⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Iodjcnca.exe
        
        C:\Windows\system32\Iodjcnca.exe
        486⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Ifnbph32.exe
        
        C:\Windows\system32\Ifnbph32.exe
        487⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Ihmnldib.exe
        
        C:\Windows\system32\Ihmnldib.exe
        488⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Icbbimih.exe
        
        C:\Windows\system32\Icbbimih.exe
        489⤵
        Drops file in System32 directory
        
        PID:11724
        
        C:\Windows\SysWOW64\Ijlkfg32.exe
        
        C:\Windows\system32\Ijlkfg32.exe
        490⤵
        Drops file in System32 directory
        
        PID:11804
        
        C:\Windows\SysWOW64\Iqfcbahb.exe
        
        C:\Windows\system32\Iqfcbahb.exe
        491⤵
        Drops file in System32 directory
        
        PID:11872
        
        C:\Windows\SysWOW64\Igpkok32.exe
        
        C:\Windows\system32\Igpkok32.exe
        492⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4244
        
        C:\Windows\SysWOW64\Iiaggc32.exe
        
        C:\Windows\system32\Iiaggc32.exe
        493⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Jicdlc32.exe
        
        C:\Windows\system32\Jicdlc32.exe
        494⤵
        Modifies registry class
        
        PID:968
        
        C:\Windows\SysWOW64\Jonlimkg.exe
        
        C:\Windows\system32\Jonlimkg.exe
        495⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Jfgefg32.exe
        
        C:\Windows\system32\Jfgefg32.exe
        496⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Jqmicpbj.exe
        
        C:\Windows\system32\Jqmicpbj.exe
        497⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Jggapj32.exe
        
        C:\Windows\system32\Jggapj32.exe
        498⤵
        
        PID:876
        
        C:\Windows\SysWOW64\Jihngboe.exe
        
        C:\Windows\system32\Jihngboe.exe
        499⤵
        Modifies registry class
        
        PID:2184
        
        C:\Windows\SysWOW64\Jcpojk32.exe
        
        C:\Windows\system32\Jcpojk32.exe
        500⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Jjjggede.exe
        
        C:\Windows\system32\Jjjggede.exe
        501⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\Kmhccpci.exe
        
        C:\Windows\system32\Kmhccpci.exe
        502⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Kcbkpj32.exe
        
        C:\Windows\system32\Kcbkpj32.exe
        503⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Kiodha32.exe
        
        C:\Windows\system32\Kiodha32.exe
        504⤵
        Drops file in System32 directory
        
        PID:11788
        
        C:\Windows\SysWOW64\Kcehejic.exe
        
        C:\Windows\system32\Kcehejic.exe
        505⤵
        Modifies registry class
        
        PID:1748
        
        C:\Windows\SysWOW64\Kmmmnp32.exe
        
        C:\Windows\system32\Kmmmnp32.exe
        506⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\Kfeagefd.exe
        
        C:\Windows\system32\Kfeagefd.exe
        507⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Kmpido32.exe
        
        C:\Windows\system32\Kmpido32.exe
        508⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Kciaqi32.exe
        
        C:\Windows\system32\Kciaqi32.exe
        509⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\Kjcjmclj.exe
        
        C:\Windows\system32\Kjcjmclj.exe
        510⤵
        Modifies registry class
        
        PID:12220
        
        C:\Windows\SysWOW64\Kanbjn32.exe
        
        C:\Windows\system32\Kanbjn32.exe
        511⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12240
        
        C:\Windows\SysWOW64\Liifnp32.exe
        
        C:\Windows\system32\Liifnp32.exe
        512⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3104
        
        C:\Windows\SysWOW64\Lcnkli32.exe
        
        C:\Windows\system32\Lcnkli32.exe
        513⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Labkempb.exe
        
        C:\Windows\system32\Labkempb.exe
        514⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\Lfodmdni.exe
        
        C:\Windows\system32\Lfodmdni.exe
        515⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4448
        
        C:\Windows\SysWOW64\Lmiljn32.exe
        
        C:\Windows\system32\Lmiljn32.exe
        516⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Lpghfi32.exe
        
        C:\Windows\system32\Lpghfi32.exe
        517⤵
        
        PID:832
        
        C:\Windows\SysWOW64\Ljmmcbdp.exe
        
        C:\Windows\system32\Ljmmcbdp.exe
        518⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Lagepl32.exe
        
        C:\Windows\system32\Lagepl32.exe
        519⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Lhammfci.exe
        
        C:\Windows\system32\Lhammfci.exe
        520⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\Libido32.exe
        
        C:\Windows\system32\Libido32.exe
        521⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Lplaaiqd.exe
        
        C:\Windows\system32\Lplaaiqd.exe
        522⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12048
        
        C:\Windows\SysWOW64\Mjafoapj.exe
        
        C:\Windows\system32\Mjafoapj.exe
        523⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\Malnklgg.exe
        
        C:\Windows\system32\Malnklgg.exe
        524⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Mhefhf32.exe
        
        C:\Windows\system32\Mhefhf32.exe
        525⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\Migcpneb.exe
        
        C:\Windows\system32\Migcpneb.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2384
        
        C:\Windows\SysWOW64\Mpqklh32.exe
        
        C:\Windows\system32\Mpqklh32.exe
        527⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Mfkcibdl.exe
        
        C:\Windows\system32\Mfkcibdl.exe
        528⤵
        Drops file in System32 directory
        
        PID:11948
        
        C:\Windows\SysWOW64\Mmdlflki.exe
        
        C:\Windows\system32\Mmdlflki.exe
        529⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Mdodbf32.exe
        
        C:\Windows\system32\Mdodbf32.exe
        530⤵
        Drops file in System32 directory
        
        PID:12064
        
        C:\Windows\SysWOW64\Mjiloqjb.exe
        
        C:\Windows\system32\Mjiloqjb.exe
        531⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Mpedgghj.exe
        
        C:\Windows\system32\Mpedgghj.exe
        532⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\Mphamg32.exe
        
        C:\Windows\system32\Mphamg32.exe
        533⤵
        Modifies registry class
        
        PID:1880
        
        C:\Windows\SysWOW64\Nfaijand.exe
        
        C:\Windows\system32\Nfaijand.exe
        534⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Nmlafk32.exe
        
        C:\Windows\system32\Nmlafk32.exe
        535⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Ndejcemn.exe
        
        C:\Windows\system32\Ndejcemn.exe
        536⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11784
        
        C:\Windows\SysWOW64\Nibbklke.exe
        
        C:\Windows\system32\Nibbklke.exe
        537⤵
        Modifies registry class
        
        PID:1444
        
        C:\Windows\SysWOW64\Nplkhf32.exe
        
        C:\Windows\system32\Nplkhf32.exe
        538⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Nhcbidcd.exe
        
        C:\Windows\system32\Nhcbidcd.exe
        539⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4536
        
        C:\Windows\SysWOW64\Nieoal32.exe
        
        C:\Windows\system32\Nieoal32.exe
        540⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\Npognfpo.exe
        
        C:\Windows\system32\Npognfpo.exe
        541⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5008
        
        C:\Windows\SysWOW64\Nmbhgjoi.exe
        
        C:\Windows\system32\Nmbhgjoi.exe
        542⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\Ndmpddfe.exe
        
        C:\Windows\system32\Ndmpddfe.exe
        543⤵
        
        PID:11776
        
        C:\Windows\SysWOW64\Niihlkdm.exe
        
        C:\Windows\system32\Niihlkdm.exe
        544⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4304
        
        C:\Windows\SysWOW64\Npcaie32.exe
        
        C:\Windows\system32\Npcaie32.exe
        545⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\Okiefn32.exe
        
        C:\Windows\system32\Okiefn32.exe
        546⤵
        
        PID:368
        
        C:\Windows\SysWOW64\Omgabj32.exe
        
        C:\Windows\system32\Omgabj32.exe
        547⤵
        Drops file in System32 directory
        
        PID:12236
        
        C:\Windows\SysWOW64\Odaiodbp.exe
        
        C:\Windows\system32\Odaiodbp.exe
        548⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Okkalnjm.exe
        
        C:\Windows\system32\Okkalnjm.exe
        549⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1476
        
        C:\Windows\SysWOW64\Ophjdehd.exe
        
        C:\Windows\system32\Ophjdehd.exe
        550⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Oknnanhj.exe
        
        C:\Windows\system32\Oknnanhj.exe
        551⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\Oahgnh32.exe
        
        C:\Windows\system32\Oahgnh32.exe
        552⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Okpkgm32.exe
        
        C:\Windows\system32\Okpkgm32.exe
        553⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Oajccgmd.exe
        
        C:\Windows\system32\Oajccgmd.exe
        554⤵
        
        PID:11420
        
        C:\Windows\SysWOW64\Oggllnkl.exe
        
        C:\Windows\system32\Oggllnkl.exe
        555⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\Onqdhh32.exe
        
        C:\Windows\system32\Onqdhh32.exe
        556⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Phfhfa32.exe
        
        C:\Windows\system32\Phfhfa32.exe
        557⤵
        Drops file in System32 directory
        
        PID:1944
        
        C:\Windows\SysWOW64\Pjgemi32.exe
        
        C:\Windows\system32\Pjgemi32.exe
        558⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Ppamjcpj.exe
        
        C:\Windows\system32\Ppamjcpj.exe
        559⤵
        Drops file in System32 directory
        
        PID:4844
        
        C:\Windows\SysWOW64\Pjjaci32.exe
        
        C:\Windows\system32\Pjjaci32.exe
        560⤵
        Drops file in System32 directory
        
        PID:11752
        
        C:\Windows\SysWOW64\Pkinmlnm.exe
        
        C:\Windows\system32\Pkinmlnm.exe
        561⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\Pacfjfej.exe
        
        C:\Windows\system32\Pacfjfej.exe
        562⤵
        Modifies registry class
        
        PID:320
        
        C:\Windows\SysWOW64\Phmnfp32.exe
        
        C:\Windows\system32\Phmnfp32.exe
        563⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Pjoknhbe.exe
        
        C:\Windows\system32\Pjoknhbe.exe
        564⤵
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Pphckb32.exe
        
        C:\Windows\system32\Pphckb32.exe
        565⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Pknghk32.exe
        
        C:\Windows\system32\Pknghk32.exe
        566⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Qgehml32.exe
        
        C:\Windows\system32\Qgehml32.exe
        567⤵
        Drops file in System32 directory
        
        PID:5296
        
        C:\Windows\SysWOW64\Qnopjfgi.exe
        
        C:\Windows\system32\Qnopjfgi.exe
        568⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5376
        
        C:\Windows\SysWOW64\Qggebl32.exe
        
        C:\Windows\system32\Qggebl32.exe
        569⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Qnamofdf.exe
        
        C:\Windows\system32\Qnamofdf.exe
        570⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Adkelplc.exe
        
        C:\Windows\system32\Adkelplc.exe
        571⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Akenij32.exe
        
        C:\Windows\system32\Akenij32.exe
        572⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5660
        
        C:\Windows\SysWOW64\Aaofedkl.exe
        
        C:\Windows\system32\Aaofedkl.exe
        573⤵
        
        PID:896
        
        C:\Windows\SysWOW64\Aglnnkid.exe
        
        C:\Windows\system32\Aglnnkid.exe
        574⤵
        Modifies registry class
        
        PID:4424
        
        C:\Windows\SysWOW64\Anffje32.exe
        
        C:\Windows\system32\Anffje32.exe
        575⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Adpogp32.exe
        
        C:\Windows\system32\Adpogp32.exe
        576⤵
        Drops file in System32 directory
        
        PID:5700
        
        C:\Windows\SysWOW64\Ajmgof32.exe
        
        C:\Windows\system32\Ajmgof32.exe
        577⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Agqhik32.exe
        
        C:\Windows\system32\Agqhik32.exe
        578⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5324
        
        C:\Windows\SysWOW64\Aqilaplo.exe
        
        C:\Windows\system32\Aqilaplo.exe
        579⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5924
        
        C:\Windows\SysWOW64\Agcdnjcl.exe
        
        C:\Windows\system32\Agcdnjcl.exe
        580⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5520
        
        C:\Windows\SysWOW64\Ajaqjfbp.exe
        
        C:\Windows\system32\Ajaqjfbp.exe
        581⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Bhbahm32.exe
        
        C:\Windows\system32\Bhbahm32.exe
        582⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Bkamdi32.exe
        
        C:\Windows\system32\Bkamdi32.exe
        583⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Bqnemp32.exe
        
        C:\Windows\system32\Bqnemp32.exe
        584⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Bggnijof.exe
        
        C:\Windows\system32\Bggnijof.exe
        585⤵
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Bnaffdfc.exe
        
        C:\Windows\system32\Bnaffdfc.exe
        586⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Bdlncn32.exe
        
        C:\Windows\system32\Bdlncn32.exe
        587⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Bkefphem.exe
        
        C:\Windows\system32\Bkefphem.exe
        588⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Bbpolb32.exe
        
        C:\Windows\system32\Bbpolb32.exe
        589⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Bkhceh32.exe
        
        C:\Windows\system32\Bkhceh32.exe
        590⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Bbbkbbkg.exe
        
        C:\Windows\system32\Bbbkbbkg.exe
        591⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Bgodjiio.exe
        
        C:\Windows\system32\Bgodjiio.exe
        592⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Ckmmpg32.exe
        
        C:\Windows\system32\Ckmmpg32.exe
        593⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Cbfema32.exe
        
        C:\Windows\system32\Cbfema32.exe
        594⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Ciqmjkno.exe
        
        C:\Windows\system32\Ciqmjkno.exe
        595⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\Cjaiac32.exe
        
        C:\Windows\system32\Cjaiac32.exe
        596⤵
        
        PID:12364
        
        C:\Windows\SysWOW64\Calbnnkj.exe
        
        C:\Windows\system32\Calbnnkj.exe
        597⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\Ckafkfkp.exe
        
        C:\Windows\system32\Ckafkfkp.exe
        598⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\Cbknhqbl.exe
        
        C:\Windows\system32\Cbknhqbl.exe
        599⤵
        
        PID:12500
        
        C:\Windows\SysWOW64\Ciefek32.exe
        
        C:\Windows\system32\Ciefek32.exe
        600⤵
        
        PID:12544
        
        C:\Windows\SysWOW64\Cjfclcpg.exe
        
        C:\Windows\system32\Cjfclcpg.exe
        601⤵
        
        PID:12584
        
        C:\Windows\SysWOW64\Capkim32.exe
        
        C:\Windows\system32\Capkim32.exe
        602⤵
        
        PID:12632
        
        C:\Windows\SysWOW64\Djipbbne.exe
        
        C:\Windows\system32\Djipbbne.exe
        603⤵
        Modifies registry class
        
        PID:12668
        
        C:\Windows\SysWOW64\Dabhomea.exe
        
        C:\Windows\system32\Dabhomea.exe
        604⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12712
        
        C:\Windows\SysWOW64\Dijppjfd.exe
        
        C:\Windows\system32\Dijppjfd.exe
        605⤵
        
        PID:12748
        
        C:\Windows\SysWOW64\Djklgb32.exe
        
        C:\Windows\system32\Djklgb32.exe
        606⤵
        
        PID:12788
        
        C:\Windows\SysWOW64\Deqqek32.exe
        
        C:\Windows\system32\Deqqek32.exe
        607⤵
        
        PID:12840
        
        C:\Windows\SysWOW64\Dlkiaece.exe
        
        C:\Windows\system32\Dlkiaece.exe
        608⤵
        
        PID:12880
        
        C:\Windows\SysWOW64\Dbdano32.exe
        
        C:\Windows\system32\Dbdano32.exe
        609⤵
        
        PID:12924
        
        C:\Windows\SysWOW64\Dioiki32.exe
        
        C:\Windows\system32\Dioiki32.exe
        610⤵
        
        PID:12972
        
        C:\Windows\SysWOW64\Djpfbahm.exe
        
        C:\Windows\system32\Djpfbahm.exe
        611⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\Dajnol32.exe
        
        C:\Windows\system32\Dajnol32.exe
        612⤵
        
        PID:13056
        
        C:\Windows\SysWOW64\Dlobmd32.exe
        
        C:\Windows\system32\Dlobmd32.exe
        613⤵
        
        PID:13108
        
        C:\Windows\SysWOW64\Dbijinfl.exe
        
        C:\Windows\system32\Dbijinfl.exe
        614⤵
        
        PID:13148
        
        C:\Windows\SysWOW64\Dicbfhni.exe
        
        C:\Windows\system32\Dicbfhni.exe
        615⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\Ejdonq32.exe
        
        C:\Windows\system32\Ejdonq32.exe
        616⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13228
        
        C:\Windows\SysWOW64\Eangjkkd.exe
        
        C:\Windows\system32\Eangjkkd.exe
        617⤵
        
        PID:13272
        
        C:\Windows\SysWOW64\Eldlhckj.exe
        
        C:\Windows\system32\Eldlhckj.exe
        618⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5720 -s 400
        619⤵
        Program crash
        
        PID:12396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4000 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:5356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5720 -ip 5720
1⤵
PID:12348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acppddig.exe

Filesize
80KB

MD5
b2e1eedc452340b4e50172a961063782

SHA1
174ada17ba4292e74cd284ccb8dcba7ff4e5eaf9

SHA256
ab6df1e286e454c6fe6e475369f04ad9ed031789cd54935ebe09ee76a5177277

SHA512
339bfdb61bc294a3fe0f891743ee51bed4f3510dbacaf57f0ce54b2d074b6c0e56aaa388fe0d7715e702e23f5d3ca1f30a74c27add906a6b3ba0889314dfea11

Download Submit
C:\Windows\SysWOW64\Afpjel32.exe

Filesize
80KB

MD5
97cc42adea34e2310f7408849ff34b80

SHA1
1d780a7a2135eeb69d62caaf0f733d4047f39dce

SHA256
e11adf65855871f108518a246c6af9c034ff106f2c6059dd1a1f5a00e86b30e0

SHA512
8b96bb26d0284b195b55ba4495ef7f01842c64033434082f5f5f153fe4093b0450c4e4a1c1ae56e2a053746c25e400a08158f5ffa306038b1c4c96d12879509b

Download Submit
C:\Windows\SysWOW64\Agmehamp.exe

Filesize
80KB

MD5
d6854f6bcbaf5d76048803cfc8420abd

SHA1
76dd9aca5b385c0fb170f0056e78122c5e20ae98

SHA256
fe5fa3090299f6708dc609ae81edf8af125b7c6bd0ac658f5abb630bdd3339d8

SHA512
69a0838b437bbcafc4dca290d87339987db169a0cf30401010fee8084153ed2823736c62c0ad9d908c91d018c63a0ba006cb3c5bcd0bb548b36f1f45ab99ef0e

Download Submit
C:\Windows\SysWOW64\Ajohfcpj.exe

Filesize
80KB

MD5
b7ba7057f921fd29b79502f81f8666af

SHA1
ce65b1b4a922d784b09bf5700c37585caf306661

SHA256
eb91f5163d79582002f8aacca2aa91eb3ff79331550ef1c87a62d1c06d289c38

SHA512
88041947e090af81b94792a55454b3fb9cf7cd25be0dae50a966366d70ba2454515b6a4938e00f9b7ffb81dd2b05eeb8da178e6b9b339feaa5036ca9a58596ed

Download Submit
C:\Windows\SysWOW64\Apmhiq32.exe

Filesize
80KB

MD5
70d39c2c3efe2872bfdca229954fa200

SHA1
57dcc55b6a8634e0697477069b95eb18ee47babf

SHA256
dc15166054f767614678a2ab59bcb38f4c51a770e8120119f8cb664e908002cc

SHA512
23afe3e7a84404bcb8fd6512fbaaefd33539a7de21987705e26413f2ac349bc933790eda3a5933716b2d8215225eab93614941d5b990629a9027fa584d142c0c

Download Submit
C:\Windows\SysWOW64\Apngjd32.exe

Filesize
80KB

MD5
db9ebbfb2acbbbd3a60d65ea9ead842c

SHA1
1497508cee34e2e3d7412156f7945369c7a4923f

SHA256
64b9ef130be52217b5fc3ae15eb247442935ca11bf106abbc799049d0a1200e4

SHA512
5647bba744f280756ee0ed12b3d318e41ea9d80fa63629f21535f60432db06fb68c0da6d7aaa3b983484f9b93c577a2c7029ce2175dabb614164c7377a91b08c

Download Submit
C:\Windows\SysWOW64\Bijncb32.exe

Filesize
80KB

MD5
7e64217b52712efde0b3df9769c696a1

SHA1
62b658bd994510c6522d059f495aa9b1f967b7dd

SHA256
8e20fed81f1993d0b0be255056d077bba7b0aa19377159b52eac8dcfec5c1957

SHA512
9afcee53852357e86d0489917390699dede8b8a7cad9147b79cc44c944bea55a4f9dd94469c70d4ee96f09723474907c861aaf853dd96c4ee0c331889247d2aa

Download Submit
C:\Windows\SysWOW64\Boihcf32.exe

Filesize
80KB

MD5
e944d2c4b4e8769de93896008648124f

SHA1
c9fd65850ec7e91dc765f8521704c5e146563e09

SHA256
48f3b5a81393c42ba27abb61b0deaf8d2497dbc9dbadc83e5631319c79f30d3b

SHA512
a69e8e001b9a15644cd1e9b3558f83159d339e3376e3825af991f99324a3823d7a1977276f264894eeb650b0af1b277b66c2f1b668ec96afeb8a16af9ba3f63a

Download Submit
C:\Windows\SysWOW64\Bpdnjple.exe

Filesize
80KB

MD5
05eebd38d0ff7fa5a8df2db3aea3d8d2

SHA1
1ab0794998dd19002d51b205a26412c9b590d12c

SHA256
bd6f9c677ceb4ca93151ac43343e40fb8bf9b28a329fa6b97169ba7485a0b49a

SHA512
7ddb1ae942e00f8fd51a8aa3faf8d555ae08c06841ab82af6cabe67a8d2dea679c754823451e336583d355310f9a699acdc0221aea4a52040bc78455ad5cc6e1

Download Submit
C:\Windows\SysWOW64\Caageq32.exe

Filesize
80KB

MD5
31e8348f33736c8f2dded0bc577d9de9

SHA1
3ec0212f55e31bba80ebf8a1b66f311d609fe99c

SHA256
80ff6015609dd715f92e298e613d8379da2cf97d515b43d8454deaf346e94def

SHA512
7ef5a27946309b4472b388528e8aaa77fee2e4d3c9300903d3f76ab3738d3b2851a1a612ca616875e89cf9ade68ad940b5673f8ee4b943cbb198caa9c1e4115f

Download Submit
C:\Windows\SysWOW64\Cpklql32.exe

Filesize
80KB

MD5
68d77d56228c8431e4ff334d22fbca33

SHA1
85f2b7c182df9f347449841261c7a5fcbe361a72

SHA256
5628052ab99809b108eade9440a6c3a2c7f7b24f3b2d6e28fc47320f5e84eca6

SHA512
dfaa9043b39752c1b993da7001c5dc3f87258e4e23fd6e26533f6b908dbebd13b7aba1de7d8da07771959e6dcc906f8fcf513974b0d891fed9fb59125142126d

Download Submit
C:\Windows\SysWOW64\Cponen32.exe

Filesize
80KB

MD5
19a78d34815eb080001cbd3380cb1e6e

SHA1
97331027266fd28851cb619fc7829ad7bd6460bc

SHA256
ef008b10d23217ddbfd87fc6b0e7a3a63fc9f57c8ce8697f2e752d43327ba7c4

SHA512
c0e6c3f515c3f5a3654694bb2bdff51c145f2cce06d7c4bbcf2da8c2b6f07d271d39a13973af78c1a119cd8c5c664094f14842b598198fc7fdcde1a1d114d9fd

Download Submit
C:\Windows\SysWOW64\Damfao32.exe

Filesize
80KB

MD5
023ea1c8b47b87d80ea9121c7862fdc7

SHA1
6b64aad200421d5e5c6985203e55fdd53f1e01bc

SHA256
04b0c254b6845934ddd6b0edd3eab5fea6ba0e4c0ef29c49f6136293a8f7c561

SHA512
ebbcad9e94f455ab4c56948f90934a0f9e6a707cf3d94392681baeb098eae83ac79a068d858e9d852b6d4dd6ff1d5717c1f998f90573915b397faa535f4d2999

Download Submit
C:\Windows\SysWOW64\Diamko32.exe

Filesize
80KB

MD5
8b1ea90d9f4f59fdae3afd28b7e6326f

SHA1
2641f2169f0de54d89a72f7e1bed91cd4e1e66b3

SHA256
a20f44a78d33b80f5a54f6d116510b0a4c19374784b7c49e0b2c82396e0940cc

SHA512
b3ec45d4cacad65b91d672e10dd0d01d227f38f99cc987e7113366b57baf8d1f11eb52f7dd87e4fc4484bc7ef11f224e7c5398388bf6b0653526de5178f09b3b

Download Submit
C:\Windows\SysWOW64\Doccpcja.exe

Filesize
80KB

MD5
2fcab917e72d92ba6ff242b391cc69fe

SHA1
ec027f9d31c50ab241c81ca6487e27cd4e8fe529

SHA256
9870ebfd54a0a4556acdf96e1b2e20ca8c7fcb6d0f4411db67d00c8e094fd5f5

SHA512
e57648f80f9f2cd17e32426ff933cc72b94035406d292d22f7e6e618349ce2a5df926ea17cbf44f4056dc840e456e03456da96faaa6d63e6738e7f9863791779

Download Submit
C:\Windows\SysWOW64\Dojqjdbl.exe

Filesize
80KB

MD5
d57133b9daca081c9677e8ede0adc305

SHA1
0777c0b68d86cb3f48c5298727d3cd877c6cb92d

SHA256
7cbfd92112f4e66d61404a6d2925c2e12c7dff99c90053dbff7192834870974c

SHA512
abdc71e1b92887fd65eeb968310001116fb50678d6654db6b3db1be046990875f4b7b802e62b5bfa5cc7c077ec8e756aabc47082ccd0709a82f8a899e3680d9a

Download Submit
C:\Windows\SysWOW64\Edeeci32.exe

Filesize
80KB

MD5
27f595783f0e59f403e5bdb74d110026

SHA1
e5afae9c810e8221d42ea2bc178c9b73eb5a5eb2

SHA256
8812bb33b6dbe35e439b6a93050154d19873aa90a31a335fd4963bd2b75bf9a3

SHA512
7feba180647e3cc106fd76a2449ec15fc25e94447075fd519f6431653bf12aa1f39d770e1e08578f74ad46b28013b94d6dc82c06b0958ad42b4fb08496b5dcd7

Download Submit
C:\Windows\SysWOW64\Ekcgkb32.exe

Filesize
80KB

MD5
6f6f4c9c2055b6a8d9e66b0fdf6e781f

SHA1
5740784a878918c3ea26acf4e2accca60a5dfc54

SHA256
bbc11185cff83704862873cb4c08d5b6c0671d11a6d92af0dac278d1cf7d8efa

SHA512
2fdea2bbf876433ec1dccf0bb23fa9b724d2de034eb7ea99c05a0733de225e088a7df9c8d0506d54b3312afaa53a01ed9eaa3d8dc2c9d911d8f28f48d91b56c3

Download Submit
C:\Windows\SysWOW64\Eleimp32.exe

Filesize
80KB

MD5
8f0558bacbc87eb4d715a1766a50a3e3

SHA1
862eaa13e332737427e956baa89d625101b3d2e4

SHA256
71a5be088ea4bc10076d7779e9ff8240645a27bb8ab601c9893c687555d8577a

SHA512
315045afe22a074138ea86e93765708e5f96ece76dd6fa263a0c0ba839423f8802250f4af562398e0905e342b7cec4202fd6d77c060c64bda48acb737e39fb8a

Download Submit
C:\Windows\SysWOW64\Enpfan32.exe

Filesize
80KB

MD5
e9aea642be8e7f10ee2792c399470162

SHA1
7845c056cf67658b0702b24fa40d91455794645a

SHA256
cb1b3937c4b9f4fe2f6f5de0d57a458cc700af9de45034a44a111953b01d944b

SHA512
2eb598814d756d329ada002e71e0e3341690e5b2daf9207493dd90055dadbd77782f7e3833c46d4b789063642500a6f806de9643b04254b708901dcc66de7f35

Download Submit
C:\Windows\SysWOW64\Fajbjh32.exe

Filesize
80KB

MD5
ae9aa328d6b902551ad0f4a2df11cf2e

SHA1
2a29e6cd96c17749cc0e69d822e5407bf10cff1a

SHA256
7f113b498b2582a3094926c4bfa11c21d5355b0251a6a74a2af089dcf4fd6b4d

SHA512
f727aa8a986b91fbb1f5b0292ff37d25ebe871de5c56b07478a9b56a5ec71be47871a2d27c4c7bc722a7911d8760ba7b2614c2c9d49c792a8a113dc9452d0e34

Download Submit
C:\Windows\SysWOW64\Fdnhih32.exe

Filesize
80KB

MD5
046ea41faffc7c2ef1de02375f2c3b44

SHA1
bdb6e2416a4fc5619b6797dcec4aeb9df0c564ce

SHA256
ed16c02ad4d334ed6a86b6daed59eee6c710a7ff7a2112fc6e531adbe6c5b3a0

SHA512
b5866f8784adcc4fb757b7104d61fd19047ab61ee7d3146c05a7f8973e2f4db9561b7230745f1d8d955010a6aa5db78729e25f8d4032ec3a29b250ee6b757f34

Download Submit
C:\Windows\SysWOW64\Fkjmlaac.exe

Filesize
80KB

MD5
f46beba07fa810aec80d53edbbbf43ba

SHA1
b0a55c0dc45d5afc9de299643df3e86ae0562f83

SHA256
8937611340062cd8efc9dfea0fdf6cf04b7de28fa322cbafbda42283d3963363

SHA512
0ff1fe93a780efcf8d544f10ead04ed6eafc6d4c98b8ee3ec282b00f4dc4d71a46c2e3f5a6476b225d1b65d98e2dfef5f660ea7812ab08d7695d73d5807db59d

Download Submit
C:\Windows\SysWOW64\Gggmgk32.exe

Filesize
80KB

MD5
e7fde81a53a2ea397f4e7946c98ae71e

SHA1
e693421b3157a98b18cf844c45de7703d3399a0e

SHA256
93dce3639f35874efe7eae3afab1a850520411cbdfe368eba55f323e9b303910

SHA512
b0be04ef903ab736973d22098f03ac170bd5b3fd538602bfbc848aa1ed31dd223a8ec5baa11ea800f54cea97eb3d613e8dde5fe5b148905edf18973448560877

Download Submit
C:\Windows\SysWOW64\Ggkqgaol.exe

Filesize
80KB

MD5
3e8f5ae8bb96fbe1c285f55efbe22184

SHA1
3c0eb27353db46a9ef0d83215b0d03040289c548

SHA256
2d031affe08656ade66682583b0d687b10a48deaf68f67eaadf259f7f7c38116

SHA512
c05cfaf7ceb3b195d518e9a8244f969511ad391f26a3e8469f4adf59dca65a2861851c601fd12c7ee541d740a05b293e65997d899bc62e9827495a21d9dd0b11

Download Submit
C:\Windows\SysWOW64\Gicgpelg.exe

Filesize
80KB

MD5
2073e06c2c8babc2f6356b6606c6908d

SHA1
51d8a707eb3242669f00629bdb39e4a664509254

SHA256
69902bb46e20fec7fb6c19a067fdee97cb892c6e692fb14604dd9274794f1f05

SHA512
2a5a7f9a7e44978b96f717cbb57387b14c82c0d13857fc95ce6d46efdbce2c379249fd0042a74f1df06514e57eb7999d4f53552ec8ff71e4ebbf75d52f199e45

Download Submit
C:\Windows\SysWOW64\Gijmad32.exe

Filesize
80KB

MD5
e847f80442674868e7ca00120124f7af

SHA1
cb64d2f8aae1595c846b2907a730829af4309341

SHA256
803aebfd4d4508f2ca1ba687ec17956b0d20d776b8c82c568e2f5135dccfe6b6

SHA512
49e39a42b9af254acc7b8cd860f4c7c50c5c8dcb7300b016abe1a335a4644e00160f78712fed16d9a6349fc672df0eba5e0733003a642220769e602d421084f4

Download Submit
C:\Windows\SysWOW64\Giljfddl.exe

Filesize
80KB

MD5
6d3382ab38e03b40ab4767dd45635f23

SHA1
a33a8c68b4c9d6fbd6ead7be29c1c05a51c65c3e

SHA256
52e6bd6ff2b0104d098bf7ca51a4537a25d9a6f44daf73e4bae5c4b8fd54aeee

SHA512
2af3a1a2fa07ecdec11524a92a95426b7c83ec7f7efc0c439138ed43743776678fe7a6ca7be57337fc30b4d6f0ca7dc777027bd3a9b020cea980ed9d86e9f779

Download Submit
C:\Windows\SysWOW64\Gpdennml.exe

Filesize
80KB

MD5
eefb9fa8ce676562061d9b8043a8ef58

SHA1
d136f364dab951c05f62f368729860097eee8473

SHA256
81725bb439bbd53f75fa1a68d0161b62d122414edc614c225c5e0d2392110903

SHA512
c6274294740a579d4501c5931c726d64973a74cd734e4195281f21b10ded13ef9eb8914310df65a8af5da8254fe780472294074815de0ea364f360b8216e9238

Download Submit
C:\Windows\SysWOW64\Haaaaeim.exe

Filesize
80KB

MD5
631e654f44e06fc48c5098bf1d167af9

SHA1
f250b89719175077ea543994b5b104b42a93019e

SHA256
124bcd9681c6aba38e89259289e35cbbbdeff4de073ce8fc39c8e675bb5ab0c0

SHA512
528056b9ec4c7fd4c635831bd62a7e423dd24bf99a7401da7ff0866e4a478ab9e1c79a1a2cdba41decb4d5fea657c1d09efbb97ca913ce6babef1cd5a435036f

Download Submit
C:\Windows\SysWOW64\Haodle32.exe

Filesize
80KB

MD5
02ee509fa1b6926fdb4bd249714c0373

SHA1
082f41d45852de3d19d3e36a3b361819c8ac4a21

SHA256
19bca6d6614fdb45221e0626595b476b7cdcb40f91f93732b68d3b7b9073dc78

SHA512
5439666de35a8db4d900f10c46abd64cc153058b8ff42bc8f306ca776d15f9e34536617e11ba8d2d2c92514d48d12297256592f5bb3f659929757661669c8525

Download Submit
C:\Windows\SysWOW64\Hlblcn32.exe

Filesize
80KB

MD5
66d2b39c253633c66340e7c5ccd32f08

SHA1
c2aaa75c347c419eb0b5b7f430967098e631f03b

SHA256
9a191ead3da4cc58d04c625ae0c98e61e36f434ca03adb19c2ace44d5835c578

SHA512
52d92036a0a234ceca73f6440211ac698d0740c8a093a21114a7969ef9d3d0991b0e4a767094451f2bd6f8098a56a65f6e69f4510f59e1f3dd6e5cd302812d81

Download Submit
C:\Windows\SysWOW64\Hnlodjpa.exe

Filesize
80KB

MD5
7b276a2d8bd2ecd230ea4081e2f238f4

SHA1
1ae80aedf198d7c504f7c7083aed1f15ecdb4b4a

SHA256
9aeeb1bdf779a3b8fc73a79b495037886d75bcfe51f72c6b117cf327396236ab

SHA512
cf7ce338f23834242336bbde2eecf1aae19bd5b61709181b932f5f9f896d2cbd59726a780c67519a3682182f52434ee578713b27e0ab4df57a35892683acb392

Download Submit
C:\Windows\SysWOW64\Hpkknmgd.exe

Filesize
80KB

MD5
522c9fcb014df56822f7eb71fcf17547

SHA1
8c7cd9ba82145d5dc1dda094e0be2b2adc2bf611

SHA256
8f8bf5b45db1f44cf48f79f509a9a309a342922fcf7b1a6d92de3f02566913c6

SHA512
6341314468a0d2fc4c2a54fc11accfcf1427eefe4d1f593744b001a8b612dd2b44094c9a029d80e6d9f2d3e22b8a234e2c939384fb26460393874161e27fe4d3

Download Submit
C:\Windows\SysWOW64\Ibegfglj.exe

Filesize
80KB

MD5
7c7dc8272a722574288df44e58a1cf76

SHA1
ba76fbc4dc2b238916ba49e54ac27e71de0a41de

SHA256
6b6b18e16a6627aabb25556f4149291668cf4501e10807368fd1ac91fb48292a

SHA512
aae90b13a972d05a7cc8f0e4347d05270f432fe718fef98c11ddd4b885abf8d9e989271357ce22b720b66e6cb91be82b9014c65159738f2c5cd7c781210d7d98

Download Submit
C:\Windows\SysWOW64\Icachjbb.exe

Filesize
80KB

MD5
fd26624d11c2feba77da17d941c54f36

SHA1
db0bbe5512f510501e98ed25208828051556dc73

SHA256
6f05906235d654dead90b64b14fa5a163dca5833de42b3c7d9e7d96f4a08413c

SHA512
e7507ee3bc02524d8d6a6e8fe0e5d68c1841cf0725f304551d035c7db47c246f4de737177e4597e223ea3609109c841c2c6028d5ce9c5a69eead0cd27e83b4a9

Download Submit
C:\Windows\SysWOW64\Ilnlom32.exe

Filesize
80KB

MD5
4c298e1800106901858bb5b130f60203

SHA1
fd581d8d59ba40389d54eb5680c8238e03a1ccda

SHA256
aa21f60bc52bf03e6cdb9ba069934a2004e696ed0c41833cc3fc28a44d72b6a9

SHA512
12cc39edb5eb9147236189239fd3af6b955b38833a04e83ee51cc4c862953528c032df4a097dd00b3bedd6a4dfcc0e7decdf31e82be7d70570e24b514a81715b

Download Submit
C:\Windows\SysWOW64\Ilphdlqh.exe

Filesize
80KB

MD5
c7a171d90d3a89d31fe198e844e54a1f

SHA1
c3d358b29fca84cc0e100f3b0a31c3e00141e0dc

SHA256
9e406aab5f109380694f03473811dac3ad7147df24e8b7c267d1ac2063d0072d

SHA512
c38cff6a774278addb4898a05d16b7fa62b64df0fa7689bf3c36b12fffa96efeb85be512339c37f0530bf48ad36de8ea5be0f147aeca8d276d54a36610e10090

Download Submit
C:\Windows\SysWOW64\Iogopi32.exe

Filesize
80KB

MD5
749dc7d5e3bd9e575bdca54fb6c1cffe

SHA1
eacd11af8a68297601bb67280a124360e75b51ed

SHA256
a28aaf57b720ce30a5059ff5207ecf6d64e1481b2c079f65344d01ce03a26af0

SHA512
d5f1494e40cae5cc0270eecca830d7da22641647b142177264b9fe3282f7ece23c6b79bd9cc6c5ab7e757808bd775a2209bff711c281be3f97817d05c962a39f

Download Submit
C:\Windows\SysWOW64\Jidinqpb.exe

Filesize
80KB

MD5
fed37ee6d0414ece1cfb1ec7fde14cca

SHA1
c11d4bcdc6cadf018ea5670407baba2542d64fce

SHA256
0be1c7a3aa21f744aba8d44b681636f891e1270f81ff6227aeaedc5e9170ee8c

SHA512
77f35722f37ea1d2848a7eec7b864129c4d22814f72f100a899a0fd6bf1bc912501caf731ca84ece79efd0b2362f1236a9f6ff2e8ca7c12dfc7a4de30f92190a

Download Submit
C:\Windows\SysWOW64\Jnfjbj32.exe

Filesize
80KB

MD5
5a3736200d4f13c728699b39115f2460

SHA1
d5fed9bc29ebdc465601586f4d98e06a640be131

SHA256
56e71ca72a7b1ead7fcea6dd39f3400e90e4a26b97d109827494a1112c544c14

SHA512
6fa7ac06cc3716a40e2e179cbf38ee95b735f2132fe2394c6b19c94554bc0223baa8b692aa17d71314fcb13054211b5cb8122f207caa4b20a31145ccb36b4ea0

Download Submit
C:\Windows\SysWOW64\Kfeagefd.exe

Filesize
80KB

MD5
a3551ac31e23631fce9e6757db2946fd

SHA1
a494e2ca2d26c4603e347fe7baefdcac3dc81c84

SHA256
bff46e0766cb8ce7de81ab0e8275f28cde6a4ea035bb17c20c3be7b312bf23e9

SHA512
9a74f4243af645a7428bd8ef8af0852ec2cb18cbcab4c9eb8c3514c2516662b15eee4128b856dca1da293b711fb9ebcbcfc48fdca9f0acb408eb71e25ee3e626

Download Submit
C:\Windows\SysWOW64\Labkempb.exe

Filesize
80KB

MD5
c8f3a117bd0124c9c1dc4f716fb15983

SHA1
42526a07f5652b7b7306d35296cf0b344719e9f7

SHA256
cc6a4de683ffe1eeaa295e438e83f13c32f8714ef8451d1eaf61cb1e576bd0a4

SHA512
041b60ee5c86dc328a3052de0be90abefa63f9f8ebc9c89ed0c979441d8e32831c3cde1f0d630d4b645623cbd43112356a61e375659d81f97f353b318502b76e

Download Submit
C:\Windows\SysWOW64\Lhgdmb32.exe

Filesize
64KB

MD5
0c7cbf78c9c4e8fe981112a8a9f4a8e2

SHA1
65937035be7640dd8efdd2c7906677a900095546

SHA256
92c80cdcdca9036d9c7ec1081b4d44a8586f2ec51622dff38fbc4944581ddd8e

SHA512
f79a4c64352b504ab06ef12c1c1e8d8cb7ed6f7bc5624ce9cba05d259d9d44caa73f4297f1b50bd4086b14409432839b80936db23deef3347ec2e8f8ad6b4be0

Download Submit
C:\Windows\SysWOW64\Napameoi.exe

Filesize
80KB

MD5
ff69009dee62abecf675ff5dc8e1da50

SHA1
38a8e36dc81e090c4353bcdd5e347e3d5c9751d5

SHA256
c73f6ab7b1193b0fcec9faf12a5d792aec5195fdf144917b416d6879f15a3697

SHA512
2a86f48554831bbb0b2d87cad21aa55f7f82d2ecd05464c6f9c127038883d227fca64f993b74c294635edcb249dcad688c9d90e5e44905edb8bb36d96ffb373d

Download Submit
C:\Windows\SysWOW64\Nooikj32.exe

Filesize
80KB

MD5
bdb7a41bd9e8c26cd81a4a27316bbb4e

SHA1
49875504a3e2d990f0c8b7137e54ea4150d970e1

SHA256
2a7e0f596c25b75ccbd07ce9f2ddf6e0c68aef42b63f87a864e0ed438db128c5

SHA512
648cce0eee0d96ba2314f690fcaaffad961bc2613acb09c60cdc922f1f73d35fe89741cea14cbe31f3d1b18280ca7e79dc9ca70b04e8a3bcebf64916e6962a9d

Download Submit
C:\Windows\SysWOW64\Obnehj32.exe

Filesize
80KB

MD5
fa140a74a2c8af658c73e76611576d31

SHA1
517c584a72a2e00750c5e1d34253cfa78e3380eb

SHA256
d59d930fed585762d6eab4dff0e96ec120618500fee4deb2d5392424eace992f

SHA512
e1e0593e4482da9ed41a5bd1bae509de7a47e40ab98e9f29ba7ebb9ffce1389016e850358b376d0c3450489ff342aef328f2b405bfb743695b68a2b654952b64

Download Submit
C:\Windows\SysWOW64\Oikjkc32.exe

Filesize
80KB

MD5
2187877274b850322e3135da8567ee3d

SHA1
746ebb952787df08a72ea2e1f722af29a67b3c6f

SHA256
67c4967a58ad48308acfb1399a2a89253bdbac0edbbde3616372052b3d49db1b

SHA512
e2c9a10307f141af0bb380f635d02619d0a3b139c6d4b0b139545abf89dd28e0196c6ed1926ec8f45c73b4af3837260a5745439ab72c0374eef30b398f6e229f

Download Submit
C:\Windows\SysWOW64\Pjmjdm32.exe

Filesize
80KB

MD5
521f45493e6a3afa8baabc58ea40478c

SHA1
f040c016fb7344527da1e63a19c3d71e59704a50

SHA256
b63b9814efaa7ac335c91a18aab0ff8d8d1f2d6f627a828e7618dd59196e5f37

SHA512
c6f3e447b26a9c58a165f941d8756a51171900a6088531e9497a9395c95647afc2b0fb12b7e621dcad7b2e7cfcf6c25ab73dcbf64db4b3c82f611ba999dc299d

Download Submit
C:\Windows\SysWOW64\Pojjcp32.exe

Filesize
80KB

MD5
527ebbac75923286cc767341d460ce2f

SHA1
27ab28c24dafc55e37bc05f721573178d22d936b

SHA256
78f0415752817c8218907bb008f1133241eebe2f7ca7e725f31aed415cc850e4

SHA512
5f5110a11f36c4a68afa17732b185676ff8d8fad29944392452425e475e732a36cd6c263ff9c30d99ed7544750a18b5995af8865d913a2618ef678292d901281

Download Submit
C:\Windows\SysWOW64\Ppahmb32.exe

Filesize
80KB

MD5
a26f11166feeec21894b5b0aff02bfe1

SHA1
d36d8623e6180ad41c482890707eee8512c43c55

SHA256
a9f92e5841655ff2d0104e6911e8017c77bcb5485dff3cbe45b8c652c4eccb97

SHA512
27879453fd0e6e628216102cee4bcf870ef987b28174fc38e1062da458b8bd41d98908f4c23603b512975389a16f2dc31836444dfacbc19b038d0981b64754e0

Download Submit
memory/212-372-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/220-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/404-318-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/832-113-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/876-48-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/916-294-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/964-306-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/996-413-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1084-242-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1092-234-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1244-82-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1476-366-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1748-210-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1884-336-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1892-300-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2076-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2076-1-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2076-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2140-218-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2180-354-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2196-378-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2332-312-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2348-324-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2384-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2564-194-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2628-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2688-226-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2968-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3104-255-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3136-282-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3140-97-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3148-264-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3276-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3548-360-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3572-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3580-330-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3596-185-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3696-348-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3724-201-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3776-154-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3800-396-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3812-162-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3872-402-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3940-384-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4056-276-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4068-137-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4120-390-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4148-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4244-72-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4292-288-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4320-178-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4356-129-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4432-170-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4440-89-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4552-403-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4628-427-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4692-346-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4704-122-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4752-106-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4824-419-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4888-421-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4904-145-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5008-258-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5068-270-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads