e650e7fa5e0d13ff61cd260f546b8a3261318890df86b350437082ff21f20397

Analysis

max time kernel
122s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 04:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e650e7fa5e0d13ff61cd260f546b8a3261318890df86b350437082ff21f20397.exe
Size

1.8MB
MD5

a1bd50626ffffb83823dfa222e117a68
SHA1

6bd2385026d7099514e2c3683273da9c52f104b8
SHA256

e650e7fa5e0d13ff61cd260f546b8a3261318890df86b350437082ff21f20397
SHA512

fe74ccda6c2b7a12c3b6bf27637dcccdfe0db9dab7cd17c72798c7d2028093512125d599ce2c46064ecce0078d7ee490e475925bac867a7a9d850af790f399c7
SSDEEP

24576:7gpKm2Nys/q1tF1Pm0jdA5uBAdpFZymfDdGsJm1OVmfihT:s12Nys/q1tF1Pm0jdFmyMPT

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbhoqj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcidfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjjbcbqj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlgmpogj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfgjgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhnepfpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjnjqfij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjlfbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilidbbgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jifhaenk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdkcde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqohnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbeqmoji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qajadlja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gifmnpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldaeka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfjhkjle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njqmepik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbmfoa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbbgnpgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoiafcic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gogbdl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eoocmoao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iiaephpc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifgbnlmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ognpebpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifopiajn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaepqjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhcpgmjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icifbang.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nggjdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eqalmafo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbioei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlgmpogj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilghlc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eoaihhlp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ieolehop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klgqcqkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhnepfpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbqlfkmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hclakimb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbanme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cahfmgoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnakhkol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aejfpjne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cojjqlpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpeiioac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpablkhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahhblemi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ondeac32.exe

Executes dropped EXE 64 IoCs

pid	Process
1552	Cpofpdgd.exe
4668	Dlegeemh.exe
4932	Dabpnlkp.exe
4804	Dhlhjf32.exe
3936	Dcalgo32.exe
852	Dhnepfpj.exe
2832	Dohmlp32.exe
4984	Debeijoc.exe
4784	Dphifcoi.exe
4980	Daifnk32.exe
4076	Dlojkddn.exe
3536	Domfgpca.exe
2616	Dakbckbe.exe
1460	Ehekqe32.exe
4236	Eoocmoao.exe
984	Ebnoikqb.exe
3416	Elccfc32.exe
1328	Eoapbo32.exe
1732	Ebploj32.exe
1164	Ehjdldfl.exe
1332	Eqalmafo.exe
3892	Ecphimfb.exe
1856	Efneehef.exe
4196	Ehlaaddj.exe
4228	Eofinnkf.exe
2240	Emjjgbjp.exe
3164	Eoifcnid.exe
1844	Fbgbpihg.exe
2708	Fjnjqfij.exe
2860	Fmmfmbhn.exe
1224	Fokbim32.exe
4060	Fbioei32.exe
2164	Ficgacna.exe
3828	Fqkocpod.exe
2168	Fbllkh32.exe
640	Fjcclf32.exe
1136	Fmapha32.exe
3672	Fckhdk32.exe
4624	Ffjdqg32.exe
3848	Fihqmb32.exe
4052	Fqohnp32.exe
3976	Fcnejk32.exe
2368	Fflaff32.exe
4324	Fmficqpc.exe
3624	Fodeolof.exe
2404	Gbcakg32.exe
3084	Gjjjle32.exe
2776	Gmhfhp32.exe
3344	Gogbdl32.exe
2212	Gbenqg32.exe
1940	Gjlfbd32.exe
4560	Gmkbnp32.exe
468	Goiojk32.exe
3460	Gbgkfg32.exe
3532	Giacca32.exe
4768	Gqikdn32.exe
3320	Gcggpj32.exe
4460	Gfedle32.exe
936	Gidphq32.exe
1464	Gqkhjn32.exe
1956	Gcidfi32.exe
1184	Gfhqbe32.exe
4292	Gifmnpnl.exe
4004	Gppekj32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gdqgmmjb.exe	Gcojed32.exe
File created	C:\Windows\SysWOW64\Ifefimom.exe	Ipknlb32.exe
File opened for modification	C:\Windows\SysWOW64\Bcebhoii.exe	Bagflcje.exe
File created	C:\Windows\SysWOW64\Qeobam32.dll	Qddfkd32.exe
File created	C:\Windows\SysWOW64\Lfmona32.dll	Dakbckbe.exe
File opened for modification	C:\Windows\SysWOW64\Fbllkh32.exe	Fqkocpod.exe
File created	C:\Windows\SysWOW64\Gbenqg32.exe	Gogbdl32.exe
File created	C:\Windows\SysWOW64\Codhke32.dll	Mglack32.exe
File opened for modification	C:\Windows\SysWOW64\Elgfgl32.exe	Edpnfo32.exe
File created	C:\Windows\SysWOW64\Kjhcgd32.dll	Gdeqhl32.exe
File created	C:\Windows\SysWOW64\Pflplnlg.exe	Pdkcde32.exe
File created	C:\Windows\SysWOW64\Ibilnj32.dll	Hbanme32.exe
File created	C:\Windows\SysWOW64\Blfdia32.exe	Baaplhef.exe
File created	C:\Windows\SysWOW64\Mipcob32.exe	Mbfkbhpa.exe
File opened for modification	C:\Windows\SysWOW64\Gjjjle32.exe	Gbcakg32.exe
File created	C:\Windows\SysWOW64\Dekhneap.exe	Clbceo32.exe
File opened for modification	C:\Windows\SysWOW64\Gdqgmmjb.exe	Gcojed32.exe
File opened for modification	C:\Windows\SysWOW64\Mpablkhc.exe	Migjoaaf.exe
File opened for modification	C:\Windows\SysWOW64\Ndaggimg.exe	Nljofl32.exe
File created	C:\Windows\SysWOW64\Dbagnedl.dll	Pncgmkmj.exe
File created	C:\Windows\SysWOW64\Nnjbke32.exe	Nklfoi32.exe
File created	C:\Windows\SysWOW64\Fkmchi32.exe	Edbklofb.exe
File created	C:\Windows\SysWOW64\Jpphah32.dll	Jbjcolha.exe
File opened for modification	C:\Windows\SysWOW64\Lmppcbjd.exe	Lffhfh32.exe
File created	C:\Windows\SysWOW64\Npcoakfp.exe	Menjdbgj.exe
File created	C:\Windows\SysWOW64\Ndaggimg.exe	Nljofl32.exe
File created	C:\Windows\SysWOW64\Clbcapmm.dll	Ognpebpj.exe
File created	C:\Windows\SysWOW64\Fhcpgmjf.exe	Fcfhof32.exe
File opened for modification	C:\Windows\SysWOW64\Gcagkdba.exe	Gkkojgao.exe
File opened for modification	C:\Windows\SysWOW64\Ghopckpi.exe	Gcagkdba.exe
File created	C:\Windows\SysWOW64\Jbjcolha.exe	Jlpkba32.exe
File created	C:\Windows\SysWOW64\Naeheh32.dll	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Oncmnnje.dll	Pjcbbmif.exe
File created	C:\Windows\SysWOW64\Qfiapa32.dll	Fbllkh32.exe
File opened for modification	C:\Windows\SysWOW64\Fcnejk32.exe	Fqohnp32.exe
File created	C:\Windows\SysWOW64\Lcglnp32.dll	Fmficqpc.exe
File created	C:\Windows\SysWOW64\Cleqadmh.dll	Andgoobc.exe
File created	C:\Windows\SysWOW64\Edbklofb.exe	Ecandfpd.exe
File opened for modification	C:\Windows\SysWOW64\Iiaephpc.exe	Hbgmcnhf.exe
File created	C:\Windows\SysWOW64\Mchqfb32.dll	Mlcifmbl.exe
File created	C:\Windows\SysWOW64\Mnapdf32.exe	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Amhpcomb.dll	Liimncmf.exe
File created	C:\Windows\SysWOW64\Pnjknp32.dll	Ncbknfed.exe
File created	C:\Windows\SysWOW64\Ojoign32.exe	Odapnf32.exe
File created	C:\Windows\SysWOW64\Fihqmb32.exe	Ffjdqg32.exe
File created	C:\Windows\SysWOW64\Gbgkfg32.exe	Goiojk32.exe
File created	C:\Windows\SysWOW64\Ihoofe32.dll	Iemppiab.exe
File opened for modification	C:\Windows\SysWOW64\Ndfqbhia.exe	Nloiakho.exe
File created	C:\Windows\SysWOW64\Jgilhm32.dll	Chcddk32.exe
File created	C:\Windows\SysWOW64\Jqqjmnii.dll	Ebploj32.exe
File created	C:\Windows\SysWOW64\Lgneampk.exe	Ldohebqh.exe
File created	C:\Windows\SysWOW64\Mgekbljc.exe	Mpkbebbf.exe
File created	C:\Windows\SysWOW64\Ogpnaafp.dll	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Jinpgcmg.dll	Clbceo32.exe
File created	C:\Windows\SysWOW64\Gdeqhl32.exe	Gcddpdpo.exe
File created	C:\Windows\SysWOW64\Oammoc32.dll	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Hpbjkl32.dll	Fcnejk32.exe
File opened for modification	C:\Windows\SysWOW64\Obidhaog.exe	Okolkg32.exe
File created	C:\Windows\SysWOW64\Nphhmj32.exe	Nnjlpo32.exe
File created	C:\Windows\SysWOW64\Jglkll32.dll	Odednmpm.exe
File created	C:\Windows\SysWOW64\Hkikkeeo.exe	Hijooifk.exe
File created	C:\Windows\SysWOW64\Kjpgii32.dll	Ogbipa32.exe
File created	C:\Windows\SysWOW64\Ldooifgl.dll	Hpbaqj32.exe
File opened for modification	C:\Windows\SysWOW64\Kdopod32.exe	Kaqcbi32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11536	11432	WerFault.exe	541

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkokhc32.dll"	Dphifcoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibilnj32.dll"	Hbanme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdmlkkap.dll"	Pnihcq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cajcbgml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlbgha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lebkhc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbioei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifhiib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cleqadmh.dll"	Andgoobc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hjolnb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckcgkldl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lipdae32.dll"	Pqdqof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Docmgjhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehgqln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbdcekmm.dll"	Fbgbpihg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbnafb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iemppiab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bppheeep.dll"	Eoifcnid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gppekj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ichhhi32.dll"	Jfkoeppq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Andgoobc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Blfdia32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cafigg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjhmqf32.dll"	Heapdjlp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpablkhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgnkd32.dll"	Nnneknob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fodeolof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbllbm32.dll"	Pjffbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oiqbfn32.dll"	Anpncp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdqfah32.dll"	Ckcgkldl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Migjoaaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nphlemjl.dll"	Gcggpj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ifopiajn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Maohkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcjapi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ilidbbgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpeiioac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dakbckbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldohebqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlokddim.dll"	Fkmchi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhoilahe.dll"	Jifhaenk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bagflcje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imdnklfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fklfdo32.dll"	Ondeac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qajadlja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hjjbcbqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbmfoa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ondeac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onklabip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odednmpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Neimdg32.dll"	Mchhggno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	e650e7fa5e0d13ff61cd260f546b8a3261318890df86b350437082ff21f20397.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmlfmg32.dll"	Hbeghene.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qloebdig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Clbceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcneih32.dll"	Gcagkdba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Icifbang.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjmehkqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifegaglc.dll"	Gfedle32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 1552	4996	e650e7fa5e0d13ff61cd260f546b8a3261318890df86b350437082ff21f20397.exe	85
PID 4996 wrote to memory of 1552	4996	e650e7fa5e0d13ff61cd260f546b8a3261318890df86b350437082ff21f20397.exe	85
PID 4996 wrote to memory of 1552	4996	e650e7fa5e0d13ff61cd260f546b8a3261318890df86b350437082ff21f20397.exe	85
PID 1552 wrote to memory of 4668	1552	Cpofpdgd.exe	86
PID 1552 wrote to memory of 4668	1552	Cpofpdgd.exe	86
PID 1552 wrote to memory of 4668	1552	Cpofpdgd.exe	86
PID 4668 wrote to memory of 4932	4668	Dlegeemh.exe	87
PID 4668 wrote to memory of 4932	4668	Dlegeemh.exe	87
PID 4668 wrote to memory of 4932	4668	Dlegeemh.exe	87
PID 4932 wrote to memory of 4804	4932	Dabpnlkp.exe	88
PID 4932 wrote to memory of 4804	4932	Dabpnlkp.exe	88
PID 4932 wrote to memory of 4804	4932	Dabpnlkp.exe	88
PID 4804 wrote to memory of 3936	4804	Dhlhjf32.exe	89
PID 4804 wrote to memory of 3936	4804	Dhlhjf32.exe	89
PID 4804 wrote to memory of 3936	4804	Dhlhjf32.exe	89
PID 3936 wrote to memory of 852	3936	Dcalgo32.exe	90
PID 3936 wrote to memory of 852	3936	Dcalgo32.exe	90
PID 3936 wrote to memory of 852	3936	Dcalgo32.exe	90
PID 852 wrote to memory of 2832	852	Dhnepfpj.exe	91
PID 852 wrote to memory of 2832	852	Dhnepfpj.exe	91
PID 852 wrote to memory of 2832	852	Dhnepfpj.exe	91
PID 2832 wrote to memory of 4984	2832	Dohmlp32.exe	92
PID 2832 wrote to memory of 4984	2832	Dohmlp32.exe	92
PID 2832 wrote to memory of 4984	2832	Dohmlp32.exe	92
PID 4984 wrote to memory of 4784	4984	Debeijoc.exe	93
PID 4984 wrote to memory of 4784	4984	Debeijoc.exe	93
PID 4984 wrote to memory of 4784	4984	Debeijoc.exe	93
PID 4784 wrote to memory of 4980	4784	Dphifcoi.exe	94
PID 4784 wrote to memory of 4980	4784	Dphifcoi.exe	94
PID 4784 wrote to memory of 4980	4784	Dphifcoi.exe	94
PID 4980 wrote to memory of 4076	4980	Daifnk32.exe	95
PID 4980 wrote to memory of 4076	4980	Daifnk32.exe	95
PID 4980 wrote to memory of 4076	4980	Daifnk32.exe	95
PID 4076 wrote to memory of 3536	4076	Dlojkddn.exe	96
PID 4076 wrote to memory of 3536	4076	Dlojkddn.exe	96
PID 4076 wrote to memory of 3536	4076	Dlojkddn.exe	96
PID 3536 wrote to memory of 2616	3536	Domfgpca.exe	97
PID 3536 wrote to memory of 2616	3536	Domfgpca.exe	97
PID 3536 wrote to memory of 2616	3536	Domfgpca.exe	97
PID 2616 wrote to memory of 1460	2616	Dakbckbe.exe	98
PID 2616 wrote to memory of 1460	2616	Dakbckbe.exe	98
PID 2616 wrote to memory of 1460	2616	Dakbckbe.exe	98
PID 1460 wrote to memory of 4236	1460	Ehekqe32.exe	99
PID 1460 wrote to memory of 4236	1460	Ehekqe32.exe	99
PID 1460 wrote to memory of 4236	1460	Ehekqe32.exe	99
PID 4236 wrote to memory of 984	4236	Eoocmoao.exe	100
PID 4236 wrote to memory of 984	4236	Eoocmoao.exe	100
PID 4236 wrote to memory of 984	4236	Eoocmoao.exe	100
PID 984 wrote to memory of 3416	984	Ebnoikqb.exe	101
PID 984 wrote to memory of 3416	984	Ebnoikqb.exe	101
PID 984 wrote to memory of 3416	984	Ebnoikqb.exe	101
PID 3416 wrote to memory of 1328	3416	Elccfc32.exe	102
PID 3416 wrote to memory of 1328	3416	Elccfc32.exe	102
PID 3416 wrote to memory of 1328	3416	Elccfc32.exe	102
PID 1328 wrote to memory of 1732	1328	Eoapbo32.exe	103
PID 1328 wrote to memory of 1732	1328	Eoapbo32.exe	103
PID 1328 wrote to memory of 1732	1328	Eoapbo32.exe	103
PID 1732 wrote to memory of 1164	1732	Ebploj32.exe	104
PID 1732 wrote to memory of 1164	1732	Ebploj32.exe	104
PID 1732 wrote to memory of 1164	1732	Ebploj32.exe	104
PID 1164 wrote to memory of 1332	1164	Ehjdldfl.exe	105
PID 1164 wrote to memory of 1332	1164	Ehjdldfl.exe	105
PID 1164 wrote to memory of 1332	1164	Ehjdldfl.exe	105
PID 1332 wrote to memory of 3892	1332	Eqalmafo.exe	106

C:\Users\Admin\AppData\Local\Temp\e650e7fa5e0d13ff61cd260f546b8a3261318890df86b350437082ff21f20397.exe
"C:\Users\Admin\AppData\Local\Temp\e650e7fa5e0d13ff61cd260f546b8a3261318890df86b350437082ff21f20397.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\Cpofpdgd.exe
  C:\Windows\system32\Cpofpdgd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\SysWOW64\Dlegeemh.exe
    C:\Windows\system32\Dlegeemh.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\Windows\SysWOW64\Dabpnlkp.exe
      C:\Windows\system32\Dabpnlkp.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4932
    - - C:\Windows\SysWOW64\Dhlhjf32.exe
        
        C:\Windows\system32\Dhlhjf32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4804
      - C:\Windows\SysWOW64\Dcalgo32.exe
        
        C:\Windows\system32\Dcalgo32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\Dhnepfpj.exe
        
        C:\Windows\system32\Dhnepfpj.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:852
        
        C:\Windows\SysWOW64\Dohmlp32.exe
        
        C:\Windows\system32\Dohmlp32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\SysWOW64\Debeijoc.exe
        
        C:\Windows\system32\Debeijoc.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\SysWOW64\Dphifcoi.exe
        
        C:\Windows\system32\Dphifcoi.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Windows\SysWOW64\Daifnk32.exe
        
        C:\Windows\system32\Daifnk32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\SysWOW64\Dlojkddn.exe
        
        C:\Windows\system32\Dlojkddn.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Windows\SysWOW64\Domfgpca.exe
        
        C:\Windows\system32\Domfgpca.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3536
        
        C:\Windows\SysWOW64\Dakbckbe.exe
        
        C:\Windows\system32\Dakbckbe.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\SysWOW64\Ehekqe32.exe
        
        C:\Windows\system32\Ehekqe32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\SysWOW64\Eoocmoao.exe
        
        C:\Windows\system32\Eoocmoao.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4236
        
        C:\Windows\SysWOW64\Ebnoikqb.exe
        
        C:\Windows\system32\Ebnoikqb.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:984
        
        C:\Windows\SysWOW64\Elccfc32.exe
        
        C:\Windows\system32\Elccfc32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3416
        
        C:\Windows\SysWOW64\Eoapbo32.exe
        
        C:\Windows\system32\Eoapbo32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\SysWOW64\Ebploj32.exe
        
        C:\Windows\system32\Ebploj32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Windows\SysWOW64\Ehjdldfl.exe
        
        C:\Windows\system32\Ehjdldfl.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1164
        
        C:\Windows\SysWOW64\Eqalmafo.exe
        
        C:\Windows\system32\Eqalmafo.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1332
        
        C:\Windows\SysWOW64\Ecphimfb.exe
        
        C:\Windows\system32\Ecphimfb.exe
        23⤵
        Executes dropped EXE
        
        PID:3892
        
        C:\Windows\SysWOW64\Efneehef.exe
        
        C:\Windows\system32\Efneehef.exe
        24⤵
        Executes dropped EXE
        
        PID:1856
        
        C:\Windows\SysWOW64\Ehlaaddj.exe
        
        C:\Windows\system32\Ehlaaddj.exe
        25⤵
        Executes dropped EXE
        
        PID:4196
        
        C:\Windows\SysWOW64\Eofinnkf.exe
        
        C:\Windows\system32\Eofinnkf.exe
        26⤵
        Executes dropped EXE
        
        PID:4228
        
        C:\Windows\SysWOW64\Emjjgbjp.exe
        
        C:\Windows\system32\Emjjgbjp.exe
        27⤵
        Executes dropped EXE
        
        PID:2240
        
        C:\Windows\SysWOW64\Eoifcnid.exe
        
        C:\Windows\system32\Eoifcnid.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3164
        
        C:\Windows\SysWOW64\Fbgbpihg.exe
        
        C:\Windows\system32\Fbgbpihg.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1844
        
        C:\Windows\SysWOW64\Fjnjqfij.exe
        
        C:\Windows\system32\Fjnjqfij.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2708
        
        C:\Windows\SysWOW64\Fmmfmbhn.exe
        
        C:\Windows\system32\Fmmfmbhn.exe
        31⤵
        Executes dropped EXE
        
        PID:2860
        
        C:\Windows\SysWOW64\Fokbim32.exe
        
        C:\Windows\system32\Fokbim32.exe
        32⤵
        Executes dropped EXE
        
        PID:1224
        
        C:\Windows\SysWOW64\Fbioei32.exe
        
        C:\Windows\system32\Fbioei32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4060
        
        C:\Windows\SysWOW64\Ficgacna.exe
        
        C:\Windows\system32\Ficgacna.exe
        34⤵
        Executes dropped EXE
        
        PID:2164
        
        C:\Windows\SysWOW64\Fqkocpod.exe
        
        C:\Windows\system32\Fqkocpod.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3828
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2168
        
        C:\Windows\SysWOW64\Fjcclf32.exe
        
        C:\Windows\system32\Fjcclf32.exe
        37⤵
        Executes dropped EXE
        
        PID:640
        
        C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        38⤵
        Executes dropped EXE
        
        PID:1136
        
        C:\Windows\SysWOW64\Fckhdk32.exe
        
        C:\Windows\system32\Fckhdk32.exe
        39⤵
        Executes dropped EXE
        
        PID:3672
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4624
        
        C:\Windows\SysWOW64\Fihqmb32.exe
        
        C:\Windows\system32\Fihqmb32.exe
        41⤵
        Executes dropped EXE
        
        PID:3848
        
        C:\Windows\SysWOW64\Fqohnp32.exe
        
        C:\Windows\system32\Fqohnp32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4052
        
        C:\Windows\SysWOW64\Fcnejk32.exe
        
        C:\Windows\system32\Fcnejk32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3976
        
        C:\Windows\SysWOW64\Fflaff32.exe
        
        C:\Windows\system32\Fflaff32.exe
        44⤵
        Executes dropped EXE
        
        PID:2368
        
        C:\Windows\SysWOW64\Fmficqpc.exe
        
        C:\Windows\system32\Fmficqpc.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4324
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3624
        
        C:\Windows\SysWOW64\Gbcakg32.exe
        
        C:\Windows\system32\Gbcakg32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2404
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        48⤵
        Executes dropped EXE
        
        PID:3084
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        49⤵
        Executes dropped EXE
        
        PID:2776
        
        C:\Windows\SysWOW64\Gogbdl32.exe
        
        C:\Windows\system32\Gogbdl32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3344
        
        C:\Windows\SysWOW64\Gbenqg32.exe
        
        C:\Windows\system32\Gbenqg32.exe
        51⤵
        Executes dropped EXE
        
        PID:2212
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1940
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        53⤵
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\SysWOW64\Goiojk32.exe
        
        C:\Windows\system32\Goiojk32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:468
        
        C:\Windows\SysWOW64\Gbgkfg32.exe
        
        C:\Windows\system32\Gbgkfg32.exe
        55⤵
        Executes dropped EXE
        
        PID:3460
        
        C:\Windows\SysWOW64\Giacca32.exe
        
        C:\Windows\system32\Giacca32.exe
        56⤵
        Executes dropped EXE
        
        PID:3532
        
        C:\Windows\SysWOW64\Gqikdn32.exe
        
        C:\Windows\system32\Gqikdn32.exe
        57⤵
        Executes dropped EXE
        
        PID:4768
        
        C:\Windows\SysWOW64\Gcggpj32.exe
        
        C:\Windows\system32\Gcggpj32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3320
        
        C:\Windows\SysWOW64\Gfedle32.exe
        
        C:\Windows\system32\Gfedle32.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4460
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        60⤵
        Executes dropped EXE
        
        PID:936
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        61⤵
        Executes dropped EXE
        
        PID:1464
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1956
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        63⤵
        Executes dropped EXE
        
        PID:1184
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4292
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4004
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1044
        
        C:\Windows\SysWOW64\Hjfihc32.exe
        
        C:\Windows\system32\Hjfihc32.exe
        67⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        68⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\Hpbaqj32.exe
        
        C:\Windows\system32\Hpbaqj32.exe
        69⤵
        Drops file in System32 directory
        
        PID:4464
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2816
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        71⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        72⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        73⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        74⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5200
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        76⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        77⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        78⤵
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        79⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        80⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        81⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        82⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        83⤵
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        84⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        85⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        86⤵
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        87⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        88⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        89⤵
        Modifies registry class
        
        PID:5756
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        90⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        91⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        92⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        93⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        94⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5972
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        96⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        97⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        98⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        99⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        100⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\Jjbako32.exe
        
        C:\Windows\system32\Jjbako32.exe
        101⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        103⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        104⤵
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        105⤵
        Drops file in System32 directory
        
        PID:5404
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        106⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        107⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        108⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        109⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        110⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        111⤵
        
        PID:60
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        112⤵
        Modifies registry class
        
        PID:4552
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        113⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        114⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        115⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        116⤵
        
        PID:828
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        117⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        118⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4836
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        119⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        120⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5300
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        122⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        123⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        124⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        125⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6048
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        127⤵
        Drops file in System32 directory
        
        PID:5676
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6120
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        129⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        130⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        131⤵
        Drops file in System32 directory
        
        PID:728
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        132⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        133⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        134⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5700
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        136⤵
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        137⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        138⤵
        Drops file in System32 directory
        
        PID:5376
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        139⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        140⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        141⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        142⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4824
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        144⤵
        Drops file in System32 directory
        
        PID:5920
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5208
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        146⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        147⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1816
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        149⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        150⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        151⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        152⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        153⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        154⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6264
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        156⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        157⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        158⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        159⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        160⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        161⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        162⤵
        Modifies registry class
        
        PID:6560
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        163⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6596
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        164⤵
        Drops file in System32 directory
        
        PID:6640
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        165⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        166⤵
        Modifies registry class
        
        PID:6724
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        167⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        168⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        169⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        170⤵
        Modifies registry class
        
        PID:6884
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        171⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        172⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        173⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        174⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        175⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7124
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        177⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        178⤵
        Modifies registry class
        
        PID:6180
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        179⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        180⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6396
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        182⤵
        Modifies registry class
        
        PID:6484
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        183⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        184⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        185⤵
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6740
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6828
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        188⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        189⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        190⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        191⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7148
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        192⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        193⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        194⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6584
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        196⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        197⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        198⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        199⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        200⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        201⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        202⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        203⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        204⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        205⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        206⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        207⤵
        Drops file in System32 directory
        
        PID:6488
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        208⤵
        Modifies registry class
        
        PID:6780
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7000
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        210⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        211⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        212⤵
        Modifies registry class
        
        PID:6660
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        213⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7180
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7228
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        216⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        217⤵
        Modifies registry class
        
        PID:7316
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        218⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        219⤵
        Modifies registry class
        
        PID:7396
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        220⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        221⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7484
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        222⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        223⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        224⤵
        Modifies registry class
        
        PID:7616
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        225⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7704
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        227⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        228⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        229⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        230⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        231⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        232⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        233⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        234⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        235⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        236⤵
        Modifies registry class
        
        PID:8156
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7188
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        238⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        239⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        240⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        241⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        242⤵
        Drops file in System32 directory
        
        PID:7524
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        243⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        244⤵
        Drops file in System32 directory
        
        PID:7676
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        245⤵
        Drops file in System32 directory
        
        PID:7736
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        246⤵
        Modifies registry class
        
        PID:7820
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        247⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        248⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        249⤵
        Drops file in System32 directory
        
        PID:8040
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8120
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        251⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        252⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        253⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        254⤵
        Modifies registry class
        
        PID:7436
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        255⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        256⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        257⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        258⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        259⤵
        Drops file in System32 directory
        
        PID:8000
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        260⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        261⤵
        Drops file in System32 directory
        
        PID:7220
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        262⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7472
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        263⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        264⤵
        Drops file in System32 directory
        
        PID:7872
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        265⤵
        Drops file in System32 directory
        
        PID:8020
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        266⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        267⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        268⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        269⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        270⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8096
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        272⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        273⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        274⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        275⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        276⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        277⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        278⤵
        Drops file in System32 directory
        
        PID:8432
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        279⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        280⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        281⤵
        Modifies registry class
        
        PID:8560
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        282⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8668
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        284⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8792
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        286⤵
        Drops file in System32 directory
        
        PID:8832
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8880
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        288⤵
        Drops file in System32 directory
        
        PID:8932
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        289⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        290⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9092
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9136
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        293⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        294⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        295⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8312
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8364
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        297⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8496
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8584
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        300⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        301⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        302⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        303⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        304⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        305⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        306⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        307⤵
        Drops file in System32 directory
        
        PID:8320
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        308⤵
        Drops file in System32 directory
        
        PID:8440
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        309⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        310⤵
        Modifies registry class
        
        PID:8740
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        311⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8960
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        313⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8276
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        315⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8616
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        317⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        318⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8536
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        320⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        321⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        322⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        323⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        324⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        325⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9292
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        327⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        328⤵
        Drops file in System32 directory
        
        PID:9376
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        329⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        330⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        331⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        332⤵
        Drops file in System32 directory
        
        PID:9548
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        333⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        334⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        335⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        336⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        337⤵
        Modifies registry class
        
        PID:9748
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        338⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        339⤵
        Drops file in System32 directory
        
        PID:9840
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        340⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        341⤵
        Modifies registry class
        
        PID:9924
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        342⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        343⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        344⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        345⤵
        Drops file in System32 directory
        
        PID:10092
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        346⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        347⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10196
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9224
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        349⤵
        Drops file in System32 directory
        
        PID:9308
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        350⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        351⤵
        Drops file in System32 directory
        
        PID:9428
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        352⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        353⤵
        Drops file in System32 directory
        
        PID:9584
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        354⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        355⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        356⤵
        Drops file in System32 directory
        
        PID:9784
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        357⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        358⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10004
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        360⤵
        Drops file in System32 directory
        
        PID:10060
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        361⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        362⤵
        Modifies registry class
        
        PID:8232
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        363⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9400
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        365⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        366⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        367⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        368⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        369⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        370⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10180
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        372⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        373⤵
        Drops file in System32 directory
        
        PID:9540
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        374⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        375⤵
        Drops file in System32 directory
        
        PID:9904
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        376⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        377⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        378⤵
        Drops file in System32 directory
        
        PID:9472
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        379⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        380⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9412
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10024
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        383⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        384⤵
        Drops file in System32 directory
        
        PID:10188
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        385⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        386⤵
        Modifies registry class
        
        PID:10284
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        387⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        388⤵
        Modifies registry class
        
        PID:10364
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        389⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        390⤵
        Modifies registry class
        
        PID:10460
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        391⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        392⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        393⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        394⤵
        Drops file in System32 directory
        
        PID:10624
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        395⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        396⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10712
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        397⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        398⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        399⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        400⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        401⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        402⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11012
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        404⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        405⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        406⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        407⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11212
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        409⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11260
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        410⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        411⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        412⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        413⤵
        Modifies registry class
        
        PID:10580
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        414⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        415⤵
        Modifies registry class
        
        PID:10732
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        416⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        417⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        418⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        419⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        420⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        421⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        422⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        423⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        424⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        425⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        426⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        427⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        428⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        429⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11032
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        430⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        431⤵
        Drops file in System32 directory
        
        PID:11248
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        432⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:10468
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        433⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        434⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10840
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        435⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        436⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        437⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        438⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        439⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        440⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10384
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        441⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        442⤵
        Drops file in System32 directory
        
        PID:10312
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        443⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11160
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        444⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        445⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        446⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        447⤵
        
        PID:11384
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        448⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11432 -s 396
        449⤵
        Program crash
        
        PID:11536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 11432 -ip 11432
1⤵
PID:11512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ajfhnjhq.exe

Filesize
1.8MB

MD5
df69839386cd53b6e174e97a7655fdda

SHA1
57bdb5b4d9f548d55458aed245afee3e2b2ae587

SHA256
78e79dff39c23aa5ae42b7a9099732c99997b563fa02f68ed4f33dd709ed1fa1

SHA512
5c2f22aafdfb8e3cfb59bce42edd2a664be4df8576a2044e6439f977446051884faa55ae8f79cff0abd83e20e530cc55e407a47dabc60265ad08c1b3d3979210

Download Submit
C:\Windows\SysWOW64\Bffkij32.exe

Filesize
1.8MB

MD5
970cbfde934d8bb38965cfab50bede3c

SHA1
c8f2e01d17f027b90da03deb25673fa7011c7dbc

SHA256
d396eb3e45084330c9706eac67f4ae0439dd7ed722d697e66a4f21465e2b79d1

SHA512
881d43b587a704a30995d81c4c2ba6742cae7cbed9a23811d12f0c8edcc5365477a9062a83c2c109948f3506a7a045e371f6a202f030091051b441cf72351174

Download Submit
C:\Windows\SysWOW64\Bjghpn32.exe

Filesize
1.8MB

MD5
863a8843176d2bdd27aaf09c2e51e645

SHA1
67217a193e10cae341f51a8212838a9cf26d203e

SHA256
db24ca062173de16cbe1c7fdbdc1a9d972493c0db0c8d3adc2978b8f750b7daf

SHA512
ff21e3b219f283ffccd3a187dd8025fb342669f97f1882eef05ee134f4af2cb6fe8e2f1c64b5813336b998c9de978b6099ba8dc35d6739c923c383daaec32f20

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
1.8MB

MD5
94cccf90894d4c77ebb748f940fb3a67

SHA1
e877f5e6f09ef8c1351dccbc82421d930b789e14

SHA256
c0cc8d1d73978fe1e04a2696848a77e3857c809db1e95dd0c9bff753a7245264

SHA512
6ac176ac20eaea38610e9551f289f2a297562f56ec3b1170fd9cca6affab991908845a0880293b7ae049245b8c264feda9de8c7f3c61aa58856207609d9bfd52

Download Submit
C:\Windows\SysWOW64\Cahfmgoo.exe

Filesize
1.8MB

MD5
fefd578cf181bc7f370b41471e302fe6

SHA1
a9b674441d243ee78c2bff9e6765f1489445bddb

SHA256
144568d689e08a2c6b3f508afa72d5d01cdc3a549fac2a293951561b7810b0a3

SHA512
50a646752a73816a3aec11a443c47181f3960699e105552b733df1c538a99461f912de3ba8fc6f5b9a5730e0975615f6c8f6c6ddaf7fac132a3bd958f5819dba

Download Submit
C:\Windows\SysWOW64\Cdcoim32.exe

Filesize
1.8MB

MD5
cc552743ab88e626274c4f5a6089dd88

SHA1
5f05e524b03959d2ca13ac9561e8e717bcefa3bf

SHA256
ad6593b4586cf58e9de852e2bd49fc552be78f168f68496da82674177b82a56e

SHA512
dcf17d835896490ba66ca5bd41e0ba4be843362e9c742f138c052fa8015129060381b18303d62270bb5ecc981a25d5f5867ce5eeac6719a09bbc8a4b6be0c6f9

Download Submit
C:\Windows\SysWOW64\Cpofpdgd.exe

Filesize
1.8MB

MD5
82cb3af04cc9fbe1c3079eb6b056064e

SHA1
56a6c6bc9c7c99c12f27d033d39fff6ea121675f

SHA256
7e65b002f14a06a162a32ea23b82bc3627ef279c7fa5d0163c8e4bf86742412c

SHA512
4531e2c4b3edff01d6209935dcd70859d5a27a19efb108d0e933fe77fedfd6b227e59b5f7265563dfa2e7c0ca23c1f7b9638ce3c3bf62761cd336637c9952fca

Download Submit
C:\Windows\SysWOW64\Dabpnlkp.exe

Filesize
1.8MB

MD5
ec4f27114d0c648b2ddae339fe2a1f55

SHA1
f14eef96ac0a076a9c36b9ede42821a2f67ee1d9

SHA256
e228bf5649d05e0f2ad21402a2d40a5b7c4f8d958513bc2dd322e77caf7a886c

SHA512
77c89679cb8b19fce98e344fe71421d12a6cbcfced30c49d6becc2d5a62116b754e812600cab560f031204b9516e278907f301c80f0a8fa828614ad99aa46e0c

Download Submit
C:\Windows\SysWOW64\Daifnk32.exe

Filesize
1.8MB

MD5
7c5ca62e8c6e73fb3a864f16eecfc5a0

SHA1
3b0bd943f15c494679fa2d102e7cc6bec0bd47b1

SHA256
d04914af6582aaf0ce5925b4b630933c2b78b8395e3cbb9094e00a65deb16549

SHA512
a79895e3449ca7786c315c9c8eb26c85d67e8b93058fef70b1a4480856f047ba17b5ddbd3ac3e150a316d497cda9f950c14f699092f780a8a64fe094b551c9cc

Download Submit
C:\Windows\SysWOW64\Dakbckbe.exe

Filesize
1.8MB

MD5
7945b965d00652d30cb7fb504b6f1fd0

SHA1
9271faae2191a5d46b5f9a9988c29803663e9f41

SHA256
3af70014fe7be8bd4049b8b29c73251568403c4dfcb5c21e7d49de6b4e044897

SHA512
336dad0a06c227c4862672c2d4b59d12c7a7a5935dc4bde87d6af353fa1818fbf932e8ba5df12477c2592fee0c501af948ff42ef553f3fd48622de2e70ebe0c1

Download Submit
C:\Windows\SysWOW64\Dcalgo32.exe

Filesize
1.8MB

MD5
483074d04a569a15bc8e166caaee0b56

SHA1
f52a444926d26ee35f503e02662530350a7ea9ec

SHA256
b216a75bc50a4450f1cc58b0ebe53b802468b94b1f44b245fa79240d4ac45390

SHA512
d9849b153c75c3c1de1576cf0c3a847689a89d40d3f8b667b915170a9eec297f30ab75bfed23c2cbfdfd7805ef46411acd21be7e365b8402e9ccac4117b6c544

Download Submit
C:\Windows\SysWOW64\Debeijoc.exe

Filesize
1.8MB

MD5
3c1cb9590f870a9e47f11e9364dfe9dc

SHA1
18ac0c541a48f749f068185e651cf409a3ba1f99

SHA256
4d1cfaef3c89b86f8e1f108e46a19b19374692a9c34c66474b361e0ac214f85f

SHA512
f965101568d9a39bd134d0353e99fcb98a3c205eba8040bbd3e1096566370a4cf800275c12aeb45475063a792bef8af0b61a690ec84314415c5fcba5fe5726cb

Download Submit
C:\Windows\SysWOW64\Dhlhjf32.exe

Filesize
1.8MB

MD5
aa7a515612a011fa8a79470fdf84d452

SHA1
7dd76e741c73069ef815823091d34e3e6f6be99a

SHA256
9615902b43de5d9b22f4542876ca1d5b395a72fe54373873237ab49515a34a2a

SHA512
a54a09bf208527894b57913e569f721dee557916d3c3c49416b28d5f9ffb82e0a1a30c86d6c88bd5bb22b091fdf530f73219dd3e4b6c25a0e56c144bed14739b

Download Submit
C:\Windows\SysWOW64\Dhnepfpj.exe

Filesize
1.8MB

MD5
1ee5b421d737fb50f54d6ddca0505709

SHA1
a9d7b3410bc1f8b3ee7d02d1e5b08d40b865f13d

SHA256
654080a7eda8a289e37b9353d5d5d01f9d8ca2a93497bb9f2e4dfa807ecafe3e

SHA512
dd8f9810d6851b670c19f8f90815e12ebb4a3e62af5f5b09237feb3d631f3e39f491fc15c00cc39e565605e789032a00518313fb5753b4c4e2eb92cfd85e143c

Download Submit
C:\Windows\SysWOW64\Dkkcge32.exe

Filesize
1.8MB

MD5
44a1fed2337460c719c6b267446c691b

SHA1
3f54e4dff46fcf8170391d0a74f359220a176845

SHA256
fa8bae708bd3de7cf7b359e86701ab79e1db84faee139a9dc2abae7191fcbd71

SHA512
631bb8e15906fe654d77346dc48d212fdf57f07b94f53d0ab505e3e417b9f57d8696a607b56efe9623c5a566e4d00c6b3e851b1026a749d0c49b9ef4f7b0ab72

Download Submit
C:\Windows\SysWOW64\Dlegeemh.exe

Filesize
1.8MB

MD5
87c4e790a2f8464a74c79df5c59f60ae

SHA1
0b2e98086a32f3eb99bf263132e43a65dd7b004d

SHA256
6c73ac1fa4dc5b89252047a648c6fe40c578c52652fcc26616425614c7651cda

SHA512
229010651a6f8c607c4b1d47d80d678d70469cd09e5246cca130ab44d2a12aeb37a6890259c9303f05c9c8da641a968c7018457935a8d62492b47f2e285f1f7b

Download Submit
C:\Windows\SysWOW64\Dlojkddn.exe

Filesize
1.8MB

MD5
e9410c36f979058d563152d94d33cbdb

SHA1
f3e35f29cbf305ffa753e0b99ab6b53ead1a6864

SHA256
2d09aa18ab403e509d5eebfd3780879f71c3a95be51d21fa570140c0cd70e3eb

SHA512
5a6959b0e3574c880a9b528d65b4c858f8c75b430f40e862aee41ba798cace18b957ffac6a0aa314991297829efdcff72affdff97aa4b2e8c8e005cc26a11714

Download Submit
C:\Windows\SysWOW64\Dohmlp32.exe

Filesize
1.8MB

MD5
f62e3746f5b78571b607d193e173c5dd

SHA1
031649ddaea0f86c7521e20b6765d87795e98b00

SHA256
aad9c6f43ad165a731a73888a7354dd28a4a760cfea4f370f34991388d515733

SHA512
401d5a7d7bfe440c309ad176e8d9a7569df55d9db95cd9e248c1f5e5ab5c09a1d86d9b59c028af07b5f0e49edf4e9682978c21d4ce7d2f4060120a6613121703

Download Submit
C:\Windows\SysWOW64\Domfgpca.exe

Filesize
1.8MB

MD5
e956a0a0ac7fa5a419fac2e4138089a8

SHA1
c037244715931bc617a50bb8c1659eeb75078d8d

SHA256
ecf0329db696678c12910da8bc57f88de70bc3deb99bea498c550cff96a1293e

SHA512
2af500bba10cc12debdf8b3fc148475ea57638fa14263370ba6b61a1a5a94e68e695438c620a00c3dc69592e461875ff5522ad1440fb95c525e29a29b91753a0

Download Submit
C:\Windows\SysWOW64\Dphifcoi.exe

Filesize
1.8MB

MD5
1b24190208e9c0c800dc1be0796a7d96

SHA1
ca0443918d0ecef437a76d32e947eb86b4b5ad06

SHA256
18b69f85a79b6ab38b901c62abb4a97ee8a8fe386fcd87dd989f42ed764fdf28

SHA512
d41f4b06b2f3c3b9c8b33f8cc63d86034b45ce9edb05903d2e4f912c459aff4280fcc4cf95e7f9f042ee2ac16caa582432b53c050ddde5b896b4887a14560264

Download Submit
C:\Windows\SysWOW64\Ebnoikqb.exe

Filesize
1.8MB

MD5
daea42adb7eda605fdcaadf964424118

SHA1
2a774456c020ff28292ebb123ea7c213596d08cc

SHA256
52da4ac7c79c54a1ebbc6b51338f9d377752eeeb7c79272a1daa0b26ecdefa19

SHA512
0a07e9afe4fcc5dd33fc5bbfa1bb952c618f9451f466ef3f8296683776ad848609337a228029061e376f7e1794fc1ac49abb9a307c2e1c7771e08f1f7c572115

Download Submit
C:\Windows\SysWOW64\Ebploj32.exe

Filesize
1.8MB

MD5
dad4ced868281b0c4578446dfeae2116

SHA1
97f791faf2294270b0b3c51c78102cb13519d37b

SHA256
08f498fe137f98b59ad2292e043e166d7f17630c2df0d7b3cf989dbec80908f5

SHA512
e1683f2d6681fa87cf5163b4e8cfc2d6b2537f0af0c4da6fccbc2e743a5290f70205a6654750c0b3f8f80086df22cb25898ad66115bba22c9eda8a3bb3f10532

Download Submit
C:\Windows\SysWOW64\Ecphimfb.exe

Filesize
1.8MB

MD5
536e5b27ceb4b7fecc921cffc10e5a15

SHA1
772299f31f394bc16e87f01c9623905db4deb79c

SHA256
f6cd8cb62adfdde0315d8844451b8de610520bd8ef90aa59e5658e80ed611b4f

SHA512
6bf4d2b8ebb2dd2ede0280c3a3e05070589dec56281aeb9aeac60d9b9770f0627e6195321e0a3c6e0dfbf1a4cc3af6050caa276665949a7cb6991cd6887d4736

Download Submit
C:\Windows\SysWOW64\Efneehef.exe

Filesize
1.8MB

MD5
2215203065f8ee533eaff8a4f621b95f

SHA1
8f65b5af757e458dd14887a888057af3cd7b8e94

SHA256
2ca5c398849d12507a82f15033c81a74302882384d56b56418c42f321ee8928b

SHA512
ac3f5a915cac8e6a0e29fe5f0041aa1dbcad0a7b5a8cd9a6684f103fc26b3a4ce6e16e2cb8a6cec5679d5840440b18295476e7ab379c4b247161d061e45d368b

Download Submit
C:\Windows\SysWOW64\Ehekqe32.exe

Filesize
1.8MB

MD5
b69197ddd6bd68a98afc547663ac11e5

SHA1
016b69625db76c9263c2265ae2625d8e558edf47

SHA256
3f7fe09a5d763eb13d85cf735d88fdbf460748247db345423a5e065271f41d28

SHA512
56083ffe46236e814f7776a94dbadb72e79c60da9a8c4b5ac65072dcab7feaf98dbdbceb6b332b8cc5cdfc5254bdeefbc205e5627407bbb80a6ad0bb38944f19

Download Submit
C:\Windows\SysWOW64\Ehjdldfl.exe

Filesize
1.8MB

MD5
c19abf388120e6b74f85a413fbbe3751

SHA1
6e2f67def2ad60bd3a21ceeaf1166ba686cf1651

SHA256
a8d96c9d40391da2a4398a0c6ceedddff28ef0dd26a6a7fa0fe61f14fc339201

SHA512
e034905fd5190acde8325286778a24ca74cd30e2348697d552c978efeaea49a522ddb233ba90dd8f6e56c90a78e285267d247a023c8c2b7c804ee464ba797c7a

Download Submit
C:\Windows\SysWOW64\Ehlaaddj.exe

Filesize
1.8MB

MD5
a1ffbdf25853ac4a5809ef9f725431d4

SHA1
6d5609bf8704f2cd4053a01ce821e93c2e96a2ea

SHA256
2ee4d855e4362918072272e9204bbba40fa57be6826127690c8bde0b735a1b7e

SHA512
c15ff3f76ce1e424940198e76b5544dabc1013a184f6d1c2aca66aebcb72f7be234e79be07c30871e54f13b727da162d8941226f144203f25b4ab9b7e82223a5

Download Submit
C:\Windows\SysWOW64\Elccfc32.exe

Filesize
1.8MB

MD5
864fc3c2a2677760d197e2a5a95f72d7

SHA1
a9b5773eae61ab368267d0693351355eab5ad505

SHA256
fbd074616805163bffae582c3434e57f61f82d8c063528c8093f42372ef2ea54

SHA512
fd6badf2589f96b4eef826192982daefde5295f868201f0d8050712e7bb4c8fd3eff2138ab205da0cf1fcc3d3f0187c5a561a42c550ad61fb061405719cf14de

Download Submit
C:\Windows\SysWOW64\Emjjgbjp.exe

Filesize
1.8MB

MD5
002b2148851eb01febd45e7dc449556e

SHA1
78bb9ba8de42ed0a2002bf9f7d0d536d3904e2d6

SHA256
692f1790629b462ea13b19ca2134a1764fe7e85979f24e87196ac06097a3bfe2

SHA512
87924fd73f555571a4455e5ea7e3f413d51797c8687fb4b8ecbbdf0b0467f3660ca0f3eca2945050e4591a48a8a979de9bafc79eeaa689af6209cf6526da981d

Download Submit
C:\Windows\SysWOW64\Eoapbo32.exe

Filesize
1.8MB

MD5
b741eb3b544a054a4d278abac5ef61c2

SHA1
6e15388d48820300394aee59481490cd973a361e

SHA256
45e37426a2090ab6fcb98fff95792e0e6f41c97cb94ba095386ed3dc97d8e974

SHA512
050f7070e715bd4bb1f983d75db40d8ab96abad16a61adc0b24440fc7287c0001f5e12520138862b0539db23a73fe116a3a81cabeba52ab92b1501cd8e2ce66e

Download Submit
C:\Windows\SysWOW64\Eofinnkf.exe

Filesize
1.8MB

MD5
5605bc802dc68b426077b3ef52d84cc1

SHA1
016137cad0c57de01af8438096c9f0c23475fd19

SHA256
f11b61589eed46febc27072059cbe1f9bbe0767a50a44968bc5b8c17f8621f49

SHA512
906ab15dca8de1c71cf15a8d6e41ec6133103974162d319d3695fcff1ff4583e6ede5f27072c0febe884c06e9efd00fe651c607ee187e782614a76e70820cf74

Download Submit
C:\Windows\SysWOW64\Eoifcnid.exe

Filesize
1.8MB

MD5
157bf22f2bd2a4966500ae36f12b0365

SHA1
67d4e6c019766242d8237229b571f859646a5db5

SHA256
674e5e2152ccb24e15d7bbd99b487743718c1c6da93c5b1e06e605130d6bf324

SHA512
d536da70d260063b261b16b52ff7aa2a4448260d1891d926a096f9cc33287b23809c8efd7c112916334db4211b6104d8c04bcd49259fe152fef925a952812cb1

Download Submit
C:\Windows\SysWOW64\Eoocmoao.exe

Filesize
1.8MB

MD5
4c0eb64f71c889996373d30b3e1d47dd

SHA1
b56cccf3b2731bb1b2f6dcdc5f040f16f7d5e5d7

SHA256
7810c61c0a0acd91475648ce24747359626e59543a03caca81d29b493ccdfaa6

SHA512
15fad43fc8aa55cac4ef2302071f380281e2329054b7cdd8c1a223a41eb823261794eaf9a483a09d6c2769ed1428f74f096b6c2ce28986a223f2fc7eebdec1f7

Download Submit
C:\Windows\SysWOW64\Eqalmafo.exe

Filesize
1.8MB

MD5
66049387d3085135ca9100c51dadadb7

SHA1
c41de3148ef94ba57cadc20de17a12290c7daea3

SHA256
5204e1df7b28688938ea943c4deeb854964e504e39afa5bfdcdb75ff9e7a65a4

SHA512
e155f5f8e64c359b0b124cd29bd7a50b04ba9124ef28632d37d2e297aa1efc85a6af18075279084bb7dbdd6ec5b482e4ca528bb44a9ecb9624252525afee9930

Download Submit
C:\Windows\SysWOW64\Fbgbpihg.exe

Filesize
1.8MB

MD5
fa66d1f70c3be275742139f7153a982a

SHA1
aa636f868b3f4815e398bb86df8829333bd7cda3

SHA256
f200446cfa8b9a9054b62536b5dd2b8c87834ab19cec66a2c2240215a095bb30

SHA512
d3ff9042b5eaa3638add2bcaa7757949a043f1fdca738c08c00c33cdc36e04709d1b6d520bab7e6e367b1153fb98653fede02e157e0f3b22342d9a3a8bd75c48

Download Submit
C:\Windows\SysWOW64\Fbioei32.exe

Filesize
1.8MB

MD5
67d334510420fe6829ac007a43a15920

SHA1
4d74e213f1556c1d20dc94e452bc628ccea4ba54

SHA256
a1a034cce3a090dabf9a6a2c3d569fa6d5b95618daa1802db6039aefb02e632f

SHA512
e2be184e103b9db5640a9c8305d08b65e70bd1d65b15860dee14afded6630fe62817cf88b61a1f73071377e1800b0ebcbf8dcec02dcf77f297410540d0f3e7ae

Download Submit
C:\Windows\SysWOW64\Fjnjqfij.exe

Filesize
1.8MB

MD5
d1567a7bda3e7d8c67c936a072a84bf0

SHA1
01b4efb2168522cdcbf529b832954cd9228505ae

SHA256
ca1af6cec57744f1e51d8041b4976e385a4aa6e4858ebf89220398bdb9ffd5ef

SHA512
9d55a5efbfb92be47fec3ab72e23f5469c6c45ceb0063a3e0ffe009e8df860fc1f7cf65a719f80622eb921c29c030feea89b43452b14473200f10fe9fe598a0f

Download Submit
C:\Windows\SysWOW64\Fmmfmbhn.exe

Filesize
1.8MB

MD5
b2e99c145acf6fc3f52e1033481725ff

SHA1
255a2d9d91806a08e52273e7c9b7d6eed1b6f59e

SHA256
2afee88391f68ddb3ef50c4123fe3a9d6ebe708051cd8d10fcee42b0d7b7c752

SHA512
66939913034ec72edf3da720b4e9d167fa8363ced33a01056180def3d4701852b05948921fb9fa6886388466f64c6f7fc9cfa22e6ac50f8fe3d40e1d26d379ee

Download Submit
C:\Windows\SysWOW64\Fokbim32.exe

Filesize
1.8MB

MD5
74744868fd8d663ad6cff24c1d7159b6

SHA1
fc84040da4bc0ed4682fc718e2b5137293ee1d61

SHA256
c6ffc666f9573a82be0a01ed8d54b9ba0ff03a135d21ebff11d7dc66c5d05cca

SHA512
d37f4a40387e8feaaad9edae284c50c784725f2dd9827035956c77bb6e0bb65b422f8584445fb3496112c8278390d04c4589ec51b6f45e463961a92cabcd5fc1

Download Submit
C:\Windows\SysWOW64\Jeaikh32.exe

Filesize
1.8MB

MD5
e1cc29c2719984e3d6d57e198c5cba48

SHA1
c981c29bd331879b1b278cc6b1354801e0899a85

SHA256
b961ca7fabadb91de7128f7aae318778e4d7c7e93c50befb1055fa0194996722

SHA512
2aba93091e52bf60db10ceb1dbdf9acaa37937a03984b2dc65c4733e773cb71d6ced79a6a6e791288ae88f8e636b30ed4cc351d3ad5cd936cc4336bdfaa2eaa0

Download Submit
C:\Windows\SysWOW64\Kdcijcke.exe

Filesize
1.8MB

MD5
c9db3dbb58333db71bfccc5be8c4786b

SHA1
a1eaeaeeb6f81ec358aa79e4973cb46e6c724f51

SHA256
9286cdeae069fc85d79d833735029de0bb94ddec11c079831611ab498f81fe07

SHA512
be148c6d177fbc6128cd7de49f51c267ee3426823c21e6718ee044fff695b8211fef92f462d2482fe130f7b4ff38c09dbe0f88f12991c34c071316c35af2285f

Download Submit
C:\Windows\SysWOW64\Ldaeka32.exe

Filesize
1.8MB

MD5
d34059ae873a295b0e83fd8be9a52122

SHA1
e6b5a475c2c7bbb504249dd2bba53a6e14d30841

SHA256
5752c5ee6a69ccb8533bff629f2e60649e649f3c8ef66e656862d3e07d3e7d0e

SHA512
f78ebd7e208efa7f3f30a743496f6549b52365cf8553fdb8e631b5555eb2f4dffd8324dba6ab3e37cb87c0583c926d78ee3df7b339fdc02ca96a0e2ba3775708

Download Submit
C:\Windows\SysWOW64\Ldmlpbbj.exe

Filesize
1.8MB

MD5
c4062b1ec4b00818daeaad91265375ea

SHA1
2cd0ab92743db5f6dcabaf51bb0c996e283f3f27

SHA256
e2a7638f8548f2fd0e18a9d0018cfd48e53dbfd6c1bb2697fe613e2c04afb443

SHA512
bc2dc554bbaad2925aa07458256e8db470032bbcb451b2807af0d6931a05e77dc9fd1427aad52903756715cb56f36af4a00fdb964ba521321baf1847e3699634

Download Submit
C:\Windows\SysWOW64\Menjdbgj.exe

Filesize
1.8MB

MD5
35f18589de78f0cf3fa729d4740aa850

SHA1
ea8283c7299ef065bc722dce13fc571c13eafe4f

SHA256
482c7f9de92aa39afff1434b6d1c117465ed66c9a3ac17109e38000e60af35bc

SHA512
636333c38fb1f224ee1dd136ceb3d807f6dacdbd6e28a50882046d7885ab3eac6a0b8b525f55743b089530fe4090de199130645ae5b5cc7062f8112fe10cb104

Download Submit
C:\Windows\SysWOW64\Mgghhlhq.exe

Filesize
1.8MB

MD5
ce5ed92f055a88a1b7a15a0a5bf37cdb

SHA1
fa14437ad4319ea226a47ecbe2c4e229dc3821dd

SHA256
d77e2939b812d423467370a19d909545160ef1a17c3eeceb47851d4948958ce6

SHA512
79c63d0fbbdf4eeb2d038a7f7238c3b1b9d6ddcc347c080d9946a1d9e802e22131fb5c1eb3812c83d298b1b98d01e69e114da8b7a7cf020b2520d62e746fa1b8

Download Submit
C:\Windows\SysWOW64\Ndfqbhia.exe

Filesize
1.8MB

MD5
612543e3b00ad0766671697f263cdf0b

SHA1
d71211bdaad8c82bc6798bc0490b2d9624dd4f96

SHA256
8eaae975d44efbd189b96e029c16eb36cca955e230821f66ce14afe65d0183ef

SHA512
d7bda4af6ea52a531254a3b1afaa98830807ed25981f4c8b8de4245061d9f84534a3df293c2508385d7ae701a6eea0653d8d636c3288a35aa79e2913978c3529

Download Submit
C:\Windows\SysWOW64\Nggjdc32.exe

Filesize
1.8MB

MD5
364e73f4413967f7fd76efe684d30d68

SHA1
df3f4787b38e52200d32be91217a66cd8dd2ddaf

SHA256
7e208be902e24f93cd8922b4376f1fb7001a0b4d33d9ccf371881bf6cb94cce5

SHA512
e8d455966e17557a00bfeb79423814e4d9a3a131f12d70c8a185ee2be3a2dd4c039c7bcb60528cb8da32f00d5301510bebe45ef39e6c714c850e5e2319d8cd31

Download Submit
C:\Windows\SysWOW64\Nnjbke32.exe

Filesize
1.8MB

MD5
5a1d42e79d6daae1713e0df1a01f8d36

SHA1
b32b41bed6d1f716adc547e819478fa3e56210cd

SHA256
a7a189e83a7714b566843e691742d5fdf11d6f510d44f72aa5d083a2eeab82b3

SHA512
8be340caf0135dd2b621a3a40eb86fde0e7186c02fac03de4a998859cc3b96466ff4da095d575b667094e3d0a71552de31bfc8541cb558b5f1e9cefff7da9cab

Download Submit
C:\Windows\SysWOW64\Nqklmpdd.exe

Filesize
1.8MB

MD5
423f0d3b6034e6bc44eeda4e124e88fc

SHA1
d3166b77474c0061acd94e31148c19398ebb0c5e

SHA256
4a4e159f07da861f9d956d27ff37804f94c48327ebd556f31201e30f8eda2f8a

SHA512
8e5e8b66854274821ffa7e0fc54cbbf89636668e08e5588ba01b6360a0a13348c9cf050dc558bb8dac632a78a310253b943977cc359cf7b16a825ca121817aa2

Download Submit
C:\Windows\SysWOW64\Obdkma32.exe

Filesize
1.8MB

MD5
bbe3ecfd8c6a1ca84f8f4e84958acabd

SHA1
029b53d146c7f9d594c06d4df3008b8e9ed10194

SHA256
3718f0fdb82f8a649ef419699e3bae7509243a7aa8df5f3974db5afd2e49e3c5

SHA512
27baffe4f2b30809c38e006572ec0f1193184de2481fe96e3fad424a074f71cc7160de5822ca60fd24535290347011517d1139a39c37530e8c9a6c28260350c2

Download Submit
C:\Windows\SysWOW64\Ogjmdigk.exe

Filesize
1.8MB

MD5
24392ec78979ea22076dacb8012a59d7

SHA1
c360e7120181e3e084534f750600edaa1564ee38

SHA256
eae1cd8b8b54125f86d8ba6222cc222edef371cdb8ad3d30f3af551a4c1a671c

SHA512
ca3da6f4ec13ad36001cf76082c224e3f0249483dcc29f280cba8d7d8931e293d9204c6e23a365dc60064965f3acd372e57be12ab579ea2c6f54e8a42bf99511

Download Submit
C:\Windows\SysWOW64\Qloebdig.exe

Filesize
1.8MB

MD5
5945f1dd9a423a02d2bf79fc6f6ce91b

SHA1
ca8e185691b62115a240139dd36756d11d5760d1

SHA256
7d5a2fbc745c8c55d943e344dd73a7755d8d0daf722502b199222f544513ec9c

SHA512
0c13d446adda58a8bf989cbde6e75ed35e33c03263a39926dd83acd21fbf2142716e7c26974a53ff8d0097687da2d59430ce2f47375b4211e5018cbacf6f0e23

Download Submit
memory/468-652-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/640-609-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/852-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/936-668-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/984-555-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1136-610-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1164-568-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1184-672-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1224-595-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1328-561-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1332-574-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1460-513-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1464-669-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1552-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-563-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1844-592-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1856-577-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1940-645-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1956-670-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2164-597-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2168-604-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-644-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2240-586-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2368-627-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2404-635-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2616-511-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2708-593-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2776-641-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2832-74-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2860-594-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3084-636-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3164-591-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3320-661-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3344-643-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3416-560-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3460-653-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3532-658-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3536-505-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3624-633-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3672-612-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3828-600-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3848-614-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3892-575-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3936-45-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3976-621-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4052-619-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4060-596-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4076-490-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4196-580-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4228-584-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4236-554-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4292-673-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4324-628-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4460-666-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4560-646-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4624-613-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4668-20-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4768-659-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4784-484-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4804-37-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4932-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4984-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4996-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4996-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10384-2920-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10468-2928-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10736-2927-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10840-2926-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11008-2925-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11024-2916-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads