d01cce01279fb0b1f92783417e02b9120573f0fd35a4d5889b5759fe01549746

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d01cce01279fb0b1f92783417e02b9120573f0fd35a4d5889b5759fe01549746.exe
Size

55KB
MD5

7bfcd8f07b4ff60c1e60e5d7b6387543
SHA1

160b69a1b2d8ce05272016804c9ff796bc314fd7
SHA256

d01cce01279fb0b1f92783417e02b9120573f0fd35a4d5889b5759fe01549746
SHA512

0a95ee521af0b6bdcb56957045aaedea65458dc8c8a445ded4f92826382263f55e2ff4478a1b5f989907f6c5fd67f6c742f9e19a71f196e75cb0ab23dd452ef8
SSDEEP

768:lPz8sITc4Iu2RwUfiJKCACN3OTgSAIUFkDzN27bs/Ah3RMKg/lqc6qMqf/1H55Xa:isII6owUAKCACE8h+h20C6KbIvld

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fplpll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opeiadfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nblolm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcljmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojcpdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojdgnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chkobkod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dahfkimd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iljpij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blqllqqa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efgemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkkaiphj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lekmnajj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enmjlojd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckfphc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpbdopck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adcjop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfldgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhnjna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omjpeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qapnmopa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acccdj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjafok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnkpnclp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klpjad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjafok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkconn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkgiimng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjhkmbho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bemqih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knenkbio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajohfcpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofmdio32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bknlbhhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chiblk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpnjah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ommceclc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nenbjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnfgcd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmgelf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnpjlajn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiiggoaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgklmacf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cemeoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdmqmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ccmcgcmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnffhgon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hemdlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofegni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbnnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipihpkkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhcali32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Padnaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Poidhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpiecd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apaadpng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnibokbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iogopi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcfbkpab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibdplaho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fniihmpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpiqfima.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmbegqjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgkdbacp.exe

Executes dropped EXE 64 IoCs

pid	Process
4496	Ckfphc32.exe
4536	Ccpdoqgd.exe
1172	Ckkiccep.exe
464	Cmjemflb.exe
3392	Cjnffjkl.exe
4176	Dfefkkqp.exe
3572	Djcoai32.exe
3752	Dckdjomg.exe
3620	Dpbdopck.exe
4340	Dpdaepai.exe
5096	Dmhand32.exe
3984	Ebejfk32.exe
2436	Ecefqnel.exe
4644	Elpkep32.exe
1668	Emphocjj.exe
3888	Ejchhgid.exe
1884	Efjimhnh.exe
3652	Fbajbi32.exe
1276	Fdqfll32.exe
1796	Fimodc32.exe
1976	Flngfn32.exe
4000	Ffclcgfn.exe
4728	Fplpll32.exe
1620	Fideeaco.exe
4572	Gpqjglii.exe
1640	Gjfnedho.exe
948	Gbabigfj.exe
208	Gbdoof32.exe
732	Gingkqkd.exe
3944	Gbfldf32.exe
2572	Hibafp32.exe
1280	Hgfapd32.exe
1336	Hkdjfb32.exe
2140	Hpabni32.exe
1852	Hiiggoaf.exe
2384	Hlhccj32.exe
3920	Iljpij32.exe
1004	Ikkpgafg.exe
4172	Ipjedh32.exe
1468	Ipmbjgpi.exe
808	Jncoikmp.exe
3260	Jgkdbacp.exe
4436	Jcbdgb32.exe
4064	Jlkipgpe.exe
4344	Jklinohd.exe
2124	Jqhafffk.exe
4068	Jjafok32.exe
2068	Knooej32.exe
888	Kkconn32.exe
316	Kqphfe32.exe
1424	Kkeldnpi.exe
3164	Kdmqmc32.exe
3028	Kkgiimng.exe
4492	Kcbnnpka.exe
1316	Kmkbfeab.exe
4708	Ljaoeini.exe
2096	Lkalplel.exe
1568	Lkchelci.exe
2820	Lekmnajj.exe
4776	Ljhefhha.exe
4364	Mnfnlf32.exe
1844	Mnhkbfme.exe
3612	Mnkggfkb.exe
644	Mchppmij.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Omopjcjp.exe	Ofegni32.exe
File created	C:\Windows\SysWOW64\Cghane32.dll	Cfkmkf32.exe
File created	C:\Windows\SysWOW64\Libmeq32.dll	Ganldgib.exe
File created	C:\Windows\SysWOW64\Lajbnn32.dll	Kahinkaf.exe
File opened for modification	C:\Windows\SysWOW64\Klfaapbl.exe	Kcmmhj32.exe
File created	C:\Windows\SysWOW64\Nalhik32.dll	Dafppp32.exe
File created	C:\Windows\SysWOW64\Mnkggfkb.exe	Mnhkbfme.exe
File created	C:\Windows\SysWOW64\Jjjojj32.dll	Nqpcjj32.exe
File opened for modification	C:\Windows\SysWOW64\Ledoegkm.exe	Logicn32.exe
File opened for modification	C:\Windows\SysWOW64\Aflpkpjm.exe	Qckfid32.exe
File opened for modification	C:\Windows\SysWOW64\Hiiggoaf.exe	Hpabni32.exe
File opened for modification	C:\Windows\SysWOW64\Jncoikmp.exe	Ipmbjgpi.exe
File created	C:\Windows\SysWOW64\Hebqnm32.dll	Imgicgca.exe
File opened for modification	C:\Windows\SysWOW64\Mqafhl32.exe	Lflbkcll.exe
File opened for modification	C:\Windows\SysWOW64\Jpbjfjci.exe	Jihbip32.exe
File created	C:\Windows\SysWOW64\Bdocph32.exe	Bmdkcnie.exe
File opened for modification	C:\Windows\SysWOW64\Ilhkigcd.exe	Iabglnco.exe
File created	C:\Windows\SysWOW64\Mdijliok.dll	Bemqih32.exe
File created	C:\Windows\SysWOW64\Ffiipfmi.dll	Efgemb32.exe
File opened for modification	C:\Windows\SysWOW64\Mokmdh32.exe	Mfchlbfd.exe
File created	C:\Windows\SysWOW64\Chkobkod.exe	Chiblk32.exe
File created	C:\Windows\SysWOW64\Nbjnhape.dll	Hhfpbpdo.exe
File created	C:\Windows\SysWOW64\Ekkkoj32.exe	Dmennnni.exe
File opened for modification	C:\Windows\SysWOW64\Lcdciiec.exe	Kngkqbgl.exe
File created	C:\Windows\SysWOW64\Dpbdopck.exe	Dckdjomg.exe
File created	C:\Windows\SysWOW64\Fmkqpkla.exe	Fmfgek32.exe
File created	C:\Windows\SysWOW64\Afpjel32.exe	Qdaniq32.exe
File created	C:\Windows\SysWOW64\Lkpemq32.dll	Jeocna32.exe
File created	C:\Windows\SysWOW64\Agolng32.dll	Ojcpdg32.exe
File created	C:\Windows\SysWOW64\Abcgjg32.exe	Amfobp32.exe
File opened for modification	C:\Windows\SysWOW64\Djcoai32.exe	Dfefkkqp.exe
File opened for modification	C:\Windows\SysWOW64\Dckdjomg.exe	Djcoai32.exe
File created	C:\Windows\SysWOW64\Edngom32.dll	Hjmodffo.exe
File created	C:\Windows\SysWOW64\Ljgmjm32.dll	Opbean32.exe
File created	C:\Windows\SysWOW64\Bmnogj32.dll	Odjeljhd.exe
File created	C:\Windows\SysWOW64\Pjdhhc32.dll	Pecellgl.exe
File opened for modification	C:\Windows\SysWOW64\Chglab32.exe	Blqllqqa.exe
File opened for modification	C:\Windows\SysWOW64\Hnibokbd.exe	Hlkfbocp.exe
File created	C:\Windows\SysWOW64\Pmbegqjk.exe	Ppnenlka.exe
File opened for modification	C:\Windows\SysWOW64\Nhbciqln.exe	Mcfkpjng.exe
File opened for modification	C:\Windows\SysWOW64\Gpqjglii.exe	Fideeaco.exe
File created	C:\Windows\SysWOW64\Ngjbaj32.exe	Nmenca32.exe
File opened for modification	C:\Windows\SysWOW64\Gihpkd32.exe	Gnblnlhl.exe
File opened for modification	C:\Windows\SysWOW64\Bgdemb32.exe	Bagmdllg.exe
File opened for modification	C:\Windows\SysWOW64\Hcljmj32.exe	Hnmeodjc.exe
File created	C:\Windows\SysWOW64\Obfhmd32.exe	Ncaklhdi.exe
File created	C:\Windows\SysWOW64\Opngmi32.dll	d01cce01279fb0b1f92783417e02b9120573f0fd35a4d5889b5759fe01549746.exe
File opened for modification	C:\Windows\SysWOW64\Emphocjj.exe	Elpkep32.exe
File opened for modification	C:\Windows\SysWOW64\Jbccge32.exe	Jlikkkhn.exe
File created	C:\Windows\SysWOW64\Ackhdo32.dll	Gbdoof32.exe
File created	C:\Windows\SysWOW64\Qhjmdp32.exe	Qjfmkk32.exe
File created	C:\Windows\SysWOW64\Lhnoigkk.dll	Obqanjdb.exe
File created	C:\Windows\SysWOW64\Hkdjfb32.exe	Hgfapd32.exe
File created	C:\Windows\SysWOW64\Mpapnfhg.exe	Mfkkqmiq.exe
File created	C:\Windows\SysWOW64\Pdjgha32.exe	Pmpolgoi.exe
File created	C:\Windows\SysWOW64\Figgdg32.exe	Fbmohmoh.exe
File created	C:\Windows\SysWOW64\Eephln32.dll	Ipmbjgpi.exe
File opened for modification	C:\Windows\SysWOW64\Cnindhpg.exe	Ckjbhmad.exe
File created	C:\Windows\SysWOW64\Fknofqcc.dll	Pjlcjf32.exe
File opened for modification	C:\Windows\SysWOW64\Bagmdllg.exe	Bkmeha32.exe
File opened for modification	C:\Windows\SysWOW64\Fnffhgon.exe	Fncibg32.exe
File opened for modification	C:\Windows\SysWOW64\Eiekog32.exe	Ebkbbmqj.exe
File opened for modification	C:\Windows\SysWOW64\Hbnaeh32.exe	Hldiinke.exe
File created	C:\Windows\SysWOW64\Qoelkp32.exe	Qdphngfl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5652	5628	WerFault.exe	561

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Paoollik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjldplpd.dll"	Akglloai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Obqanjdb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ccmcgcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkiecbnd.dll"	Bmkjig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cbaehl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjfnedho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chkobkod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkndie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmhkflnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cleqfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlhmjl32.dll"	Pafkgphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmdjlcnk.dll"	Fbdnne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkdjfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnfgcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmmmfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lqkqhm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpdennml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Panlem32.dll"	Hldiinke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbbnhl32.dll"	Ilhkigcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkdjfb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkalplel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akqfkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdijliok.dll"	Bemqih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcijdmpm.dll"	Ebejfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnhkbfme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bahkih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmiikh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmbnnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qckfid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnocia32.dll"	Mfchlbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egilaj32.dll"	Qdaniq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chiblk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Babcil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekljpm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hnmeodjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdflknog.dll"	Mfkkqmiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbcolk32.dll"	Calfpk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmenca32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phdnngdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bemqih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gemkelcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmephjke.dll"	Pjpfjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbandhne.dll"	Qmgelf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfcoblfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eehicoel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfgomdnj.dll"	Amjbbfgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kplqhmfl.dll"	Edfknb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmjaeema.dll"	Ookhfigk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohcmpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opepqban.dll"	Qckfid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaagdbfm.dll"	Opclldhj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iahgad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfhpakim.dll"	Lkchelci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmpcbhji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hemdlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahhjomjk.dll"	Omopjcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckidcpjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkalplel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phfjcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlllhigk.dll"	Lflbkcll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ieagmcmq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iehmmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhikci32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 4496	484	d01cce01279fb0b1f92783417e02b9120573f0fd35a4d5889b5759fe01549746.exe	92
PID 484 wrote to memory of 4496	484	d01cce01279fb0b1f92783417e02b9120573f0fd35a4d5889b5759fe01549746.exe	92
PID 484 wrote to memory of 4496	484	d01cce01279fb0b1f92783417e02b9120573f0fd35a4d5889b5759fe01549746.exe	92
PID 4496 wrote to memory of 4536	4496	Ckfphc32.exe	93
PID 4496 wrote to memory of 4536	4496	Ckfphc32.exe	93
PID 4496 wrote to memory of 4536	4496	Ckfphc32.exe	93
PID 4536 wrote to memory of 1172	4536	Ccpdoqgd.exe	94
PID 4536 wrote to memory of 1172	4536	Ccpdoqgd.exe	94
PID 4536 wrote to memory of 1172	4536	Ccpdoqgd.exe	94
PID 1172 wrote to memory of 464	1172	Ckkiccep.exe	95
PID 1172 wrote to memory of 464	1172	Ckkiccep.exe	95
PID 1172 wrote to memory of 464	1172	Ckkiccep.exe	95
PID 464 wrote to memory of 3392	464	Cmjemflb.exe	96
PID 464 wrote to memory of 3392	464	Cmjemflb.exe	96
PID 464 wrote to memory of 3392	464	Cmjemflb.exe	96
PID 3392 wrote to memory of 4176	3392	Cjnffjkl.exe	97
PID 3392 wrote to memory of 4176	3392	Cjnffjkl.exe	97
PID 3392 wrote to memory of 4176	3392	Cjnffjkl.exe	97
PID 4176 wrote to memory of 3572	4176	Dfefkkqp.exe	98
PID 4176 wrote to memory of 3572	4176	Dfefkkqp.exe	98
PID 4176 wrote to memory of 3572	4176	Dfefkkqp.exe	98
PID 3572 wrote to memory of 3752	3572	Djcoai32.exe	99
PID 3572 wrote to memory of 3752	3572	Djcoai32.exe	99
PID 3572 wrote to memory of 3752	3572	Djcoai32.exe	99
PID 3752 wrote to memory of 3620	3752	Dckdjomg.exe	100
PID 3752 wrote to memory of 3620	3752	Dckdjomg.exe	100
PID 3752 wrote to memory of 3620	3752	Dckdjomg.exe	100
PID 3620 wrote to memory of 4340	3620	Dpbdopck.exe	101
PID 3620 wrote to memory of 4340	3620	Dpbdopck.exe	101
PID 3620 wrote to memory of 4340	3620	Dpbdopck.exe	101
PID 4340 wrote to memory of 5096	4340	Dpdaepai.exe	102
PID 4340 wrote to memory of 5096	4340	Dpdaepai.exe	102
PID 4340 wrote to memory of 5096	4340	Dpdaepai.exe	102
PID 5096 wrote to memory of 3984	5096	Dmhand32.exe	103
PID 5096 wrote to memory of 3984	5096	Dmhand32.exe	103
PID 5096 wrote to memory of 3984	5096	Dmhand32.exe	103
PID 3984 wrote to memory of 2436	3984	Ebejfk32.exe	104
PID 3984 wrote to memory of 2436	3984	Ebejfk32.exe	104
PID 3984 wrote to memory of 2436	3984	Ebejfk32.exe	104
PID 2436 wrote to memory of 4644	2436	Ecefqnel.exe	105
PID 2436 wrote to memory of 4644	2436	Ecefqnel.exe	105
PID 2436 wrote to memory of 4644	2436	Ecefqnel.exe	105
PID 4644 wrote to memory of 1668	4644	Elpkep32.exe	106
PID 4644 wrote to memory of 1668	4644	Elpkep32.exe	106
PID 4644 wrote to memory of 1668	4644	Elpkep32.exe	106
PID 1668 wrote to memory of 3888	1668	Emphocjj.exe	107
PID 1668 wrote to memory of 3888	1668	Emphocjj.exe	107
PID 1668 wrote to memory of 3888	1668	Emphocjj.exe	107
PID 3888 wrote to memory of 1884	3888	Ejchhgid.exe	108
PID 3888 wrote to memory of 1884	3888	Ejchhgid.exe	108
PID 3888 wrote to memory of 1884	3888	Ejchhgid.exe	108
PID 1884 wrote to memory of 3652	1884	Efjimhnh.exe	109
PID 1884 wrote to memory of 3652	1884	Efjimhnh.exe	109
PID 1884 wrote to memory of 3652	1884	Efjimhnh.exe	109
PID 3652 wrote to memory of 1276	3652	Fbajbi32.exe	110
PID 3652 wrote to memory of 1276	3652	Fbajbi32.exe	110
PID 3652 wrote to memory of 1276	3652	Fbajbi32.exe	110
PID 1276 wrote to memory of 1796	1276	Fdqfll32.exe	111
PID 1276 wrote to memory of 1796	1276	Fdqfll32.exe	111
PID 1276 wrote to memory of 1796	1276	Fdqfll32.exe	111
PID 1796 wrote to memory of 1976	1796	Fimodc32.exe	112
PID 1796 wrote to memory of 1976	1796	Fimodc32.exe	112
PID 1796 wrote to memory of 1976	1796	Fimodc32.exe	112
PID 1976 wrote to memory of 4000	1976	Flngfn32.exe	113

C:\Users\Admin\AppData\Local\Temp\d01cce01279fb0b1f92783417e02b9120573f0fd35a4d5889b5759fe01549746.exe
"C:\Users\Admin\AppData\Local\Temp\d01cce01279fb0b1f92783417e02b9120573f0fd35a4d5889b5759fe01549746.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:484
- C:\Windows\SysWOW64\Ckfphc32.exe
  C:\Windows\system32\Ckfphc32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\SysWOW64\Ccpdoqgd.exe
    C:\Windows\system32\Ccpdoqgd.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Windows\SysWOW64\Ckkiccep.exe
      C:\Windows\system32\Ckkiccep.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1172
    - - C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:464
      - C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4176
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3572
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3620
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3984
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1668
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3888
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1884
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3652
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        23⤵
        Executes dropped EXE
        
        PID:4000
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4728
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1620
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        26⤵
        Executes dropped EXE
        
        PID:4572
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1640
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        28⤵
        Executes dropped EXE
        
        PID:948
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:208
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        30⤵
        Executes dropped EXE
        
        PID:732
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        31⤵
        Executes dropped EXE
        
        PID:3944
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        32⤵
        Executes dropped EXE
        
        PID:2572
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1280
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1336
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2140
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1852
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        37⤵
        Executes dropped EXE
        
        PID:2384
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3920
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        39⤵
        Executes dropped EXE
        
        PID:1004
        
        C:\Windows\SysWOW64\Ipjedh32.exe
        
        C:\Windows\system32\Ipjedh32.exe
        40⤵
        Executes dropped EXE
        
        PID:4172
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1468
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        42⤵
        Executes dropped EXE
        
        PID:808
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3260
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        44⤵
        Executes dropped EXE
        
        PID:4436
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        45⤵
        Executes dropped EXE
        
        PID:4064
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        46⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        47⤵
        Executes dropped EXE
        
        PID:2124
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4068
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        49⤵
        Executes dropped EXE
        
        PID:2068
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:888
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        51⤵
        Executes dropped EXE
        
        PID:316
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        52⤵
        Executes dropped EXE
        
        PID:1424
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3164
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3028
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        55⤵
        Executes dropped EXE
        
        PID:4492
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        56⤵
        Executes dropped EXE
        
        PID:1316
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        57⤵
        Executes dropped EXE
        
        PID:4708
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2096
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1568
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2820
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        61⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        62⤵
        Executes dropped EXE
        
        PID:4364
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1844
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        64⤵
        Executes dropped EXE
        
        PID:3612
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        65⤵
        Executes dropped EXE
        
        PID:644
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        66⤵
        
        PID:656
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        67⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        68⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1044
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        69⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3584
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2180
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        72⤵
        
        PID:936
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3280
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        74⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        75⤵
        Drops file in System32 directory
        
        PID:1252
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        76⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        77⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        78⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        79⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        80⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5260
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        82⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        83⤵
        Drops file in System32 directory
        
        PID:5348
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        84⤵
        Modifies registry class
        
        PID:5392
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        85⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        86⤵
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        87⤵
        Modifies registry class
        
        PID:5524
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        88⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        89⤵
        Drops file in System32 directory
        
        PID:5612
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        90⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        91⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        92⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        93⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        94⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        95⤵
        Modifies registry class
        
        PID:5876
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        96⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        97⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        98⤵
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        100⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        101⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        102⤵
        Modifies registry class
        
        PID:5160
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5244
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        104⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        105⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        106⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        107⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        108⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        109⤵
        Drops file in System32 directory
        
        PID:5688
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        110⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        111⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        112⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        113⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        114⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        115⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        116⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        117⤵
        Drops file in System32 directory
        
        PID:5292
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        118⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        119⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        120⤵
        Modifies registry class
        
        PID:5636
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5792
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        122⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        123⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        124⤵
        Drops file in System32 directory
        
        PID:6132
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        125⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        126⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        127⤵
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        128⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        129⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        130⤵
        Modifies registry class
        
        PID:2664
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        131⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        132⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        133⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6048
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        135⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        136⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        137⤵
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        138⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5948
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        140⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        141⤵
        Drops file in System32 directory
        
        PID:5196
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        142⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        143⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        144⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        145⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        146⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        147⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        148⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        149⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        150⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        151⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        152⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        153⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        154⤵
        Drops file in System32 directory
        
        PID:6660
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        155⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        156⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6792
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        158⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        159⤵
        Drops file in System32 directory
        
        PID:6888
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        160⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        161⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        162⤵
        Modifies registry class
        
        PID:7024
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        163⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        164⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7120
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        165⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        166⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        167⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        168⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6336
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        169⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        170⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        171⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        172⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        173⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        174⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        175⤵
        Drops file in System32 directory
        
        PID:6816
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        176⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        177⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        178⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        179⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        180⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        181⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        182⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6468
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        184⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        185⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        186⤵
        Modifies registry class
        
        PID:6784
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6872
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6988
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        189⤵
        Modifies registry class
        
        PID:7084
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        190⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        191⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        192⤵
        Modifies registry class
        
        PID:6552
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        193⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        194⤵
        Drops file in System32 directory
        
        PID:6840
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        195⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        196⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        197⤵
        Drops file in System32 directory
        
        PID:6880
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        198⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6936
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        200⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7112
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        201⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        202⤵
        Modifies registry class
        
        PID:6168
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6424
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        204⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        205⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        206⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        207⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        208⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7308
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        210⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        211⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        212⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        213⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        214⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7564
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        216⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        217⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        218⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        219⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7800
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7844
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        222⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        223⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        224⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        225⤵
        Drops file in System32 directory
        
        PID:8028
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        226⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        227⤵
        Modifies registry class
        
        PID:8124
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        228⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        229⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        230⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        231⤵
        Modifies registry class
        
        PID:7328
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        232⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        233⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        234⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        235⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7716
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        237⤵
        Drops file in System32 directory
        
        PID:7792
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        238⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        239⤵
        Drops file in System32 directory
        
        PID:7952
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        240⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        241⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5708
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        243⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        244⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        245⤵
        Drops file in System32 directory
        
        PID:7468
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        246⤵
        Drops file in System32 directory
        
        PID:7604
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        247⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        248⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        249⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        250⤵
        Modifies registry class
        
        PID:8040
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        251⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        252⤵
        Drops file in System32 directory
        
        PID:7236
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7424
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        254⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        255⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        256⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        257⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        258⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        259⤵
        Drops file in System32 directory
        
        PID:7644
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        260⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7704
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        261⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        262⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        263⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        264⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8232
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        266⤵
        Modifies registry class
        
        PID:8280
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        267⤵
        Modifies registry class
        
        PID:8324
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8376
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        269⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        270⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        271⤵
        Modifies registry class
        
        PID:8504
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        272⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        273⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        274⤵
        Drops file in System32 directory
        
        PID:8632
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        275⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        276⤵
        Drops file in System32 directory
        
        PID:8708
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        277⤵
        Drops file in System32 directory
        
        PID:8760
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        278⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        279⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        280⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8952
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        282⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        283⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        284⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        285⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9168
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        287⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        288⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        289⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        290⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        291⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        292⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        293⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8744
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        295⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        296⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        297⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        298⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9028
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        299⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        300⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        301⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        302⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        303⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        304⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8912
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8976
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        307⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        308⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        309⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8876
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        311⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        312⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        313⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        314⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        315⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2204
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2380
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        318⤵
        Modifies registry class
        
        PID:9252
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9304
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        320⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        321⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        322⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        323⤵
        Drops file in System32 directory
        
        PID:9476
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        324⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9516
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        325⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        326⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9664
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        328⤵
        Drops file in System32 directory
        
        PID:9704
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        329⤵
        Modifies registry class
        
        PID:9748
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        330⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        331⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        332⤵
        Drops file in System32 directory
        
        PID:9880
        
        C:\Windows\SysWOW64\Pmbegqjk.exe
        
        C:\Windows\system32\Pmbegqjk.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9928
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9968
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        335⤵
        Drops file in System32 directory
        
        PID:10024
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        336⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10120
        
        C:\Windows\SysWOW64\Aiplmq32.exe
        
        C:\Windows\system32\Aiplmq32.exe
        338⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Apjdikqd.exe
        
        C:\Windows\system32\Apjdikqd.exe
        339⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Ajohfcpj.exe
        
        C:\Windows\system32\Ajohfcpj.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9240
        
        C:\Windows\SysWOW64\Aplaoj32.exe
        
        C:\Windows\system32\Aplaoj32.exe
        341⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Apnndj32.exe
        
        C:\Windows\system32\Apnndj32.exe
        342⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        343⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Bmbnnn32.exe
        
        C:\Windows\system32\Bmbnnn32.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9524
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        345⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Bmdkcnie.exe
        
        C:\Windows\system32\Bmdkcnie.exe
        346⤵
        Drops file in System32 directory
        
        PID:9660
        
        C:\Windows\SysWOW64\Bdocph32.exe
        
        C:\Windows\system32\Bdocph32.exe
        347⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Bjhkmbho.exe
        
        C:\Windows\system32\Bjhkmbho.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9776
        
        C:\Windows\SysWOW64\Babcil32.exe
        
        C:\Windows\system32\Babcil32.exe
        349⤵
        Modifies registry class
        
        PID:9864
        
        C:\Windows\SysWOW64\Bbdpad32.exe
        
        C:\Windows\system32\Bbdpad32.exe
        350⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        351⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        352⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        353⤵
        Drops file in System32 directory
        
        PID:10188
        
        C:\Windows\SysWOW64\Bagmdllg.exe
        
        C:\Windows\system32\Bagmdllg.exe
        354⤵
        Drops file in System32 directory
        
        PID:3628
        
        C:\Windows\SysWOW64\Bgdemb32.exe
        
        C:\Windows\system32\Bgdemb32.exe
        355⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        356⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        357⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Calfpk32.exe
        
        C:\Windows\system32\Calfpk32.exe
        358⤵
        Modifies registry class
        
        PID:9632
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9692
        
        C:\Windows\SysWOW64\Cigkdmel.exe
        
        C:\Windows\system32\Cigkdmel.exe
        360⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Cgklmacf.exe
        
        C:\Windows\system32\Cgklmacf.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10020
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        362⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Cdolgfbp.exe
        
        C:\Windows\system32\Cdolgfbp.exe
        363⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Ckidcpjl.exe
        
        C:\Windows\system32\Ckidcpjl.exe
        364⤵
        Modifies registry class
        
        PID:9372
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        365⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Dkkaiphj.exe
        
        C:\Windows\system32\Dkkaiphj.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9756
        
        C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        367⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Dahfkimd.exe
        
        C:\Windows\system32\Dahfkimd.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9300
        
        C:\Windows\SysWOW64\Dkpjdo32.exe
        
        C:\Windows\system32\Dkpjdo32.exe
        369⤵
        
        PID:628
        
        C:\Windows\SysWOW64\Dalofi32.exe
        
        C:\Windows\system32\Dalofi32.exe
        370⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Eaaiahei.exe
        
        C:\Windows\system32\Eaaiahei.exe
        371⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Ejlnfjbd.exe
        
        C:\Windows\system32\Ejlnfjbd.exe
        372⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Ekljpm32.exe
        
        C:\Windows\system32\Ekljpm32.exe
        373⤵
        Modifies registry class
        
        PID:9220
        
        C:\Windows\SysWOW64\Edfknb32.exe
        
        C:\Windows\system32\Edfknb32.exe
        374⤵
        Modifies registry class
        
        PID:1172
        
        C:\Windows\SysWOW64\Ejccgi32.exe
        
        C:\Windows\system32\Ejccgi32.exe
        375⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\Fjeplijj.exe
        
        C:\Windows\system32\Fjeplijj.exe
        376⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Fncibg32.exe
        
        C:\Windows\system32\Fncibg32.exe
        377⤵
        Drops file in System32 directory
        
        PID:1052
        
        C:\Windows\SysWOW64\Fnffhgon.exe
        
        C:\Windows\system32\Fnffhgon.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2344
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        379⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        380⤵
        Modifies registry class
        
        PID:4636
        
        C:\Windows\SysWOW64\Gkoplk32.exe
        
        C:\Windows\system32\Gkoplk32.exe
        381⤵
        
        PID:724
        
        C:\Windows\SysWOW64\Gnmlhf32.exe
        
        C:\Windows\system32\Gnmlhf32.exe
        382⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Gbkdod32.exe
        
        C:\Windows\system32\Gbkdod32.exe
        383⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Gclafmej.exe
        
        C:\Windows\system32\Gclafmej.exe
        384⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Gdknpp32.exe
        
        C:\Windows\system32\Gdknpp32.exe
        385⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\Gdnjfojj.exe
        
        C:\Windows\system32\Gdnjfojj.exe
        386⤵
        
        PID:408
        
        C:\Windows\SysWOW64\Hjmodffo.exe
        
        C:\Windows\system32\Hjmodffo.exe
        387⤵
        Drops file in System32 directory
        
        PID:9508
        
        C:\Windows\SysWOW64\Hbdgec32.exe
        
        C:\Windows\system32\Hbdgec32.exe
        388⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\Hkmlnimb.exe
        
        C:\Windows\system32\Hkmlnimb.exe
        389⤵
        
        PID:212
        
        C:\Windows\SysWOW64\Hchqbkkm.exe
        
        C:\Windows\system32\Hchqbkkm.exe
        390⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\Hnmeodjc.exe
        
        C:\Windows\system32\Hnmeodjc.exe
        391⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5028
        
        C:\Windows\SysWOW64\Hcljmj32.exe
        
        C:\Windows\system32\Hcljmj32.exe
        392⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1448
        
        C:\Windows\SysWOW64\Hnbnjc32.exe
        
        C:\Windows\system32\Hnbnjc32.exe
        393⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\Iapjgo32.exe
        
        C:\Windows\system32\Iapjgo32.exe
        394⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\Iabglnco.exe
        
        C:\Windows\system32\Iabglnco.exe
        395⤵
        Drops file in System32 directory
        
        PID:948
        
        C:\Windows\SysWOW64\Ilhkigcd.exe
        
        C:\Windows\system32\Ilhkigcd.exe
        396⤵
        Modifies registry class
        
        PID:9528
        
        C:\Windows\SysWOW64\Ibbcfa32.exe
        
        C:\Windows\system32\Ibbcfa32.exe
        397⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\Ibdplaho.exe
        
        C:\Windows\system32\Ibdplaho.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3384
        
        C:\Windows\SysWOW64\Ijpepcfj.exe
        
        C:\Windows\system32\Ijpepcfj.exe
        399⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\Iloajfml.exe
        
        C:\Windows\system32\Iloajfml.exe
        400⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\Jnpjlajn.exe
        
        C:\Windows\system32\Jnpjlajn.exe
        401⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4228
        
        C:\Windows\SysWOW64\Jhhodg32.exe
        
        C:\Windows\system32\Jhhodg32.exe
        402⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Jjihfbno.exe
        
        C:\Windows\system32\Jjihfbno.exe
        403⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\Jeaiij32.exe
        
        C:\Windows\system32\Jeaiij32.exe
        404⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\Kahinkaf.exe
        
        C:\Windows\system32\Kahinkaf.exe
        405⤵
        Drops file in System32 directory
        
        PID:3888
        
        C:\Windows\SysWOW64\Klpjad32.exe
        
        C:\Windows\system32\Klpjad32.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3564
        
        C:\Windows\SysWOW64\Kopcbo32.exe
        
        C:\Windows\system32\Kopcbo32.exe
        407⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\Kaaldjil.exe
        
        C:\Windows\system32\Kaaldjil.exe
        408⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Logicn32.exe
        
        C:\Windows\system32\Logicn32.exe
        409⤵
        Drops file in System32 directory
        
        PID:3260
        
        C:\Windows\SysWOW64\Ledoegkm.exe
        
        C:\Windows\system32\Ledoegkm.exe
        410⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\Lefkkg32.exe
        
        C:\Windows\system32\Lefkkg32.exe
        411⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\Lcjldk32.exe
        
        C:\Windows\system32\Lcjldk32.exe
        412⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\Mekdffee.exe
        
        C:\Windows\system32\Mekdffee.exe
        413⤵
        
        PID:884
        
        C:\Windows\SysWOW64\Mociol32.exe
        
        C:\Windows\system32\Mociol32.exe
        414⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Mlgjhp32.exe
        
        C:\Windows\system32\Mlgjhp32.exe
        415⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Mhnjna32.exe
        
        C:\Windows\system32\Mhnjna32.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4856
        
        C:\Windows\SysWOW64\Mllccpfj.exe
        
        C:\Windows\system32\Mllccpfj.exe
        417⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\Mcfkpjng.exe
        
        C:\Windows\system32\Mcfkpjng.exe
        418⤵
        Drops file in System32 directory
        
        PID:2296
        
        C:\Windows\SysWOW64\Nhbciqln.exe
        
        C:\Windows\system32\Nhbciqln.exe
        419⤵
        
        PID:808
        
        C:\Windows\SysWOW64\Nomlek32.exe
        
        C:\Windows\system32\Nomlek32.exe
        420⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Ndidna32.exe
        
        C:\Windows\system32\Ndidna32.exe
        421⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\Nooikj32.exe
        
        C:\Windows\system32\Nooikj32.exe
        422⤵
        
        PID:456
        
        C:\Windows\SysWOW64\Nfiagd32.exe
        
        C:\Windows\system32\Nfiagd32.exe
        423⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\Noaeqjpe.exe
        
        C:\Windows\system32\Noaeqjpe.exe
        424⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\Nkhfek32.exe
        
        C:\Windows\system32\Nkhfek32.exe
        425⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Ndpjnq32.exe
        
        C:\Windows\system32\Ndpjnq32.exe
        426⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\Ncaklhdi.exe
        
        C:\Windows\system32\Ncaklhdi.exe
        427⤵
        Drops file in System32 directory
        
        PID:2576
        
        C:\Windows\SysWOW64\Obfhmd32.exe
        
        C:\Windows\system32\Obfhmd32.exe
        428⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Ookhfigk.exe
        
        C:\Windows\system32\Ookhfigk.exe
        429⤵
        Modifies registry class
        
        PID:2124
        
        C:\Windows\SysWOW64\Ohcmpn32.exe
        
        C:\Windows\system32\Ohcmpn32.exe
        430⤵
        Modifies registry class
        
        PID:4092
        
        C:\Windows\SysWOW64\Oomelheh.exe
        
        C:\Windows\system32\Oomelheh.exe
        431⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\Oheienli.exe
        
        C:\Windows\system32\Oheienli.exe
        432⤵
        
        PID:656
        
        C:\Windows\SysWOW64\Oooaah32.exe
        
        C:\Windows\system32\Oooaah32.exe
        433⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Oflfdbip.exe
        
        C:\Windows\system32\Oflfdbip.exe
        434⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Pbbgicnd.exe
        
        C:\Windows\system32\Pbbgicnd.exe
        435⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Pmhkflnj.exe
        
        C:\Windows\system32\Pmhkflnj.exe
        436⤵
        Modifies registry class
        
        PID:4468
        
        C:\Windows\SysWOW64\Pfppoa32.exe
        
        C:\Windows\system32\Pfppoa32.exe
        437⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Poidhg32.exe
        
        C:\Windows\system32\Poidhg32.exe
        438⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2192
        
        C:\Windows\SysWOW64\Pkabbgol.exe
        
        C:\Windows\system32\Pkabbgol.exe
        439⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Qifbll32.exe
        
        C:\Windows\system32\Qifbll32.exe
        440⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Qckfid32.exe
        
        C:\Windows\system32\Qckfid32.exe
        441⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4056
        
        C:\Windows\SysWOW64\Aflpkpjm.exe
        
        C:\Windows\system32\Aflpkpjm.exe
        442⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Akihcfid.exe
        
        C:\Windows\system32\Akihcfid.exe
        443⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Alkeifga.exe
        
        C:\Windows\system32\Alkeifga.exe
        444⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\Afqifo32.exe
        
        C:\Windows\system32\Afqifo32.exe
        445⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Aeffgkkp.exe
        
        C:\Windows\system32\Aeffgkkp.exe
        446⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\Acgfec32.exe
        
        C:\Windows\system32\Acgfec32.exe
        447⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Aehbmk32.exe
        
        C:\Windows\system32\Aehbmk32.exe
        448⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Bejobk32.exe
        
        C:\Windows\system32\Bejobk32.exe
        449⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Bmddihfj.exe
        
        C:\Windows\system32\Bmddihfj.exe
        450⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Bflham32.exe
        
        C:\Windows\system32\Bflham32.exe
        451⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Bcpika32.exe
        
        C:\Windows\system32\Bcpika32.exe
        452⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Beaecjab.exe
        
        C:\Windows\system32\Beaecjab.exe
        453⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Bmkjig32.exe
        
        C:\Windows\system32\Bmkjig32.exe
        454⤵
        Modifies registry class
        
        PID:380
        
        C:\Windows\SysWOW64\Cfcoblfb.exe
        
        C:\Windows\system32\Cfcoblfb.exe
        455⤵
        Modifies registry class
        
        PID:5836
        
        C:\Windows\SysWOW64\Cplckbmc.exe
        
        C:\Windows\system32\Cplckbmc.exe
        456⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Cekhihig.exe
        
        C:\Windows\system32\Cekhihig.exe
        457⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Cleqfb32.exe
        
        C:\Windows\system32\Cleqfb32.exe
        458⤵
        Modifies registry class
        
        PID:5656
        
        C:\Windows\SysWOW64\Cemeoh32.exe
        
        C:\Windows\system32\Cemeoh32.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5748
        
        C:\Windows\SysWOW64\Cbaehl32.exe
        
        C:\Windows\system32\Cbaehl32.exe
        460⤵
        Modifies registry class
        
        PID:1044
        
        C:\Windows\SysWOW64\Ddcogo32.exe
        
        C:\Windows\system32\Ddcogo32.exe
        461⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Dbhlikpf.exe
        
        C:\Windows\system32\Dbhlikpf.exe
        462⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        463⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5628 -s 400
        464⤵
        Program crash
        
        PID:5652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5628 -ip 5628
1⤵
PID:5356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3940 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:5820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Apaadpng.exe

Filesize
55KB

MD5
7ec7bc587ee0fb9716aab2c21f418d79

SHA1
944808e88205daa755f69f42b5c8b72f48c89d90

SHA256
65cf7dd4f1dfb629cbd741f517e9dc3923164ab896d37a9619d089a9808b0fd5

SHA512
7535d8ab94d54a382e565bf6cec5700bf83d49c547a0c0257654c79ec79f2a8d7c47e90e652e0c199b9878e69974782034167474d49e9ec8e88ce76cbbf7cd33

Download Submit
C:\Windows\SysWOW64\Bahkih32.exe

Filesize
55KB

MD5
decd508e5a5cfbcbb893e42d1befc9af

SHA1
a7f16d6013d9576bd768e4660bac425e10801cfb

SHA256
128fd8a087dc2d44e78ebacaa33dc9f1c9537cabc06fd3c8725853c147d94deb

SHA512
8867e53373627cf7b54f9586e47414a04812239e209f053149c83267b0f6a718ee7a814d716d1f474a8df37d66b6630a6add8b7b259a4f1f5537fc9230fafaf8

Download Submit
C:\Windows\SysWOW64\Ccpdoqgd.exe

Filesize
55KB

MD5
e10ac979b84fef3f9375c6654f44aecc

SHA1
768cfc6af07318f34532795fda34cc317e67640d

SHA256
09788db4c23a4e11903850de80cb2486459c3ce1706a6eb2c7f41b73cf64854f

SHA512
06f3f2c945ea167da95127c192070f874d2ece3c787458a4e4f2fe92c9bcddb35c1eeb57e4e0df92757ce8e00670bd35b86199cf4c89a2c893924a9191611d7e

Download Submit
C:\Windows\SysWOW64\Cjnffjkl.exe

Filesize
55KB

MD5
8f1544a6ed6882da0bbafa66c6d62b77

SHA1
ba040502a72ae247c86da6ded3cb1a385f61a318

SHA256
1adbd7176ab8e78e5085a76e6dd693f19b56ab46a6bdac17d82fabe567b20f30

SHA512
88cf5e8b9f50be55da3503e57cf42160d549eb68e0adafb6ce7cdbe91f823932d80ce7cefe932058c7a9b67898807e1a63a5f74ec6ab855a582120f2895b28c6

Download Submit
C:\Windows\SysWOW64\Ckfphc32.exe

Filesize
55KB

MD5
696df64adedb3b5ac82af790a1d160b5

SHA1
c461c6da0cd2f5f877289308a409935f53bf8447

SHA256
7f4992afcc59249435f8209d538de42a489f47df1e7699cfbabbcf85c2ad4050

SHA512
6a01c75e5bc74fcca3df5fbeb7a26e252dcf6b41323cafd145c0eb3398b7f77b7a9e11cd68e16a21b26bbe5ee30846d49320a5e4e1291b80fe1accd03977c4ac

Download Submit
C:\Windows\SysWOW64\Ckkiccep.exe

Filesize
55KB

MD5
2dc848022e93ecfd30f542d3054bf05b

SHA1
8279ce0070dadd5f3503b5f926413752119fbc0f

SHA256
be18e878be4284db2164c49e1d0a1b1c6008856171580231f0981c5ef6a86b59

SHA512
f33b310223137784afc13f92dfe9db3d5b7f74f516a9502462b12b799f6c60e9872f6a029fa02fb060949275dc433a07e23eb266d49ce72300376defe13c8a35

Download Submit
C:\Windows\SysWOW64\Cmjemflb.exe

Filesize
55KB

MD5
a4eb76937f06bb65b3c1b02eedc13940

SHA1
41e8687de49f9267782bb80ef6ea617cd3af60ec

SHA256
73b036583c28d5db295dcb0a396ae88b16778a9c000a15630679ab9b25e5d0f3

SHA512
cd5693e8f73695bd503875c83cfad5f747b240d978ed9abc5b2c56de954fd2854f973af959822be63ed8426b07a6f9c2d6ec7c3137c1bece653de35c7538a1d0

Download Submit
C:\Windows\SysWOW64\Dckdjomg.exe

Filesize
55KB

MD5
bb4b5f2c39c7c3f085b07fd25eb24293

SHA1
40de77681ac2fc20e21419e51e3fcf96d9ffe62a

SHA256
bdaf0ba3d12a5283772b065ca9394757998a683fcba07fc5b8c3270943be801f

SHA512
69e50a93e1bccba7b2b76ec877208fdd050467ea9ae85654daf1e555c035b2df9f5519f683d9e3c23705315d06e6234e3148fd692b25462c7c93ebe77eb5dff9

Download Submit
C:\Windows\SysWOW64\Dfefkkqp.exe

Filesize
55KB

MD5
6f4e6ca5a325bd2e1efd0b9cd36b8489

SHA1
d0b31d6d6082a920a73f754b0a887193e6a174c9

SHA256
2a09809890bf459e0f5ddc3d711a7387c471eaa0b5c6004c85dcd97c2237f8fa

SHA512
14688624f412934ece53425c746d7b11e1544d03230f31a788fbd92fad7a772837e76b1ff60eba3642af9879c89274ad432e2028c4a16a92100ae06bd98a8d71

Download Submit
C:\Windows\SysWOW64\Djcoai32.exe

Filesize
55KB

MD5
25d71b1bdf99c87bbb291690e903b682

SHA1
9141fcc37176f90e184f2856551f62c809c8c11d

SHA256
bc14eb5ec4c82bb97105d2f113694afff4f6e07464ebc25f75fdfb8ce0c1ff08

SHA512
6ff3cd3aa6ebc98bce0e7fc529738ff968445cbdaacd09c46adbd68f7cb4a5aa496422b0b281135a762be738c3295d0a2589202800f8c025e3e9524752934ac7

Download Submit
C:\Windows\SysWOW64\Dkceokii.exe

Filesize
55KB

MD5
5900901bdf631b5fda078565e189b2ff

SHA1
26f7010e14cb200a4e962c578fd6e74cc1f45d23

SHA256
787c106b94d0fd99713324db836b08e68f44d40b96abe44e38e0bce6bf2175b1

SHA512
f87550b644c98a78598b8cd694b3db585b55369937196003be0d8df8fdd7f78da99d0e5178f7642d8f41ae3f5cc4b5946190c51308e808a7f563df6f4b6c9bcd

Download Submit
C:\Windows\SysWOW64\Dmhand32.exe

Filesize
55KB

MD5
7fdf80e172cccfebae3cf52ab361f0d4

SHA1
14d0f3757332777836e15d00406e6a721010c80c

SHA256
1f6aa18e7b3d3eff1c55ad89b54a44784fc894d77dfc9364e1462743e6e176aa

SHA512
84278f3a28a83dee942d335825b1483f9bdf7242f47a5df2395331361ae763f1e58dd664df5686015c3649bc1d721f995eeb1e5d7aaf542ae40a6d287f0c5c7a

Download Submit
C:\Windows\SysWOW64\Dpbdopck.exe

Filesize
55KB

MD5
714af69c702cc39f3477d1c894d255b1

SHA1
0c4f8a4d7f44c7c9032fba42529dd2022fb47b61

SHA256
4b6bc32fdda7f852fb3e995945c21767dd18f13715c8784065d3a0ee0214206c

SHA512
32ef165a18f3968a0a63811d4ada0dcadaf052d24a9f3304c91aec22d7c1812049b56141a34544b1c8a66794fe54cc860bb444f1fcefe77ca07f39a957959dc0

Download Submit
C:\Windows\SysWOW64\Dpdaepai.exe

Filesize
55KB

MD5
cb26ce88ed6664da2b527f56b4bc896d

SHA1
912105f5684f540cc03d57e623f50ce6877c1ddd

SHA256
3c4ba1072438ef86f8a2a238e2a628b23ad66567ed4d68a7485328d91adc9ee8

SHA512
c57baa895b7a8263ceebbea03339bfd2df0014867ba076b8430306c48bc292f59e66cd2d606431e8721ed2ccf23ca2fbfb215d2a01d3bc1bd67fa25d2e08d966

Download Submit
C:\Windows\SysWOW64\Ebejfk32.exe

Filesize
55KB

MD5
b1b4c47ee575854812b1e333b600c98b

SHA1
3c00d68d6a3ec4c75032e680f51dd69e3d20f6b4

SHA256
ee3f4d3b2fe98927cd3f1fa24420087b346108e241ce0eaee2cf8c15ce17da27

SHA512
1ebf0b24efd857a3735de7df3f2e854e17f08a54aa7751f3910b7bd01402c51d45a7db10b18721152b9259ff91725d318ecd30d31f5228a27c97ef061e451fe5

Download Submit
C:\Windows\SysWOW64\Ecefqnel.exe

Filesize
55KB

MD5
3c94806bf5aca9bf488baaf64b884d59

SHA1
8706916bef5c8fc97a9dec7b5f49d3baf41c6cb4

SHA256
5aa766e0d817f75f41137e8362b44762e621faa6230d7f6d1c80c2c485ea4144

SHA512
717bdc8423296596bece686a7bba98a9ed7abe4514f141dd8523a9cb097024475eccdafdbed1b193deb2e40ca53d3424244632e1c2438d8c7801b94a0112e505

Download Submit
C:\Windows\SysWOW64\Eehicoel.exe

Filesize
55KB

MD5
812e6fa80449ed9836a4aa9191c81130

SHA1
f64f8cf36aa54d3ec7b915c1c32b3b50f0a4baee

SHA256
3447a8fa00ecf7ff7723e8fc03eca98f201b1b7a5558049bc912d2f39d5858e6

SHA512
71e220ea76327c1514af8a48ae73e9086ec67580d39e3ac4068c09930f745433a38fef2afefdef92e1f3a32ea1a289f36e3d82a0ec4648ec85224793843d36f6

Download Submit
C:\Windows\SysWOW64\Efjimhnh.exe

Filesize
55KB

MD5
e69bb5dc222b05a461045c770047a59c

SHA1
773f897430a89e790cd40b8838c6eb0a9a5790fe

SHA256
8d6f23b341b4b82d25253a7b2ddd801fd06920aa9b1d38ce642d3e039eed5a7f

SHA512
c8f5a2c4a0de8eeb11c28fca110cd7c20c83ae96644be631c9f89b360daca8f923ca41e23556450e18292f0d2644fc6d01aab792ac92ac97c5f9bf849d9f98e7

Download Submit
C:\Windows\SysWOW64\Ejchhgid.exe

Filesize
55KB

MD5
d410f32217fd756f079b9b86ff5954ce

SHA1
548cf649a4668b644162592c5315635099a80377

SHA256
55933d7976cbd1b56ad50d1c14e89c086f01cddc07451abe87568c686d60ecf5

SHA512
54f8b77bf397e5a338a556a367d10a02d1bace171158abcd62552e57b3daa3a8ebebd5746e61b50bcfac6a1a49a1bb921253729f4b370382a0c9d5a5d35c1831

Download Submit
C:\Windows\SysWOW64\Elpkep32.exe

Filesize
55KB

MD5
0545acce48bf7847e9b8a4983aecbae5

SHA1
3d55ea0b5df24890739b1c3b1e38e4bb24d56231

SHA256
e9d6b7b48da4ba17d4c36d126eadcd5747738dbc717416650e46d6c582b9b970

SHA512
0cd2707d8e68a0af52d5c27dc7235f60e563aac779f7b956f45117370ef0ba8232107b4e1e3af6e33b953d79687fe560a8adb31b750985a0800cc084f2dfba64

Download Submit
C:\Windows\SysWOW64\Emphocjj.exe

Filesize
55KB

MD5
dcb467728bd8f151d526f1717693c493

SHA1
acf1369eef5df12e65e883b10393c15b271faab2

SHA256
d9838799917ec166f7dd1d6e743a3ee53cf0b186eb00e8acf3e6ae57acc3488d

SHA512
91ab92f6e9273085d9d11bd5a386169260f5d2cd8efa0ed6ddf6d89de08299dea6df68c7d712258b13af9a7e87b2e6dd0585b0d8102f554bad29b9a75c802f31

Download Submit
C:\Windows\SysWOW64\Fbajbi32.exe

Filesize
55KB

MD5
51c8ab324e2995eefa6447c4da69803d

SHA1
eb3c18e46fc18e5541fd25bacb77ad945a740f50

SHA256
6317178feeb54c0fdbb5b7b11507caf95df7ca5652731db119f9a2d56ac2db0a

SHA512
853f6caa8a8df9ad92d79de6c7d5ade8ed2b4d22ae1c4dc7ac7f76f00f59091d491b039507e6b035188020079319871de098573b9d9592d54b4b4ef5f73837af

Download Submit
C:\Windows\SysWOW64\Fdqfll32.exe

Filesize
55KB

MD5
c5345d20649abf8a9ae07d82aa6b8da9

SHA1
39744b5fcc34e3c687b78111f3c98fb45b31d18d

SHA256
dc730a8829449243fd609298804e5940d463f7f4cf86f7fb9ee8e184c3daced6

SHA512
fa7998ddb4a6de54910fce5be87e08d823449436db7190924f72d302317ae3129174e59f10a2fa80befba12b2c7fe9ce49ce53deb468ab47d6c063afef6a0ab9

Download Submit
C:\Windows\SysWOW64\Ffclcgfn.exe

Filesize
55KB

MD5
92e3a948a462b61f41c8e10a7cd39b4f

SHA1
c823c389dfd0bbda4bc454897ac7942b371e066f

SHA256
ab66e8e4b89e7edc81b328ee08c5496130317d7adf53702daf0f5d5f571ee2e7

SHA512
5f10ec6f888463e249f3f0cc624e90279383d89aeefd489a257ad992503c02a8942a06b4d3563b66bb12ee3f2514afabeb79ba61ed52dad38a61e22185f53057

Download Submit
C:\Windows\SysWOW64\Fideeaco.exe

Filesize
55KB

MD5
b4663859f11ac308735a2eba3b9fc99f

SHA1
84255660fb40ecba5356789fb17af7ccbf304489

SHA256
c09dde9dda429295a5643c5c427728d33055bb83fd1e993caf05931467b05028

SHA512
557d049e14daecc3162ea3879c75438d4e031d02b6634b8c8088e830e29f17917a0a313b118a8105a65b12ed546dbfb9ff6971d7e99b97801070805cea5316cd

Download Submit
C:\Windows\SysWOW64\Fimodc32.exe

Filesize
55KB

MD5
a7f7dc7dc556967d08054e54b8fadadb

SHA1
684b709bed3bb55a792ff96458ab12732135a867

SHA256
c2efe1af5fe7322e4d0b5ee3ac6511c677a72e5b941c46ffc50e28f88f22d7ff

SHA512
67d88c9e5386e65b5e8d78c48f23b71b3d3fce876f891ace7e923c509330b5a20c15bfd54b4d824f0b666acfee7ddd46654ec68e2d337d9c2647a3edc3cc6a3a

Download Submit
C:\Windows\SysWOW64\Flngfn32.exe

Filesize
55KB

MD5
3683f3369bb55337cd4390f99ae38592

SHA1
3b28d8a76878d2ed0218d999f0bcaae2e2c58dc2

SHA256
d993c5ebc16aa10ddd24cd08783392d7170a5522d2d5024877c03f187cb1047c

SHA512
4de0a106adf1bd6c69a563ce87c41623aea471a27fa682d9c529bce7619631ebbac0dd435401f03dde815d99c78726bc91519622ae77d80eedebc6752992180b

Download Submit
C:\Windows\SysWOW64\Fplpll32.exe

Filesize
55KB

MD5
345a8ed4d6bae2e689f1a5479dd38ce6

SHA1
92f8a5944dbd5974149f91fdba90148e51b955a3

SHA256
4104de3e9ab811832e57c91d234bcf4441e3842f15bd6ea4e527bd3749c46394

SHA512
e266a961720e60cd4bfb60ff406277e8a9f94c35a1c72632f78ff29cd56a1cf146209b1c88ba127d18e0b2c585dc2365af9e1521feeceab535b3fc876e4c6a06

Download Submit
C:\Windows\SysWOW64\Gbabigfj.exe

Filesize
55KB

MD5
8697a01cefd151c2f389e3bcc78dbef4

SHA1
2e53994cbe341326b05c9b66dd24df65e6d0f774

SHA256
05a63f6846e7892024fbf176f986a433182ae6f8f40c44d17258cf66f3433392

SHA512
737bbba7e94fa257e4ad7e1a7e43db2cba90a399bdb56a06fdeb4fed4d1e1a27e8ec59acb5bb6d7c28f7b00496896b02af9e5f2f1dbc26b85b3d3594ab006628

Download Submit
C:\Windows\SysWOW64\Gbdoof32.exe

Filesize
55KB

MD5
62eda3a5d320c266092b389e0b0bfa52

SHA1
523cf647e3d867a6969c0d373161d0bb18e04282

SHA256
eab9808f660e04c4072a4f6c34ae43106e0d0f403bed284a7960ae079ec8e60e

SHA512
9555b97adf2706f1969fa4422552bfd4d81d8f6dcc65cc5eecb5ab2ecad139f3d113d99da1b9eb298ff918ea91df05108fa6e8c96845e22d1c7a2fdbe9256012

Download Submit
C:\Windows\SysWOW64\Gbfldf32.exe

Filesize
55KB

MD5
06d89a4394f7da4fe92d6a924db23e08

SHA1
34ad28597785e45fe4ff7a51e4630fada1411598

SHA256
742543ef7a4683c8a41f2f6128582a1eac10e8e596127612f515229fa9a9b5f5

SHA512
5e9a1322af3dcfc1c26df4000a57b657ea43df24d1d9625bb053d9ef39f1c751673facd61c0b90630c8762027784b889deccc2cee41c81a81aaffe4a6b0133d2

Download Submit
C:\Windows\SysWOW64\Gingkqkd.exe

Filesize
55KB

MD5
6e553422395f63aedefec75e7b52866e

SHA1
d968f90d91d3406ef949c29788c1b9f7570f0fa9

SHA256
25c1c27b307b4bd55761ec6a02d8625d5ca64f7a19fe9f422c6c89a4a3d530b4

SHA512
7dd2c3d47220a86c4f7e083b987dbd742ae639dcebff335653738023c3045b40de108b337f4eb6f2738c9dd6e7d15440b94791b7b6cfedfc879a617b9ea1b1a4

Download Submit
C:\Windows\SysWOW64\Gjfnedho.exe

Filesize
55KB

MD5
d75f43fe6aa5a65172c9b2cfa68d9c71

SHA1
90cf9047aa687cc6ba723a95bc39339f60a66422

SHA256
39deaebe9f434be035c7af893988e1fb3b43b668734171483dee83062841e30e

SHA512
d0eda5a656e2ac5ea795a8ff350845551cdb744ca288e49331ce4c15243e7d40e99ab11f162f013c658140eb6b89079ea412962c4842c3f95f94cbbbd6787440

Download Submit
C:\Windows\SysWOW64\Gpqjglii.exe

Filesize
55KB

MD5
273563d1b25b8f279c79fc62c78d1b43

SHA1
3f9b6c18d693eb6d0fbe68b73dd04ddbbec41b9b

SHA256
bb2f3ffe4d11fa3cba601a34f3cfab0c8b90e4fc3147602e70fce5269dfe9c7b

SHA512
fdad0cdce6752a9c3edb9fb1d09ccfe0b8006260ba77df78e93a9b4d6697071fb0bf61f75c3d933fa125750faf3862930c62f2563f1f13d7ff8c58d6761d710f

Download Submit
C:\Windows\SysWOW64\Hemdlj32.exe

Filesize
55KB

MD5
de9e5fce400d263b55c897cffd0812d0

SHA1
6b831006cf9fbc92aa2910091fd7f58047ad2b3f

SHA256
23bc6828f1d46a75736fece5925e9f10ea46a56ba1cca859b2e7a8b9527fa400

SHA512
46e9529eee9d75eb7676ae9aec4081323235a08ca667e778f9d4bfe2a5e346546ede80004cdf0126f510cb426a61e114e05671f372686d5603f81ac74dcdea53

Download Submit
C:\Windows\SysWOW64\Hgfapd32.exe

Filesize
55KB

MD5
5a476e525867329d968f344bc0e1e4d5

SHA1
f19d785ce6850416662b8d76d9151f2f93bd2f79

SHA256
1e633e1ac45d7b0683f81d76b37fceda83a7b0b16170f08d4c9948d22425dbc6

SHA512
78ae16f12d08980f5cb1195f29f609fb026f15c137830a0241481c80a839b6afa574d8635270f42f642cb3376342d4a678792fb51004555c83f05997daf63eb6

Download Submit
C:\Windows\SysWOW64\Hibafp32.exe

Filesize
55KB

MD5
e8d99a347c8b343ba1d0d85041db1015

SHA1
076aab139a49a59baf9075baf4c45801707a0fe3

SHA256
e91c5103adc0e2e4b1ad9ab5500e11eb6627d2ee4f596c2da4ac2e4c861ae237

SHA512
4dfd96a1661c54635cd9a1713ec6b1e07f8d2c25a40157082025d857ded3174fcb428bb5247d4b5fc98cae140f36b508e1246ca95db064049a1472577c8d8339

Download Submit
C:\Windows\SysWOW64\Iahgad32.exe

Filesize
55KB

MD5
ab57363d137829682e5c695ffb66cd71

SHA1
f596db01b34c55a9fcb13132f205b1d4e9a0acae

SHA256
c1974d1d579a9ce211f2fa96e51c0c5af26e89c890599b1283bc1d826323bb8a

SHA512
c62db8f41ab25b8e57c1380a8e27b125960ccd11e3956d872a990fff5c562d36650bce2aa3b83ee47447ca3e8636cc25b5322ab7f1c80f0fed10635554fe6a04

Download Submit
C:\Windows\SysWOW64\Ickglm32.exe

Filesize
55KB

MD5
ed42c5d7f1324e309633b9b44f776b3b

SHA1
e944e26e87dd5d09374cd5332524c8109e710d83

SHA256
becba6a956e7f38f289b8e0bd0fb206a2c43c900304db48535384d0807ab2437

SHA512
9f7925e87dc6bcd94cba5306cd907cefc519cc8aaa6b882afa54655686c834a7a4390afca444ea1bddb0499151f37a66f335db4d83fac042e9d539a2d2568c15

Download Submit
C:\Windows\SysWOW64\Iebngial.exe

Filesize
55KB

MD5
cc7f6c8ce952fa8d3364256dbc0b398e

SHA1
66202080e644a4747af363c1673c2ac519b80494

SHA256
fab8465c80753c071c60808958d3b7137737a2e524a223045ada5fa4dc0b0cc6

SHA512
f59b1758ebee2587aaf34849984355ca1701db384815f80f1a12c593e879f9687c90d2d90f908710f13f3d9d78157811239be36ca5333c4fed7ad0d9a66a1d25

Download Submit
C:\Windows\SysWOW64\Iefphb32.exe

Filesize
55KB

MD5
cd5f8ad7ed1ba064652b4ccca9c4f090

SHA1
78f35115768b67f76cc8093f997ee873d3e8c2a1

SHA256
7e91ae8ebcbfb33daea12b99b40e04e8476b3f80c8768e8e7a724569b03b9ec0

SHA512
e868d8cba842157a4d0f1be784abb7758da240f6ab7df77bd67398c2b3403bcf271b82c33d75636cd8da755cb31531f53a65fd85138ee38175f3bbc50fbd8818

Download Submit
C:\Windows\SysWOW64\Jcbdgb32.exe

Filesize
55KB

MD5
85c06c815ef5d7d6b2f61a7dccc695a3

SHA1
bcfe4bb1b52ded6c617a2d740bb197c9a4d0a542

SHA256
523b10b0d62d41c1a7b6c36dcf460d825a4549c9db7ff46cc437d7d41fb18822

SHA512
c08b08d2905833c082c508a7a2b56b6618d989455c369a95fb508ca2150c280fe5c0fdfc40ee9a3a4d4d46de7b455f4f56c8986ed3209cf3accdf56c0950688a

Download Submit
C:\Windows\SysWOW64\Jifecp32.exe

Filesize
55KB

MD5
2938ea11104c971d0ce399905700a4c0

SHA1
3a29bd7efc1f5f70622b5e793bcc68d9bf9d12e8

SHA256
dbb7429437feb7319c6c547cc8f651c221b59381502439e6703ae385bb58f08a

SHA512
a1790d316c735575c9e90e2a4ed752b99e14a1db2638b7b28fe140be2e321e7a4791984afb4f146ae22c5d07755e0d5719b3e829b29eb4b1992ffc6508e17b30

Download Submit
C:\Windows\SysWOW64\Knooej32.exe

Filesize
55KB

MD5
a6ab2737bd3b4d595a6598310351b9b4

SHA1
155f58ff27a3beba26c81faf3417ad9494fbc776

SHA256
dadc5f5ad6cf286adc35d4f5c324b0142e11fb7a85b70d30bf9666c1e987b055

SHA512
809d18cb8d26b4f05c1ef279f164622c9c5b06b1f07fea91b843b438a38139c55861c2298f2067fd2451175cb5c4d2db5593d066473c742d70489965d426fa87

Download Submit
C:\Windows\SysWOW64\Ljhefhha.exe

Filesize
55KB

MD5
fe473de86c095f0eee5e2284910704c5

SHA1
1596444d9a10339a9d6f6bb3c13540ee73fb360f

SHA256
77fb1ef69e043dcf61cd343466f9c94296248de6196b1793c5b6be6100f9c84d

SHA512
6ae08022429496da107ed77d283720de884aaa1d88e1685c00927aa4eb30886b57ebca16c72030de6542069ebe21bb5d3f4b6f97dfb116520c0ba1b9e160ff9a

Download Submit
C:\Windows\SysWOW64\Lkalplel.exe

Filesize
55KB

MD5
ee534312210fdae34b70c1814274519a

SHA1
ba9f527c66c7d3e8ed4cb7cb467f16ef0d7e5bde

SHA256
0cadbe2f21bf2dc376e0763e6064444be569c88d960496a469bfb402d7ffca79

SHA512
585925ed8e7449b5cab12c16ef8597c3282088fa4e002e941d374ea718283609cc9a9be8ef6381e4a2da78d0f6c66dda533fb14f4839f4ae14b1bedef40099b3

Download Submit
C:\Windows\SysWOW64\Ojdgnn32.exe

Filesize
55KB

MD5
537dddc242d809c3d6c488a92eced369

SHA1
7e1593586f9e1d2a418579cec67fa7921fdc697d

SHA256
d6d479317499528e6d92d6b2d775fd27f46e9fffda46bbd3216c71d2497f75e0

SHA512
4d11e9d6e874590dfde3e4cc92b51af23b15448a3efa1f56bce40f14d004fa5d9623ef67fad0c37dc324821791f7660da135f0acfd4a134cc178e6e96c5dd4a7

Download Submit
C:\Windows\SysWOW64\Ojfcdnjc.exe

Filesize
55KB

MD5
c5cf1eb554c59708d7917074217a2552

SHA1
b0c69e8a1e3ccdabee3f2e20ad8619789c892fb7

SHA256
7838a553614e0259e990bf4f52cc05f8b910fbe587632b702ffda5eca4689a7d

SHA512
cb573461f2ee271b30c06ab8590d8de2a53e2e935c1a2854d12f1c5786c86af1eee56c5397a3e1cc3c1a4be7313b0803fa3d99626ecb85b46fa2162911c004ae

Download Submit
C:\Windows\SysWOW64\Onpjichj.exe

Filesize
55KB

MD5
5757f7ae7a1c513fd80f991f54bf882f

SHA1
a0f7154712dad9aa0814f6e6809741aa21930f25

SHA256
ccda3ec58e5cc392f424d2831d2ecae41ac1d0a3c168d24aa3938f5cdeb1afa6

SHA512
8f991e9c853232079cde1c1d485892f65e7f338c8ee13cd600322b8e97691be21b8e0e69ac7ed6ac69c2f758fd3b22394642506e1e13cb87c0c4dc52c0b3af56

Download Submit
memory/208-230-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/316-366-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/464-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/484-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/484-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/484-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/732-234-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/808-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/888-360-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/948-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1004-294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1172-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1276-154-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1280-258-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1316-396-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1336-264-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1424-372-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1468-306-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1568-414-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1620-194-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1640-210-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1668-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1796-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1852-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1884-137-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1976-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2068-354-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2096-408-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2124-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2140-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2384-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2436-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2572-250-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2820-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3028-384-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3164-378-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3260-318-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3392-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3572-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3620-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3652-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3752-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3888-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3920-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3944-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3984-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4000-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4064-330-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4068-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4172-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4176-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4340-82-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4344-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4364-432-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4436-324-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4492-390-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4496-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4536-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4572-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4644-114-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4708-402-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4728-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4776-426-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5096-90-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads