f91e1f0c6f3fdd5d1269c863d928ec729c5181cd38d5fe009330aea386b86809

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f91e1f0c6f3fdd5d1269c863d928ec729c5181cd38d5fe009330aea386b86809.exe
Size

128KB
MD5

651712e7ab55ca060f48c19badfb41b3
SHA1

4ad3409346aff29e4db492d6da6949ae5245b1b1
SHA256

f91e1f0c6f3fdd5d1269c863d928ec729c5181cd38d5fe009330aea386b86809
SHA512

945860d1ce76d66115b1368dd5939d308695e56675c34c03d4706f29cf718be63817583a514cd5030a2a1333704ee7ea5eadbfb18312644c1e3e77309da8ce06
SSDEEP

3072:gqpbaRUjf10W029S5DSCopsIm81+jq2832dp5Xp+7+10l:Xb6Uj10i9SZSCZj81+jq4peBl

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgflcifg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcnfohmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omnjojpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnfiplog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hejqldci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfaajnfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqhdbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhfpbpdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfkkqmiq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpnfge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Palklf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfkqjmdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gppcmeem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Joahqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnlkedai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnjgfb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcelpggq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nncccnol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ihpcinld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjeiodek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imnocf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onapdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onapdl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hajkqfoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkphhgfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eqiibjlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jekjcaef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gblbca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpmhdmea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iefphb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kekbjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nckkfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgflcifg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fndpmndl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oiccje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Geldkfpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imiehfao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofhknodl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oclkgccf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfandnla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edeeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpkknmgd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hehdfdek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipeeobbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mqfpckhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcdeeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmjfodne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aagkhd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dahmfpap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fohfbpgi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hecjke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlblcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gflhoo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilphdlqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpegkj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adkqoohc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fooclapd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpgdai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imnocf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmeede32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpjgaoqm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfeljd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogekbb32.exe

Executes dropped EXE 64 IoCs

pid	Process
1448	Fiodpl32.exe
4112	Fpimlfke.exe
5116	Ffceip32.exe
2028	Fiaael32.exe
4876	Flpmagqi.exe
3384	Fnnjmbpm.exe
2520	Gfeaopqo.exe
384	Gmojkj32.exe
3028	Gpnfge32.exe
1720	Gblbca32.exe
2884	Gejopl32.exe
1052	Gmafajfi.exe
3676	Gppcmeem.exe
3692	Gfjkjo32.exe
4204	Gihgfk32.exe
116	Glgcbf32.exe
4828	Gnepna32.exe
3652	Gflhoo32.exe
1980	Gmfplibd.exe
2132	Goglcahb.exe
3960	Gfodeohd.exe
4880	Gimqajgh.exe
2392	Gpgind32.exe
3756	Hfaajnfb.exe
540	Hipmfjee.exe
1832	Hbhboolf.exe
2668	Hibjli32.exe
5024	Hbjoeojc.exe
3884	Hehkajig.exe
4700	Hmpcbhji.exe
3792	Hoaojp32.exe
2760	Hfhgkmpj.exe
1932	Hifcgion.exe
5112	Hlepcdoa.exe
4144	Hoclopne.exe
3004	Hfjdqmng.exe
2800	Hmdlmg32.exe
4452	Hpchib32.exe
2300	Ibaeen32.exe
3736	Iepaaico.exe
3428	Imgicgca.exe
4840	Ipeeobbe.exe
3532	Iohejo32.exe
5028	Ifomll32.exe
4428	Iinjhh32.exe
1088	Imiehfao.exe
1316	Ibfnqmpf.exe
3360	Iipfmggc.exe
3524	Ilnbicff.exe
4652	Ibhkfm32.exe
1472	Iefgbh32.exe
4604	Imnocf32.exe
4548	Iplkpa32.exe
2952	Ieidhh32.exe
4668	Impliekg.exe
388	Joahqn32.exe
3340	Jcmdaljn.exe
3892	Jpaekqhh.exe
4312	Jenmcggo.exe
4680	Jmeede32.exe
2596	Jofalmmp.exe
3904	Jepjhg32.exe
3488	Jpenfp32.exe
1776	Jgpfbjlo.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gejopl32.exe	Gblbca32.exe
File created	C:\Windows\SysWOW64\Hhfpbpdo.exe	Hehdfdek.exe
File opened for modification	C:\Windows\SysWOW64\Hlblcn32.exe	Hhfpbpdo.exe
File created	C:\Windows\SysWOW64\Khlaie32.dll	Mofmobmo.exe
File created	C:\Windows\SysWOW64\Gihgfk32.exe	Gfjkjo32.exe
File created	C:\Windows\SysWOW64\Giidol32.dll	Ppjbmc32.exe
File opened for modification	C:\Windows\SysWOW64\Iajdgcab.exe	Ipihpkkd.exe
File created	C:\Windows\SysWOW64\Llnnmhfe.exe	Ljpaqmgb.exe
File opened for modification	C:\Windows\SysWOW64\Onapdl32.exe	Oclkgccf.exe
File opened for modification	C:\Windows\SysWOW64\Dpiplm32.exe	Cogddd32.exe
File created	C:\Windows\SysWOW64\Mjaonjaj.dll	Ebkbbmqj.exe
File created	C:\Windows\SysWOW64\Kabcopmg.exe	Kocgbend.exe
File created	C:\Windows\SysWOW64\Bdfpkm32.exe	Bpkdjofm.exe
File created	C:\Windows\SysWOW64\Olaafabl.dll	Cammjakm.exe
File created	C:\Windows\SysWOW64\Ipgkjlmg.exe	Ihpcinld.exe
File created	C:\Windows\SysWOW64\Fnebjidl.dll	Lohqnd32.exe
File created	C:\Windows\SysWOW64\Gmfplibd.exe	Gflhoo32.exe
File opened for modification	C:\Windows\SysWOW64\Mgbefe32.exe	Mokmdh32.exe
File created	C:\Windows\SysWOW64\Pnkbkk32.exe	Pdenmbkk.exe
File created	C:\Windows\SysWOW64\Bklomh32.exe	Bhmbqm32.exe
File created	C:\Windows\SysWOW64\Emlmcm32.dll	Lojmcdgl.exe
File created	C:\Windows\SysWOW64\Jenmcggo.exe	Jpaekqhh.exe
File created	C:\Windows\SysWOW64\Oonnoglh.dll	Llodgnja.exe
File created	C:\Windows\SysWOW64\Jocnlg32.exe	Jldbpl32.exe
File created	C:\Windows\SysWOW64\Kidben32.exe	Kamjda32.exe
File created	C:\Windows\SysWOW64\Olieecnn.dll	Jgpfbjlo.exe
File opened for modification	C:\Windows\SysWOW64\Llodgnja.exe	Lfeljd32.exe
File created	C:\Windows\SysWOW64\Dkpqlc32.dll	Fbplml32.exe
File created	C:\Windows\SysWOW64\Khiofk32.exe	Kekbjo32.exe
File opened for modification	C:\Windows\SysWOW64\Lqmmmmph.exe	Ljceqb32.exe
File opened for modification	C:\Windows\SysWOW64\Iacngdgj.exe	Inebjihf.exe
File created	C:\Windows\SysWOW64\Omalpc32.exe	Ojcpdg32.exe
File opened for modification	C:\Windows\SysWOW64\Hhdcmp32.exe	Heegad32.exe
File created	C:\Windows\SysWOW64\Kiphjo32.exe	Jahqiaeb.exe
File created	C:\Windows\SysWOW64\Hejeak32.dll	Pbekii32.exe
File opened for modification	C:\Windows\SysWOW64\Jpaekqhh.exe	Jcmdaljn.exe
File created	C:\Windows\SysWOW64\Lcnfohmi.exe	Lobjni32.exe
File opened for modification	C:\Windows\SysWOW64\Bpfkpp32.exe	Bacjdbch.exe
File opened for modification	C:\Windows\SysWOW64\Dhbebj32.exe	Ddgibkpc.exe
File created	C:\Windows\SysWOW64\Cjehdpem.dll	Hlblcn32.exe
File created	C:\Windows\SysWOW64\Hdbplg32.dll	Gfeaopqo.exe
File opened for modification	C:\Windows\SysWOW64\Gpnfge32.exe	Gmojkj32.exe
File created	C:\Windows\SysWOW64\Dakikoom.exe	Dolmodpi.exe
File created	C:\Windows\SysWOW64\Jjpdeo32.dll	Gkaclqkk.exe
File created	C:\Windows\SysWOW64\Mgccelpk.dll	Mhanngbl.exe
File created	C:\Windows\SysWOW64\Dgmchiim.dll	Gblbca32.exe
File created	C:\Windows\SysWOW64\Bhmbqm32.exe	Bpfkpp32.exe
File created	C:\Windows\SysWOW64\Iajdgcab.exe	Ipihpkkd.exe
File created	C:\Windows\SysWOW64\Lomjicei.exe	Lpjjmg32.exe
File opened for modification	C:\Windows\SysWOW64\Inebjihf.exe	Ihkjno32.exe
File created	C:\Windows\SysWOW64\Mfnhfm32.exe	Mcoljagj.exe
File created	C:\Windows\SysWOW64\Mfpell32.exe	Mcaipa32.exe
File created	C:\Windows\SysWOW64\Jpaekqhh.exe	Jcmdaljn.exe
File created	C:\Windows\SysWOW64\Abhemohm.dll	Kgflcifg.exe
File created	C:\Windows\SysWOW64\Gdmpga32.dll	Oaplqh32.exe
File created	C:\Windows\SysWOW64\Bddcenpi.exe	Baegibae.exe
File opened for modification	C:\Windows\SysWOW64\Nfnamjhk.exe	Ncpeaoih.exe
File opened for modification	C:\Windows\SysWOW64\Oophlo32.exe	Omalpc32.exe
File created	C:\Windows\SysWOW64\Pplhhm32.exe	Paihlpfi.exe
File opened for modification	C:\Windows\SysWOW64\Nncccnol.exe	Ngjkfd32.exe
File opened for modification	C:\Windows\SysWOW64\Apmhiq32.exe	Amnlme32.exe
File created	C:\Windows\SysWOW64\Dkbnla32.dll	Bdfpkm32.exe
File created	C:\Windows\SysWOW64\Kihgqfld.dll	Gihpkd32.exe
File created	C:\Windows\SysWOW64\Egohdegl.exe	Edplhjhi.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11548	12272	WerFault.exe	569

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mfchlbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmfplibd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekamnhne.dll"	Kcbfcigf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbagbebm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mfenglqf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nckkfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Komhll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fihgkk32.dll"	Ljeafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibegfglj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nfldgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cggkemhh.dll"	Qmeigg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkfcqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekajec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kocgbend.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omopjcjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kcmmhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqnbqh32.dll"	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Figmglee.dll"	Ofhknodl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ppgegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkaclqkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aglmllpq.dll"	Ipgkjlmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dognaofl.dll"	Kamjda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khlaie32.dll"	Mofmobmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpoalo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgbefe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oblhcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lepleocn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nijqcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaaklfpn.dll"	Pfhmjf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibaeen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fniihmpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpbhgp32.dll"	Edgbii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbplml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbnaeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lindkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emlmcm32.dll"	Lojmcdgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlhqcgnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgfpihkg.dll"	Ocohmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkbnla32.dll"	Bdfpkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljpaqmgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfhgkmpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Knnhjcog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hehdfdek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgmbbe32.dll"	Jidinqpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mfkkqmiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pimfpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfgllk32.dll"	Ibaeen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnhdgpii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eohmkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgeaiknl.dll"	Kpanan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oplfkeob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmjkic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdbpgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hnnljj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kapfiqoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kabcopmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhoped32.dll"	Padnaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmpcbhji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfbped32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deaiemli.dll"	Pidlqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kamjda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ppgomnai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npbceggm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpiqfima.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	7700	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1448	2256	f91e1f0c6f3fdd5d1269c863d928ec729c5181cd38d5fe009330aea386b86809.exe	86
PID 2256 wrote to memory of 1448	2256	f91e1f0c6f3fdd5d1269c863d928ec729c5181cd38d5fe009330aea386b86809.exe	86
PID 2256 wrote to memory of 1448	2256	f91e1f0c6f3fdd5d1269c863d928ec729c5181cd38d5fe009330aea386b86809.exe	86
PID 1448 wrote to memory of 4112	1448	Fiodpl32.exe	87
PID 1448 wrote to memory of 4112	1448	Fiodpl32.exe	87
PID 1448 wrote to memory of 4112	1448	Fiodpl32.exe	87
PID 4112 wrote to memory of 5116	4112	Fpimlfke.exe	88
PID 4112 wrote to memory of 5116	4112	Fpimlfke.exe	88
PID 4112 wrote to memory of 5116	4112	Fpimlfke.exe	88
PID 5116 wrote to memory of 2028	5116	Ffceip32.exe	89
PID 5116 wrote to memory of 2028	5116	Ffceip32.exe	89
PID 5116 wrote to memory of 2028	5116	Ffceip32.exe	89
PID 2028 wrote to memory of 4876	2028	Fiaael32.exe	90
PID 2028 wrote to memory of 4876	2028	Fiaael32.exe	90
PID 2028 wrote to memory of 4876	2028	Fiaael32.exe	90
PID 4876 wrote to memory of 3384	4876	Flpmagqi.exe	91
PID 4876 wrote to memory of 3384	4876	Flpmagqi.exe	91
PID 4876 wrote to memory of 3384	4876	Flpmagqi.exe	91
PID 3384 wrote to memory of 2520	3384	Fnnjmbpm.exe	92
PID 3384 wrote to memory of 2520	3384	Fnnjmbpm.exe	92
PID 3384 wrote to memory of 2520	3384	Fnnjmbpm.exe	92
PID 2520 wrote to memory of 384	2520	Gfeaopqo.exe	93
PID 2520 wrote to memory of 384	2520	Gfeaopqo.exe	93
PID 2520 wrote to memory of 384	2520	Gfeaopqo.exe	93
PID 384 wrote to memory of 3028	384	Gmojkj32.exe	94
PID 384 wrote to memory of 3028	384	Gmojkj32.exe	94
PID 384 wrote to memory of 3028	384	Gmojkj32.exe	94
PID 3028 wrote to memory of 1720	3028	Gpnfge32.exe	95
PID 3028 wrote to memory of 1720	3028	Gpnfge32.exe	95
PID 3028 wrote to memory of 1720	3028	Gpnfge32.exe	95
PID 1720 wrote to memory of 2884	1720	Gblbca32.exe	96
PID 1720 wrote to memory of 2884	1720	Gblbca32.exe	96
PID 1720 wrote to memory of 2884	1720	Gblbca32.exe	96
PID 2884 wrote to memory of 1052	2884	Gejopl32.exe	97
PID 2884 wrote to memory of 1052	2884	Gejopl32.exe	97
PID 2884 wrote to memory of 1052	2884	Gejopl32.exe	97
PID 1052 wrote to memory of 3676	1052	Gmafajfi.exe	98
PID 1052 wrote to memory of 3676	1052	Gmafajfi.exe	98
PID 1052 wrote to memory of 3676	1052	Gmafajfi.exe	98
PID 3676 wrote to memory of 3692	3676	Gppcmeem.exe	100
PID 3676 wrote to memory of 3692	3676	Gppcmeem.exe	100
PID 3676 wrote to memory of 3692	3676	Gppcmeem.exe	100
PID 3692 wrote to memory of 4204	3692	Gfjkjo32.exe	101
PID 3692 wrote to memory of 4204	3692	Gfjkjo32.exe	101
PID 3692 wrote to memory of 4204	3692	Gfjkjo32.exe	101
PID 4204 wrote to memory of 116	4204	Gihgfk32.exe	102
PID 4204 wrote to memory of 116	4204	Gihgfk32.exe	102
PID 4204 wrote to memory of 116	4204	Gihgfk32.exe	102
PID 116 wrote to memory of 4828	116	Glgcbf32.exe	103
PID 116 wrote to memory of 4828	116	Glgcbf32.exe	103
PID 116 wrote to memory of 4828	116	Glgcbf32.exe	103
PID 4828 wrote to memory of 3652	4828	Gnepna32.exe	104
PID 4828 wrote to memory of 3652	4828	Gnepna32.exe	104
PID 4828 wrote to memory of 3652	4828	Gnepna32.exe	104
PID 3652 wrote to memory of 1980	3652	Gflhoo32.exe	105
PID 3652 wrote to memory of 1980	3652	Gflhoo32.exe	105
PID 3652 wrote to memory of 1980	3652	Gflhoo32.exe	105
PID 1980 wrote to memory of 2132	1980	Gmfplibd.exe	107
PID 1980 wrote to memory of 2132	1980	Gmfplibd.exe	107
PID 1980 wrote to memory of 2132	1980	Gmfplibd.exe	107
PID 2132 wrote to memory of 3960	2132	Goglcahb.exe	108
PID 2132 wrote to memory of 3960	2132	Goglcahb.exe	108
PID 2132 wrote to memory of 3960	2132	Goglcahb.exe	108
PID 3960 wrote to memory of 4880	3960	Gfodeohd.exe	109

C:\Users\Admin\AppData\Local\Temp\f91e1f0c6f3fdd5d1269c863d928ec729c5181cd38d5fe009330aea386b86809.exe
"C:\Users\Admin\AppData\Local\Temp\f91e1f0c6f3fdd5d1269c863d928ec729c5181cd38d5fe009330aea386b86809.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\Fiodpl32.exe
  C:\Windows\system32\Fiodpl32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\SysWOW64\Fpimlfke.exe
    C:\Windows\system32\Fpimlfke.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Windows\SysWOW64\Ffceip32.exe
      C:\Windows\system32\Ffceip32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5116
    - - C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2028
      - C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:384
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:116
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4828
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3652
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        23⤵
        Executes dropped EXE
        
        PID:4880
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        24⤵
        Executes dropped EXE
        
        PID:2392
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3756
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        26⤵
        Executes dropped EXE
        
        PID:540
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        27⤵
        Executes dropped EXE
        
        PID:1832
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        28⤵
        Executes dropped EXE
        
        PID:2668
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        29⤵
        Executes dropped EXE
        
        PID:5024
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        30⤵
        Executes dropped EXE
        
        PID:3884
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4700
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        32⤵
        Executes dropped EXE
        
        PID:3792
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2760
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        34⤵
        Executes dropped EXE
        
        PID:1932
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        35⤵
        Executes dropped EXE
        
        PID:5112
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        36⤵
        Executes dropped EXE
        
        PID:4144
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        37⤵
        Executes dropped EXE
        
        PID:3004
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        38⤵
        Executes dropped EXE
        
        PID:2800
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        39⤵
        Executes dropped EXE
        
        PID:4452
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2300
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        41⤵
        Executes dropped EXE
        
        PID:3736
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        42⤵
        Executes dropped EXE
        
        PID:3428
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4840
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        44⤵
        Executes dropped EXE
        
        PID:3532
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        45⤵
        Executes dropped EXE
        
        PID:5028
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        46⤵
        Executes dropped EXE
        
        PID:4428
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1088
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        48⤵
        Executes dropped EXE
        
        PID:1316
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        49⤵
        Executes dropped EXE
        
        PID:3360
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        50⤵
        Executes dropped EXE
        
        PID:3524
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        51⤵
        Executes dropped EXE
        
        PID:4652
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        52⤵
        Executes dropped EXE
        
        PID:1472
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4604
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        54⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        55⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        56⤵
        Executes dropped EXE
        
        PID:4668
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:388
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3340
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3892
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        60⤵
        Executes dropped EXE
        
        PID:4312
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4680
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        62⤵
        Executes dropped EXE
        
        PID:2596
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        63⤵
        Executes dropped EXE
        
        PID:3904
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        64⤵
        Executes dropped EXE
        
        PID:3488
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1776
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        66⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        67⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        68⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        69⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2408
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4996
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        72⤵
        Modifies registry class
        
        PID:4472
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        73⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        74⤵
        Modifies registry class
        
        PID:5012
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        75⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        76⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3368
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        78⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1920
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        80⤵
        Modifies registry class
        
        PID:3944
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        81⤵
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        82⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        83⤵
        Modifies registry class
        
        PID:5200
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        84⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        85⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        86⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        87⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        88⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        89⤵
        Modifies registry class
        
        PID:5460
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        90⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        91⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        92⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        93⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        94⤵
        Modifies registry class
        
        PID:5692
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5732
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        97⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5864
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        99⤵
        Drops file in System32 directory
        
        PID:5908
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        100⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        101⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        102⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        103⤵
        Drops file in System32 directory
        
        PID:6080
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        104⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        105⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        106⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        107⤵
        Modifies registry class
        
        PID:5280
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        108⤵
        Drops file in System32 directory
        
        PID:5356
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5424
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        110⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        111⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        112⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        113⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        114⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        115⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        116⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        117⤵
        Modifies registry class
        
        PID:5972
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6016
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6116
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        120⤵
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        121⤵
        Drops file in System32 directory
        
        PID:5272
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        122⤵
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        123⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        124⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        125⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        126⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        127⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        128⤵
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        129⤵
        Drops file in System32 directory
        
        PID:4376
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5332
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        131⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5708
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        133⤵
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        134⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        135⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        136⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6088
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5444
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        139⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6028
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6012
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        142⤵
        Drops file in System32 directory
        
        PID:6168
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        143⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        144⤵
        Modifies registry class
        
        PID:6248
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        145⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        146⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        147⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        148⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6472
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        150⤵
        Modifies registry class
        
        PID:6520
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6568
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        152⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        154⤵
        Drops file in System32 directory
        
        PID:6700
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        155⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        156⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        157⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6876
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        159⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        160⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        161⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7108
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        163⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        164⤵
        Modifies registry class
        
        PID:6204
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        165⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        166⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        167⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        168⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        169⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        170⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        171⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        172⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        173⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        174⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7084
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        176⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        177⤵
        Drops file in System32 directory
        
        PID:6228
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        178⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        179⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        180⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6856
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        182⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        183⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        184⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        185⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        186⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        187⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        188⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        189⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        190⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        191⤵
        Drops file in System32 directory
        
        PID:6388
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        192⤵
        Drops file in System32 directory
        
        PID:6720
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6676
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        194⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        195⤵
        Modifies registry class
        
        PID:7244
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        196⤵
        Drops file in System32 directory
        
        PID:7292
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        197⤵
        Modifies registry class
        
        PID:7328
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        198⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        199⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        200⤵
        Drops file in System32 directory
        
        PID:7452
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        201⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7496
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        202⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7584
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        204⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        205⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        206⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        207⤵
        Drops file in System32 directory
        
        PID:7748
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        208⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        209⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        210⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        211⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        212⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        213⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        214⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        215⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        216⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        217⤵
        Modifies registry class
        
        PID:8172
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        218⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        219⤵
        Drops file in System32 directory
        
        PID:7240
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        220⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        221⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        222⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7524
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        224⤵
        Drops file in System32 directory
        
        PID:7564
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        225⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        226⤵
        Drops file in System32 directory
        
        PID:7744
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        227⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        228⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        229⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Damfao32.exe
        
        C:\Windows\system32\Damfao32.exe
        230⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        231⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        232⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        233⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        234⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        235⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        236⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        237⤵
        Drops file in System32 directory
        
        PID:7560
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        238⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        239⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        240⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        241⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        242⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        243⤵
        Modifies registry class
        
        PID:7224
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7436
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7608
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        246⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        247⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        248⤵
        Modifies registry class
        
        PID:7316
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        249⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        250⤵
        Modifies registry class
        
        PID:8024
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        251⤵
        Drops file in System32 directory
        
        PID:7404
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        252⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        253⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        254⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8228
        
        C:\Windows\SysWOW64\Fqppci32.exe
        
        C:\Windows\system32\Fqppci32.exe
        256⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        257⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        258⤵
        Modifies registry class
        
        PID:8364
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8408
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        260⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8448
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        261⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        262⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        263⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        264⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        265⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        266⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        267⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        268⤵
        Modifies registry class
        
        PID:8780
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        269⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        270⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        271⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8948
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        273⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        274⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        275⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        276⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        277⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        278⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8216
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        279⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        280⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        281⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        282⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        283⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8608
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        285⤵
        Drops file in System32 directory
        
        PID:8676
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        286⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        287⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        288⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        289⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        290⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        291⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        292⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        293⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        294⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8476
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        296⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        297⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        298⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8796
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        300⤵
        Drops file in System32 directory
        
        PID:8932
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        301⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9196
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        303⤵
        Modifies registry class
        
        PID:8272
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8428
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9112
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8768
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8956
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        308⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8320
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        310⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        311⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        312⤵
        Modifies registry class
        
        PID:9124
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        313⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        314⤵
        Drops file in System32 directory
        
        PID:9120
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        315⤵
        Drops file in System32 directory
        
        PID:8360
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        316⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        317⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        318⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        319⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        320⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        321⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9424
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        323⤵
        Modifies registry class
        
        PID:9464
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        324⤵
        Modifies registry class
        
        PID:9504
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        325⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        326⤵
        Drops file in System32 directory
        
        PID:9592
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        327⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9676
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        329⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9760
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        331⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        332⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        333⤵
        Modifies registry class
        
        PID:9884
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        334⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        335⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        336⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10048
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        338⤵
        Drops file in System32 directory
        
        PID:10092
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        339⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        340⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        341⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        342⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        343⤵
        Modifies registry class
        
        PID:9288
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        344⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        345⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        346⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9572
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        348⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        349⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9844
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        351⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        352⤵
        Drops file in System32 directory
        
        PID:9964
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        353⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        354⤵
        Modifies registry class
        
        PID:10120
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        355⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        356⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        357⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        358⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        359⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        360⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        361⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9832
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        362⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        363⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        364⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        365⤵
        Modifies registry class
        
        PID:8764
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9376
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        367⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        368⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        369⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9988
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        370⤵
        Modifies registry class
        
        PID:10192
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        371⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        372⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        373⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        374⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        375⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        376⤵
        Modifies registry class
        
        PID:9328
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        377⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        378⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        379⤵
        Drops file in System32 directory
        
        PID:10324
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        380⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        381⤵
        Modifies registry class
        
        PID:10432
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        382⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        383⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        384⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10564
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        385⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        386⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10648
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        387⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        388⤵
        Drops file in System32 directory
        
        PID:10752
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        389⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        390⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        391⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        392⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        393⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        394⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        395⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        396⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        397⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11192
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        399⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        400⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        401⤵
        Drops file in System32 directory
        
        PID:10352
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        402⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        403⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        404⤵
        Modifies registry class
        
        PID:10600
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        405⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10684
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        406⤵
        Drops file in System32 directory
        
        PID:10748
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        407⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        408⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        409⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11012
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        411⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        412⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        413⤵
        Drops file in System32 directory
        
        PID:11232
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        414⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        415⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        416⤵
        Modifies registry class
        
        PID:10572
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        417⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        418⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        419⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        420⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        421⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        422⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10416
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        424⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        425⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        426⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        427⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        428⤵
        Modifies registry class
        
        PID:10508
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        429⤵
        Modifies registry class
        
        PID:10820
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        430⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        431⤵
        Drops file in System32 directory
        
        PID:11248
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        432⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        433⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        434⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        435⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11304
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        437⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        438⤵
        
        PID:11384
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        439⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        440⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        441⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11552
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        443⤵
        Modifies registry class
        
        PID:11592
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        444⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        445⤵
        Modifies registry class
        
        PID:11688
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        446⤵
        Drops file in System32 directory
        
        PID:11736
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        447⤵
        Drops file in System32 directory
        
        PID:11776
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        448⤵
        
        PID:11820
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        449⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        450⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        451⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        452⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        453⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        454⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        455⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        456⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        457⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        458⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        459⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        460⤵
        Modifies registry class
        
        PID:11356
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        461⤵
        Modifies registry class
        
        PID:11456
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        462⤵
        Modifies registry class
        
        PID:11540
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        463⤵
        Drops file in System32 directory
        
        PID:11612
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        464⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        465⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        466⤵
        Drops file in System32 directory
        
        PID:11840
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        467⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        468⤵
        Modifies registry class
        
        PID:11988
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        469⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        470⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        471⤵
        Modifies registry class
        
        PID:12196
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        472⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12272 -s 408
        473⤵
        Program crash
        
        PID:11548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 12272 -ip 12272
1⤵
PID:11452

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:8000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aoioli32.exe

Filesize
128KB

MD5
97410fe941563cc652603be0fc33e8ba

SHA1
3cc9c7af43f1fb2518c8d7f11ecb63da435e1694

SHA256
58524f556f7a40bc4161687617659e9f7c599008b18ab19add17edca2b963cd5

SHA512
05a21f4000ccda9d97de3c6e447f454ef8b07a26b4f937cede5a71e3465f9c4da8b569a7bd0357eae79a7570a02d98bccbb9e354878c4698320daa4d0ed66100

Download Submit
C:\Windows\SysWOW64\Bmeandma.exe

Filesize
128KB

MD5
506c48f1e617733f2870e3a4b998aa1a

SHA1
c5ea29baa63c06eff67be17aab296203ac7d1bbc

SHA256
0898f8f69f387d11f48525407e2472a87e745b75c1710a606b43046a479e7572

SHA512
6df4aba576d6fccc72bc7b1456ad59b2eb8713401f15a5afa45c2c3b0cb109a473959309ef667245f8cab61f5f25468c693bdde872115a2ffd64196362a92864

Download Submit
C:\Windows\SysWOW64\Cdbpgl32.exe

Filesize
128KB

MD5
db24f769eda321d76d49f72cfc69a5ee

SHA1
e095fbfb61252a486907664e03f26d44ac06ffe8

SHA256
c5fe8a75c4d083d9cb5f04b436c49ff6a09f3317b13ea06b020eb34306a374a6

SHA512
851638fb22f73eee8da1eb71b2575603539216fd93bc22354dfc6b8345d6b8677f6997f75e5c89e2a013886e408081eb2b3d5979aabc473645e10ccd69a2d6c0

Download Submit
C:\Windows\SysWOW64\Cdimqm32.exe

Filesize
128KB

MD5
070eef7e012989a2327ef0ab26cb18a3

SHA1
e5de011562ebdb61b36a78349fb96cbdf35349aa

SHA256
885dcdf1c41626d2eae9773b607bd734b8e1dfde765bcf688589c2e51aff9846

SHA512
e0b496b7ce6d6d2e8f6f792ffb165efe73e5adedc73c4d07c04230442b09756aa0da0e37b28ec9172da545889087364cb1a8c2c48686aacb712fc51f63e2b637

Download Submit
C:\Windows\SysWOW64\Dakikoom.exe

Filesize
128KB

MD5
65797f7bf30029b363aa85592a2df0ed

SHA1
86b02c80c98d7b6c1c01233593aa3692343accab

SHA256
84bc3200c3527b5fb7c1aa4212163f465fa61ba333d42676fd2921afc1daa8f5

SHA512
01dde5458d9377d0c73add49797a59600524e54464b9896316599ab4a607bf61838b856c69e3f5fe24f22a8141e75183fc49456db1096631068f0e7a0953766b

Download Submit
C:\Windows\SysWOW64\Ffceip32.exe

Filesize
128KB

MD5
efa4130c469ec34e75e49adb3cbdcbea

SHA1
27c4a97c734608924007cca689c1ea26f533dbf6

SHA256
09fe4f2437145ab69c6364c3a32bd5b34a52c8f184b9ca03f0f5c980dffcc9a3

SHA512
fefbd12927e0fe9045349aeb4dbb4d1668528fe2b8d3c8c7f105f06c25b956ba2248a3119b8459e20bc71a160a24d5c28e95cf727d0a15d9b0a84c7c48370c23

Download Submit
C:\Windows\SysWOW64\Fiaael32.exe

Filesize
128KB

MD5
3fb033fb20a11cde798887a1d9d773ea

SHA1
5395e59f59c4490ab742b4121674d37343a893be

SHA256
94244f3c5e21d74f3812cb381f477e23a7002e2e4648d7189acdd2d1ad08b9a9

SHA512
25464c02be7f8d33cb3a66720e1dc0347ee1d3630992341f4a17fa65888a4e3ffaddd999c69b9a1a9a6b403463122f75c869cbe2e158f9ce56a852f48847fff7

Download Submit
C:\Windows\SysWOW64\Fiodpl32.exe

Filesize
128KB

MD5
4c3f03c1b76d93a9797a3bc6f995f5bf

SHA1
5a6ade16fb66e24228ba7337de2d8bd2837f8762

SHA256
dcdd163e4c725f513a1fc3c8b9b3974b727b41ec60a34ef0380c8c0e827fe89c

SHA512
054a718ff0b2d4737ae005b4c01e9b1c4d20ff0d01f10ecbb4f3080aef62156db866f4522b4613ec6fa2ba71c6719e40d886800a7a453de7c30432184e9a9711

Download Submit
C:\Windows\SysWOW64\Flpmagqi.exe

Filesize
128KB

MD5
34865e59d58ddc06a80dbf1bd2f3a1a8

SHA1
6171dc6ce51b93c314bee0c4a95830bd04ce9f68

SHA256
acd01bcc2c398a4865e9382ed76cd74d6e6f7ae3ee625957545a472826d11457

SHA512
5990555ab293902ef3bd3bf6557fbdf96e86e9a2fb2b42c9810e5f18ba661935d5133567bf7d86469efc831ca4d27dfa91852b73b034cb9aebf6b79127f3dcdc

Download Submit
C:\Windows\SysWOW64\Fnnjmbpm.exe

Filesize
128KB

MD5
cc40ad05872e813d8f1f561aa6e6ced2

SHA1
16a478ee81205b2819b780dbe10ae275c1de7c2a

SHA256
cef11aedf1ca84450a9e8e8af53a045a278af265fccdb63717a89a4acbcc4a72

SHA512
c5728234ef53918d85789fc36183e54811125c39a070b494a74613621b0652860eafae664979395664ce1e0e8e2c194e2518dd0c83fe7891a4e051c4972838e2

Download Submit
C:\Windows\SysWOW64\Fpimlfke.exe

Filesize
128KB

MD5
6a1c21a3d5748f103f55b9a2337e65b3

SHA1
35d0d9e8dacf6361c5d0f8776a1988d888444922

SHA256
873e60d3f496dd3d240e608cba5d3ca0d272c095a1fab7cb75add8587e8ee976

SHA512
b1325c3fe1b81ba35d256bb8d0d9cacf7eaa77530e23b24a4e1beacc07b5c09deffd5282c4082a8699ec9596e70cbcd3fe4e01005075ad2f9d73e8fd309e3e1e

Download Submit
C:\Windows\SysWOW64\Gblbca32.exe

Filesize
128KB

MD5
4a3ece2eb592d4683ed935c322869285

SHA1
e7c5c5436ce4dffeacbc589c08e81dc50853a466

SHA256
d0e0ce7be322cd4914fa07734a2f5a85e0c4ee98b75ad09abddc30cbddcb35c3

SHA512
6ca7d70bcbdc0b04a95e577a22b484984382087460f31de1279a6d006bfa0f44ea6f8f4822f5e3cfec08ab4cba46ecfdab8a17f975f897ced31918c728a519e6

Download Submit
C:\Windows\SysWOW64\Gejopl32.exe

Filesize
128KB

MD5
42df78d3888eb9a93dab1570d578c04c

SHA1
eef9d820513410504a8ef92ae9550972092351e2

SHA256
4daf182e20db0242a44152f443abe640c6377a0f52460864d156dbeaa8a1a8b4

SHA512
c0e0c8f8c1caba050010d76677817189ce863004eb00b8839fb2b8aaf24bb2b258657b66161e67133d5f7f11319c163501e3fac4f150e85f1711a974b8ceb8ef

Download Submit
C:\Windows\SysWOW64\Gfeaopqo.exe

Filesize
128KB

MD5
3141b9798be8d46e705bc64cbe7747c6

SHA1
59b3ff0a4793d25f75e97b4a6e05c18fd182530d

SHA256
26186eff2f88f7b5599e813bcd87cba257f355e96fa856b759c4bc347003063e

SHA512
d5a5dfee1da3e978b15154e1b89fdacb81d9aac2ce5fd6ba3960f92acf101f42289261735eb7f5908d7b00a3e31f66999f80109fce9899f53a58aced1738f26b

Download Submit
C:\Windows\SysWOW64\Gfjkjo32.exe

Filesize
128KB

MD5
8fe533bbb2f13ae39a7a8920533a01bc

SHA1
b17f7ef0e977a31cef0ec5b86f7f5866de3f33bf

SHA256
6d9c0cf9315d83f3e485c2039aa52228c2d0a5d96670f896d0a5151b5aac88df

SHA512
650ede04f9906676ee26eef6d2822816b5d751693f6c1180df4e863b7458d227b4a60cbab114b1f45852c3039f7ee65ab2ee764da3f7f51fd838ded4c2350dac

Download Submit
C:\Windows\SysWOW64\Gflhoo32.exe

Filesize
128KB

MD5
12b799360a560b64c8ae4d48c87091be

SHA1
5ee19f5ce760f0d6d59698df876e73be0a1cb3da

SHA256
295f0e9b14b57356ab0f4800bcda1f256ef8ba7811d76d4d8efd6f2e71c88e22

SHA512
92714bd113d2ec332f152ff8b27e45f5060f1cbc278f1b7cc579a43b72f81dd6bc94e59728489506e674174e4069c0de145f2d2f08ea185b279ec78fbb741f61

Download Submit
C:\Windows\SysWOW64\Gfodeohd.exe

Filesize
128KB

MD5
79e5ae96fc5611089e984b77bc1ebfbf

SHA1
54aef2831b28739fdb0ff2a1584c622afb4c2d9b

SHA256
61d348b00c128128bf59fb36877d46089fd44ec046158d3d371036153e7ffd5f

SHA512
0d1baeb943d3e9df1e3bb71676d5b7a67546e74fa360b152eb4de6910d70d9d62f9f294db2b0e0867a32fcf3645726824eac0534a04b88b1848ca666d05d2a86

Download Submit
C:\Windows\SysWOW64\Gihgfk32.exe

Filesize
128KB

MD5
e51b1d98a520c3aa4eaa82652d85663f

SHA1
0ed36d21407c22bb82fdea52a6614a88eea6ae2d

SHA256
eb09f06815353e6b89327adfa76cc0f44ea2651bb9a2fd709285b53ca1f60950

SHA512
adb818af0595694f45c85d3befc6514e72e365a3bd362e804e4b1128433831ec8560e4737be414214378ecf575de22ddd361bab83ca2fd890689bcbf44b392dd

Download Submit
C:\Windows\SysWOW64\Gimqajgh.exe

Filesize
128KB

MD5
8a1f65bffb5d06249601e960acb998bd

SHA1
3f8849e5b6d28ce598ce6ad35157224f87b7c08c

SHA256
f15eeadf933d6248557dc85ccad6eed4c82d1a38d96615839404e933388c9a0c

SHA512
af66ea7dbdaaac3df142ad2a5b28c76df771f55bce992ed1a80378d57771d02598cb50dc7876408392b77099f43d7f90645906781e0b22a939bd10fbf6b6197c

Download Submit
C:\Windows\SysWOW64\Glgcbf32.exe

Filesize
128KB

MD5
4ba41735846ad95bfb84137950dce7e2

SHA1
a0f810cf11c840f0540424dc878c91abb206f7d8

SHA256
b410141cb37a67dc1d512a25fe3d547b3764e98749039932a504274e2f5d0e23

SHA512
0f4b7258a66f0de44f683a9e721ed73791401acfdea01fb0c740c5ff7b1765ed4281ef382a4ba2f5619fb6cb48be4ddb6af897c210a95f92dae8de636ad99aba

Download Submit
C:\Windows\SysWOW64\Gmafajfi.exe

Filesize
128KB

MD5
d71ead43a8763cd9ce23b1aaa92d72fb

SHA1
8158ee7a514285cde7241442052b38caad47ddc9

SHA256
db231c36b5adc6f6af29c55b2b847b319e1f00ef687455ebcd59dbcaecfb7e62

SHA512
54bf4cfdaaef23988298b9000f6d90c3b79d3a9e56fffc87cfe1559c14e9827f7f6626b4e4c958a28695b64a501555265de5505e6ef3810921ba112cfec9af1f

Download Submit
C:\Windows\SysWOW64\Gmfplibd.exe

Filesize
128KB

MD5
d02afeb7ef82742a9d4bde0ee1f35484

SHA1
976213958c946977a0053a8713ed2b2e6a842b54

SHA256
b674359d0bfefd76b6d1c1031cf50e7d630a5cc5111402f8698267fe328ab17c

SHA512
feb19e34c143ea532e335a03e3cbc1585b2e7ecc1adc1e15963dbc9da045a5e717ac7358e08462bdd5ddf696e7241bed90c588b27239e75cb34fa487314b3da0

Download Submit
C:\Windows\SysWOW64\Gmojkj32.exe

Filesize
128KB

MD5
8a9f9e824ea142612dd5a1edb46207b9

SHA1
d81a843ce617db52d00d39d1fbe8e09ebf5e19ba

SHA256
14c1eb0b0142105050bc027978e62e1d2323bda353db38afe31be1b413435465

SHA512
077747063590468743627986ec3e1fc62e5cc0ad0ccfc9c548586df1e981c4893f24cb2ec89cb3e3b6b782a0f5beb89a7c312684ac8137057a9095cbdebd308c

Download Submit
C:\Windows\SysWOW64\Gnepna32.exe

Filesize
128KB

MD5
83cdb8fa1d64e10bac4ac81b1a6b3a9d

SHA1
064f0f8971334148840de0392fd5bf87caaf20cd

SHA256
d265ee0cc22b9c1e26c5c0a46afafa4485a614aedcfce7b49f10d490eb03b2cb

SHA512
f9d5cb9756e3eca3acb945d4507e086b09eac70abd96ed2da994b5d5c9ecd35d1529e9751e3d46ccf216cea1b1c2b8b77f3eb0cb5381a655626348ff16184515

Download Submit
C:\Windows\SysWOW64\Goglcahb.exe

Filesize
128KB

MD5
c200a12ee2a8b26d4120f35efc12e3ad

SHA1
c64d3631d657ab3112765d78f87e88ddc026784b

SHA256
cc679697e7f53c1e363d22e2c7c0d41e92a28707ee7d4ea3309664ed8e9d69f5

SHA512
b468ea95db659cd5312fd8cac292afc4e9122ba1559b5387c33cae464c2dd4931aec9f28571f2fc4f4085e0838918ab8c381444d956c7765895106398d953f32

Download Submit
C:\Windows\SysWOW64\Gpgind32.exe

Filesize
128KB

MD5
034dcbd12d1132094a65b8214bf058eb

SHA1
31a80a9f9eccd38c7428d292f8d2ba6af89949ac

SHA256
70dab8b35c5439642f9c09eae5deb8dee226267973e4bd7f5cbef77710f3201f

SHA512
479e71e935e525d77e85bd514610d52f4314d723e991dbce1379da769bc3cdc60136c8bec123d42323ab214c3a997d6359f9d58a3393fdb0ae1a47c09038786e

Download Submit
C:\Windows\SysWOW64\Gpnfge32.exe

Filesize
128KB

MD5
e84a3bbb4817e434ac18003dc6714f3a

SHA1
550f759c6032a1a6ad620ddd4143024eec638e79

SHA256
e25e5969e0e8ee6412e9b07fef57c0f9d1180e2d1facaf4311a78eeffeda6455

SHA512
962ab49123d6104db773c837ad757c2716f32c1c82ee96fb3cf6f0d030e409b038025af33881be81b0f7fc3a0aad1e42ac66966b38ff0d10d1e0fa269ddcb5d1

Download Submit
C:\Windows\SysWOW64\Gppcmeem.exe

Filesize
128KB

MD5
d1684aaa7b4219adb7bafafda7335a8b

SHA1
770826b6ddf3f0d60c1dfa95f69bceaa8dc88097

SHA256
d3caa3ac558728544e73b54dbb1ce7d04dd9b8a437e06486a3aee402b1198d1d

SHA512
5ea703642e7b040ed6db10a413d6f38c5b8e348d20705b3fcadc6bda9ffe45d9ac3675af74ed5eaf9a0e83e5672912f153a4e7e4a27dbaa3efc81e740d95d146

Download Submit
C:\Windows\SysWOW64\Hbhboolf.exe

Filesize
128KB

MD5
7de508c82012cc9462ea4c7557b8659f

SHA1
968ab2af8dd5f47bcc0ebfbc2d69216e7a1f7683

SHA256
acfd9eeeeb86301565f6457dbd1bf46f91f1e602229cdf39414ca1d648844dfd

SHA512
8cca3c947ae161bdbf850b7d0e4177fa6bde74f793c8475a91d3c73d6731ecd22dc4af50c5a2137b6c7d757a5299499068bdbba9c1af295fd22c2f965c0b7910

Download Submit
C:\Windows\SysWOW64\Hbjoeojc.exe

Filesize
128KB

MD5
26bf87cbf617d00b8e0577942ed23d96

SHA1
61414cacd2c0aac8fd39278ffcf4eeab43a6e3e0

SHA256
3b9da00ebf3963a78ab13195224224397af34964c671c6e7df9749ff2594a237

SHA512
866f712ea3e657c7a9df99a58b71f880fc4982d2512ed2f343470365f4f99d2f2511b00d2a9ad719c5bb013ec90cef3e0e37301d1e1e983dec8d6b9ede075140

Download Submit
C:\Windows\SysWOW64\Hbnaeh32.exe

Filesize
128KB

MD5
6a10f7fd75d64218d6d85662e0d4b0fb

SHA1
14160ab3ad4242190ece0f89472a6fe7269de82b

SHA256
747584c8ac907de6ac3dd756cc8ec2179995166ea68b1307bcddada124cb0d32

SHA512
c2caef144bc9af2bea5a489cd8ae4e56ad52e0454ab35c8af23b4fa6248b30d50671249beba2f990ba7ae47602195ef2044e922c97e6d05e24bf283a8c24c8fa

Download Submit
C:\Windows\SysWOW64\Hehkajig.exe

Filesize
128KB

MD5
5af6ce53fd6e988874338a5581cae83f

SHA1
38417e9435b242308916e91ea41b03047ef8b250

SHA256
7f38b9eae9b493d1d0f7f1f4ad507ec56e0d1a8d711a6f5abc4185936afb620c

SHA512
4b7caf85ada015190f65355cb92434de32a579d98f1d5891d7146996928f2270fda1ff19bda68ea7c13fcce8d5a6df47f9538edc959a8bf57b09ed521a0c0b3a

Download Submit
C:\Windows\SysWOW64\Hfaajnfb.exe

Filesize
128KB

MD5
d2e5fe587663cf834d8867c9034fc5a2

SHA1
fa0caa44779eb4aa807f8cac795b059453fd7f14

SHA256
82c86341cfd0a6226e153cb05c9027073c6c10247a0daa3d91a82423c173e9d0

SHA512
e65fe7666e1b30cb69c2324064d64527839b95354af75b3a664bc42c246ec34d3c1e152eb42329a897dfe7ba457827663d229d0a7d25947f906ca35263893196

Download Submit
C:\Windows\SysWOW64\Hfhgkmpj.exe

Filesize
128KB

MD5
252770d464f75a36f83b7a984c8db910

SHA1
326d65642349814fab62f079f16e6e9493879c74

SHA256
cd3c89a999272d43909cdfd1fe7000bd5e81f23aed37f009738d520eeb90e1f2

SHA512
2b954d4db07204f6fc60ab03b5beb5a8182f2e80f84affe8fe3692a5454aae5d252090c1bfbd27ba5a3850f8fe3f839f98de0b233ea78af6e49c08ee72edc120

Download Submit
C:\Windows\SysWOW64\Hibjli32.exe

Filesize
128KB

MD5
773700d7df472cd97d4649d3e7e87429

SHA1
29cff4cbb2e7b351a625d5fc49b1b1c734707862

SHA256
ab428e35c4f12228a1e7d3eea7c2b271079c1f641fed4ce43e76e258848ef84b

SHA512
48cd03b65ab2e00fba381bf50f9304fe27d252e3418ed7dcda593287371b73d2b9a20ef4a78f55781f6731caa990505493e37a4148d39ea9266691aa8965671f

Download Submit
C:\Windows\SysWOW64\Hipmfjee.exe

Filesize
128KB

MD5
a4f853d5679515b336695646685ecc2e

SHA1
f8985c903b2f9e20b0c78cff68e12c4c0b76c191

SHA256
f1421ca3a2b311f7d8a48141c12a2ad1dc654fb136c55d407352a5b3d12ffee9

SHA512
200bf92ea48c0fa14ec5555f558f4b81f6b292b8f01b9a55926db143851d55507bb44054231228773dd522c34084353fd035c627a53e7ab12f90af5770a8b040

Download Submit
C:\Windows\SysWOW64\Hmpcbhji.exe

Filesize
128KB

MD5
7a027cc8ea16dc6c9b91cc6296ee9347

SHA1
3f3a5793fc45bdf07ddfcdf90a4e98b91bc14db1

SHA256
58e1d514cfe9310a07f48135adfce15226351a92b9dce3fb36621c957456284e

SHA512
5344d2bf535ef07c502d9ac061ce17901037850313f44278a692ae7e3052333b46f2630e466bd58c154b169733dcf02d3cd68dc05219d97ce3696391b6fa543f

Download Submit
C:\Windows\SysWOW64\Hoaojp32.exe

Filesize
128KB

MD5
7924e0648a183b68a98cefae38608cae

SHA1
81c0de4acd4a3b8def34df223ab6c4af08076ec5

SHA256
e42e8cd107b71d76b5ff5ac7d506d38036193beb1551f6b54b4b76c53a526b34

SHA512
5e3d9f5645acbeea8efb797b36f82ed1eeac2394de9b24cb7e618ac14649157b50d97346b65fd4e8f96e070ac3a5cb699d2311e71ae5be73109e2efea9e24f23

Download Submit
C:\Windows\SysWOW64\Jpaekqhh.exe

Filesize
128KB

MD5
383e38bccef38d5e2b7515b98baddd53

SHA1
9178729026b1da70cc741d26d58a80a5a531c66b

SHA256
4712ac13f9f97e7b8ddf430d7ac960719353db09614574fe9b548e962a9ac26a

SHA512
c7290094cafd2c43aa05c6d5a12cc96d6413e9d04899dfa24f0e5ce744fdb741ac542401e72d657d7b6574aebf820e07a7354850a75c121d38862f290f9e238d

Download Submit
C:\Windows\SysWOW64\Ojnfihmo.exe

Filesize
128KB

MD5
2c1321a01e006076ea27be07c22c7618

SHA1
72dcebdadc55aea64a5a04eb1195d5a68672b2c6

SHA256
2969bfb6fd740e035d14b86711699e26dc9c746b8b6b0b3df270cf621cc42e86

SHA512
17c535c29b6ebd213e8350fcc719dfeb55e9fa091f2182c6ab7b16dc0ad6cfcc926e28f8aa65b6feedec789beb6f2795429758008cd42b50fe5b21b20a7294ea

Download Submit
C:\Windows\SysWOW64\Pidlqb32.exe

Filesize
128KB

MD5
77727efc597c8beebcd63730ddfd54c7

SHA1
e1628ec0c5ec828e5de4b803c6ac7c5108a515d0

SHA256
2277eb5c253ea00036489829662400450986ff47f67bd31491fd1153c17cb476

SHA512
7f5dcde954dc14bcbba555c010d4dde346bdaf22caab27daf3f49beb90a2bc27b8c4c1c105d173b30346877789ed39633ce2f8cd9e63bfae677aaf605bb89214

Download Submit
memory/116-129-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/384-69-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/388-406-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/540-200-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1052-97-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1088-345-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1316-347-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1448-8-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1472-375-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1720-81-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1832-211-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1932-267-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1980-153-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2028-37-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2132-160-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2256-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2256-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2300-302-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2392-185-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2520-56-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2596-435-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2668-216-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2760-257-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2800-287-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2884-88-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2952-393-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3004-281-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3028-72-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3340-407-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3360-357-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3384-49-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3428-313-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3524-363-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3532-326-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3652-149-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3676-105-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3692-113-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3736-305-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3756-197-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3792-249-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3884-236-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3892-413-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3904-441-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3960-169-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4112-17-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4144-278-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4204-120-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4312-419-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4428-339-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4452-293-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4548-383-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4604-381-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4652-369-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4668-395-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4680-425-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4700-245-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4828-137-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4840-317-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4876-45-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4880-177-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5024-229-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5028-329-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5112-269-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5116-25-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/7700-3096-0x0000010DE41A0000-0x0000010DE41B0000-memory.dmp

Filesize
64KB

Download
memory/7700-3112-0x0000010DE42A0000-0x0000010DE42B0000-memory.dmp

Filesize
64KB

Download
memory/7700-3128-0x0000010DEC610000-0x0000010DEC611000-memory.dmp

Filesize
4KB

Download
memory/7700-3130-0x0000010DEC640000-0x0000010DEC641000-memory.dmp

Filesize
4KB

Download
memory/7700-3131-0x0000010DEC640000-0x0000010DEC641000-memory.dmp

Filesize
4KB

Download
memory/7700-3132-0x0000010DEC750000-0x0000010DEC751000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads