f712bfde1ff48082588037d2dde68be674a28db4c14ed71364b6bc1743198be4

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9fb397b74ffe39389507b3581d5ea28.exe
Size

72KB
MD5

a9fb397b74ffe39389507b3581d5ea28
SHA1

6927199bcd5446ee88037846dc3a457fec6dce98
SHA256

f712bfde1ff48082588037d2dde68be674a28db4c14ed71364b6bc1743198be4
SHA512

cc09118f8bec8b20ae89ecb4ac74d6efa5a8f45abaac9b83a2e4c531a68048b95eaaec8aad621b2175281b664d3bb8b0d6ae6f9b58e70d7d58fc8b691f9ad3a2
SSDEEP

1536:3xU5N7VCcUxplb2Cym0nUsFKvJHoRkdMruJ62W5lsVcIUju+:3QYZxp92Cy5n1FkYkdMruJ62PC3a+

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bakgoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfipef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edplhjhi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klbnajqc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khlklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hhdcmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekljpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjlalkmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldfoad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nopfpgip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlblcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gljgbllj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oalipoiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Badanigc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnlhncgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Alnfpcag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hfjdqmng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlepcdoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdmlkfjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcnfohmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eiobceef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpjcgm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahdged32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfglfdkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbhboolf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmmfmhll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mfenglqf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhnikc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Llkjmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdpagc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cefoni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgdidgjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbkkik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeaiij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nhbciqln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ofgmib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Adkgje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njfkmphe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngqagcag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngqagcag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjggal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llkjmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahpmjejp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjlhgaqp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amjbbfgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nijqcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kapfiqoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfhmjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnfnlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bahkih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdnmfclj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkpjdo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nckkfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daeifj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eiieicml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oeehkn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fflohaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fmndpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Emoadlfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkibgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klndfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oeehkn32.exe

Executes dropped EXE 64 IoCs

pid	Process
3352	Dpbdopck.exe
3620	Djjebh32.exe
4340	Eiobceef.exe
3796	Ebhglj32.exe
2200	Ebjcajjd.exe
4968	Eciplm32.exe
4644	Eleepoob.exe
1448	Eiieicml.exe
3028	Fbajbi32.exe
1884	Fdqfll32.exe
4492	Fimodc32.exe
1452	Fjmkoeqi.exe
4804	Fpjcgm32.exe
4252	Fmndpq32.exe
2020	Fmpqfq32.exe
4728	Gfheof32.exe
4544	Gpqjglii.exe
1100	Glgjlm32.exe
408	Gkhkjd32.exe
1428	Gljgbllj.exe
756	Gkkgpc32.exe
1336	Gbfldf32.exe
5088	Hdehni32.exe
456	Hibafp32.exe
540	Hdhedh32.exe
3516	Hdjbiheb.exe
2192	Higjaoci.exe
1468	Hcblpdgg.exe
440	Ipflihfq.exe
4944	Igpdfb32.exe
4536	Icfekc32.exe
4572	Iciaqc32.exe
3104	Idhnkf32.exe
3752	Jncoikmp.exe
1280	Jkgpbp32.exe
1652	Jdodkebj.exe
4952	Jnhidk32.exe
3164	Jcdala32.exe
4508	Jnjejjgh.exe
4708	Jjafok32.exe
880	Jdfjld32.exe
1808	Kmaopfjm.exe
2876	Kjepjkhf.exe
448	Kcndbp32.exe
3128	Kqbdldnq.exe
1668	Kjjiej32.exe
4172	Kdpmbc32.exe
3792	Kmkbfeab.exe
3844	Ljobpiql.exe
3956	Lcggio32.exe
4056	Lqkgbcff.exe
552	Lkalplel.exe
5100	Lqndhcdc.exe
5044	Lnadagbm.exe
732	Lgjijmin.exe
4344	Lqbncb32.exe
4856	Mnfnlf32.exe
5128	Mccfdmmo.exe
5172	Mmkkmc32.exe
5216	Mmnhcb32.exe
5264	Malpia32.exe
5304	Meiioonj.exe
5344	Nmigoagp.exe
5388	Nhokljge.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Higjaoci.exe	Hdjbiheb.exe
File opened for modification	C:\Windows\SysWOW64\Neclenfo.exe	Nhokljge.exe
File created	C:\Windows\SysWOW64\Lepglifa.dll	a9fb397b74ffe39389507b3581d5ea28.exe
File created	C:\Windows\SysWOW64\Jdfjld32.exe	Jjafok32.exe
File created	C:\Windows\SysWOW64\Lqkgbcff.exe	Lcggio32.exe
File created	C:\Windows\SysWOW64\Aphblj32.dll	Bahkih32.exe
File created	C:\Windows\SysWOW64\Chfegk32.exe	Cammjakm.exe
File created	C:\Windows\SysWOW64\Leboon32.dll	Klbnajqc.exe
File opened for modification	C:\Windows\SysWOW64\Qckfid32.exe	Qejfkmem.exe
File opened for modification	C:\Windows\SysWOW64\Glgjlm32.exe	Gpqjglii.exe
File opened for modification	C:\Windows\SysWOW64\Lqbncb32.exe	Lgjijmin.exe
File created	C:\Windows\SysWOW64\Cghane32.dll	Cdnmfclj.exe
File created	C:\Windows\SysWOW64\Abdkep32.dll	Eecphp32.exe
File opened for modification	C:\Windows\SysWOW64\Fpgpgfmh.exe	Ffnknafg.exe
File created	C:\Windows\SysWOW64\Lpcncmnn.dll	Iojbpo32.exe
File created	C:\Windows\SysWOW64\Pbjddh32.exe	Pfccogfc.exe
File created	C:\Windows\SysWOW64\Jkgpbp32.exe	Jncoikmp.exe
File opened for modification	C:\Windows\SysWOW64\Ckjknfnh.exe	Caageq32.exe
File created	C:\Windows\SysWOW64\Nqfbpb32.exe	Nfqnbjfi.exe
File created	C:\Windows\SysWOW64\Cemeoh32.exe	Cifdjg32.exe
File created	C:\Windows\SysWOW64\Kjeiodek.exe	Komhll32.exe
File created	C:\Windows\SysWOW64\Nknjec32.dll	Kofdhd32.exe
File created	C:\Windows\SysWOW64\Inkaqb32.exe	Iagqgn32.exe
File opened for modification	C:\Windows\SysWOW64\Ohhfknjf.exe	Oooaah32.exe
File opened for modification	C:\Windows\SysWOW64\Meiioonj.exe	Malpia32.exe
File opened for modification	C:\Windows\SysWOW64\Cnkkjh32.exe	Chnbbqpn.exe
File created	C:\Windows\SysWOW64\Ddnfmqng.exe	Dkfadkgf.exe
File created	C:\Windows\SysWOW64\Mqafhl32.exe	Lcnfohmi.exe
File opened for modification	C:\Windows\SysWOW64\Ogcnmc32.exe	Omnjojpo.exe
File opened for modification	C:\Windows\SysWOW64\Hajkqfoe.exe	Hioflcbj.exe
File opened for modification	C:\Windows\SysWOW64\Lkalplel.exe	Lqkgbcff.exe
File created	C:\Windows\SysWOW64\Micgbemj.dll	Cdpjlb32.exe
File created	C:\Windows\SysWOW64\Minqeaad.dll	Lqhdbm32.exe
File created	C:\Windows\SysWOW64\Ibepke32.dll	Keifdpif.exe
File opened for modification	C:\Windows\SysWOW64\Mohbjkgp.exe	Mcabej32.exe
File created	C:\Windows\SysWOW64\Eijbed32.dll	Ndpjnq32.exe
File created	C:\Windows\SysWOW64\Gkhkjd32.exe	Glgjlm32.exe
File created	C:\Windows\SysWOW64\Dempqa32.dll	Nmkmjjaa.exe
File created	C:\Windows\SysWOW64\Dnljkk32.exe	Daeifj32.exe
File created	C:\Windows\SysWOW64\Oooaah32.exe	Ofgmib32.exe
File created	C:\Windows\SysWOW64\Imdnon32.dll	Dinjjf32.exe
File created	C:\Windows\SysWOW64\Eiohdo32.dll	Hibafp32.exe
File created	C:\Windows\SysWOW64\Ajihlijd.dll	Lqbncb32.exe
File opened for modification	C:\Windows\SysWOW64\Lckiihok.exe	Lgdidgjg.exe
File created	C:\Windows\SysWOW64\Mqimikfj.exe	Moipoh32.exe
File opened for modification	C:\Windows\SysWOW64\Ciihjmcj.exe	Cmbgdl32.exe
File opened for modification	C:\Windows\SysWOW64\Epdime32.exe	Ekgqennl.exe
File opened for modification	C:\Windows\SysWOW64\Cofnik32.exe	Cdpjlb32.exe
File created	C:\Windows\SysWOW64\Kfnfjehl.exe	Koaagkcb.exe
File created	C:\Windows\SysWOW64\Bgkiaj32.exe	Aaoaic32.exe
File created	C:\Windows\SysWOW64\Mfikmmob.dll	Ekljpm32.exe
File created	C:\Windows\SysWOW64\Cogcho32.dll	Pofhbgmn.exe
File created	C:\Windows\SysWOW64\Dggkcakg.dll	Aimhmkgn.exe
File created	C:\Windows\SysWOW64\Efpgoecp.dll	Hdehni32.exe
File created	C:\Windows\SysWOW64\Coadnlnb.exe	Cfipef32.exe
File created	C:\Windows\SysWOW64\Ckjinf32.dll	Gifkpknp.exe
File created	C:\Windows\SysWOW64\Mgmodn32.dll	Bgkiaj32.exe
File created	C:\Windows\SysWOW64\Obhehh32.dll	Qjhbfd32.exe
File created	C:\Windows\SysWOW64\Jjfaml32.dll	Mlbpma32.exe
File created	C:\Windows\SysWOW64\Oanokhdb.exe	Ojdgnn32.exe
File created	C:\Windows\SysWOW64\Omfmcjlk.dll	Ocaebc32.exe
File created	C:\Windows\SysWOW64\Baannc32.exe	Bgkiaj32.exe
File created	C:\Windows\SysWOW64\Clpchk32.dll	Jafdcbge.exe
File created	C:\Windows\SysWOW64\Nfqnbjfi.exe	Nofefp32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6028	5608	WerFault.exe	554

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Filclgic.dll"	Gbchdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngekilj.dll"	Ihmfco32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Adjjeieh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogcho32.dll"	Pofhbgmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fpjcgm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hibafp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iciaqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojqhdcii.dll"	Mfenglqf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okliqfhj.dll"	Gcnnllcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdnmfclj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Baannc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mablfnne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kjeiodek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jbncbpqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbpijjbj.dll"	Nkjckkcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iaedanal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Meiioonj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ocnabm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngqagcag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ahaceo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aimhmkgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhjhdagb.dll"	Hlbcnd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fjhmbihg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fjhmbihg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lcfidb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mablfnne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odedipge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lqkgbcff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bomfgoah.dll"	Malpia32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hbihjifh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecfjqmbc.dll"	Momcpa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nofefp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klfhhpnk.dll"	Fbaahf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oooaah32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gkhkjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdjgko32.dll"	Jdfjld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mfeeabda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gejqna32.dll"	Oonlfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obhehh32.dll"	Qjhbfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ekgqennl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cghane32.dll"	Cdnmfclj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kjeiodek.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njhgbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipbehfom.dll"	Lfbped32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcominjm.dll"	Bkmeha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqoppk32.dll"	Oooaah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbpnnj32.dll"	Djjebh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fmndpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdpjlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcqelbcc.dll"	Fdbkja32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mcabej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aagkhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ieccbbkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlmmnd32.dll"	Ljdkll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ekjded32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iehmmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ponfka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmcckk32.dll"	Jmbhoeid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Agimkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bpedeiff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfikmmob.dll"	Ekljpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieaqqigc.dll"	Ldfoad32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 3352	1640	a9fb397b74ffe39389507b3581d5ea28.exe	96
PID 1640 wrote to memory of 3352	1640	a9fb397b74ffe39389507b3581d5ea28.exe	96
PID 1640 wrote to memory of 3352	1640	a9fb397b74ffe39389507b3581d5ea28.exe	96
PID 3352 wrote to memory of 3620	3352	Dpbdopck.exe	97
PID 3352 wrote to memory of 3620	3352	Dpbdopck.exe	97
PID 3352 wrote to memory of 3620	3352	Dpbdopck.exe	97
PID 3620 wrote to memory of 4340	3620	Djjebh32.exe	98
PID 3620 wrote to memory of 4340	3620	Djjebh32.exe	98
PID 3620 wrote to memory of 4340	3620	Djjebh32.exe	98
PID 4340 wrote to memory of 3796	4340	Eiobceef.exe	99
PID 4340 wrote to memory of 3796	4340	Eiobceef.exe	99
PID 4340 wrote to memory of 3796	4340	Eiobceef.exe	99
PID 3796 wrote to memory of 2200	3796	Ebhglj32.exe	100
PID 3796 wrote to memory of 2200	3796	Ebhglj32.exe	100
PID 3796 wrote to memory of 2200	3796	Ebhglj32.exe	100
PID 2200 wrote to memory of 4968	2200	Ebjcajjd.exe	101
PID 2200 wrote to memory of 4968	2200	Ebjcajjd.exe	101
PID 2200 wrote to memory of 4968	2200	Ebjcajjd.exe	101
PID 4968 wrote to memory of 4644	4968	Eciplm32.exe	102
PID 4968 wrote to memory of 4644	4968	Eciplm32.exe	102
PID 4968 wrote to memory of 4644	4968	Eciplm32.exe	102
PID 4644 wrote to memory of 1448	4644	Eleepoob.exe	103
PID 4644 wrote to memory of 1448	4644	Eleepoob.exe	103
PID 4644 wrote to memory of 1448	4644	Eleepoob.exe	103
PID 1448 wrote to memory of 3028	1448	Eiieicml.exe	104
PID 1448 wrote to memory of 3028	1448	Eiieicml.exe	104
PID 1448 wrote to memory of 3028	1448	Eiieicml.exe	104
PID 3028 wrote to memory of 1884	3028	Fbajbi32.exe	105
PID 3028 wrote to memory of 1884	3028	Fbajbi32.exe	105
PID 3028 wrote to memory of 1884	3028	Fbajbi32.exe	105
PID 1884 wrote to memory of 4492	1884	Fdqfll32.exe	106
PID 1884 wrote to memory of 4492	1884	Fdqfll32.exe	106
PID 1884 wrote to memory of 4492	1884	Fdqfll32.exe	106
PID 4492 wrote to memory of 1452	4492	Fimodc32.exe	107
PID 4492 wrote to memory of 1452	4492	Fimodc32.exe	107
PID 4492 wrote to memory of 1452	4492	Fimodc32.exe	107
PID 1452 wrote to memory of 4804	1452	Fjmkoeqi.exe	108
PID 1452 wrote to memory of 4804	1452	Fjmkoeqi.exe	108
PID 1452 wrote to memory of 4804	1452	Fjmkoeqi.exe	108
PID 4804 wrote to memory of 4252	4804	Fpjcgm32.exe	109
PID 4804 wrote to memory of 4252	4804	Fpjcgm32.exe	109
PID 4804 wrote to memory of 4252	4804	Fpjcgm32.exe	109
PID 4252 wrote to memory of 2020	4252	Fmndpq32.exe	110
PID 4252 wrote to memory of 2020	4252	Fmndpq32.exe	110
PID 4252 wrote to memory of 2020	4252	Fmndpq32.exe	110
PID 2020 wrote to memory of 4728	2020	Fmpqfq32.exe	111
PID 2020 wrote to memory of 4728	2020	Fmpqfq32.exe	111
PID 2020 wrote to memory of 4728	2020	Fmpqfq32.exe	111
PID 4728 wrote to memory of 4544	4728	Gfheof32.exe	112
PID 4728 wrote to memory of 4544	4728	Gfheof32.exe	112
PID 4728 wrote to memory of 4544	4728	Gfheof32.exe	112
PID 4544 wrote to memory of 1100	4544	Gpqjglii.exe	113
PID 4544 wrote to memory of 1100	4544	Gpqjglii.exe	113
PID 4544 wrote to memory of 1100	4544	Gpqjglii.exe	113
PID 1100 wrote to memory of 408	1100	Glgjlm32.exe	114
PID 1100 wrote to memory of 408	1100	Glgjlm32.exe	114
PID 1100 wrote to memory of 408	1100	Glgjlm32.exe	114
PID 408 wrote to memory of 1428	408	Gkhkjd32.exe	115
PID 408 wrote to memory of 1428	408	Gkhkjd32.exe	115
PID 408 wrote to memory of 1428	408	Gkhkjd32.exe	115
PID 1428 wrote to memory of 756	1428	Gljgbllj.exe	116
PID 1428 wrote to memory of 756	1428	Gljgbllj.exe	116
PID 1428 wrote to memory of 756	1428	Gljgbllj.exe	116
PID 756 wrote to memory of 1336	756	Gkkgpc32.exe	117

C:\Users\Admin\AppData\Local\Temp\a9fb397b74ffe39389507b3581d5ea28.exe
"C:\Users\Admin\AppData\Local\Temp\a9fb397b74ffe39389507b3581d5ea28.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\Dpbdopck.exe
  C:\Windows\system32\Dpbdopck.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\SysWOW64\Djjebh32.exe
    C:\Windows\system32\Djjebh32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3620
  - - C:\Windows\SysWOW64\Eiobceef.exe
      C:\Windows\system32\Eiobceef.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4340
    - - C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3796
      - C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1448
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1884
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4492
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1452
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:408
        
        C:\Windows\SysWOW64\Gljgbllj.exe
        
        C:\Windows\system32\Gljgbllj.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1428
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        23⤵
        Executes dropped EXE
        
        PID:1336
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5088
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:456
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        26⤵
        Executes dropped EXE
        
        PID:540
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3516
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        28⤵
        Executes dropped EXE
        
        PID:2192
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        29⤵
        Executes dropped EXE
        
        PID:1468
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        30⤵
        Executes dropped EXE
        
        PID:440
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        31⤵
        Executes dropped EXE
        
        PID:4944
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        32⤵
        Executes dropped EXE
        
        PID:4536
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4572
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        34⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3752
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        36⤵
        Executes dropped EXE
        
        PID:1280
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        37⤵
        Executes dropped EXE
        
        PID:1652
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        38⤵
        Executes dropped EXE
        
        PID:4952
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        39⤵
        Executes dropped EXE
        
        PID:3164
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        40⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4708
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:880
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        43⤵
        Executes dropped EXE
        
        PID:1808
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        44⤵
        Executes dropped EXE
        
        PID:2876
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        45⤵
        Executes dropped EXE
        
        PID:448
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        46⤵
        Executes dropped EXE
        
        PID:3128
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        47⤵
        Executes dropped EXE
        
        PID:1668
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        48⤵
        Executes dropped EXE
        
        PID:4172
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        49⤵
        Executes dropped EXE
        
        PID:3792
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        50⤵
        Executes dropped EXE
        
        PID:3844
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3956
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4056
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        53⤵
        Executes dropped EXE
        
        PID:552
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        54⤵
        Executes dropped EXE
        
        PID:5100
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        55⤵
        Executes dropped EXE
        
        PID:5044
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:732
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4344
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4856
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        59⤵
        Executes dropped EXE
        
        PID:5128
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        60⤵
        Executes dropped EXE
        
        PID:5172
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        61⤵
        Executes dropped EXE
        
        PID:5216
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        64⤵
        Executes dropped EXE
        
        PID:5344
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        66⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        67⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5512
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5556
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        70⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        71⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        72⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        73⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        74⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        75⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        76⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        77⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        78⤵
        Modifies registry class
        
        PID:5920
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        79⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        80⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        81⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        82⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        83⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        84⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        85⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5288
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5384
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5456
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        89⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5592
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        91⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        92⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        93⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5904
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5988
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        96⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6120
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5224
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        99⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5428
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        101⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5668
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        103⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        104⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1128
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        105⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        106⤵
        Drops file in System32 directory
        
        PID:6116
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        107⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        108⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        109⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4476
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        111⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        112⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        113⤵
        Drops file in System32 directory
        
        PID:5352
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        114⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        115⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        116⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        117⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        118⤵
        Drops file in System32 directory
        
        PID:2360
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        119⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5536
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        121⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        122⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        123⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6248
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        125⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        126⤵
        Drops file in System32 directory
        
        PID:6340
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        127⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        128⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        129⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        130⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        131⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        132⤵
        Drops file in System32 directory
        
        PID:6628
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        133⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        134⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        135⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        136⤵
        Modifies registry class
        
        PID:6824
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        137⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        138⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6952
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7000
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        141⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        142⤵
        Modifies registry class
        
        PID:7084
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        143⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5576
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6240
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        146⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        147⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        148⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        149⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        150⤵
        Drops file in System32 directory
        
        PID:6576
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        151⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        152⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        153⤵
        Modifies registry class
        
        PID:6812
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        154⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        155⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        156⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        157⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        158⤵
        Drops file in System32 directory
        
        PID:6244
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        159⤵
        Modifies registry class
        
        PID:6312
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        160⤵
        Drops file in System32 directory
        
        PID:6432
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        161⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        162⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        163⤵
        Modifies registry class
        
        PID:6708
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        164⤵
        Drops file in System32 directory
        
        PID:6868
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        165⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        166⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6224
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        168⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        169⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6716
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        171⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        172⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        173⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6616
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        175⤵
        Drops file in System32 directory
        
        PID:6904
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        176⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        177⤵
        Modifies registry class
        
        PID:6540
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        178⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        179⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6556
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7176
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        182⤵
        Modifies registry class
        
        PID:7212
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        183⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        184⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        185⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        186⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        187⤵
        Drops file in System32 directory
        
        PID:7432
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7472
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7524
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        190⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        191⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        192⤵
        Drops file in System32 directory
        
        PID:7648
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        193⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        194⤵
        Drops file in System32 directory
        
        PID:7752
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        195⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        196⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        197⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        198⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        199⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        200⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        201⤵
        Modifies registry class
        
        PID:8092
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8144
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        203⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        204⤵
        Modifies registry class
        
        PID:7208
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        205⤵
        Modifies registry class
        
        PID:7268
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        206⤵
        Modifies registry class
        
        PID:7368
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        207⤵
        Drops file in System32 directory
        
        PID:7428
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        208⤵
        Drops file in System32 directory
        
        PID:6820
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        209⤵
        Modifies registry class
        
        PID:5768
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7548
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        211⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        212⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        213⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7832
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        215⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        216⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        217⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        218⤵
        Drops file in System32 directory
        
        PID:8140
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        219⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        220⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        221⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        222⤵
        Drops file in System32 directory
        
        PID:7420
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        223⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        224⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        225⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        226⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        227⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        228⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        229⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        230⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        231⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        232⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7820
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        234⤵
        Modifies registry class
        
        PID:7880
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        235⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        236⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        237⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        238⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        239⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        240⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        241⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        242⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        243⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        244⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        245⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        246⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8272
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        248⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        249⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        250⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        251⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        252⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        253⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        254⤵
        Drops file in System32 directory
        
        PID:8624
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        255⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8712
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        257⤵
        Modifies registry class
        
        PID:8764
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8808
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        259⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        260⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        261⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        262⤵
        Modifies registry class
        
        PID:9016
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        263⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        264⤵
        Modifies registry class
        
        PID:9112
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        265⤵
        Modifies registry class
        
        PID:9152
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        266⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        267⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        268⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        269⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        270⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        271⤵
        Drops file in System32 directory
        
        PID:8464
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        272⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        273⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8652
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        275⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        276⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        277⤵
        Drops file in System32 directory
        
        PID:8856
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7644
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8960
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        280⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9048
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        282⤵
        Drops file in System32 directory
        
        PID:9108
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        283⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        284⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        285⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        286⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        287⤵
        Modifies registry class
        
        PID:8524
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        288⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        289⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        290⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        291⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        292⤵
        Modifies registry class
        
        PID:4528
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        293⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9192
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        295⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        296⤵
        Modifies registry class
        
        PID:8444
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        297⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8724
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        299⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        300⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        301⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8408
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        303⤵
        Modifies registry class
        
        PID:8772
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        304⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9140
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        306⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        307⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8328
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        309⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        310⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        311⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8580
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        312⤵
        Drops file in System32 directory
        
        PID:9252
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        313⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        314⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        315⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        316⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        317⤵
        Modifies registry class
        
        PID:9516
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        318⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        319⤵
        Modifies registry class
        
        PID:9620
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        320⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        321⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        322⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        323⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        324⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        325⤵
        Drops file in System32 directory
        
        PID:9928
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        326⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        327⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        328⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10144
        
        C:\Windows\SysWOW64\Qppaclio.exe
        
        C:\Windows\system32\Qppaclio.exe
        330⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        331⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Qpbnhl32.exe
        
        C:\Windows\system32\Qpbnhl32.exe
        332⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Qjhbfd32.exe
        
        C:\Windows\system32\Qjhbfd32.exe
        333⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9336
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        334⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Apggckbf.exe
        
        C:\Windows\system32\Apggckbf.exe
        335⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Amkhmoap.exe
        
        C:\Windows\system32\Amkhmoap.exe
        336⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Afcmfe32.exe
        
        C:\Windows\system32\Afcmfe32.exe
        337⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        338⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Aidehpea.exe
        
        C:\Windows\system32\Aidehpea.exe
        339⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        340⤵
        Modifies registry class
        
        PID:9852
        
        C:\Windows\SysWOW64\Bigbmpco.exe
        
        C:\Windows\system32\Bigbmpco.exe
        341⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Bfkbfd32.exe
        
        C:\Windows\system32\Bfkbfd32.exe
        342⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Bmdkcnie.exe
        
        C:\Windows\system32\Bmdkcnie.exe
        343⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Bdocph32.exe
        
        C:\Windows\system32\Bdocph32.exe
        344⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        345⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        346⤵
        Modifies registry class
        
        PID:7600
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        347⤵
        Modifies registry class
        
        PID:9472
        
        C:\Windows\SysWOW64\Bbhildae.exe
        
        C:\Windows\system32\Bbhildae.exe
        348⤵
        
        PID:656
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        349⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Cmbgdl32.exe
        
        C:\Windows\system32\Cmbgdl32.exe
        350⤵
        Drops file in System32 directory
        
        PID:9696
        
        C:\Windows\SysWOW64\Ciihjmcj.exe
        
        C:\Windows\system32\Ciihjmcj.exe
        351⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        352⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        353⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:716
        
        C:\Windows\SysWOW64\Dnljkk32.exe
        
        C:\Windows\system32\Dnljkk32.exe
        355⤵
        
        PID:964
        
        C:\Windows\SysWOW64\Dkpjdo32.exe
        
        C:\Windows\system32\Dkpjdo32.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4668
        
        C:\Windows\SysWOW64\Dckoia32.exe
        
        C:\Windows\system32\Dckoia32.exe
        357⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Dkedonpo.exe
        
        C:\Windows\system32\Dkedonpo.exe
        358⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Ekgqennl.exe
        
        C:\Windows\system32\Ekgqennl.exe
        359⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9808
        
        C:\Windows\SysWOW64\Epdime32.exe
        
        C:\Windows\system32\Epdime32.exe
        360⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Ejlnfjbd.exe
        
        C:\Windows\system32\Ejlnfjbd.exe
        361⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Ekljpm32.exe
        
        C:\Windows\system32\Ekljpm32.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3420
        
        C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        363⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Eajlhg32.exe
        
        C:\Windows\system32\Eajlhg32.exe
        364⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Fkcpql32.exe
        
        C:\Windows\system32\Fkcpql32.exe
        365⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Fqphic32.exe
        
        C:\Windows\system32\Fqphic32.exe
        366⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        367⤵
        Modifies registry class
        
        PID:4792
        
        C:\Windows\SysWOW64\Fbaahf32.exe
        
        C:\Windows\system32\Fbaahf32.exe
        368⤵
        Modifies registry class
        
        PID:5092
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        369⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        370⤵
        Modifies registry class
        
        PID:9512
        
        C:\Windows\SysWOW64\Gnmlhf32.exe
        
        C:\Windows\system32\Gnmlhf32.exe
        371⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Ggepalof.exe
        
        C:\Windows\system32\Ggepalof.exe
        372⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Gdiakp32.exe
        
        C:\Windows\system32\Gdiakp32.exe
        373⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Gcnnllcg.exe
        
        C:\Windows\system32\Gcnnllcg.exe
        374⤵
        Modifies registry class
        
        PID:2352
        
        C:\Windows\SysWOW64\Gnfooe32.exe
        
        C:\Windows\system32\Gnfooe32.exe
        375⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\Hcedmkmp.exe
        
        C:\Windows\system32\Hcedmkmp.exe
        376⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\Hgcmbj32.exe
        
        C:\Windows\system32\Hgcmbj32.exe
        377⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Hjdedepg.exe
        
        C:\Windows\system32\Hjdedepg.exe
        378⤵
        
        PID:464

C:\Windows\SysWOW64\Hcljmj32.exe
C:\Windows\system32\Hcljmj32.exe
1⤵
PID:1708
- C:\Windows\SysWOW64\Hnbnjc32.exe
  C:\Windows\system32\Hnbnjc32.exe
  2⤵
  PID:4648
- - C:\Windows\SysWOW64\Igjbci32.exe
    C:\Windows\system32\Igjbci32.exe
    3⤵
    PID:9388
  - - C:\Windows\SysWOW64\Iabglnco.exe
      C:\Windows\system32\Iabglnco.exe
      4⤵
      PID:3888
    - - C:\Windows\SysWOW64\Ilhkigcd.exe
        
        C:\Windows\system32\Ilhkigcd.exe
        5⤵
        
        PID:3328
      - C:\Windows\SysWOW64\Iaedanal.exe
        
        C:\Windows\system32\Iaedanal.exe
        6⤵
        Modifies registry class
        
        PID:9744
        
        C:\Windows\SysWOW64\Iholohii.exe
        
        C:\Windows\system32\Iholohii.exe
        7⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\Iagqgn32.exe
        
        C:\Windows\system32\Iagqgn32.exe
        8⤵
        Drops file in System32 directory
        
        PID:3256
        
        C:\Windows\SysWOW64\Inkaqb32.exe
        
        C:\Windows\system32\Inkaqb32.exe
        9⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\Jaljbmkd.exe
        
        C:\Windows\system32\Jaljbmkd.exe
        10⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\Jldkeeig.exe
        
        C:\Windows\system32\Jldkeeig.exe
        11⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Jbncbpqd.exe
        
        C:\Windows\system32\Jbncbpqd.exe
        12⤵
        Modifies registry class
        
        PID:9400
        
        C:\Windows\SysWOW64\Jlfhke32.exe
        
        C:\Windows\system32\Jlfhke32.exe
        13⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Jacpcl32.exe
        
        C:\Windows\system32\Jacpcl32.exe
        14⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\Jeaiij32.exe
        
        C:\Windows\system32\Jeaiij32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:772
        
        C:\Windows\SysWOW64\Koljgppp.exe
        
        C:\Windows\system32\Koljgppp.exe
        16⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Klpjad32.exe
        
        C:\Windows\system32\Klpjad32.exe
        17⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\Kdmlkfjb.exe
        
        C:\Windows\system32\Kdmlkfjb.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3384
        
        C:\Windows\SysWOW64\Kocphojh.exe
        
        C:\Windows\system32\Kocphojh.exe
        19⤵
        
        PID:1624

C:\Windows\SysWOW64\Kdpiqehp.exe
C:\Windows\system32\Kdpiqehp.exe
1⤵
PID:1720
- C:\Windows\SysWOW64\Lbqinm32.exe
  C:\Windows\system32\Lbqinm32.exe
  2⤵
  PID:1316
- - C:\Windows\SysWOW64\Llkjmb32.exe
    C:\Windows\system32\Llkjmb32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:4716
  - - C:\Windows\SysWOW64\Ldfoad32.exe
      C:\Windows\system32\Ldfoad32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Modifies registry class
      PID:10160
    - - C:\Windows\SysWOW64\Lkqgno32.exe
        
        C:\Windows\system32\Lkqgno32.exe
        5⤵
        
        PID:1560
      - C:\Windows\SysWOW64\Llpchaqg.exe
        
        C:\Windows\system32\Llpchaqg.exe
        6⤵
        
        PID:416
        
        C:\Windows\SysWOW64\Lamlphoo.exe
        
        C:\Windows\system32\Lamlphoo.exe
        7⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\Mlbpma32.exe
        
        C:\Windows\system32\Mlbpma32.exe
        8⤵
        Drops file in System32 directory
        
        PID:3260
        
        C:\Windows\SysWOW64\Mhiabbdi.exe
        
        C:\Windows\system32\Mhiabbdi.exe
        9⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Mdpagc32.exe
        
        C:\Windows\system32\Mdpagc32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9568
        
        C:\Windows\SysWOW64\Mcabej32.exe
        
        C:\Windows\system32\Mcabej32.exe
        11⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1976
        
        C:\Windows\SysWOW64\Mohbjkgp.exe
        
        C:\Windows\system32\Mohbjkgp.exe
        12⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Mllccpfj.exe
        
        C:\Windows\system32\Mllccpfj.exe
        13⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Nhbciqln.exe
        
        C:\Windows\system32\Nhbciqln.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2192
        
        C:\Windows\SysWOW64\Nakhaf32.exe
        
        C:\Windows\system32\Nakhaf32.exe
        15⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Nooikj32.exe
        
        C:\Windows\system32\Nooikj32.exe
        16⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Nfiagd32.exe
        
        C:\Windows\system32\Nfiagd32.exe
        17⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Ncmaai32.exe
        
        C:\Windows\system32\Ncmaai32.exe
        18⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\Nlefjnno.exe
        
        C:\Windows\system32\Nlefjnno.exe
        19⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\Ndpjnq32.exe
        
        C:\Windows\system32\Ndpjnq32.exe
        20⤵
        Drops file in System32 directory
        
        PID:1808
        
        C:\Windows\SysWOW64\Nkjckkcg.exe
        
        C:\Windows\system32\Nkjckkcg.exe
        21⤵
        Modifies registry class
        
        PID:224
        
        C:\Windows\SysWOW64\Oljoen32.exe
        
        C:\Windows\system32\Oljoen32.exe
        22⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\Odedipge.exe
        
        C:\Windows\system32\Odedipge.exe
        23⤵
        Modifies registry class
        
        PID:2100
        
        C:\Windows\SysWOW64\Ocfdgg32.exe
        
        C:\Windows\system32\Ocfdgg32.exe
        24⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Oloipmfd.exe
        
        C:\Windows\system32\Oloipmfd.exe
        25⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Ofgmib32.exe
        
        C:\Windows\system32\Ofgmib32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4204
        
        C:\Windows\SysWOW64\Oooaah32.exe
        
        C:\Windows\system32\Oooaah32.exe
        27⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4736
        
        C:\Windows\SysWOW64\Ohhfknjf.exe
        
        C:\Windows\system32\Ohhfknjf.exe
        28⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\Obpkcc32.exe
        
        C:\Windows\system32\Obpkcc32.exe
        29⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Pkholi32.exe
        
        C:\Windows\system32\Pkholi32.exe
        30⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\Pofhbgmn.exe
        
        C:\Windows\system32\Pofhbgmn.exe
        31⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3484
        
        C:\Windows\SysWOW64\Pmjhlklg.exe
        
        C:\Windows\system32\Pmjhlklg.exe
        32⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Pkoemhao.exe
        
        C:\Windows\system32\Pkoemhao.exe
        33⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\Pomncfge.exe
        
        C:\Windows\system32\Pomncfge.exe
        34⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Qejfkmem.exe
        
        C:\Windows\system32\Qejfkmem.exe
        35⤵
        Drops file in System32 directory
        
        PID:4244
        
        C:\Windows\SysWOW64\Qckfid32.exe
        
        C:\Windows\system32\Qckfid32.exe
        36⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Qmckbjdl.exe
        
        C:\Windows\system32\Qmckbjdl.exe
        37⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\Akihcfid.exe
        
        C:\Windows\system32\Akihcfid.exe
        38⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Aimhmkgn.exe
        
        C:\Windows\system32\Aimhmkgn.exe
        39⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4856
        
        C:\Windows\SysWOW64\Acbmjcgd.exe
        
        C:\Windows\system32\Acbmjcgd.exe
        40⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\Aiabhj32.exe
        
        C:\Windows\system32\Aiabhj32.exe
        41⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Aidomjaf.exe
        
        C:\Windows\system32\Aidomjaf.exe
        42⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Bfhofnpp.exe
        
        C:\Windows\system32\Bfhofnpp.exe
        43⤵
        
        PID:724
        
        C:\Windows\SysWOW64\Bldgoeog.exe
        
        C:\Windows\system32\Bldgoeog.exe
        44⤵
        
        PID:380
        
        C:\Windows\SysWOW64\Bpbpecen.exe
        
        C:\Windows\system32\Bpbpecen.exe
        45⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Bpgjpb32.exe
        
        C:\Windows\system32\Bpgjpb32.exe
        46⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Bipnihgi.exe
        
        C:\Windows\system32\Bipnihgi.exe
        47⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Cefoni32.exe
        
        C:\Windows\system32\Cefoni32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6016
        
        C:\Windows\SysWOW64\Cplckbmc.exe
        
        C:\Windows\system32\Cplckbmc.exe
        49⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\Cmpcdfll.exe
        
        C:\Windows\system32\Cmpcdfll.exe
        50⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Cifdjg32.exe
        
        C:\Windows\system32\Cifdjg32.exe
        51⤵
        Drops file in System32 directory
        
        PID:10140
        
        C:\Windows\SysWOW64\Cemeoh32.exe
        
        C:\Windows\system32\Cemeoh32.exe
        52⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\Dinjjf32.exe
        
        C:\Windows\system32\Dinjjf32.exe
        53⤵
        Drops file in System32 directory
        
        PID:5384
        
        C:\Windows\SysWOW64\Dipgpf32.exe
        
        C:\Windows\system32\Dipgpf32.exe
        54⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        55⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5608 -s 416
        56⤵
        Program crash
        
        PID:6028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5608 -ip 5608
1⤵
PID:6084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3772 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:6004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Amjbbfgo.exe

Filesize
72KB

MD5
6119653bc8506505e8dd3ab43c138b48

SHA1
3ca1adc68fbda8d8f3efc47b673ca4e85f437d55

SHA256
a3b4f6a0ecb24b40f02095f4884e77407690e972c10edc9878416fbd00d645d7

SHA512
3537611cda655d9fc408191e8874054d9f4999f6464771b78f28072a7400864f1ee04b518e592085379ef9e4819668616416020105ca9106e5f0f3045f4c2c15

Download Submit
C:\Windows\SysWOW64\Chnbbqpn.exe

Filesize
72KB

MD5
f5e3070f6974ea91dc4d8ed2a7f9eb2d

SHA1
1819be5ff4f3d83a05c287c21d5f019d6a6ba2ce

SHA256
dcf37120174bf7d6c4da7283a110d8046337ad135791058798b132deec8abfb2

SHA512
bd1aab94db81ac59f5eee8ef64f45b68b3733c6a90ebbe51a44497b919835b123f28dc18df161f7f3ba1ef7af0e6a869e42d6e07ad471041523242a65ec9e1ba

Download Submit
C:\Windows\SysWOW64\Djjebh32.exe

Filesize
72KB

MD5
aa78fb14fb7c639a6ba223dc3fcf7893

SHA1
5a8018d2b7329196f432b0105e2c0a6bb351c900

SHA256
3d449460ce702a490cfd78dc0405fc4f7df53319108a09d870c9862664b45f11

SHA512
f226d9565a4a08e5bb87f80b966ada63c94aa55293541d77c165a08bbc232c7bebb0b0ea1d68ca9e8166ee92a46359c4f33a5bf7be4b273311046f523c9cc0db

Download Submit
C:\Windows\SysWOW64\Dnljkk32.exe

Filesize
72KB

MD5
12ef3cf971f51100fb5a19df1b020059

SHA1
59a9645f08bf1bee1dd95233bf13913400292c23

SHA256
42c966b5f906ecfe1de1ec449fb490154294a5a0e9a518cc8bc682f0055180e4

SHA512
ab367ea9f4c55f87ce6d730232514e00c92c2ef32b389669a9f12360dbb7f2b7b95260575ccb5e61e0680e47fcd1dda86c9f9fd62183d4b36d01f7c0adbac937

Download Submit
C:\Windows\SysWOW64\Dpbdopck.exe

Filesize
72KB

MD5
66eecf6383ba18ca81fac73b4208e666

SHA1
94fd5d33598e0135268e0e1cffda36dcd0c49190

SHA256
19cfff4def66ab1391e0a4a4d5174c91bf96a1f090dee2ed6068de89f7ffb617

SHA512
2e0910c16ce2c7fc1e6e463e22b4ad9e09012c91174a2386f2270fb4462b6966b46f47a23ec4be23837e907d25019f4b85dcf03bcac4f1f51bd131ae4078a5d6

Download Submit
C:\Windows\SysWOW64\Ebhglj32.exe

Filesize
72KB

MD5
da3e489ea2a541aa080635f46cdf607c

SHA1
3dd3731559deff4dc2ab80611639f1e0841a8470

SHA256
ab1eac24652c30a3994e21433cea3586d83a3b50649eb686fbc79b96dfd16e86

SHA512
19def403184ca4d5809fad46059693cead9d392f889829f293f98c798a6991021a3baa19f9a9809540d42854f8afe46165835753b3c6b3b46ae2457707bd086f

Download Submit
C:\Windows\SysWOW64\Ebjcajjd.exe

Filesize
72KB

MD5
35bfdeb865deb0738778a6c31100eaee

SHA1
220308a7f03cdf76eb3bef3d09f9e7fca9c4896a

SHA256
cfae8fb043a04a4f86459383cff092a39733be1361a6b686e4f6d890ed1410dc

SHA512
9ca29a6dfa6c3838fc38bc1b54b53435987b9eab5e2a3dfafd78c9f0d21b47f98715c55749c31d6bc12f93ef46184f6491f7f5c42853b2340775e458eff0a0fb

Download Submit
C:\Windows\SysWOW64\Eciplm32.exe

Filesize
72KB

MD5
cbff7b8b5d3c0413fc8bcabe891b47bf

SHA1
a95a27721ec54b1f2f2c512e43954ac3671481e9

SHA256
391a86ce9633a3a01e791512b30ce0a2d6e80d139413b59529d62b4b563dd7a9

SHA512
b2d5225d657c5466f8e8563272cdb231434089068ff255a8736c551b3795ab3210583563abf655aa8d309e5671a507789482aa2d4d9c242dd3e6b1a2a1f70c31

Download Submit
C:\Windows\SysWOW64\Eiieicml.exe

Filesize
72KB

MD5
02ceb3e8e566a2ccc81e9d9954717e79

SHA1
c3c3314ed64734b146931c3d0cbb26167be2fed8

SHA256
8553bd71ec8a3cabafe3b20f1ac82df1cfb3eb9f0a8dd4478724427d25a4c4fc

SHA512
89f4bf2c30f01435fecd9c7bfcb393b91957ae0980ee85d33c7f295889285831453ea56aa4d19245dd332e2d5f560ead08c7982cba81cc7cd1c5eccbaba7fe97

Download Submit
C:\Windows\SysWOW64\Eiobceef.exe

Filesize
72KB

MD5
476cc4e5cd6ddfcebc2afb261b44fd74

SHA1
4ad4d73ea6e2f1a44225414636dc2d1112ebb467

SHA256
4906574080b177806d9148e13b471edc2a680021ea41e067b4231f8a5ad43e70

SHA512
101261a0139d86dd7041020947012391a60091ae915a5d6f03ccddc59879da7f28c41b06c6b6e61d71799f149a51bb9c0da2d9c1911a5aa6f264e2e1f178ef1f

Download Submit
C:\Windows\SysWOW64\Eleepoob.exe

Filesize
72KB

MD5
178dfb8e5414b0fef840770e88083422

SHA1
071db7f62aa7d04625677ac8223138d83507d57c

SHA256
cea3b58512176c6b870294871bb82485fc594a5460d0df1f0d33f2441f698255

SHA512
730abd4ecbbec0da0c3cdf3549fbbe0bdc66724107f707d913100cb3c8fa37794624586d8ab75044915cab98c6823be3d28f6571e55fc2414fa9422eaf6e8903

Download Submit
C:\Windows\SysWOW64\Fbajbi32.exe

Filesize
72KB

MD5
94ddf421a4e1bf5fd1a02c2be49f66a6

SHA1
b89c52be03a185324bb08cefe664df20f428513a

SHA256
37a1f2a124c8c2879988a52f85f3ec95a45d73293b8dfef28049595348177eab

SHA512
8fa613812a359abcd229b500e8bf44ffaa9ac0d3775f4cc19c57a0df5ab803a4b3390c1f588c496b4e10158196ea484912784edd2614c58bc3d5906bae4bbd42

Download Submit
C:\Windows\SysWOW64\Fdqfll32.exe

Filesize
72KB

MD5
14342215f455eabaa011ed1631f0103b

SHA1
341501aedca784fd32d3ebfc9c2c8bef674ffd32

SHA256
83d853fe034e4cdb0e516ac96f1fdd3340ba0f5213798e81d6fd8c2ce573f3c8

SHA512
885290c91146f383dcd3498fbc2121e04c1545f5580c7514cf6c4079255609c18e0efe239d467df4fcb943e20a03de15e8fa4040400775e29467996e9e6e3d52

Download Submit
C:\Windows\SysWOW64\Fhffdban.dll

Filesize
7KB

MD5
e7324078a00ae2b57967800a872fb9ce

SHA1
125c277c670a3569ef0334a2aa32f1ee9a6d867d

SHA256
ce39e3b5deff7fecf81a5d785689a9106dad6e4d867e286872bd2327813ee08c

SHA512
321cfb910201e06be1013a6950c97d809b6fe27c6ca1b482321ab6cd1aaf05f646043e4e510ff02b998c3aab9a144a2ce98029b1d518b7d42890395e5526bc41

Download Submit
C:\Windows\SysWOW64\Fimodc32.exe

Filesize
72KB

MD5
70f0d69f2778628a49c9b777077c729d

SHA1
88595e81c95508300ece515ac1dba1496598d7f9

SHA256
2b20d43a654dbd0155ea1a235eddad3813f02d7c8061fb49085022627e4106c1

SHA512
72ebeddc68849948dd47dce24c86e5005e0737bdda05173bb1f003a6e60ccd9f97a95f8ec100b2f7f396c1881ba30736a3ba60b7aabacea99132782b93ed45d2

Download Submit
C:\Windows\SysWOW64\Fjmkoeqi.exe

Filesize
72KB

MD5
34247b70b94e6f2735838edb73a1ac0f

SHA1
ad594055d7635ae004ce7ddab4402ec450a18add

SHA256
7810f6d5bf2ddcb5fe907d6a33733fc13e82faeb4854032b81d19d07c4693479

SHA512
e1613abc37aba8864e306fd35ee2fb83ddf57b10e395367d0c7847a4642a97fcbe6b8e79c02eb422efda67516721e0c4a0e65e1da1133dc0899d756a45868f0b

Download Submit
C:\Windows\SysWOW64\Fmndpq32.exe

Filesize
72KB

MD5
1b9fb8222babc2a94eea5bbb77db6f0e

SHA1
d10f0c044c2d35578687f6660019a56a2fee0700

SHA256
a097411c4199c44ede0b4c7d31c2ad6d496cfdf86b1d18560437b54e4123d59a

SHA512
9ed0f2d34a620fc1cb6a587d458e4e9009859fedda3096a3ac7a8c90201cc1b6d2939cfc5a3ddec8f2aa640a88bdf7637cfe07fc2e2b88ddb9fb8f5773e7c4aa

Download Submit
C:\Windows\SysWOW64\Fmpqfq32.exe

Filesize
72KB

MD5
5e5afeb0ecb0b93584682da4752fd505

SHA1
acfd75296ff100864da77535d4e135e1e34b1d9d

SHA256
4ffb4f084d6ad533c26190674f3944c68e7b123cef8cdfcb1e9e4c4112fb41bc

SHA512
5b078310b848b9358bcd1fd2e864f3518e212ae52d1304a79ef903740862fecc50e2c063b25b1fea95f9a5fc26270e7ff1e2a96cd1f395f58ed57242990b3bf7

Download Submit
C:\Windows\SysWOW64\Fpjcgm32.exe

Filesize
72KB

MD5
b4dd090bd63917b82f2ab72a9bb1e958

SHA1
c8a249bcb189b2b370d9ef171d401bc273566446

SHA256
ee8b2e483e22a431d4425876e502060ad2fa0325e726fe886de3adf31f514b33

SHA512
cf68f41b81178d844137fbe927000a47d374bfbe4991bd84be6fb0769c5ef04bb1eef45913a70a829c72f1ada74cfd8ddb6a636aeb5ffd1561f4697eb7d18811

Download Submit
C:\Windows\SysWOW64\Gbfldf32.exe

Filesize
72KB

MD5
2b2bb99a9b4042a0cf9df4d0056c1e9a

SHA1
da3d11a1406fedce72d4c00cb66688228a568b95

SHA256
dc9690342090323b0d94855e26cb00f4000bfec448acac50ecec9eb07fe81fb9

SHA512
d98c1d57e11527a98e5299dfe3a15d3d6032c8ad61f8759c48ba0576664d40783d2b0955e258d2f444a48d13c4ec9b37cf0db91e80399155fcc3376e4cbfa159

Download Submit
C:\Windows\SysWOW64\Gfheof32.exe

Filesize
72KB

MD5
6cf831a1c86a14cc37d877f6ab422b6d

SHA1
d4debd8a6a49ceb8a2c8d835055a7256dd563af8

SHA256
92d5727533d8adb8a9608cbeb7b277e9799d47ca4b886e7129025948acbc55c0

SHA512
013969fbf8cd3f53f87d5d2c20be8d32aa9ba36d6728e99489dea339f567f3e7f654329ca454edb203f41b2c16e8d7e5f1627ae216bcc51109ae5efdbcc1a632

Download Submit
C:\Windows\SysWOW64\Gkhkjd32.exe

Filesize
72KB

MD5
2069bb1103d523602670a5a3123ad6e8

SHA1
bafba7acd36332d4c56423278c91e727db36c200

SHA256
be218fb78076f5a17c8d0186bfef5b979f8610960db27a67ef067798f434a9cf

SHA512
0f8512f3423440d9cb680d77f92d87462ad7d418c3ad36cf716589c6e5c94a414898dddac54938b6532e91db141be1c22cf51f6a5d909a55691ec2798442457f

Download Submit
C:\Windows\SysWOW64\Gkkgpc32.exe

Filesize
72KB

MD5
4785d1e02db1f12fef547fb018139bf9

SHA1
35428410271590c17a55605dc320a79c0a66e826

SHA256
1c8651a2e3feaee7e4bfb67381d6214f9c876c952d70c8b6bb46d08022798ecf

SHA512
969eb8545141cf76d477a2ffcc7cb04af39c0c305b405f3eb71c0a2cf14da394dc4465100f4f59c004282910e69540cdb8260815b98030446ca47a7ed9b8470e

Download Submit
C:\Windows\SysWOW64\Glgjlm32.exe

Filesize
72KB

MD5
2d54cb74b1e0fdb43c59ecb4fcf8b3de

SHA1
e778748ae19501440b5249b6504216bf5f5c23e9

SHA256
5809999bdeb8eaf02cdb9327a4675a05dfef1db4321b4d3d639502be0c9d7e44

SHA512
9301c53f88303fb1e7b7431d1a3d18c6e864727ceaec61d19a7ac592e9d5050fb75aa853cb3fbab016401624dfa0e1707a62a85a503dbc0de8e3ca43271a8376

Download Submit
C:\Windows\SysWOW64\Gljgbllj.exe

Filesize
72KB

MD5
5cb85b2dd6b548890b99bf5b49b103d6

SHA1
9224d97e2f69dbf55dd59c2acfb5b99c97ab7c34

SHA256
b36b6ac90f7d2eeffc223484fa399176b78199958ee6b221371e9c89bb473a5c

SHA512
ad49c31820911cd2f83b8627f46f9f892ff848b877ae762ebb6d0b6ae565cc42719f4d16b9eca21f4f1a1333acec0a57fb9e4a75c2cfc0918856b2c7a0a6ec11

Download Submit
C:\Windows\SysWOW64\Gpqjglii.exe

Filesize
72KB

MD5
9dbac5a2a94964b2f34ab146b6eeaf62

SHA1
7e2086118985f960734a97becbd5503f7a67926a

SHA256
9c6bc6fed58af33fad6bcc2172b88bbc4eb19a3a09a74d5c06b618d915152d76

SHA512
c0872d65df9be72f306e85adb28df1c5902ccfba993e62129982d34ecb185aff32cc956e4c2b83b912001c89e82369cea8a8991ddd15ea8d7352852a18d0ec75

Download Submit
C:\Windows\SysWOW64\Hcblpdgg.exe

Filesize
72KB

MD5
4cef3b3d373091018f081db1e90521c9

SHA1
7b984ca786cff217cd9bed6438111a390c663e87

SHA256
54a2d17121fdc9b5ade013c2266c1ab694384a3cf489c24c03a67fa7c15c1c2e

SHA512
c70854bc7b3d5c2744a7f262a74c56bf49723a55258951e5280dd365b3b1f01fe540565de00c7ba44ccd4c92a85f7646e86462db7d36945c40448a0c82cb100f

Download Submit
C:\Windows\SysWOW64\Hdehni32.exe

Filesize
72KB

MD5
f500a70cc12ee1bcb3673f6c3991949d

SHA1
f9964fcc0be9458d3af9b8b0da0378849dabe19e

SHA256
eff383145af85e0accf0678ecc0281aeb64fae2ffe4b063c473765642381901b

SHA512
ee4a6b95e35080f1f6f31085363c728408b0e087b77da10f8268a570b71541a465e4c25fb423d9b1ffb6f230bd73110f45fbbfcd2041b9e1873cbaf91037bf71

Download Submit
C:\Windows\SysWOW64\Hdhedh32.exe

Filesize
72KB

MD5
13d42b76966ab6cf080a2b8a23a2fb89

SHA1
39ba9b5fc9606648683cbef78658ca20a9f52ad0

SHA256
bce1d37476605149cc25b4b6018c623388395237a8dacd34b1153b4cedbf2987

SHA512
e98945ac29572c558088393535a3daf714f89d361f9f61827eb4e4374c60db4810fc52b587921fdf4557b189fee5e4a66a2b5a1ccc3a490676358300e4db91ed

Download Submit
C:\Windows\SysWOW64\Hdjbiheb.exe

Filesize
72KB

MD5
e02d4a5ed38b19ba2f506dd60a47eb0c

SHA1
7dc0b051f15c81db37c05270f4923430d3b646e6

SHA256
760af598241caae4f39b279e1432d8ebebe13531eaf8ce81ee68e4052ef28310

SHA512
b5a98c0ac4cece878279447e1f235157b9cd79413486e7ddeac6b30410ae1a436611796b22860dac1527bf0a7fea976fa0f9afa950e5ded1dd678df5ece68ca7

Download Submit
C:\Windows\SysWOW64\Hdjbiheb.exe

Filesize
72KB

MD5
74400f8d4dc0b431d3f618cb3dabdf7a

SHA1
aff8f2f6532b8a28eaab0409e359006f789cea00

SHA256
18af74649d1c282dd24a9c800a44d1dacb72f945d611502dd8595877832c4769

SHA512
295564c05ba4b3125253a26890b4debcde562d7a9bc530f7c8527980ce0ff825ad7296323b1777c571e3ac8012bdb58880136905c17ea3e3590e465cc0d5daa5

Download Submit
C:\Windows\SysWOW64\Hibafp32.exe

Filesize
72KB

MD5
6379f5bbd144a3b83a1f0fa1cd97695a

SHA1
cad4b3341005ab860809f5b901dfb9b7fd09f1b6

SHA256
2ded794d3a4c5d62aba972044da99161ff8ffa99bda35a0fa0b9b66ce0909e0c

SHA512
f17b59df64454b2673edf1ca1a7453385f03b1dcf31800fea434b96fb8d73b8c0cb55588d177634890337eb8c200488018098e885f7ddc1dd00c2b1df9d7148f

Download Submit
C:\Windows\SysWOW64\Higjaoci.exe

Filesize
72KB

MD5
6ad42c5534acefe6da1462f6b1c45c42

SHA1
638ebe1ef47889fa2c97a4f824feef785d436f9f

SHA256
63ff1969b82b8cfd89297fa141b49901193a6012515c30cf95290cd5fe3ded9a

SHA512
a2709574a18d6d4bca0368ea797c5f3d323911b6bbe1a8d2b47e3ca27a0011ff8799458ec0bf5e7301aab50f2db725eb9da6a7c422bc255d0cbb2f04f4951597

Download Submit
C:\Windows\SysWOW64\Icfekc32.exe

Filesize
72KB

MD5
ba99ae2348cb88e725b7b02e140f4afb

SHA1
f78067f02b467c86b877f38bc8a353557375b31f

SHA256
955d6b6c309d955eaf1922b8c4f9dc758b66d678728e877af234bf3a2c551d3f

SHA512
3ecdfa2f69511eaf75b6f7a2da73025b0941b21469617392b16223b0dd549aa33869b4b7f5729f852e6971ae119323ec6ec1c3f0a65dcf585cc96ee88aab3b37

Download Submit
C:\Windows\SysWOW64\Iciaqc32.exe

Filesize
72KB

MD5
43a0625ac6c382a14ca725e2d1fb638d

SHA1
94117a46a7439f2c02756b0a959bb6d1460b3685

SHA256
6d298d28d578949cc94c1d260d9d9dc69bd774def526579488a7ca140e18a47d

SHA512
4cc10ba15b88a71dc9d166c37368d5cd4add9897ba3d5d940d679caf4a901c85123f13baf538347ad3d0d5bf1880e7cd7b085924bb37dfdbed2715632cf01b84

Download Submit
C:\Windows\SysWOW64\Igpdfb32.exe

Filesize
72KB

MD5
e5439e6319cd6df26b92680cea8b196c

SHA1
6ebf2f6338efde3b8a1973e6bdd7649cad963a74

SHA256
7d1de52fed4afdeb8392e97064f893bd82d102613b97b1f41e7261a0c32b0248

SHA512
d91f68d7819351d0bd62d7772000a5aa697e9f78bb3d130654de639dac98b6f8cb401062b3527f8494cf969a5f86a64a628cc6f1e8f7811d257d2d9731959cad

Download Submit
C:\Windows\SysWOW64\Ipflihfq.exe

Filesize
72KB

MD5
3edcb34899c5d84b9050dfb9190c0116

SHA1
340c7c7131d340630b906b5cfca3c8c713779f71

SHA256
505c1927202f6a3f00c5c15f71e218e8ab37e07fae242efe379c39503ab7386c

SHA512
70da17d880fd201cf6a40c239202c759d546c02b79b5b342431a463fb5704e36d584ea95c8cf72b3a79e8825dd40c8e036340cd4977582949ac4e1589fe7dbba

Download Submit
C:\Windows\SysWOW64\Kmaopfjm.exe

Filesize
72KB

MD5
dad0b40bd35c0177b5fd7ba5eb174cf0

SHA1
de1ea8c1b2580e9015ba03c7de3e24045c143627

SHA256
fa606408a7591f002412e45a3e9016f8dcd675bce7f9f10de92d632301e6dc9e

SHA512
079aa8d36e43106b17f5ad6e3f89bc176ccd4e98c65befd9ce8b7510ac409aead7a683d5ad543ccdb050c2e2959964f67ec0d14351c487a2920640728723b36d

Download Submit
C:\Windows\SysWOW64\Lckiihok.exe

Filesize
72KB

MD5
c9c59126753acf83229ea4deeab695e1

SHA1
b467871465488d0d9dfca9a3d46fdf398b18a0fd

SHA256
e7cb2e74e07dfdaad2de43a45a2ec5e1df49b0441b5a47813bb025049f03a0bd

SHA512
bf68c440a15625031409b9f729a85fabc9d227120819285ef0b96a79bcf26bb98ae35606428215815bd83a87dc4d3f2876a21847874c47ffe830be099a470152

Download Submit
C:\Windows\SysWOW64\Lcnfohmi.exe

Filesize
72KB

MD5
ec8b8480366edf2f20edd4218f6fdfe6

SHA1
e5d260a8379ac88e4fbef1f8339363468404f8d0

SHA256
7335813fc17ad8fc0ba255bf5a9a2e21fc77b228aee6b9a8152a4d09180f48d4

SHA512
d2d98a0752f335aa35f9d19ae79be2d49aee9b8397ae51f98eeef23c452e1aebd5985e5e40316a4e45572b9d5e0788eceb0ed0a96b633f9dc2eb3c0dc6732c5d

Download Submit
memory/408-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/440-231-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/448-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/456-192-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/540-200-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/552-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/732-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/756-168-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/880-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1100-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1280-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1336-176-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1428-159-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1448-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1452-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1468-223-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1640-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1652-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1668-344-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1808-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1884-79-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2020-120-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2192-216-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2200-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2876-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3028-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3104-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3128-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3164-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3352-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3516-208-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3620-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3752-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3792-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3796-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3844-362-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3956-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4056-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4172-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4252-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4340-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4344-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4492-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4508-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4536-247-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4544-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4572-255-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4644-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4708-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4728-128-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4804-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4856-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4944-239-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4952-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4968-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5044-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5088-184-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5100-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5128-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5172-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5216-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5264-430-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5304-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5344-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads