304df0e1c8ae4d0502bee2f87e35d73e2019b60624535ee6756d2422de07d43e

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 18:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

304df0e1c8ae4d0502bee2f87e35d73e2019b60624535ee6756d2422de07d43e.exe
Size

97KB
MD5

0df01c90f13190d44c349c811412f036
SHA1

af0b3a9dc4c8e3a4d2df0aa0889df51e4d290857
SHA256

304df0e1c8ae4d0502bee2f87e35d73e2019b60624535ee6756d2422de07d43e
SHA512

3006858bc8fb62abfa7f058d361e87929856ab4f5342a7c26112cdd731993a41af36e27f135edd51d17fe894d61e9d844e8969985d1d163e031d44932703c3db
SSDEEP

3072:BSCKIknNNynDrSUCmnfCm04AetXS+bJXeK6:EbIiszf04JXS+ReX

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kqmkae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bgelgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Migjoaaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Empoiimf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpkchqdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mniallpq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlhbal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qdbiedpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Najceeoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbnafb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgjljpkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jkhngl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Emehdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Idahjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fakdpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kemhff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnodaecc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idahjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kpjcdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eiildjag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mehcdfch.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kglmio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jcllonma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kilpmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmhocd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gkglja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hfhgkmpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Joiccj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdkcde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hffcmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iigdfa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhiajmod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Maeachag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhpofl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hfningai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lelchgne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amlogfel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Opakbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ggilil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gahcmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gkmdecbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hgdejd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pamiaboj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gkhkjd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmabdibj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kplpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjcbbmif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Edmjfifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gmcdffmq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhfedm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ikdcmpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aqppkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgghjjid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmijbcpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epcdqd32.exe

Executes dropped EXE 64 IoCs

pid	Process
952	Ffddka32.exe
5104	Flnlhk32.exe
4124	Fakdpb32.exe
5064	Fhemmlhc.exe
2468	Fbnafb32.exe
2376	Fhgjblfq.exe
4268	Fcmnpe32.exe
1820	Fdnjgmle.exe
3332	Gododflk.exe
4604	Gdqgmmjb.exe
2012	Gofkje32.exe
3552	Gfpcgpae.exe
4080	Gkmlofol.exe
3840	Gdeqhl32.exe
2300	Gkaejf32.exe
1544	Hmabdibj.exe
4460	Hbnjmp32.exe
3528	Hobkfd32.exe
2356	Hmfkoh32.exe
4068	Hodgkc32.exe
1488	Jplfcpin.exe
3992	Jfeopj32.exe
2072	Jmpgldhg.exe
5096	Jcioiood.exe
3700	Jifhaenk.exe
2492	Jcllonma.exe
3400	Kemhff32.exe
4432	Kfmepi32.exe
4532	Kmfmmcbo.exe
3724	Kbceejpf.exe
2156	Kmijbcpl.exe
3264	Kfankifm.exe
3556	Kpjcdn32.exe
2620	Kefkme32.exe
2588	Kplpjn32.exe
3256	Leihbeib.exe
3884	Llcpoo32.exe
4212	Lekehdgp.exe
2676	Lboeaifi.exe
536	Llgjjnlj.exe
1484	Likjcbkc.exe
116	Lebkhc32.exe
468	Lllcen32.exe
4684	Mgddhf32.exe
4524	Mlampmdo.exe
2900	Mmpijp32.exe
1532	Migjoaaf.exe
2128	Menjdbgj.exe
232	Mlhbal32.exe
1904	Ndokbi32.exe
1640	Nilcjp32.exe
5128	Ndaggimg.exe
5172	Nlmllkja.exe
5216	Ncianepl.exe
5256	Njciko32.exe
5316	Npmagine.exe
5368	Nggjdc32.exe
5420	Nnqbanmo.exe
5464	Ogifjcdp.exe
5504	Opakbi32.exe
5560	Ogkcpbam.exe
5608	Oneklm32.exe
5648	Opdghh32.exe
5692	Olkhmi32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hkckeo32.exe	Hheoid32.exe
File created	C:\Windows\SysWOW64\Mibime32.dll	Gahcmd32.exe
File created	C:\Windows\SysWOW64\Jebqacjl.dll	Nihipdhl.exe
File created	C:\Windows\SysWOW64\Mminhceb.exe	Mglfplgk.exe
File opened for modification	C:\Windows\SysWOW64\Dpiplm32.exe	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Lfjhbihm.dll	Cenahpha.exe
File opened for modification	C:\Windows\SysWOW64\Bnhjohkb.exe	Accfbokl.exe
File opened for modification	C:\Windows\SysWOW64\Doilmc32.exe	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Kkcmfmhk.dll	Ekiohclf.exe
File opened for modification	C:\Windows\SysWOW64\Mjbogmdb.exe	Mhdckaeo.exe
File opened for modification	C:\Windows\SysWOW64\Mnnkgl32.exe	Mjbogmdb.exe
File created	C:\Windows\SysWOW64\Dmlijb32.dll	Pidabppl.exe
File opened for modification	C:\Windows\SysWOW64\Gpcfmkff.exe	Gmdjapgb.exe
File created	C:\Windows\SysWOW64\Mmpijp32.exe	Mlampmdo.exe
File opened for modification	C:\Windows\SysWOW64\Ggnlobej.exe	Ghklce32.exe
File opened for modification	C:\Windows\SysWOW64\Eibfck32.exe	Ehailbaa.exe
File opened for modification	C:\Windows\SysWOW64\Hmkigh32.exe	Fmkqpkla.exe
File created	C:\Windows\SysWOW64\Calhnpgn.exe	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Nokpao32.dll	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Eaonjngh.exe	Egijmegb.exe
File created	C:\Windows\SysWOW64\Ghbbcd32.exe	Gohaeo32.exe
File created	C:\Windows\SysWOW64\Ganmcc32.dll	Hncmmd32.exe
File created	C:\Windows\SysWOW64\Kknombmk.dll	Nlphbnoe.exe
File created	C:\Windows\SysWOW64\Pmemlfol.dll	Hlegnjbm.exe
File created	C:\Windows\SysWOW64\Jpaleglc.exe	Ikdcmpnl.exe
File created	C:\Windows\SysWOW64\Gpiaib32.dll	Gdqgmmjb.exe
File created	C:\Windows\SysWOW64\Mmkkmc32.exe	Mjmoag32.exe
File opened for modification	C:\Windows\SysWOW64\Ipoopgnf.exe	Inqbclob.exe
File created	C:\Windows\SysWOW64\Lgepom32.exe	Lmpkadnm.exe
File created	C:\Windows\SysWOW64\Baannc32.exe	Bkgeainn.exe
File created	C:\Windows\SysWOW64\Hcjnlmph.dll	Cnjdpaki.exe
File opened for modification	C:\Windows\SysWOW64\Gmcdffmq.exe	Gigheh32.exe
File opened for modification	C:\Windows\SysWOW64\Kfqgab32.exe	Kpgodhkd.exe
File created	C:\Windows\SysWOW64\Empmffib.dll	Inqbclob.exe
File created	C:\Windows\SysWOW64\Obnbpa32.dll	Mminhceb.exe
File created	C:\Windows\SysWOW64\Ejldilhc.dll	Jieagojp.exe
File created	C:\Windows\SysWOW64\Ingapb32.dll	Jmpgldhg.exe
File created	C:\Windows\SysWOW64\Npmagine.exe	Njciko32.exe
File created	C:\Windows\SysWOW64\Naaqofgj.exe	Maodigil.exe
File created	C:\Windows\SysWOW64\Giidol32.dll	Jmbhoeid.exe
File created	C:\Windows\SysWOW64\Gbhhlfgd.dll	Bknlbhhe.exe
File created	C:\Windows\SysWOW64\Ohjgdmkj.dll	Fhgjblfq.exe
File created	C:\Windows\SysWOW64\Gdbmhf32.exe	Gadqlkep.exe
File created	C:\Windows\SysWOW64\Jofabneq.dll	Naaqofgj.exe
File created	C:\Windows\SysWOW64\Idahjg32.exe	Ingpmmgm.exe
File opened for modification	C:\Windows\SysWOW64\Pmfhig32.exe	Pflplnlg.exe
File opened for modification	C:\Windows\SysWOW64\Gofkje32.exe	Gdqgmmjb.exe
File opened for modification	C:\Windows\SysWOW64\Menjdbgj.exe	Migjoaaf.exe
File opened for modification	C:\Windows\SysWOW64\Pmidog32.exe	Pfolbmje.exe
File opened for modification	C:\Windows\SysWOW64\Fafdkmap.exe	Foghnabl.exe
File opened for modification	C:\Windows\SysWOW64\Jicdap32.exe	Jbileede.exe
File created	C:\Windows\SysWOW64\Idcondbo.dll	Eplnpeol.exe
File opened for modification	C:\Windows\SysWOW64\Kqnbkl32.exe	Hjjnae32.exe
File created	C:\Windows\SysWOW64\Fdnjgmle.exe	Fcmnpe32.exe
File opened for modification	C:\Windows\SysWOW64\Bhpofl32.exe	Bmhocd32.exe
File opened for modification	C:\Windows\SysWOW64\Ggilil32.exe	Fpodlbng.exe
File opened for modification	C:\Windows\SysWOW64\Gpkchqdj.exe	Gahcmd32.exe
File opened for modification	C:\Windows\SysWOW64\Neafjdkn.exe	Nliaao32.exe
File created	C:\Windows\SysWOW64\Nlkngo32.exe	Neafjdkn.exe
File created	C:\Windows\SysWOW64\Hahohdla.dll	Neccpd32.exe
File created	C:\Windows\SysWOW64\Cpmapodj.exe	Bnoddcef.exe
File opened for modification	C:\Windows\SysWOW64\Bfdodjhm.exe	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Jmqgabec.dll	Bjaqpbkh.exe
File created	C:\Windows\SysWOW64\Ghpocngo.exe	Gddbcp32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8044	4212	WerFault.exe	528

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lafdhogo.dll"	Menjdbgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfilim32.dll"	Pjcbbmif.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fdfmlhna.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jfgdkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Migidc32.dll"	Ggpbjkpl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kglmio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bddchh32.dll"	Lihpif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fajbad32.dll"	Higjaoci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lmbhgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aphnnafb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Olkhmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfjhbihm.dll"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gpkchqdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hkicaahi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecgamkhq.dll"	Igdnabjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bgelgi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fhemmlhc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oqhacgdh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gdafnpqh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hdilnojp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oipckj32.dll"	Nbqmiinl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Flnlhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fbnafb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Igcoqocb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjaqpbkh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbkkam32.dll"	Caageq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeheh32.dll"	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fbajbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jkaqnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Igdnabjh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Knchpiom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjmoag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgngnj32.dll"	Jnlbojee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlingkpe.dll"	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiclgb32.dll"	Opdghh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idcondbo.dll"	Eplnpeol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idfjphid.dll"	Fpodlbng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gknkpjfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nolgijpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cbfgkffn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbobhb32.dll"	Akblfj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kjmmepfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jnlbojee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekppjn32.dll"	Dpiplm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhphmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Boklbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjaqpbkh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eibfck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nlkngo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hepfdc32.dll"	Ggkiol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnoddcef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qdbiedpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gahcmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjqjajoe.dll"	Mjbogmdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elkalfog.dll"	Hkhdqoac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gddmgi32.dll"	Gkmdecbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chkobkod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oqhacgdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gokgpogl.dll"	Qdbiedpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Emehdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hgdejd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 952	2720	304df0e1c8ae4d0502bee2f87e35d73e2019b60624535ee6756d2422de07d43e.exe	95
PID 2720 wrote to memory of 952	2720	304df0e1c8ae4d0502bee2f87e35d73e2019b60624535ee6756d2422de07d43e.exe	95
PID 2720 wrote to memory of 952	2720	304df0e1c8ae4d0502bee2f87e35d73e2019b60624535ee6756d2422de07d43e.exe	95
PID 952 wrote to memory of 5104	952	Ffddka32.exe	96
PID 952 wrote to memory of 5104	952	Ffddka32.exe	96
PID 952 wrote to memory of 5104	952	Ffddka32.exe	96
PID 5104 wrote to memory of 4124	5104	Flnlhk32.exe	97
PID 5104 wrote to memory of 4124	5104	Flnlhk32.exe	97
PID 5104 wrote to memory of 4124	5104	Flnlhk32.exe	97
PID 4124 wrote to memory of 5064	4124	Fakdpb32.exe	98
PID 4124 wrote to memory of 5064	4124	Fakdpb32.exe	98
PID 4124 wrote to memory of 5064	4124	Fakdpb32.exe	98
PID 5064 wrote to memory of 2468	5064	Fhemmlhc.exe	99
PID 5064 wrote to memory of 2468	5064	Fhemmlhc.exe	99
PID 5064 wrote to memory of 2468	5064	Fhemmlhc.exe	99
PID 2468 wrote to memory of 2376	2468	Fbnafb32.exe	100
PID 2468 wrote to memory of 2376	2468	Fbnafb32.exe	100
PID 2468 wrote to memory of 2376	2468	Fbnafb32.exe	100
PID 2376 wrote to memory of 4268	2376	Fhgjblfq.exe	101
PID 2376 wrote to memory of 4268	2376	Fhgjblfq.exe	101
PID 2376 wrote to memory of 4268	2376	Fhgjblfq.exe	101
PID 4268 wrote to memory of 1820	4268	Fcmnpe32.exe	102
PID 4268 wrote to memory of 1820	4268	Fcmnpe32.exe	102
PID 4268 wrote to memory of 1820	4268	Fcmnpe32.exe	102
PID 1820 wrote to memory of 3332	1820	Fdnjgmle.exe	104
PID 1820 wrote to memory of 3332	1820	Fdnjgmle.exe	104
PID 1820 wrote to memory of 3332	1820	Fdnjgmle.exe	104
PID 3332 wrote to memory of 4604	3332	Gododflk.exe	105
PID 3332 wrote to memory of 4604	3332	Gododflk.exe	105
PID 3332 wrote to memory of 4604	3332	Gododflk.exe	105
PID 4604 wrote to memory of 2012	4604	Gdqgmmjb.exe	106
PID 4604 wrote to memory of 2012	4604	Gdqgmmjb.exe	106
PID 4604 wrote to memory of 2012	4604	Gdqgmmjb.exe	106
PID 2012 wrote to memory of 3552	2012	Gofkje32.exe	107
PID 2012 wrote to memory of 3552	2012	Gofkje32.exe	107
PID 2012 wrote to memory of 3552	2012	Gofkje32.exe	107
PID 3552 wrote to memory of 4080	3552	Gfpcgpae.exe	108
PID 3552 wrote to memory of 4080	3552	Gfpcgpae.exe	108
PID 3552 wrote to memory of 4080	3552	Gfpcgpae.exe	108
PID 4080 wrote to memory of 3840	4080	Gkmlofol.exe	109
PID 4080 wrote to memory of 3840	4080	Gkmlofol.exe	109
PID 4080 wrote to memory of 3840	4080	Gkmlofol.exe	109
PID 3840 wrote to memory of 2300	3840	Gdeqhl32.exe	111
PID 3840 wrote to memory of 2300	3840	Gdeqhl32.exe	111
PID 3840 wrote to memory of 2300	3840	Gdeqhl32.exe	111
PID 2300 wrote to memory of 1544	2300	Gkaejf32.exe	112
PID 2300 wrote to memory of 1544	2300	Gkaejf32.exe	112
PID 2300 wrote to memory of 1544	2300	Gkaejf32.exe	112
PID 1544 wrote to memory of 4460	1544	Hmabdibj.exe	113
PID 1544 wrote to memory of 4460	1544	Hmabdibj.exe	113
PID 1544 wrote to memory of 4460	1544	Hmabdibj.exe	113
PID 4460 wrote to memory of 3528	4460	Hbnjmp32.exe	114
PID 4460 wrote to memory of 3528	4460	Hbnjmp32.exe	114
PID 4460 wrote to memory of 3528	4460	Hbnjmp32.exe	114
PID 3528 wrote to memory of 2356	3528	Hobkfd32.exe	115
PID 3528 wrote to memory of 2356	3528	Hobkfd32.exe	115
PID 3528 wrote to memory of 2356	3528	Hobkfd32.exe	115
PID 2356 wrote to memory of 4068	2356	Hmfkoh32.exe	117
PID 2356 wrote to memory of 4068	2356	Hmfkoh32.exe	117
PID 2356 wrote to memory of 4068	2356	Hmfkoh32.exe	117
PID 4068 wrote to memory of 1488	4068	Hodgkc32.exe	118
PID 4068 wrote to memory of 1488	4068	Hodgkc32.exe	118
PID 4068 wrote to memory of 1488	4068	Hodgkc32.exe	118
PID 1488 wrote to memory of 3992	1488	Jplfcpin.exe	119

C:\Users\Admin\AppData\Local\Temp\304df0e1c8ae4d0502bee2f87e35d73e2019b60624535ee6756d2422de07d43e.exe
"C:\Users\Admin\AppData\Local\Temp\304df0e1c8ae4d0502bee2f87e35d73e2019b60624535ee6756d2422de07d43e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\Ffddka32.exe
  C:\Windows\system32\Ffddka32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\SysWOW64\Flnlhk32.exe
    C:\Windows\system32\Flnlhk32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\SysWOW64\Fakdpb32.exe
      C:\Windows\system32\Fakdpb32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4124
    - - C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5064
      - C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1820
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4080
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3840
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        23⤵
        Executes dropped EXE
        
        PID:3992
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2072
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        25⤵
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        26⤵
        Executes dropped EXE
        
        PID:3700
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2492
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3400
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        29⤵
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        30⤵
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        31⤵
        Executes dropped EXE
        
        PID:3724
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2156
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        33⤵
        Executes dropped EXE
        
        PID:3264
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3556
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        35⤵
        Executes dropped EXE
        
        PID:2620
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2588
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        37⤵
        Executes dropped EXE
        
        PID:3256
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        38⤵
        Executes dropped EXE
        
        PID:3884
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        39⤵
        Executes dropped EXE
        
        PID:4212
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        40⤵
        Executes dropped EXE
        
        PID:2676
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        41⤵
        Executes dropped EXE
        
        PID:536
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        42⤵
        Executes dropped EXE
        
        PID:1484
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        43⤵
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        44⤵
        Executes dropped EXE
        
        PID:468
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        45⤵
        Executes dropped EXE
        
        PID:4684
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4524
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        47⤵
        Executes dropped EXE
        
        PID:2900
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1532
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2128
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:232
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        51⤵
        Executes dropped EXE
        
        PID:1904
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        52⤵
        Executes dropped EXE
        
        PID:1640
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5128
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        54⤵
        Executes dropped EXE
        
        PID:5172
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        55⤵
        Executes dropped EXE
        
        PID:5216
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5256
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        57⤵
        Executes dropped EXE
        
        PID:5316
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        58⤵
        Executes dropped EXE
        
        PID:5368
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5420
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        60⤵
        Executes dropped EXE
        
        PID:5464
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5504
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        62⤵
        Executes dropped EXE
        
        PID:5560
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        63⤵
        Executes dropped EXE
        
        PID:5608
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5648
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5692
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        66⤵
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5772
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        69⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5912
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        71⤵
        Drops file in System32 directory
        
        PID:5952
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        72⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        73⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        74⤵
        Drops file in System32 directory
        
        PID:6120
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        75⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5204
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        77⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        79⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        80⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        81⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        82⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        83⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        84⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        85⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5124
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        87⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5584
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        89⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        90⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        91⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        92⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        93⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        94⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        95⤵
        Drops file in System32 directory
        
        PID:5864
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        96⤵
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        97⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        98⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        99⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        100⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3824
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6168
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        103⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        104⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6256
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6300
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        106⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        107⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        108⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        109⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        110⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        111⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        112⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6652
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        114⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        115⤵
        Drops file in System32 directory
        
        PID:6744
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        116⤵
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        117⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Dahhio32.exe
        
        C:\Windows\system32\Dahhio32.exe
        118⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Edfdej32.exe
        
        C:\Windows\system32\Edfdej32.exe
        119⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        120⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Emoinpcd.exe
        
        C:\Windows\system32\Emoinpcd.exe
        121⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Ealadnik.exe
        
        C:\Windows\system32\Ealadnik.exe
        122⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Edknqiho.exe
        
        C:\Windows\system32\Edknqiho.exe
        123⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Egijmegb.exe
        
        C:\Windows\system32\Egijmegb.exe
        124⤵
        Drops file in System32 directory
        
        PID:6176
        
        C:\Windows\SysWOW64\Eaonjngh.exe
        
        C:\Windows\system32\Eaonjngh.exe
        125⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Edmjfifl.exe
        
        C:\Windows\system32\Edmjfifl.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6308
        
        C:\Windows\SysWOW64\Ekgbccni.exe
        
        C:\Windows\system32\Ekgbccni.exe
        127⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        128⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Ekiohclf.exe
        
        C:\Windows\system32\Ekiohclf.exe
        129⤵
        Drops file in System32 directory
        
        PID:6532
        
        C:\Windows\SysWOW64\Fdbdah32.exe
        
        C:\Windows\system32\Fdbdah32.exe
        130⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Fgppmd32.exe
        
        C:\Windows\system32\Fgppmd32.exe
        131⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Foghnabl.exe
        
        C:\Windows\system32\Foghnabl.exe
        132⤵
        Drops file in System32 directory
        
        PID:6752
        
        C:\Windows\SysWOW64\Fafdkmap.exe
        
        C:\Windows\system32\Fafdkmap.exe
        133⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Fddqghpd.exe
        
        C:\Windows\system32\Fddqghpd.exe
        134⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Fknicb32.exe
        
        C:\Windows\system32\Fknicb32.exe
        135⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Fnmepn32.exe
        
        C:\Windows\system32\Fnmepn32.exe
        136⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Fdfmlhna.exe
        
        C:\Windows\system32\Fdfmlhna.exe
        137⤵
        Modifies registry class
        
        PID:6160
        
        C:\Windows\SysWOW64\Fkqeib32.exe
        
        C:\Windows\system32\Fkqeib32.exe
        138⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Fajnfl32.exe
        
        C:\Windows\system32\Fajnfl32.exe
        139⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Fggfnc32.exe
        
        C:\Windows\system32\Fggfnc32.exe
        140⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Fkcboack.exe
        
        C:\Windows\system32\Fkcboack.exe
        141⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        142⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Fdkggg32.exe
        
        C:\Windows\system32\Fdkggg32.exe
        143⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Fkeodaai.exe
        
        C:\Windows\system32\Fkeodaai.exe
        144⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Gdncmghi.exe
        
        C:\Windows\system32\Gdncmghi.exe
        145⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Gkglja32.exe
        
        C:\Windows\system32\Gkglja32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6180
        
        C:\Windows\SysWOW64\Gaadfkgc.exe
        
        C:\Windows\system32\Gaadfkgc.exe
        147⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Ghklce32.exe
        
        C:\Windows\system32\Ghklce32.exe
        148⤵
        Drops file in System32 directory
        
        PID:6496
        
        C:\Windows\SysWOW64\Ggnlobej.exe
        
        C:\Windows\system32\Ggnlobej.exe
        149⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Gadqlkep.exe
        
        C:\Windows\system32\Gadqlkep.exe
        150⤵
        Drops file in System32 directory
        
        PID:6912
        
        C:\Windows\SysWOW64\Gdbmhf32.exe
        
        C:\Windows\system32\Gdbmhf32.exe
        151⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Gohaeo32.exe
        
        C:\Windows\system32\Gohaeo32.exe
        152⤵
        Drops file in System32 directory
        
        PID:6328
        
        C:\Windows\SysWOW64\Ghbbcd32.exe
        
        C:\Windows\system32\Ghbbcd32.exe
        153⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Hffcmh32.exe
        
        C:\Windows\system32\Hffcmh32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6932
        
        C:\Windows\SysWOW64\Hheoid32.exe
        
        C:\Windows\system32\Hheoid32.exe
        155⤵
        Drops file in System32 directory
        
        PID:7004
        
        C:\Windows\SysWOW64\Hkckeo32.exe
        
        C:\Windows\system32\Hkckeo32.exe
        156⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Hbmcbime.exe
        
        C:\Windows\system32\Hbmcbime.exe
        157⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Hgjljpkm.exe
        
        C:\Windows\system32\Hgjljpkm.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6492
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        159⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Hfklhhcl.exe
        
        C:\Windows\system32\Hfklhhcl.exe
        160⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        161⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Hkhdqoac.exe
        
        C:\Windows\system32\Hkhdqoac.exe
        162⤵
        Modifies registry class
        
        PID:7220
        
        C:\Windows\SysWOW64\Hnfamjqg.exe
        
        C:\Windows\system32\Hnfamjqg.exe
        163⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Hfningai.exe
        
        C:\Windows\system32\Hfningai.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7312
        
        C:\Windows\SysWOW64\Igcoqocb.exe
        
        C:\Windows\system32\Igcoqocb.exe
        165⤵
        Modifies registry class
        
        PID:7356
        
        C:\Windows\SysWOW64\Inmgmijo.exe
        
        C:\Windows\system32\Inmgmijo.exe
        166⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        167⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Iomcgl32.exe
        
        C:\Windows\system32\Iomcgl32.exe
        168⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Iigdfa32.exe
        
        C:\Windows\system32\Iigdfa32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7524
        
        C:\Windows\SysWOW64\Ikfabm32.exe
        
        C:\Windows\system32\Ikfabm32.exe
        170⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        171⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Jkhngl32.exe
        
        C:\Windows\system32\Jkhngl32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7652
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        173⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Jnifigpa.exe
        
        C:\Windows\system32\Jnifigpa.exe
        174⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Jecofa32.exe
        
        C:\Windows\system32\Jecofa32.exe
        175⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Joiccj32.exe
        
        C:\Windows\system32\Joiccj32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7844
        
        C:\Windows\SysWOW64\Jfbkpd32.exe
        
        C:\Windows\system32\Jfbkpd32.exe
        177⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Jiaglp32.exe
        
        C:\Windows\system32\Jiaglp32.exe
        178⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Jkodhk32.exe
        
        C:\Windows\system32\Jkodhk32.exe
        179⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Jbileede.exe
        
        C:\Windows\system32\Jbileede.exe
        180⤵
        Drops file in System32 directory
        
        PID:8072
        
        C:\Windows\SysWOW64\Jicdap32.exe
        
        C:\Windows\system32\Jicdap32.exe
        181⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Jkaqnk32.exe
        
        C:\Windows\system32\Jkaqnk32.exe
        182⤵
        Modifies registry class
        
        PID:8164
        
        C:\Windows\SysWOW64\Jnpmjf32.exe
        
        C:\Windows\system32\Jnpmjf32.exe
        183⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Jfgdkd32.exe
        
        C:\Windows\system32\Jfgdkd32.exe
        184⤵
        Modifies registry class
        
        PID:7216
        
        C:\Windows\SysWOW64\Jieagojp.exe
        
        C:\Windows\system32\Jieagojp.exe
        185⤵
        Drops file in System32 directory
        
        PID:7304
        
        C:\Windows\SysWOW64\Kppici32.exe
        
        C:\Windows\system32\Kppici32.exe
        186⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Kbnepe32.exe
        
        C:\Windows\system32\Kbnepe32.exe
        187⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        188⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Kbpbed32.exe
        
        C:\Windows\system32\Kbpbed32.exe
        189⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Khmknk32.exe
        
        C:\Windows\system32\Khmknk32.exe
        190⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Kpdboimg.exe
        
        C:\Windows\system32\Kpdboimg.exe
        191⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\Kfnkkb32.exe
        
        C:\Windows\system32\Kfnkkb32.exe
        192⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Kpgodhkd.exe
        
        C:\Windows\system32\Kpgodhkd.exe
        193⤵
        Drops file in System32 directory
        
        PID:7932
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        194⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Khbdikip.exe
        
        C:\Windows\system32\Khbdikip.exe
        195⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        196⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Kiaqcnpb.exe
        
        C:\Windows\system32\Kiaqcnpb.exe
        197⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        198⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Bjodjb32.exe
        
        C:\Windows\system32\Bjodjb32.exe
        199⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        200⤵
        Modifies registry class
        
        PID:7592
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        201⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3220
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        202⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Edemkd32.exe
        
        C:\Windows\system32\Edemkd32.exe
        203⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        204⤵
        Drops file in System32 directory
        
        PID:8080
        
        C:\Windows\SysWOW64\Eibfck32.exe
        
        C:\Windows\system32\Eibfck32.exe
        205⤵
        Modifies registry class
        
        PID:6776
        
        C:\Windows\SysWOW64\Eplnpeol.exe
        
        C:\Windows\system32\Eplnpeol.exe
        206⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2600
        
        C:\Windows\SysWOW64\Ehcfaboo.exe
        
        C:\Windows\system32\Ehcfaboo.exe
        207⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Ejbbmnnb.exe
        
        C:\Windows\system32\Ejbbmnnb.exe
        208⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Empoiimf.exe
        
        C:\Windows\system32\Empoiimf.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5680
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        210⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Efhcbodf.exe
        
        C:\Windows\system32\Efhcbodf.exe
        211⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Eigonjcj.exe
        
        C:\Windows\system32\Eigonjcj.exe
        212⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        213⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7584
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7676
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7232
        
        C:\Windows\SysWOW64\Fpodlbng.exe
        
        C:\Windows\system32\Fpodlbng.exe
        217⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7364
        
        C:\Windows\SysWOW64\Ggilil32.exe
        
        C:\Windows\system32\Ggilil32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5008
        
        C:\Windows\SysWOW64\Gigheh32.exe
        
        C:\Windows\system32\Gigheh32.exe
        219⤵
        Drops file in System32 directory
        
        PID:1892
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3616
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        221⤵
        Modifies registry class
        
        PID:7948
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        222⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        223⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Ghkeio32.exe
        
        C:\Windows\system32\Ghkeio32.exe
        224⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Ggnedlao.exe
        
        C:\Windows\system32\Ggnedlao.exe
        225⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Gnhnaf32.exe
        
        C:\Windows\system32\Gnhnaf32.exe
        226⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        227⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Gdafnpqh.exe
        
        C:\Windows\system32\Gdafnpqh.exe
        228⤵
        Modifies registry class
        
        PID:8332
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        229⤵
        Modifies registry class
        
        PID:8380
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        230⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        231⤵
        Drops file in System32 directory
        
        PID:8468
        
        C:\Windows\SysWOW64\Ghpocngo.exe
        
        C:\Windows\system32\Ghpocngo.exe
        232⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Gknkpjfb.exe
        
        C:\Windows\system32\Gknkpjfb.exe
        233⤵
        Modifies registry class
        
        PID:8556
        
        C:\Windows\SysWOW64\Gahcmd32.exe
        
        C:\Windows\system32\Gahcmd32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8608
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8652
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        236⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8740
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        238⤵
        Modifies registry class
        
        PID:8784
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8820
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        240⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Hhfedm32.exe
        
        C:\Windows\system32\Hhfedm32.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8912
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        242⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Hncmmd32.exe
        
        C:\Windows\system32\Hncmmd32.exe
        243⤵
        Drops file in System32 directory
        
        PID:8996
        
        C:\Windows\SysWOW64\Haoimcgg.exe
        
        C:\Windows\system32\Haoimcgg.exe
        244⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Hhiajmod.exe
        
        C:\Windows\system32\Hhiajmod.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9084
        
        C:\Windows\SysWOW64\Hjjnae32.exe
        
        C:\Windows\system32\Hjjnae32.exe
        246⤵
        Drops file in System32 directory
        
        PID:9152
        
        C:\Windows\SysWOW64\Kqnbkl32.exe
        
        C:\Windows\system32\Kqnbkl32.exe
        247⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        248⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        249⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Kaehljpj.exe
        
        C:\Windows\system32\Kaehljpj.exe
        250⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8440
        
        C:\Windows\SysWOW64\Kjmmepfj.exe
        
        C:\Windows\system32\Kjmmepfj.exe
        252⤵
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        253⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Knkekn32.exe
        
        C:\Windows\system32\Knkekn32.exe
        254⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        255⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Lbkkgl32.exe
        
        C:\Windows\system32\Lbkkgl32.exe
        256⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        257⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8808
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        259⤵
        Modifies registry class
        
        PID:8896
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        260⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        261⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        262⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        263⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\Maeachag.exe
        
        C:\Windows\system32\Maeachag.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9136
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9208
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        266⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        267⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Mjpbam32.exe
        
        C:\Windows\system32\Mjpbam32.exe
        268⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        269⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Mhdckaeo.exe
        
        C:\Windows\system32\Mhdckaeo.exe
        270⤵
        Drops file in System32 directory
        
        PID:8540
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        271⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8660
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        272⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8908
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        274⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        275⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        276⤵
        Drops file in System32 directory
        
        PID:4972
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        277⤵
        Drops file in System32 directory
        
        PID:9188
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        278⤵
        Drops file in System32 directory
        
        PID:8316
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        279⤵
        Modifies registry class
        
        PID:5844
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        280⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        281⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        282⤵
        Drops file in System32 directory
        
        PID:8892
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        283⤵
        Drops file in System32 directory
        
        PID:3456
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        284⤵
        Modifies registry class
        
        PID:9172
        
        C:\Windows\SysWOW64\Nojjcj32.exe
        
        C:\Windows\system32\Nojjcj32.exe
        285⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        286⤵
        Drops file in System32 directory
        
        PID:8592
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        287⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        288⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        289⤵
        Modifies registry class
        
        PID:8752
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5604
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        291⤵
        Drops file in System32 directory
        
        PID:8860
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        292⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        293⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        294⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        295⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        296⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Ohpkmn32.exe
        
        C:\Windows\system32\Ohpkmn32.exe
        297⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        298⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        299⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        300⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        301⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        302⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9664
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        304⤵
        Drops file in System32 directory
        
        PID:9704
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        305⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        306⤵
        Modifies registry class
        
        PID:9872
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        307⤵
        Drops file in System32 directory
        
        PID:9920
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        308⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10012
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        310⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        311⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        312⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10220
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        314⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9300
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        316⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        317⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        318⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        319⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        320⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        321⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        322⤵
        Modifies registry class
        
        PID:4436
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        323⤵
        Drops file in System32 directory
        
        PID:1972
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        324⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        325⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        326⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        327⤵
        Modifies registry class
        
        PID:10000
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        328⤵
        Drops file in System32 directory
        
        PID:2376
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10064
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        330⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        331⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        332⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        333⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        334⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        335⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Ipjedh32.exe
        
        C:\Windows\system32\Ipjedh32.exe
        336⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        337⤵
        Modifies registry class
        
        PID:9644
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        338⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        339⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        340⤵
        
        PID:952
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        341⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        342⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        343⤵
        Drops file in System32 directory
        
        PID:236
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        344⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:780
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        346⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        347⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        348⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        349⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        350⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        351⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        352⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        353⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        354⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        355⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        356⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        357⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        358⤵
        Modifies registry class
        
        PID:4052
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        359⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        360⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        361⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2300
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        363⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        364⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        365⤵
        Modifies registry class
        
        PID:4664
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3128
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        367⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        368⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        369⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        370⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        371⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        372⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        373⤵
        Drops file in System32 directory
        
        PID:4488
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        374⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        375⤵
        Modifies registry class
        
        PID:4784
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        376⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        377⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        378⤵
        Drops file in System32 directory
        
        PID:4152
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        379⤵
        Drops file in System32 directory
        
        PID:2260
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        380⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1080
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        381⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        382⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        383⤵
        Modifies registry class
        
        PID:6096
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        384⤵
        Drops file in System32 directory
        
        PID:5696
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        385⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        386⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3940
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        388⤵
        Drops file in System32 directory
        
        PID:5360
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        389⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        390⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        391⤵
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        392⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5668
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        393⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        394⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        395⤵
        Modifies registry class
        
        PID:6964
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        396⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        397⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        398⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        399⤵
        Drops file in System32 directory
        
        PID:6464
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        400⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        401⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6424
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6600
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        404⤵
        Drops file in System32 directory
        
        PID:6160
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        405⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6420
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        407⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        408⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        409⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        410⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        411⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        412⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        413⤵
        Modifies registry class
        
        PID:7288
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        414⤵
        Modifies registry class
        
        PID:7084
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        415⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        416⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        417⤵
        Drops file in System32 directory
        
        PID:6064
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        418⤵
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        419⤵
        Modifies registry class
        
        PID:4148
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        420⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        421⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        422⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 420
        423⤵
        Program crash
        
        PID:8044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4432 --field-trial-handle=2496,i,15897292497548307209,13920214570023230813,262144 --variations-seed-version /prefetch:8
1⤵
PID:6696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4212 -ip 4212
1⤵
PID:7488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
64KB

MD5
f005e36e34aa193ac32bc55c2cc52210

SHA1
557c39b201f02a17b5d47f0bb68b1d46c4ae02ae

SHA256
ea454dd029a08812c166d7c0ab76a04a5d4ee125989bf6672ce7984529ac0fdc

SHA512
9c3b51ff09238b3a388f536405b1d0cc7fb77fe9cb366e6745dd48305dec27f282f8831266a70e6661485b41869c53c6c89b9fdd7ec1b6ee85c4fb32df8acbda

Download Submit
C:\Windows\SysWOW64\Cnffqf32.exe

Filesize
97KB

MD5
07fd4fbf6c08c29145346602dd77cb14

SHA1
22f0c09ebd6ba5988f6458ebad71452ea861156d

SHA256
f68a4e4473e9849bd6d50b20bafd0a46e69082193c86d3f6c5ee1b2f14dd6ed1

SHA512
230ed9404ab5c0058c535776a90d7478a34c02d0b54d8d646ed8b63b0bc76fd3b72eae242718bce626e96788e992dfd1819db9804f68da198c2342f15e704fb4

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
97KB

MD5
4f6ebc155567729fd5f08c52f2087574

SHA1
3dca28f2f72fb71e5a8323c4de5accc101ae22c1

SHA256
6fc706c296d71e0ca020e7c4cff2474f58009c3badc13b29d4671c54bbf81b4e

SHA512
314a93975b998ffe01da8192d3d007a599919511167fd9fbc0356bacaa368ee82f24fb7bd9889e02d5fd1b4973fac3b48fb5b03a7457fbcea2a1d16585d0200c

Download Submit
C:\Windows\SysWOW64\Eplnpeol.exe

Filesize
97KB

MD5
dbb632e2583887b866ea4a4e20375ac9

SHA1
988ce82a1feaae5b9b6e129af610b0d788a55a52

SHA256
96cb1b543e7eb3e1523a43f39cf1b34a1d2f7b7781a91adccb8d2068fee3fb59

SHA512
3865abbe2f76725bbcc87e4d0a3b96f2f05c26812266f64e46a93b107760db4b8411837fe00f021d9603aa71538eccf040671d27cb3eceeb56d1e3d745520ccc

Download Submit
C:\Windows\SysWOW64\Fakdpb32.exe

Filesize
97KB

MD5
ba5712bc3862988d64655dcd9a89eccf

SHA1
91122a14baa67e40e98b11a57571824d193b4ef5

SHA256
9edb71a6840a25894fd81dd115d102c7a21afbdb54ef41356d2de9446701c07d

SHA512
95987141c58f5abf16f4475285a8a2bcc38661298978f341fe873872362a36c248eee8ddecb02905edb906cf5058cc92fbf2fac8b03a5eee41b2893143484113

Download Submit
C:\Windows\SysWOW64\Fbnafb32.exe

Filesize
97KB

MD5
41d8452ba3465ea19a58e144f493548a

SHA1
e96ca58b073742569cf7a4568a3453e9812804e0

SHA256
0eb781d2e8d7432fbaf539cb874e63e9a6225a9ca12bcc6b5fddc49d5a7b9860

SHA512
4001b07a23c768d7aaff96d65e92b7345a62a185433d7ab4852b3ef65bf4d4278791dfa38945ddda488648638413198bb761cca5c2dd90c821078dcdc237d9e1

Download Submit
C:\Windows\SysWOW64\Fcmnpe32.exe

Filesize
97KB

MD5
628daca752e2d274a4d88c78d73f724a

SHA1
2ca26a1bdb408c959dc4257d5236e346917bdce6

SHA256
e27e167ae9a5b476521b97ec0dc9cc1836fc36ee16067802b1f7d1ec21ad9f37

SHA512
b8567ba12d04cacb44388cee7686167211ddcf7ffb59f1f7f51434e9db4604f16a1044bf7bec1bc0c5471d810ad7819063bc82a1a6217696a5290844875c4a22

Download Submit
C:\Windows\SysWOW64\Fdnjgmle.exe

Filesize
97KB

MD5
8c1cc2d07f3748ba601eed35fe0f1d30

SHA1
4032c67fb6ac525f8e43b5b55e9ca3fa0b87cf13

SHA256
10b7b2223e0c500ef7ce2f7ef663213839e6568f1158eab538e0ce081d49e3fb

SHA512
3a23a1ed72743af833a8c4c01ffc8f7b884968350ba577f6e48a0f280dd89793561a9cf6a6955672cf0a120487ef8532796dd44d2f6bb08e31225487ef40148c

Download Submit
C:\Windows\SysWOW64\Ffddka32.exe

Filesize
97KB

MD5
0c777078218cd9550efb3f722c4bb42b

SHA1
53bfdc1416dfa6d3b77e819c8eec0a3bade4a486

SHA256
fc319f455ce65c123a51cfb87bca747ee4f0c05413a6f9fd7b2403e8914b79f4

SHA512
7e03b612f05d6885bccba6f134d5c86a6c3870795d5bb3918872a7fd60dbb4f0fe5c9daa4d173bae92cfb5f42f3fcf18fea2c700339c2b3932350ae988318a94

Download Submit
C:\Windows\SysWOW64\Fhemmlhc.exe

Filesize
97KB

MD5
dfb40a2cb0731e2f04130653a7cf8153

SHA1
4b581f0574b28a57f6c631424c6d58a8d435bc83

SHA256
999e5a2bdf0cf7719b2eb1da7dde6410efed62b900c3440e1b18252601f26b38

SHA512
78e8c03f154ce98733b902080351dcffd88df765de56e4fc5b0707704fa918c4218723b3b41aabdb169f33a7b2a1b44d9b74676f4c2bafb367756af439d9045c

Download Submit
C:\Windows\SysWOW64\Fhgjblfq.exe

Filesize
97KB

MD5
067e42a46a8ba4cca30569f657345456

SHA1
124bfd86dcffbf213e42eaa872594b5b0b8310f2

SHA256
4fb9d7d54cd60a2fba69fac2b001476ff66ab4611015be51e06d0e2e5cdefe3c

SHA512
c14499c1392926f3395b68f493ec8f691a1d8914b1c4dea2852e1781bca5b69ef34d0ab1b13d66eb08269537d638f45a3d1d2d1d754f0fd74cf44959ecbe1776

Download Submit
C:\Windows\SysWOW64\Flnlhk32.exe

Filesize
97KB

MD5
a1d44d4bea378352c266d5d332763686

SHA1
7f48bcf8f3c3989634e4f47c83f24646641ddc7c

SHA256
68b8115371e729c4121536c2fa98bf090e06d79bfd972c4c16c0a99f58cf8d65

SHA512
b745942bd41e26743e458a7775779e9c424c41ef91c658cab9b3254a2fb4cbd043d9fcb6b883e29a16820ef7de012c842983fcde7781704615bd927bfdff45c7

Download Submit
C:\Windows\SysWOW64\Gdeqhl32.exe

Filesize
97KB

MD5
9686a1ee43899324c997027eb8203fdf

SHA1
12ddd4b7ebf7df548454cb1b333f314387f44d9a

SHA256
044489ebc1396eb0ee5d0509adc58b54ef5674d4dc650b2fdc3d5d82c0df53c6

SHA512
0be516db3a326dc932cbe6330081f10086895aa2294ad53dd51b339113ce977353a363e3bb9e437877df67ea0d4c6bbfc8d972776f39f580fd361ba1676116d7

Download Submit
C:\Windows\SysWOW64\Gdncmghi.exe

Filesize
97KB

MD5
7b45eb3f73be4c87d7a6b16121ab478d

SHA1
63ab232c4f94c1bba004146d1aecd9e69a14c0f9

SHA256
180300def7434daebc20c06dac6cee3d3bb3cbb6ab2cce4ccf15670d07b8d524

SHA512
1bbda5818005ef32872222b3c928fe4f38d747c055b783164c64e818e523183afda9326cd2202cab2ddc0c8af3ddb92fcdaad3391d3f5cfb480e1d2b8da93a6e

Download Submit
C:\Windows\SysWOW64\Gdqgmmjb.exe

Filesize
97KB

MD5
c27e193dec7720db8c0526af3fc35939

SHA1
201f1227135d18aaae92fb29b3ee492d94026a20

SHA256
05553416fb2a1b23b79aa69ac4bb4373766ee39f98e0d3792ef58370995ef207

SHA512
1c914186506055e74e03425b2c01c6323d2faa509c18ffbb0a02f0aad6e6bf959b72fe13c0ae86e6ac3b68b45d68fcfecf12465b8392290b27d972ab7deccbbc

Download Submit
C:\Windows\SysWOW64\Gfpcgpae.exe

Filesize
97KB

MD5
9a424c546d20a47f862455a66380a602

SHA1
e4832ddda695f51dfbcb18dd6fa3ad60701da431

SHA256
427a7634d2bc6b0d5566824de711d5ec1cef447573d1ffae4874d42be76011a1

SHA512
57568d4ade3d2542a1a4297acb3fce2fb332d0792507afd5fa6e752753a3cfab22d3da939b7295a3db32e9cecdb5417c8fc33675ea5ad25b52325c604aae9561

Download Submit
C:\Windows\SysWOW64\Gkaejf32.exe

Filesize
97KB

MD5
bade4f8a45625341dc5834c9538b4d68

SHA1
763c9526dead9dd8c39bac2be1ea47321ee0ccf7

SHA256
877fcb116643116211995a6506e8f2f02c2379c9a39cdccb7c44c5224752167e

SHA512
615627740f99d53d5955e67494a37b88bb5aec80c36fd3033ae109a6a17b2dbcd5676665612d81dd5596f92ee0a5c629bb230db5eb9cd705083bef5c015a0fee

Download Submit
C:\Windows\SysWOW64\Gkmlofol.exe

Filesize
97KB

MD5
ca19901ae373eaabfefb488c1483e276

SHA1
0430acb5884a817a85daec10eb9f60fe662437f0

SHA256
464646c17703cacb16abf7f3b439676c557d3e122f4327dcb1e382442a9dca50

SHA512
f36c20b5125bb3333c47bc88da5524b2bc7d0d42425988dc6ea239e45da9f8ca1267c3a7d907333e58654be156b09abea7339377242244cba80fd0d83b20c1a4

Download Submit
C:\Windows\SysWOW64\Gododflk.exe

Filesize
97KB

MD5
b4b9e51b060fc8dd00d48140f8ff03f0

SHA1
c1bb7fc7e99ccb6bacc28758bffb927c9568052b

SHA256
30715406de7ae8ab7cf94a3906eab5ce577e5d370b204857a957f26e3f500a9f

SHA512
ec4eef9f1ea9d202116e042b4335b725065a02ab7a805a13108f10d3497c1cf30e166475ce86954b63cd9b8c59277cdba9c7a1c0a51e4afdacdeed64faea4a28

Download Submit
C:\Windows\SysWOW64\Gofkje32.exe

Filesize
97KB

MD5
15b6593ceccae179ab30763c9ce5c26c

SHA1
0a8e3760d76421451530a33220df32b297411227

SHA256
53f9383fb32432687af85d53be037855157036d6a7daa52f5e9b3adac4810d58

SHA512
ffbcf3d49cbb18113b3b032be20ead6009c0d003dfa6367366ca462e6f657d713af4394e4ffdfa55ca30fe17e389a5fc9249f2293f1055bb0439f5007e85114b

Download Submit
C:\Windows\SysWOW64\Hbnjmp32.exe

Filesize
97KB

MD5
1e778072abc674a0fd9de614ac5ec0a0

SHA1
9379e4472c123816a93a9467a3877d6a4435d2c5

SHA256
6055544d4d36ec1863907e9344d706936d35fbc0c00d75f8881b6cb7e53bf071

SHA512
64b3ded2146686475d098a80c3767ff989a810a9b21e2bc1820c9f7974b84dadb3e6a30e6aaf6c8b2a4530dce60d2bc7ff656a17906cb04c4c76a5394515db97

Download Submit
C:\Windows\SysWOW64\Hmabdibj.exe

Filesize
97KB

MD5
01e21dc518ddc1c71577d503ffc8ecea

SHA1
e17f56181a9f6b2cb848a6fd1b7bf646fb421306

SHA256
9f9e6245e3bd352de40d2f4e17b8b041412a76d6c2f9154a12ac4dd2bcfbe1f2

SHA512
1c042d1792e873de16547284090aabcedfc63f7f977dc4c1baf5ca6f4fff57727db9348db377cf5294f4d0c8b0e9f2331f9093d56d6302fd76f363b35c6a7cf2

Download Submit
C:\Windows\SysWOW64\Hmfkoh32.exe

Filesize
97KB

MD5
8a7fc0e3e22fab50eb7be52c638ded98

SHA1
e6b9f6d36507d988ed5e9e8ac78517de40d5d752

SHA256
34150a6d80bac3d3fd047206379c4aaf9227d92b0636b6b978f501da9eca4264

SHA512
abd0cb62854f7d140e645e7968f0051d3b5050b41405e94ab32d63fe06990c5328061c85b368c3eea9826b039b4e99ae84954cc593b65f06fc14d129c2d0d588

Download Submit
C:\Windows\SysWOW64\Hobkfd32.exe

Filesize
97KB

MD5
5552d86f4db4fc20c1553ac7095df17f

SHA1
c3b673b6a7ba687c0c861883d39216df9dc548f3

SHA256
4d45ea1b801d49a0e6fd1bba5ccb420fb165ee697749f68f03dcbbeddaaf6071

SHA512
b99a32b62d094a3e7596f07cde01a0fbebafb283986f8202af54e276b31ddda4803472c878ed21a40690f9f437713e069c9dbfb905b03466c4802ced7a9ba296

Download Submit
C:\Windows\SysWOW64\Hodgkc32.exe

Filesize
97KB

MD5
9e459255afd4032e15139325a90fb7dd

SHA1
5931cf181231b6212b899ad3448847a109a19052

SHA256
d70fa55e0b50313ff59a8980b375366b36ab64b980ddadbda5fd34fc790aac81

SHA512
d5f5bc58cf05dd69cb75fcc3c5f970a95b4ce2b0edad9440ed378225732cc0665a5ac27e9d7a9061128dd2364608a5fa1c11104557518909e8dd4217bfd71087

Download Submit
C:\Windows\SysWOW64\Jcioiood.exe

Filesize
97KB

MD5
84b27dbaad11e054c7d2c0ad228986af

SHA1
5c379a7f970db294e8537ab4238a9d3ddce855e1

SHA256
92dce51378ec6663929c36bb7f1a086c0b788eac9cdb8fef3f1e37ceb6ccb464

SHA512
a3dd23d68f423a6ad82a19a46d7de63520fd0d542236b11ba06d62af8f4e52c320f68a8be1dcdfabb3459b78733335995a020229bcc6a9ee027bf6ce14a3c264

Download Submit
C:\Windows\SysWOW64\Jcllonma.exe

Filesize
97KB

MD5
3461d9b164c592b2c7f16c72c69efc71

SHA1
215cb57b45ccf5ea10efb8c03c1367935b9e905b

SHA256
61a96c1e19d934411edbe95bb1dcd14fc37a3f55d0c502ce8a9d6e6dd39857cf

SHA512
10c87d8a2c861058a332ce1e4e062ee85589342d6b2ac604fdbdd65c80039139ab5c7e7b5c5edf8a7b015452c78d8df10755be5663fb1470d4da01a3c9b1ebf3

Download Submit
C:\Windows\SysWOW64\Jfeopj32.exe

Filesize
97KB

MD5
45b041b700dd31b9daa4504a75a0492a

SHA1
37b57bdfcc01c48fa7862e3212245748b0faecee

SHA256
e62f26471c025fbd396adfb193bbfe4effc42c743b9ac0e13e24f5b5f62ec2d5

SHA512
eebf839af6dff6456252b6479afb33a4847ddaa722698ec3ba21b6301aa0c0809b4f60adb5bebfa0d16d2bd7cec545d703530af01e2513eab8458080f132d96e

Download Submit
C:\Windows\SysWOW64\Jifhaenk.exe

Filesize
97KB

MD5
8c7b6c5084cfc7b50fbe7a8e52439aa4

SHA1
4a4c679bd20dc36cc8e8f3365bfdaaa48b07bf00

SHA256
65004225f050a3098aa6e383d596b81fe54b63a2a2aa65779724c63fb774848b

SHA512
48ab998ddee6f4e88f3fa9a52d49e5efaff31dc67787b56ae5468be287601acb4da23451d01823b9894db8b9be6e9c7f918dd55e3a2ad669435acccd77b33617

Download Submit
C:\Windows\SysWOW64\Jmpgldhg.exe

Filesize
97KB

MD5
c41eb7fc9bed0869dbb66d50d5a51914

SHA1
bfaf0d57411baf30e9687b857037746e1527db42

SHA256
95f5da2b346a3e7dbf20e46dfaad6266ed62d411be4210924e940067cf32dc51

SHA512
42ceb9ea28ee6020f1b9e2acffa81b91e5345f4ec5999c2ab698ff00ef390af164243e7fb0f5618cea5d5f01cf422287986e69bd334b13b9bcb58fd877bc0c55

Download Submit
C:\Windows\SysWOW64\Jplfcpin.exe

Filesize
97KB

MD5
306526dab3bcf488124847e02fe729fd

SHA1
91245f27c3f9142f7560b90be93a840204c5ce92

SHA256
f755d6135e96ed0f2e7f12097e4ee8ac8888d82e59a603e4d54d0d68112f763f

SHA512
e46d10d3e043e543fae3da9efdd204d29887be33f6cc08bd8566743fc9993acecff8abcb684bc4274724f01faeed6c4c489d3e64653e0ffe9e69a72b27127eb2

Download Submit
C:\Windows\SysWOW64\Kbceejpf.exe

Filesize
97KB

MD5
70da2a588565d618b8ef4e0fc7afc494

SHA1
bf80feeffa937d3af59e12221b6511e2921cebfb

SHA256
945c314f4ebf3431bee29521eb8983e3634379307db37e7a421f4158e05ce7e7

SHA512
29c83e3a58c5fc1f4fff7aa1ca37a6ccaa214e8de777c9f5658771377973e3a166ca758078c39285739379202c3b681c1dc74df00b431df1d8b7ad329d8cb96d

Download Submit
C:\Windows\SysWOW64\Kemhff32.exe

Filesize
97KB

MD5
b3e8dea04ac8b48b84d11252517052b8

SHA1
e8606e7cdc341d998c307545e88e5ef24161774b

SHA256
f7435bf3af5f5fffeab92e0512c196471fffcf8b10cd12e690f371ef3e4323da

SHA512
7c7c766e27448713d91dbf96a3636919f85d68e174cf1fd58232b11f78ffc9f104ae20823587d6ae9d239c7ce12b59fe0b63268c98d32656ade84f0d0da5ad85

Download Submit
C:\Windows\SysWOW64\Kfankifm.exe

Filesize
97KB

MD5
7b172d66ace49ca2e3b383974cba8917

SHA1
7cfe8723e9857586e38f6bc98a1a298f41671520

SHA256
3466ed1ef41c7ce7abda910a1aa300762054805daed1ae9c11526ce8ec43941c

SHA512
6e442e0bc7aba620e1edafb392c2ef312790243c5ee5e9c693bf345e6f09d387edb0c32341269b9a1d006c5d61f4133c848e42426dcd430eaf389cb3ac32743b

Download Submit
C:\Windows\SysWOW64\Kfmepi32.exe

Filesize
97KB

MD5
ba2e3c3e30ae8534161841389ad0f032

SHA1
a057b8d847ea84239f46007d094f5877a9f8ef60

SHA256
a0b015d8067e45ea202b9e69a7b62791f4529c309e78c4e8347bf2fadfb3247c

SHA512
70e4b9656dcead0c923add4ad4882213c1308247bb41cb33b08e887d166612cf99d9af1d08a057df6c4a7b2c1fb572abb7b1be66aff09bbe424acf4996816d83

Download Submit
C:\Windows\SysWOW64\Kmfmmcbo.exe

Filesize
97KB

MD5
cbf18f0c533f88665e0f8c0fee0bc2db

SHA1
311463b72a553168f63b043ed665a32e4eebc4b1

SHA256
2e1ee6ba7d9732d45cf86f8b86dbbb9ce008239406677328ba32bb11f3c013c0

SHA512
2bfebe1f9e35e65ffe325280aee4667bb8293f5a4b2123bda8d83a3edc8c097a324ad04e11ee86f7a5df466aad50a52287c524eb9047ee181be6177ea3034bd3

Download Submit
C:\Windows\SysWOW64\Kmijbcpl.exe

Filesize
97KB

MD5
df6b38205fe5cf638cd9783fe0882bcc

SHA1
44da1710cd7e6967e216c8029939984ca8de552e

SHA256
511141717b8b05a36064fb5c1a0d355d1ca5f4eafcbc37aab54124df41093dca

SHA512
03fd87b2a4149b51bc02ab071941dc23febf2feeb80a91fb0fd3a132a9d14df6ac138d4637c87a87eab172029cd966961d7ed7efa20dbddf3e754c74eb2c5a51

Download Submit
C:\Windows\SysWOW64\Knkekn32.exe

Filesize
97KB

MD5
4000768d9756301cfd5f80ab7e7e89f2

SHA1
d252944d11aeda3492e4073c12fd9ecdaf783c09

SHA256
34663747f03cb8d9a873ef01119c1f4948674ffcf4fa74f7712277c40e2f28f7

SHA512
a434d634c74d188754b4c93f1ab66d4723dd54093070dbaa2b3454f73ee2262f78285798170978b0dfb27f68634157271e335847c428531c4d5a40c8767ec2cf

Download Submit
C:\Windows\SysWOW64\Lekehdgp.exe

Filesize
97KB

MD5
da28889b85051a63cd0369c179caffd4

SHA1
bbed30c11dcf397de96fc1d9bba1969ab3838c5d

SHA256
0506ded923ce4314adcf60cffe78f1aaf239163b4fba6fc79a88e12997c46e63

SHA512
4648db993df6ceb08feec98f6f56b8072af2ab85ef67f7450a1e347e969b9b3ca963e86815456af0b853c3847a451334051e2669902aa6b2a23dcc54cdb1ceda

Download Submit
C:\Windows\SysWOW64\Llgjjnlj.exe

Filesize
97KB

MD5
730f12ee53f8a28ab9a9292988002bd9

SHA1
97808253efc8f0a5043ee71f8bb25b6d8839f96e

SHA256
837caf6b94d3ab46f1741f7c90f15aec4f3ac3ea783e3352dda2ab840a542969

SHA512
511103f803ec217171f8c55aba4eb06c87ab77b457afad18223b3335bf2bfd18d52c92ec25b19bce2599e3b4b672466371250a7e180110a844a8af06fff056f8

Download Submit
C:\Windows\SysWOW64\Migjoaaf.exe

Filesize
97KB

MD5
605652cf9c3126bcabf991baf0cdb290

SHA1
765764da43ef285c29e1c6d99195ce7737450ff3

SHA256
4cb3ad0a4c945d9474845d693a181b64913cf2cca079565e15b7b7ea890ac56b

SHA512
1946c88b72a262cb27b38ef918eca4828bbf7245047a6870dc459246baf2aebe1ab3a21b1a446d2187978d14d2b9d7a2b7b38aca0fa31149fc1be2352b3ca14d

Download Submit
C:\Windows\SysWOW64\Nliaao32.exe

Filesize
97KB

MD5
b389a5e8ea76878ffb3b7258180833c6

SHA1
0b967d64646f2d2adbbd5e0918b8c6428ce0428a

SHA256
a98d0ba12ca2ab530a43c1d98ac3ccd3497f2a4d73afa23e47c94780c4c01571

SHA512
9975fea97f9453d5f170ff5cbbf46d72c41c54bebf01104f1f7a75b09071c35fa260a7d563349d268e3478cd3d3b957e4a8f2a3e3a73cf21a9971abd684eaa1f

Download Submit
C:\Windows\SysWOW64\Oadfkdgd.exe

Filesize
97KB

MD5
bc980f0ddc2545818958c5ced728cbb6

SHA1
3bcf7adb256ee629df52e835abb848cebb6aac54

SHA256
9d3ee25ee274881fafaddaa836fc75a9863a1276d56e11d69d3cbd2dd0c4e3b1

SHA512
7ed1849891448caaa94b57cc2675936bc897c7ed59ce2a97c366944dce5f98d8a764a0dfcc349b403aad6d411b0d055253a14dccc4ce33c1d2505b8b3443e1cc

Download Submit
C:\Windows\SysWOW64\Olkhmi32.exe

Filesize
97KB

MD5
ca7ea168fbea5588e5b09f52ea8cdcb0

SHA1
1685052e78e5e51fc14aeb4552dbbbc80488abeb

SHA256
de9362adc40f9574e1d66d6d560c3a77616420acc9ee2225b77fbf77e9cf1109

SHA512
62fb6e7602dc4a15750373a7e629a39fecd441e21bc4f0114e8eb631e65cb374dbd5789809ce5faec7c21de89645f28ec7402628721fd9b11b1d9fcafb8558b9

Download Submit
C:\Windows\SysWOW64\Ophfae32.dll

Filesize
7KB

MD5
d067bb6fe1110d7d8cab66e7e9e379da

SHA1
efd4605a880b68d85bb36a3a40c48c65593b6ad5

SHA256
070ec8c6ed34251c685dd592ec8a2fa56ac74cd5df98ea2b0cdf641ffda79808

SHA512
4a6d84bb478591aae8d0724c647d81715b1f7f0d22eb1d4cb317db73b9027c6b904c29ffc9d16a5b4d6cfd80954eb59ce319de73d97f65b84ff908d0bd8e891d

Download Submit
C:\Windows\SysWOW64\Pamiaboj.exe

Filesize
97KB

MD5
5a0c8569f20ae62e800bacfb6b3bedf7

SHA1
7e5a28c202058b05a199ec3ef112eac45ee098ea

SHA256
95a8ea1c39ebe8b5d6bf4aac90592f3b018112fd54dbcfe7e0dcb2a32acb0725

SHA512
0e8f5b3466c1ff2a635d607655ddf66d75a6351dfa28458da1bfc3037e65d23964d6a8f2e9f0cecf7c05bb904790fd05872c9e31f635d43efaf371d61f7f40ee

Download Submit
C:\Windows\SysWOW64\Qlggjk32.exe

Filesize
97KB

MD5
95e94f784e8a5f5f9fbe26960b2d9484

SHA1
7e9cb90fbf703757bf213324c2aef271daa02605

SHA256
0b49c5af33b5e4266704735ec05553faba46a585fb33b6386ee3c2b082717996

SHA512
be249a6928be7203366341304e2fa64dcd2b70bd3aa31671fb9dd969b1559f0eb627bf42be97dcacb3eccfd67f353ffb6a84de72b5883d3dd083d865f6b5a139

Download Submit
memory/116-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/232-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/468-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/536-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/952-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1484-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1488-168-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1532-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1544-127-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1640-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1820-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1904-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2012-88-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2072-183-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2128-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2156-248-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2300-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2356-155-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2376-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2468-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2492-212-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2588-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2620-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2676-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2720-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2900-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3256-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3264-256-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3332-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3400-215-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3528-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3552-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3556-266-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3700-199-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3724-244-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3840-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3884-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3992-176-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4068-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4080-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4124-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4212-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4268-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4432-228-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4460-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4524-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4532-234-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4604-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4684-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5064-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5096-192-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5104-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5128-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5172-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5216-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5256-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5316-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5368-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5420-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5464-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5504-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5560-430-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5608-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5648-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads