62e378a5f616cc3aa900b3efaf7e34e3c688e8212053bd537de45c2cff8546f6

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62e378a5f616cc3aa900b3efaf7e34e3c688e8212053bd537de45c2cff8546f6.exe
Size

45KB
MD5

1d42aa4763128ef5210ecfaf11f2fdc0
SHA1

b53f5e74ef3656416433f5c9464b5e6f4b39d5a7
SHA256

62e378a5f616cc3aa900b3efaf7e34e3c688e8212053bd537de45c2cff8546f6
SHA512

8b318a7a56c34990c9d5c351dd4f3074cce1fc4516260f74e21c16f17889f353c1e0a83bca5ac1ced28d37b4cd1f5fcccbb5b70994950ae04f6031f0c0c4ebd8
SSDEEP

768:BiEQjQM3y3dSQ59qIWZiJA0ijcvkCvPlewabbTKP/1H5Ix:BiljQMC3T5uZiJA0iwHYvc2x

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdgljmcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mehjol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llmhaold.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogkcpbam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjpbam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Domdjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qlimed32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlolpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fojlngce.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgbmccpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iohjlmeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igmagnkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehkclgmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdbnjdfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgcihgaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpqiemge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nckndeni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eaonjngh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Papfgbmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imfdff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eggmge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dheibpje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njqmepik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocpgod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emhldnkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnkcogno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Leoghn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckhecmcf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoaojp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmdina32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adfnofpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhbebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eaklidoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdeqhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmijbcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eefaomcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdfmlhna.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnbakghm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmfkoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlampmdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhpiafnm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aogiap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmennnni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ecmeig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Moobbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Palbgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdmpje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqijje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgepom32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbnafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifdonfka.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mibijk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjpobg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akccap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qcgffqei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eefaomcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbhamajc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmbmkpie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hofdacke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ippggbck.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmdkch32.exe

Executes dropped EXE 64 IoCs

pid	Process
2172	Eaklidoi.exe
1540	Eoolbinc.exe
3288	Edkdkplj.exe
4876	Ekemhj32.exe
3004	Ecmeig32.exe
4140	Eleiam32.exe
4872	Ecoangbg.exe
552	Ehljfnpn.exe
2148	Eadopc32.exe
1676	Fkmchi32.exe
1288	Febgea32.exe
4560	Fojlngce.exe
1996	Fchddejl.exe
4616	Fdialn32.exe
1140	Fkciihgg.exe
3160	Fbnafb32.exe
2472	Fhgjblfq.exe
5016	Ffkjlp32.exe
2256	Fhjfhl32.exe
2600	Gcojed32.exe
2056	Gdqgmmjb.exe
4020	Gcddpdpo.exe
4784	Gdeqhl32.exe
1360	Gokdeeec.exe
3016	Gfembo32.exe
1592	Gmoeoidl.exe
1848	Gfgjgo32.exe
1088	Hmabdibj.exe
4296	Hckjacjg.exe
3688	Helfik32.exe
3980	Hkfoeega.exe
3836	Hbpgbo32.exe
4260	Hmfkoh32.exe
1352	Heapdjlp.exe
4540	Hofdacke.exe
2204	Hecmijim.exe
212	Hoiafcic.exe
1792	Iefioj32.exe
3812	Immapg32.exe
1448	Ibjjhn32.exe
2452	Iicbehnq.exe
3544	Ipnjab32.exe
4388	Iejcji32.exe
2884	Ippggbck.exe
2192	Ifjodl32.exe
464	Imdgqfbd.exe
3264	Ibqpimpl.exe
3164	Ieolehop.exe
3212	Imfdff32.exe
4404	Ipdqba32.exe
1552	Jlkagbej.exe
1620	Jioaqfcc.exe
2476	Jcefno32.exe
4672	Jfcbjk32.exe
536	Jlpkba32.exe
2428	Jeklag32.exe
1720	Jpppnp32.exe
2384	Kemhff32.exe
2072	Klgqcqkl.exe
348	Kdnidn32.exe
1844	Kikame32.exe
1116	Kpeiioac.exe
1920	Kfoafi32.exe
3964	Kmijbcpl.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mgeakekd.exe	Mcgiefen.exe
File created	C:\Windows\SysWOW64\Ddakjkqi.exe	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Mjlhgaqp.exe	Mgloefco.exe
File created	C:\Windows\SysWOW64\Inaoom32.dll	Lifjnm32.exe
File created	C:\Windows\SysWOW64\Lgepom32.exe	Kjjiej32.exe
File created	C:\Windows\SysWOW64\Jomdjhoo.dll	Npchgdcd.exe
File created	C:\Windows\SysWOW64\Dekclg32.dll	Gcddpdpo.exe
File created	C:\Windows\SysWOW64\Nnjlpo32.exe	Ncdgcf32.exe
File created	C:\Windows\SysWOW64\Goedpofl.exe	Ghklce32.exe
File created	C:\Windows\SysWOW64\Mbibld32.dll	Ckjbhmad.exe
File created	C:\Windows\SysWOW64\Khfclo32.dll	Chnbbqpn.exe
File created	C:\Windows\SysWOW64\Igjnojdk.dll	Pdfjifjo.exe
File opened for modification	C:\Windows\SysWOW64\Aepefb32.exe	Aminee32.exe
File opened for modification	C:\Windows\SysWOW64\Mckemg32.exe	Mlampmdo.exe
File created	C:\Windows\SysWOW64\Ngdmod32.exe	Ndfqbhia.exe
File created	C:\Windows\SysWOW64\Ohepjfbb.dll	Gkobjpin.exe
File created	C:\Windows\SysWOW64\Dgmchiim.dll	Gpnfge32.exe
File created	C:\Windows\SysWOW64\Iloidijb.exe	Iknmla32.exe
File created	C:\Windows\SysWOW64\Ogcggo32.dll	Mimpolee.exe
File opened for modification	C:\Windows\SysWOW64\Ogklelna.exe	Olehhc32.exe
File created	C:\Windows\SysWOW64\Kbblcj32.dll	Efeihb32.exe
File created	C:\Windows\SysWOW64\Olcjhi32.dll	Mcpnhfhf.exe
File created	C:\Windows\SysWOW64\Mcgiefen.exe	Mfchlbfd.exe
File opened for modification	C:\Windows\SysWOW64\Fdialn32.exe	Fchddejl.exe
File opened for modification	C:\Windows\SysWOW64\Fggfnc32.exe	Fdijbg32.exe
File opened for modification	C:\Windows\SysWOW64\Bmkjkd32.exe	Bfabnjjp.exe
File opened for modification	C:\Windows\SysWOW64\Moobbb32.exe	Mlpeff32.exe
File created	C:\Windows\SysWOW64\Lfkaag32.exe	Lpqiemge.exe
File opened for modification	C:\Windows\SysWOW64\Ajanck32.exe	Qcgffqei.exe
File opened for modification	C:\Windows\SysWOW64\Nqbpojnp.exe	Nfjola32.exe
File created	C:\Windows\SysWOW64\Gifjfmcq.dll	Jgmjmjnb.exe
File opened for modification	C:\Windows\SysWOW64\Bllbaa32.exe	Bebjdgmj.exe
File created	C:\Windows\SysWOW64\Aogbfi32.exe	Qmeigg32.exe
File created	C:\Windows\SysWOW64\Gfpggnan.dll	62e378a5f616cc3aa900b3efaf7e34e3c688e8212053bd537de45c2cff8546f6.exe
File created	C:\Windows\SysWOW64\Pjhlml32.exe	Pcncpbmd.exe
File created	C:\Windows\SysWOW64\Iohjlmeg.exe	Hgabkoee.exe
File opened for modification	C:\Windows\SysWOW64\Nohehq32.exe	Nhnlkfpp.exe
File opened for modification	C:\Windows\SysWOW64\Eadopc32.exe	Ehljfnpn.exe
File opened for modification	C:\Windows\SysWOW64\Fdbdah32.exe	Emhldnkj.exe
File created	C:\Windows\SysWOW64\Bhagaamj.dll	Kbbokdlk.exe
File created	C:\Windows\SysWOW64\Pmmnjnld.dll	Nlmdbh32.exe
File created	C:\Windows\SysWOW64\Loeolc32.exe	Llgcph32.exe
File created	C:\Windows\SysWOW64\Ohkhqj32.dll	Lphoelqn.exe
File created	C:\Windows\SysWOW64\Nhpiafnm.exe	Nebmekoi.exe
File created	C:\Windows\SysWOW64\Moobbb32.exe	Mlpeff32.exe
File opened for modification	C:\Windows\SysWOW64\Efeihb32.exe	Eokqkh32.exe
File created	C:\Windows\SysWOW64\Hcjdeo32.dll	Feapkk32.exe
File created	C:\Windows\SysWOW64\Cikjab32.dll	Nlqomd32.exe
File created	C:\Windows\SysWOW64\Aogiap32.exe	Qlimed32.exe
File opened for modification	C:\Windows\SysWOW64\Domdjj32.exe	Dmohno32.exe
File created	C:\Windows\SysWOW64\Npcoakfp.exe	Miifeq32.exe
File opened for modification	C:\Windows\SysWOW64\Idjlpc32.exe	Inpccihl.exe
File created	C:\Windows\SysWOW64\Feoodn32.exe	Fpbflg32.exe
File created	C:\Windows\SysWOW64\Aafkfgeh.dll	Jmbhoeid.exe
File opened for modification	C:\Windows\SysWOW64\Fmcjpl32.exe	Ekdnei32.exe
File created	C:\Windows\SysWOW64\Dkqaoe32.exe	Dhbebj32.exe
File created	C:\Windows\SysWOW64\Iefioj32.exe	Hoiafcic.exe
File opened for modification	C:\Windows\SysWOW64\Ogjdmbil.exe	Ojajin32.exe
File created	C:\Windows\SysWOW64\Ljodkeij.dll	Lpqiemge.exe
File opened for modification	C:\Windows\SysWOW64\Fmmmfj32.exe	Fnlmhc32.exe
File opened for modification	C:\Windows\SysWOW64\Fhjfhl32.exe	Ffkjlp32.exe
File created	C:\Windows\SysWOW64\Fdnnlj32.dll	Cbdjeg32.exe
File created	C:\Windows\SysWOW64\Bdifpa32.dll	Gejopl32.exe
File created	C:\Windows\SysWOW64\Phincl32.exe	Papfgbmg.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6796	8368	WerFault.exe	617

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lckiihok.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Feapkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjpfjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chiblk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lihfcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjpbam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iicbehnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Popodg32.dll"	Pdifoehl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhagaamj.dll"	Kbbokdlk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcmmhj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehfjah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ghklce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfmcjh32.dll"	Iohjlmeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgmbieme.dll"	Ekemhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ppmcdq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpiplm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkfoeega.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjdeo32.dll"	Feapkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmhbagkn.dll"	Nemcjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbpjaeoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Immapg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbeedbdm.dll"	Lmppcbjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjdhbppo.dll"	Jiiicf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kijjbofj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jboqnpjm.dll"	Moobbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbbpmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpfgmnfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eokqkh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqmmmmph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhphmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijlbqboa.dll"	Helfik32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibqpimpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjeoglgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajdjin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfjehk32.dll"	Ecoangbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfoafi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jphopllo.dll"	Lmdina32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogklelna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Feapkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hdbfodfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfbcke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpdlhkad.dll"	Edmjfifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fhmpagkp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Helfik32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icfekc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcinbcgc.dll"	Ibjjhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klgqcqkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjpobg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdecba32.dll"	Dmadco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbblcj32.dll"	Efeihb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Knkekn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idnljnaa.dll"	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efqidp32.dll"	Fgjccb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnjlpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klplbbaq.dll"	Oaqbkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cponen32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 2172	4284	62e378a5f616cc3aa900b3efaf7e34e3c688e8212053bd537de45c2cff8546f6.exe	88
PID 4284 wrote to memory of 2172	4284	62e378a5f616cc3aa900b3efaf7e34e3c688e8212053bd537de45c2cff8546f6.exe	88
PID 4284 wrote to memory of 2172	4284	62e378a5f616cc3aa900b3efaf7e34e3c688e8212053bd537de45c2cff8546f6.exe	88
PID 2172 wrote to memory of 1540	2172	Eaklidoi.exe	89
PID 2172 wrote to memory of 1540	2172	Eaklidoi.exe	89
PID 2172 wrote to memory of 1540	2172	Eaklidoi.exe	89
PID 1540 wrote to memory of 3288	1540	Eoolbinc.exe	90
PID 1540 wrote to memory of 3288	1540	Eoolbinc.exe	90
PID 1540 wrote to memory of 3288	1540	Eoolbinc.exe	90
PID 3288 wrote to memory of 4876	3288	Edkdkplj.exe	91
PID 3288 wrote to memory of 4876	3288	Edkdkplj.exe	91
PID 3288 wrote to memory of 4876	3288	Edkdkplj.exe	91
PID 4876 wrote to memory of 3004	4876	Ekemhj32.exe	92
PID 4876 wrote to memory of 3004	4876	Ekemhj32.exe	92
PID 4876 wrote to memory of 3004	4876	Ekemhj32.exe	92
PID 3004 wrote to memory of 4140	3004	Ecmeig32.exe	93
PID 3004 wrote to memory of 4140	3004	Ecmeig32.exe	93
PID 3004 wrote to memory of 4140	3004	Ecmeig32.exe	93
PID 4140 wrote to memory of 4872	4140	Eleiam32.exe	94
PID 4140 wrote to memory of 4872	4140	Eleiam32.exe	94
PID 4140 wrote to memory of 4872	4140	Eleiam32.exe	94
PID 4872 wrote to memory of 552	4872	Ecoangbg.exe	95
PID 4872 wrote to memory of 552	4872	Ecoangbg.exe	95
PID 4872 wrote to memory of 552	4872	Ecoangbg.exe	95
PID 552 wrote to memory of 2148	552	Ehljfnpn.exe	97
PID 552 wrote to memory of 2148	552	Ehljfnpn.exe	97
PID 552 wrote to memory of 2148	552	Ehljfnpn.exe	97
PID 2148 wrote to memory of 1676	2148	Eadopc32.exe	98
PID 2148 wrote to memory of 1676	2148	Eadopc32.exe	98
PID 2148 wrote to memory of 1676	2148	Eadopc32.exe	98
PID 1676 wrote to memory of 1288	1676	Fkmchi32.exe	99
PID 1676 wrote to memory of 1288	1676	Fkmchi32.exe	99
PID 1676 wrote to memory of 1288	1676	Fkmchi32.exe	99
PID 1288 wrote to memory of 4560	1288	Febgea32.exe	100
PID 1288 wrote to memory of 4560	1288	Febgea32.exe	100
PID 1288 wrote to memory of 4560	1288	Febgea32.exe	100
PID 4560 wrote to memory of 1996	4560	Fojlngce.exe	101
PID 4560 wrote to memory of 1996	4560	Fojlngce.exe	101
PID 4560 wrote to memory of 1996	4560	Fojlngce.exe	101
PID 1996 wrote to memory of 4616	1996	Fchddejl.exe	102
PID 1996 wrote to memory of 4616	1996	Fchddejl.exe	102
PID 1996 wrote to memory of 4616	1996	Fchddejl.exe	102
PID 4616 wrote to memory of 1140	4616	Fdialn32.exe	103
PID 4616 wrote to memory of 1140	4616	Fdialn32.exe	103
PID 4616 wrote to memory of 1140	4616	Fdialn32.exe	103
PID 1140 wrote to memory of 3160	1140	Fkciihgg.exe	104
PID 1140 wrote to memory of 3160	1140	Fkciihgg.exe	104
PID 1140 wrote to memory of 3160	1140	Fkciihgg.exe	104
PID 3160 wrote to memory of 2472	3160	Fbnafb32.exe	106
PID 3160 wrote to memory of 2472	3160	Fbnafb32.exe	106
PID 3160 wrote to memory of 2472	3160	Fbnafb32.exe	106
PID 2472 wrote to memory of 5016	2472	Fhgjblfq.exe	107
PID 2472 wrote to memory of 5016	2472	Fhgjblfq.exe	107
PID 2472 wrote to memory of 5016	2472	Fhgjblfq.exe	107
PID 5016 wrote to memory of 2256	5016	Ffkjlp32.exe	108
PID 5016 wrote to memory of 2256	5016	Ffkjlp32.exe	108
PID 5016 wrote to memory of 2256	5016	Ffkjlp32.exe	108
PID 2256 wrote to memory of 2600	2256	Fhjfhl32.exe	109
PID 2256 wrote to memory of 2600	2256	Fhjfhl32.exe	109
PID 2256 wrote to memory of 2600	2256	Fhjfhl32.exe	109
PID 2600 wrote to memory of 2056	2600	Gcojed32.exe	110
PID 2600 wrote to memory of 2056	2600	Gcojed32.exe	110
PID 2600 wrote to memory of 2056	2600	Gcojed32.exe	110
PID 2056 wrote to memory of 4020	2056	Gdqgmmjb.exe	111

C:\Users\Admin\AppData\Local\Temp\62e378a5f616cc3aa900b3efaf7e34e3c688e8212053bd537de45c2cff8546f6.exe
"C:\Users\Admin\AppData\Local\Temp\62e378a5f616cc3aa900b3efaf7e34e3c688e8212053bd537de45c2cff8546f6.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\Eaklidoi.exe
  C:\Windows\system32\Eaklidoi.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\SysWOW64\Eoolbinc.exe
    C:\Windows\system32\Eoolbinc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\Windows\SysWOW64\Edkdkplj.exe
      C:\Windows\system32\Edkdkplj.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3288
    - - C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4876
      - C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:552
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2148
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1140
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3160
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2472
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4020
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4784
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        25⤵
        Executes dropped EXE
        
        PID:1360
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        26⤵
        Executes dropped EXE
        
        PID:3016
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        27⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        28⤵
        Executes dropped EXE
        
        PID:1848
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        29⤵
        Executes dropped EXE
        
        PID:1088
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        30⤵
        Executes dropped EXE
        
        PID:4296
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3688
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3980
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        33⤵
        Executes dropped EXE
        
        PID:3836
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4260
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        35⤵
        Executes dropped EXE
        
        PID:1352
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4540
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        37⤵
        Executes dropped EXE
        
        PID:2204
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:212
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        39⤵
        Executes dropped EXE
        
        PID:1792
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3812
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1448
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2452
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        43⤵
        Executes dropped EXE
        
        PID:3544
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        44⤵
        Executes dropped EXE
        
        PID:4388
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2884
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        46⤵
        Executes dropped EXE
        
        PID:2192
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        47⤵
        Executes dropped EXE
        
        PID:464
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3264
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        49⤵
        Executes dropped EXE
        
        PID:3164
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3212
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        51⤵
        Executes dropped EXE
        
        PID:4404
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        52⤵
        Executes dropped EXE
        
        PID:1552
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        53⤵
        Executes dropped EXE
        
        PID:1620
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        54⤵
        Executes dropped EXE
        
        PID:2476
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        55⤵
        Executes dropped EXE
        
        PID:4672
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        56⤵
        Executes dropped EXE
        
        PID:536
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        57⤵
        Executes dropped EXE
        
        PID:2428
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        58⤵
        Executes dropped EXE
        
        PID:1720
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        59⤵
        Executes dropped EXE
        
        PID:2384
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2072
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        61⤵
        Executes dropped EXE
        
        PID:348
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        62⤵
        Executes dropped EXE
        
        PID:1844
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        63⤵
        Executes dropped EXE
        
        PID:1116
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1920
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3964
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        66⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        67⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        68⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        69⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3764
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        71⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        72⤵
        Modifies registry class
        
        PID:5060
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        73⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        74⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        75⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4176
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        77⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5128
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        79⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        80⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        81⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        82⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        83⤵
        Drops file in System32 directory
        
        PID:5344
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        84⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        86⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        87⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        88⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        89⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        90⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        91⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        92⤵
        Drops file in System32 directory
        
        PID:5800
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        93⤵
        Drops file in System32 directory
        
        PID:5852
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        94⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        95⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        96⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        97⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        98⤵
        Drops file in System32 directory
        
        PID:6108
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        99⤵
        Modifies registry class
        
        PID:5180
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        100⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5332
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        102⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        103⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        104⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        105⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        106⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5828
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        108⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        109⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        110⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        111⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        112⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5452
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5592
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        115⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        116⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        117⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        118⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        119⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        120⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        121⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        122⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        123⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        124⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        125⤵
        Drops file in System32 directory
        
        PID:5492
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        126⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        127⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        128⤵
        Modifies registry class
        
        PID:6160
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        129⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        130⤵
        Modifies registry class
        
        PID:6248
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6292
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        132⤵
        Drops file in System32 directory
        
        PID:6336
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6380
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        134⤵
        Modifies registry class
        
        PID:6424
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6472
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        136⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        137⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        138⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        139⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        140⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        141⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6792
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6836
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        144⤵
        Modifies registry class
        
        PID:6884
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        145⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        146⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        147⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        148⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        149⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        150⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        151⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        152⤵
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        153⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        154⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        155⤵
        Modifies registry class
        
        PID:6460
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        156⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        157⤵
        Modifies registry class
        
        PID:6584
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        158⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        159⤵
        Drops file in System32 directory
        
        PID:6772
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        160⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        161⤵
        Drops file in System32 directory
        
        PID:6908
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        162⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        163⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        164⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6148
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        166⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        167⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        168⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        169⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        170⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        171⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        172⤵
        Modifies registry class
        
        PID:7112
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        173⤵
        Modifies registry class
        
        PID:6224
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        174⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        175⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        176⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6916
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7096
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        178⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        179⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        180⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        181⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        182⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Eecdjmfi.exe
        
        C:\Windows\system32\Eecdjmfi.exe
        183⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Ehapfiem.exe
        
        C:\Windows\system32\Ehapfiem.exe
        184⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Ekpmbddq.exe
        
        C:\Windows\system32\Ekpmbddq.exe
        185⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Eefaomcg.exe
        
        C:\Windows\system32\Eefaomcg.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7224
        
        C:\Windows\SysWOW64\Eggmge32.exe
        
        C:\Windows\system32\Eggmge32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7260
        
        C:\Windows\SysWOW64\Emaedo32.exe
        
        C:\Windows\system32\Emaedo32.exe
        188⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Eehnem32.exe
        
        C:\Windows\system32\Eehnem32.exe
        189⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Ehfjah32.exe
        
        C:\Windows\system32\Ehfjah32.exe
        190⤵
        Modifies registry class
        
        PID:7408
        
        C:\Windows\SysWOW64\Eopbnbhd.exe
        
        C:\Windows\system32\Eopbnbhd.exe
        191⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Eaonjngh.exe
        
        C:\Windows\system32\Eaonjngh.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7484
        
        C:\Windows\SysWOW64\Edmjfifl.exe
        
        C:\Windows\system32\Edmjfifl.exe
        193⤵
        Modifies registry class
        
        PID:7536
        
        C:\Windows\SysWOW64\Eglgbdep.exe
        
        C:\Windows\system32\Eglgbdep.exe
        194⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Eobocb32.exe
        
        C:\Windows\system32\Eobocb32.exe
        195⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        196⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Ehkclgmb.exe
        
        C:\Windows\system32\Ehkclgmb.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7712
        
        C:\Windows\SysWOW64\Eoekia32.exe
        
        C:\Windows\system32\Eoekia32.exe
        198⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Emhldnkj.exe
        
        C:\Windows\system32\Emhldnkj.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7796
        
        C:\Windows\SysWOW64\Fdbdah32.exe
        
        C:\Windows\system32\Fdbdah32.exe
        200⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Fhmpagkp.exe
        
        C:\Windows\system32\Fhmpagkp.exe
        201⤵
        Modifies registry class
        
        PID:7884
        
        C:\Windows\SysWOW64\Feapkk32.exe
        
        C:\Windows\system32\Feapkk32.exe
        202⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7928
        
        C:\Windows\SysWOW64\Fgbmccpg.exe
        
        C:\Windows\system32\Fgbmccpg.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7972
        
        C:\Windows\SysWOW64\Fdfmlhna.exe
        
        C:\Windows\system32\Fdfmlhna.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8020
        
        C:\Windows\SysWOW64\Fajnfl32.exe
        
        C:\Windows\system32\Fajnfl32.exe
        205⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Fdijbg32.exe
        
        C:\Windows\system32\Fdijbg32.exe
        206⤵
        Drops file in System32 directory
        
        PID:8104
        
        C:\Windows\SysWOW64\Fggfnc32.exe
        
        C:\Windows\system32\Fggfnc32.exe
        207⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        208⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Fgjccb32.exe
        
        C:\Windows\system32\Fgjccb32.exe
        209⤵
        Modifies registry class
        
        PID:7244
        
        C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        210⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Gaogak32.exe
        
        C:\Windows\system32\Gaogak32.exe
        211⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Gekcaj32.exe
        
        C:\Windows\system32\Gekcaj32.exe
        212⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Gglpibgm.exe
        
        C:\Windows\system32\Gglpibgm.exe
        213⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Gochjpho.exe
        
        C:\Windows\system32\Gochjpho.exe
        214⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Ghklce32.exe
        
        C:\Windows\system32\Ghklce32.exe
        215⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7636
        
        C:\Windows\SysWOW64\Goedpofl.exe
        
        C:\Windows\system32\Goedpofl.exe
        216⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Gadqlkep.exe
        
        C:\Windows\system32\Gadqlkep.exe
        217⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Ghniielm.exe
        
        C:\Windows\system32\Ghniielm.exe
        218⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Gkleeplq.exe
        
        C:\Windows\system32\Gkleeplq.exe
        219⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Gddinf32.exe
        
        C:\Windows\system32\Gddinf32.exe
        220⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Gkobjpin.exe
        
        C:\Windows\system32\Gkobjpin.exe
        221⤵
        Drops file in System32 directory
        
        PID:7204
        
        C:\Windows\SysWOW64\Gahjgj32.exe
        
        C:\Windows\system32\Gahjgj32.exe
        222⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Ghbbcd32.exe
        
        C:\Windows\system32\Ghbbcd32.exe
        223⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Gkaopp32.exe
        
        C:\Windows\system32\Gkaopp32.exe
        224⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Hnoklk32.exe
        
        C:\Windows\system32\Hnoklk32.exe
        225⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Hheoid32.exe
        
        C:\Windows\system32\Hheoid32.exe
        226⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Hoogfnnb.exe
        
        C:\Windows\system32\Hoogfnnb.exe
        227⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Hnagak32.exe
        
        C:\Windows\system32\Hnagak32.exe
        228⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Hdlpneli.exe
        
        C:\Windows\system32\Hdlpneli.exe
        229⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Hgjljpkm.exe
        
        C:\Windows\system32\Hgjljpkm.exe
        230⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        231⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Hglipp32.exe
        
        C:\Windows\system32\Hglipp32.exe
        232⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Hbbmmi32.exe
        
        C:\Windows\system32\Hbbmmi32.exe
        233⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Hgoeep32.exe
        
        C:\Windows\system32\Hgoeep32.exe
        234⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Hninbj32.exe
        
        C:\Windows\system32\Hninbj32.exe
        235⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Hdbfodfa.exe
        
        C:\Windows\system32\Hdbfodfa.exe
        236⤵
        Modifies registry class
        
        PID:7824
        
        C:\Windows\SysWOW64\Hgabkoee.exe
        
        C:\Windows\system32\Hgabkoee.exe
        237⤵
        Drops file in System32 directory
        
        PID:8116
        
        C:\Windows\SysWOW64\Iohjlmeg.exe
        
        C:\Windows\system32\Iohjlmeg.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7628
        
        C:\Windows\SysWOW64\Ifbbig32.exe
        
        C:\Windows\system32\Ifbbig32.exe
        239⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Ihqoeb32.exe
        
        C:\Windows\system32\Ihqoeb32.exe
        240⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Inmgmijo.exe
        
        C:\Windows\system32\Inmgmijo.exe
        241⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Ifdonfka.exe
        
        C:\Windows\system32\Ifdonfka.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8208
        
        C:\Windows\SysWOW64\Iickkbje.exe
        
        C:\Windows\system32\Iickkbje.exe
        243⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        244⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Inpccihl.exe
        
        C:\Windows\system32\Inpccihl.exe
        245⤵
        Drops file in System32 directory
        
        PID:8344
        
        C:\Windows\SysWOW64\Idjlpc32.exe
        
        C:\Windows\system32\Idjlpc32.exe
        246⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Ighhln32.exe
        
        C:\Windows\system32\Ighhln32.exe
        247⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Ioopml32.exe
        
        C:\Windows\system32\Ioopml32.exe
        248⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Ibnligoc.exe
        
        C:\Windows\system32\Ibnligoc.exe
        249⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Iigdfa32.exe
        
        C:\Windows\system32\Iigdfa32.exe
        250⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Igjeanmj.exe
        
        C:\Windows\system32\Igjeanmj.exe
        251⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Ioambknl.exe
        
        C:\Windows\system32\Ioambknl.exe
        252⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        253⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Ienekbld.exe
        
        C:\Windows\system32\Ienekbld.exe
        254⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Igmagnkg.exe
        
        C:\Windows\system32\Igmagnkg.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8784
        
        C:\Windows\SysWOW64\Jodjhkkj.exe
        
        C:\Windows\system32\Jodjhkkj.exe
        256⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Jfnbdecg.exe
        
        C:\Windows\system32\Jfnbdecg.exe
        257⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Jilnqqbj.exe
        
        C:\Windows\system32\Jilnqqbj.exe
        258⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Jbdbjf32.exe
        
        C:\Windows\system32\Jbdbjf32.exe
        259⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Jiokfpph.exe
        
        C:\Windows\system32\Jiokfpph.exe
        260⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Jnkcogno.exe
        
        C:\Windows\system32\Jnkcogno.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9044
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        262⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Kpbfii32.exe
        
        C:\Windows\system32\Kpbfii32.exe
        263⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Kbpbed32.exe
        
        C:\Windows\system32\Kbpbed32.exe
        264⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Kijjbofj.exe
        
        C:\Windows\system32\Kijjbofj.exe
        265⤵
        Modifies registry class
        
        PID:9212
        
        C:\Windows\SysWOW64\Kbbokdlk.exe
        
        C:\Windows\system32\Kbbokdlk.exe
        266⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8232
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        267⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Khpgckkb.exe
        
        C:\Windows\system32\Khpgckkb.exe
        268⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Knippe32.exe
        
        C:\Windows\system32\Knippe32.exe
        269⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        270⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Lnnikdnj.exe
        
        C:\Windows\system32\Lnnikdnj.exe
        271⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        272⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Lidmhmnp.exe
        
        C:\Windows\system32\Lidmhmnp.exe
        273⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Lfhnaa32.exe
        
        C:\Windows\system32\Lfhnaa32.exe
        274⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Lifjnm32.exe
        
        C:\Windows\system32\Lifjnm32.exe
        275⤵
        Drops file in System32 directory
        
        PID:8892
        
        C:\Windows\SysWOW64\Lfjjga32.exe
        
        C:\Windows\system32\Lfjjga32.exe
        276⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Lihfcm32.exe
        
        C:\Windows\system32\Lihfcm32.exe
        277⤵
        Modifies registry class
        
        PID:9012
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        278⤵
        Drops file in System32 directory
        
        PID:9056
        
        C:\Windows\SysWOW64\Loeolc32.exe
        
        C:\Windows\system32\Loeolc32.exe
        279⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9204
        
        C:\Windows\SysWOW64\Llipehgk.exe
        
        C:\Windows\system32\Llipehgk.exe
        281⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Lpekef32.exe
        
        C:\Windows\system32\Lpekef32.exe
        282⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Lfodbqfa.exe
        
        C:\Windows\system32\Lfodbqfa.exe
        283⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Mimpolee.exe
        
        C:\Windows\system32\Mimpolee.exe
        284⤵
        Drops file in System32 directory
        
        PID:4748
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        285⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Mbedga32.exe
        
        C:\Windows\system32\Mbedga32.exe
        286⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Medqcmki.exe
        
        C:\Windows\system32\Medqcmki.exe
        287⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Mlnipg32.exe
        
        C:\Windows\system32\Mlnipg32.exe
        288⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Mbhamajc.exe
        
        C:\Windows\system32\Mbhamajc.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9024
        
        C:\Windows\SysWOW64\Mibijk32.exe
        
        C:\Windows\system32\Mibijk32.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9152
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        291⤵
        Drops file in System32 directory
        
        PID:8252
        
        C:\Windows\SysWOW64\Moobbb32.exe
        
        C:\Windows\system32\Moobbb32.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8332
        
        C:\Windows\SysWOW64\Mehjol32.exe
        
        C:\Windows\system32\Mehjol32.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2572
        
        C:\Windows\SysWOW64\Mhgfkg32.exe
        
        C:\Windows\system32\Mhgfkg32.exe
        294⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\Moaogand.exe
        
        C:\Windows\system32\Moaogand.exe
        295⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\Mleoafmn.exe
        
        C:\Windows\system32\Mleoafmn.exe
        296⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Nemcjk32.exe
        
        C:\Windows\system32\Nemcjk32.exe
        297⤵
        Modifies registry class
        
        PID:8928
        
        C:\Windows\SysWOW64\Npchgdcd.exe
        
        C:\Windows\system32\Npchgdcd.exe
        298⤵
        Drops file in System32 directory
        
        PID:4576
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        299⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        300⤵
        Drops file in System32 directory
        
        PID:5584
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        301⤵
        
        PID:936
        
        C:\Windows\SysWOW64\Nebmekoi.exe
        
        C:\Windows\system32\Nebmekoi.exe
        302⤵
        Drops file in System32 directory
        
        PID:8724
        
        C:\Windows\SysWOW64\Nhpiafnm.exe
        
        C:\Windows\system32\Nhpiafnm.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8876
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        304⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Ngdfdmdi.exe
        
        C:\Windows\system32\Ngdfdmdi.exe
        305⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Nlqomd32.exe
        
        C:\Windows\system32\Nlqomd32.exe
        306⤵
        Drops file in System32 directory
        
        PID:8688
        
        C:\Windows\SysWOW64\Olckbd32.exe
        
        C:\Windows\system32\Olckbd32.exe
        307⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Ocmconhk.exe
        
        C:\Windows\system32\Ocmconhk.exe
        308⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Olehhc32.exe
        
        C:\Windows\system32\Olehhc32.exe
        309⤵
        Drops file in System32 directory
        
        PID:8200
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        310⤵
        Modifies registry class
        
        PID:8940
        
        C:\Windows\SysWOW64\Olgemcli.exe
        
        C:\Windows\system32\Olgemcli.exe
        311⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Ogmijllo.exe
        
        C:\Windows\system32\Ogmijllo.exe
        312⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        313⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        314⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Ogpepl32.exe
        
        C:\Windows\system32\Ogpepl32.exe
        315⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Ojnblg32.exe
        
        C:\Windows\system32\Ojnblg32.exe
        316⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Ookjdn32.exe
        
        C:\Windows\system32\Ookjdn32.exe
        317⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Pjpobg32.exe
        
        C:\Windows\system32\Pjpobg32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9524
        
        C:\Windows\SysWOW64\Ppjgoaoj.exe
        
        C:\Windows\system32\Ppjgoaoj.exe
        319⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Pfgogh32.exe
        
        C:\Windows\system32\Pfgogh32.exe
        320⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Ppmcdq32.exe
        
        C:\Windows\system32\Ppmcdq32.exe
        321⤵
        Modifies registry class
        
        PID:9652
        
        C:\Windows\SysWOW64\Poodpmca.exe
        
        C:\Windows\system32\Poodpmca.exe
        322⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Pgflqkdd.exe
        
        C:\Windows\system32\Pgflqkdd.exe
        323⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Plcdiabk.exe
        
        C:\Windows\system32\Plcdiabk.exe
        324⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        325⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Pjgebf32.exe
        
        C:\Windows\system32\Pjgebf32.exe
        326⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Ppamophb.exe
        
        C:\Windows\system32\Ppamophb.exe
        327⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Plhnda32.exe
        
        C:\Windows\system32\Plhnda32.exe
        328⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        329⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Qgnbaj32.exe
        
        C:\Windows\system32\Qgnbaj32.exe
        330⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Qhonib32.exe
        
        C:\Windows\system32\Qhonib32.exe
        331⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        332⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Knkekn32.exe
        
        C:\Windows\system32\Knkekn32.exe
        333⤵
        Modifies registry class
        
        PID:9332
        
        C:\Windows\SysWOW64\Mjpbam32.exe
        
        C:\Windows\system32\Mjpbam32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9424
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9492
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        336⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        337⤵
        Modifies registry class
        
        PID:9636
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        338⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        339⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        340⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        341⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        342⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        343⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        344⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        345⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10228
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        347⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        348⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        349⤵
        Modifies registry class
        
        PID:10020
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        350⤵
        Drops file in System32 directory
        
        PID:1576
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        351⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        352⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        353⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        354⤵
        Drops file in System32 directory
        
        PID:3108
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1628
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        356⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        357⤵
        Drops file in System32 directory
        
        PID:4804
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        358⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        359⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        360⤵
        Modifies registry class
        
        PID:3164
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        361⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        362⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        363⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:532
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        365⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        366⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9256
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1140
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        369⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2464
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9604
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        372⤵
        
        PID:348
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        373⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        374⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4328
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        376⤵
        Drops file in System32 directory
        
        PID:5068
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        377⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        378⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        379⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        380⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5152
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        382⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        383⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        384⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        385⤵
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        386⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        387⤵
        Drops file in System32 directory
        
        PID:3608
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        388⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        389⤵
        Drops file in System32 directory
        
        PID:5396
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        390⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        391⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        392⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        393⤵
        Modifies registry class
        
        PID:4092
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        394⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        395⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        396⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        397⤵
        Drops file in System32 directory
        
        PID:4648
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5428
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        399⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        400⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        401⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1124
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        402⤵
        Modifies registry class
        
        PID:3936
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        403⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5860
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        405⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        406⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        407⤵
        Modifies registry class
        
        PID:5788
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6396
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        409⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        410⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        411⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        412⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2740
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        413⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2388
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        414⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        415⤵
        Drops file in System32 directory
        
        PID:8324
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        416⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        417⤵
        Drops file in System32 directory
        
        PID:9320
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        418⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        419⤵
        Modifies registry class
        
        PID:6304
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        420⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        421⤵
        Drops file in System32 directory
        
        PID:1720
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        422⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        423⤵
        Drops file in System32 directory
        
        PID:6704
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        424⤵
        Drops file in System32 directory
        
        PID:6900
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        425⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        426⤵
        
        PID:768
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        427⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        428⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        429⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        430⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        431⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        432⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        433⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        434⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2780
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        436⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        437⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        438⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        439⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        440⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        441⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        442⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        443⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        444⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        445⤵
        Drops file in System32 directory
        
        PID:6000
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        446⤵
        Modifies registry class
        
        PID:3292
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        447⤵
        Drops file in System32 directory
        
        PID:6008
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        448⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        449⤵
        
        PID:376
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        450⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        451⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5912
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        452⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        453⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        454⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        455⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        456⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        457⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        458⤵
        Modifies registry class
        
        PID:1836
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        459⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        460⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        461⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        462⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        463⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        464⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        465⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        466⤵
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9296
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        468⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        469⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        470⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        471⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        472⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        473⤵
        Modifies registry class
        
        PID:4492
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        474⤵
        Modifies registry class
        
        PID:752
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        475⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        476⤵
        Drops file in System32 directory
        
        PID:9640
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        477⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        478⤵
        Drops file in System32 directory
        
        PID:392
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        479⤵
        Drops file in System32 directory
        
        PID:6972
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        480⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        481⤵
        Drops file in System32 directory
        
        PID:8068
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        482⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        483⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        484⤵
        Drops file in System32 directory
        
        PID:1864
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        485⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        486⤵
        Modifies registry class
        
        PID:8148
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        487⤵
        Drops file in System32 directory
        
        PID:4040
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        488⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        489⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        490⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        491⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        492⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        493⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        494⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        495⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        496⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        497⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        498⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        499⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        500⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        501⤵
        Modifies registry class
        
        PID:8788
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        502⤵
        
        PID:832
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        503⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        504⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        505⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        506⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        507⤵
        
        PID:840
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        508⤵
        Modifies registry class
        
        PID:6528
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        509⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        510⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        511⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        512⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        513⤵
        Modifies registry class
        
        PID:7844
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        514⤵
        Modifies registry class
        
        PID:8720
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        515⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7176
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        516⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        517⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        518⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7540
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        519⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8368 -s 408
        520⤵
        Program crash
        
        PID:6796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 8368 -ip 8368
1⤵
PID:8556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abbkcpma.exe

Filesize
45KB

MD5
9b2c47811e21324baffa2b3cc58e02c4

SHA1
48f2ba7435fd4567066bcf60d38636c9004a12a9

SHA256
918b4e6e8dacbd0ed309a43cc93c879054349d771190141657b16e4fb0655b0e

SHA512
4ea413f38f966d96f57c245f3ed473237b53278b453202fb0a05816ea8317acca7bb74eb9a3b4a9d1e4ddcc77075db171e612c266ae006a3fce8a0bab64a4e44

Download Submit
C:\Windows\SysWOW64\Eadopc32.exe

Filesize
45KB

MD5
58dfba5586957d1a189a8a742f07cbe9

SHA1
5f98be69b3a5ac1d54a70ce63e50d1db75ba1492

SHA256
1427b44ff00af5a865659b06f8fe3afc4929f3ea271fdc66215122715b619bb6

SHA512
61dc5aa33d171afec8b157a91b04c610f2658027b1519560d4b5bdcba494fa9ae72e3f7229009cb580c4fcce7eadba60074c777ce373084dd5c3f0b3826d7590

Download Submit
C:\Windows\SysWOW64\Eaklidoi.exe

Filesize
45KB

MD5
29331cef0068b1fae7ad41f98055f983

SHA1
9b8a35a5fb67a7b83bd3a6da6f149ac4567decc0

SHA256
2da0802e3230f782efaf008a1f0fe21ab53c59af9b148a68614764ae26bb041e

SHA512
93db33f624bcd9ea843f0e19a4ef275cc2cd2b0715790538b8b3eee977df261b17be0dea2af3e2f24f7fe1ef72bd72daf4de9f21de99391c0b429368bbb16e64

Download Submit
C:\Windows\SysWOW64\Ecmeig32.exe

Filesize
45KB

MD5
550ffca407ff23a79fdf027e6f12a8e5

SHA1
b63cb6404c5090c83f455321027aa4e70e2ee085

SHA256
2601e4673542bc918c3d1dadeebd0515a87fef8f0b80bc91a01f60abe9c75a18

SHA512
4dcf051f01e0d8555212252b35a2debccffe21588f6c72948f571d70c42faec336da95ce65e3a54f8ab730855a8016ac0087a2b879dc2fdfb87dfda124cfcb4b

Download Submit
C:\Windows\SysWOW64\Ecoangbg.exe

Filesize
45KB

MD5
e4d6d17a12e7a0bc149d7fc1b3e434b4

SHA1
ae546657021bab89969d09e733547dba05a20a8f

SHA256
d6fc5d3ec5165d3f99070652e6eb7eef25e03b2ed62096feb2a19c0a98a9e72a

SHA512
ecaa7f577e4706f2a7f1b1c0ae3e5dcf95c8df4b9844019290f7c15a3fb16c648e35c912d4c493e667cb4911d13484f40660fbad4a2766ef80e6fb5c63470406

Download Submit
C:\Windows\SysWOW64\Edkdkplj.exe

Filesize
45KB

MD5
b4197e9a7b29bb13d7fee4beb429a779

SHA1
347d00f86d88a75e4b8067baab972f560c2b5ec7

SHA256
953ac43994ce7b32b91b8ceef186bfdb91961651edb3998b0c1ff52a074a70f8

SHA512
a0c0fb939292c842a7446f91e6f3d90dc39fc72cc8892e631c68ea6b18b1e6c8f988d3a188a5cf7f0a3f6f93f4ab844276897d8368d16ab06782cd416896027b

Download Submit
C:\Windows\SysWOW64\Ehljfnpn.exe

Filesize
45KB

MD5
4cfc98fec163a376abfbe623860af4fe

SHA1
9c1346e69db907aa1c85a5b65e55cfd561ac50d5

SHA256
9a0f4b7ae3344a37e57a0ffd3e1c4abc72ed28e19f93dfbd961c424adf97a6f5

SHA512
3051a5a293c0b1ddcbcd5903cc479e5fd467f69114404eac212ca83c11fc73b1673fd26f63a2881ea262f216950b13b310b94ad8da72c255561a3401bb93e96f

Download Submit
C:\Windows\SysWOW64\Ekemhj32.exe

Filesize
45KB

MD5
427f66c77a140b8299807b41fcae39f4

SHA1
bf88629880e39b40dd13c858a003e2b72b52aea6

SHA256
d53e5091213f9192e07f16e6eab14b897bd11605ea5eb0521759dac13272ba6e

SHA512
a5e64db919338ecefb7b9248f9848cc9f509e16ecd2902807b42c5be603113e812208f134610a3fdec2b8fb736b351552a4f4fabbfe729653b68ebe8504b4f9d

Download Submit
C:\Windows\SysWOW64\Eleiam32.exe

Filesize
45KB

MD5
61f72c51f32eeb57c682ad1a07f5a2f0

SHA1
4898cf23accff8c37f63be780651cab0b752c0de

SHA256
d759bc476b342582bd60ff57cb3b5222e79afb9d770ac2b2d80b36e696883850

SHA512
ad08420e2efce3586e7dd3735e0deec1010a008e964cc8eac9772b2cb91c9ebe76aa7632ba6099ed9d6c6d94c4cdfac114df51b0a17c072411180255e9b2e6a3

Download Submit
C:\Windows\SysWOW64\Eoolbinc.exe

Filesize
45KB

MD5
94472e5d1f53234209a9879ea90203b7

SHA1
3b385364e6b09e8ca9da94cfb1f06ea8fcdc80c6

SHA256
6af84848bbb1bb6b26a01e1a9e897a6effaaee339934817f1c9f460f437e29b7

SHA512
e3cf5dfb00ff5f7579357afd2d38abd084419125a544fe1f1aa5e313df1464c485ea45a0366d9ff476db66b7178a027c468e743bfcfd5acc54e769fe07804990

Download Submit
C:\Windows\SysWOW64\Fbnafb32.exe

Filesize
45KB

MD5
1d935ecbdbd78f94ee2f5d7bf3c5c8f8

SHA1
e6b54886cd329359688f427256587a21f2f05166

SHA256
d6ae5f6a9c23dd71c900307fb8e4f058e07e80371c7e44893f698301777b880d

SHA512
549d42913ee0d5f12ad57c0df3db815e9478f3fc6a38eeeb9ca5424a826ecec729a5f8a6dd22f27e5e347e64792cbeb9515ff9fe22eeac18cbf7cb65bf449ecb

Download Submit
C:\Windows\SysWOW64\Fchddejl.exe

Filesize
45KB

MD5
6803906829af4d75213003468e1a2d86

SHA1
62f6cad74a4c2aaa4429cc4ae849fe6df78da173

SHA256
7d22e0a4dee45d47e9dde15a61e6cdc4a8a3e427766e6471e4b43c1c4a5c9970

SHA512
e55c6c13e611bd16d09873a4b06fc35db079f045b59efbc5ecc1941dad35c8c3007d38ce3a4705b4899f58bc67d933b6f8b7de83a2e60bc838b161ea6f6e8707

Download Submit
C:\Windows\SysWOW64\Fdialn32.exe

Filesize
45KB

MD5
9b61f664e6b4898962d07ceb62116080

SHA1
eab17d5630cd7949bbe8fc0caae524164bbd5a60

SHA256
091324f110ee4bbc4c075fc1580bab65a84973d2393d32f1ed4927c35a6dd366

SHA512
7cc5c3bcbad29e264d223aafd145272b641a7b946f420e5ced98f2515df298a188d92699b84fe79372c3afa3e6b91865679c85b6a1ffdfbe62fd389655bea45b

Download Submit
C:\Windows\SysWOW64\Feapkk32.exe

Filesize
45KB

MD5
c79e56f6cd2415c7756ddd5de560cf19

SHA1
f5aa3b3084b1a257b92f4b7c714cd8882591a344

SHA256
02b4211ebc9d7c8ebd40270e281b4efd76beead612bfb6e689b43b317ac0e61a

SHA512
54c44ae036283a23642f6cb3d45bd963820992d8c144ec399f2b88575b4538f67b030e7a2666d5f611a87558e2f00a0065f346093b520f97eb148978cfdc278c

Download Submit
C:\Windows\SysWOW64\Febgea32.exe

Filesize
45KB

MD5
f833ef023b8346c359d5bc57fb7b35fe

SHA1
caee65baecf7198ee1f123cc35ccc45b8d2fd9d8

SHA256
69100dafa5e56b9c29365c4107b9390cfe7f941eeca3557cc7217a5b3f952294

SHA512
a349ee5c3710504252ed62f10999e00cd764397add4c39dee11094be1b6eada001b042577b93db380fc25bae3f3b0e42435650a1e69c1f998f02a4e34b98a4bb

Download Submit
C:\Windows\SysWOW64\Ffkjlp32.exe

Filesize
45KB

MD5
f4cf7828806e8b5ca40174859c8c50e5

SHA1
eb9296b66fe02e2d88a7097cd804e6cb42f76159

SHA256
4379ca6f8fbadb042e96097b932aa677302dddb3f957637e98c1f00c8ab463f3

SHA512
9f03b372354f2f12192af6ffc8696fce3197c3906bc2d49020eaea7dc75a20fdf9602bb665b7429c203be773832c8a3e65fac9d07346e5deb10f0b6d6c821899

Download Submit
C:\Windows\SysWOW64\Fhgjblfq.exe

Filesize
45KB

MD5
d52b164eb399a2528613c373a1436dfb

SHA1
5dc3a164f5c060b986b9857750bf1d00cc3929b2

SHA256
0fb2458d0c1b22e769c478a1a6d2851d9becf9a3f9e818fde945cc0c957bb9d2

SHA512
4383840c3a73e7106f3cb9aad4a4996465730a29c29365abd09bd77bc0a9fde20d261bd796d82da1d0f92b1d750043c40092d95ea4043303303e2632cec2204c

Download Submit
C:\Windows\SysWOW64\Fhjfhl32.exe

Filesize
45KB

MD5
4062becb367909c5c2c49e5fe2b5904b

SHA1
5bea3f6714f3f89c04b0ca5e0f19e690fc54a678

SHA256
80c86babae17de9f2e46ed0affe65f7ced98602a51928cf24048e614e30c4680

SHA512
030f66c85bcee5510fb33a45aedf6721bcb29c458c6cb5b6301621615b1d3fba5829b76e7838ad185e88023587446b519da728cea553082c7f4baa2129e92ff4

Download Submit
C:\Windows\SysWOW64\Fkciihgg.exe

Filesize
45KB

MD5
a8090e1365066d9b30b0b3c89ac87f8e

SHA1
4ab26f9a260229e3e73abd60c8e9074eb85b1263

SHA256
3750efe9c93e19542419366338e7fb260461c115d58bdf6839b60483f33ef707

SHA512
3491ef14ec4a54f92e95269dcb0e176753fa7805459036d6a32f60c3c9ae3f5b7c06ee1c2773408cca891bf48d2279c20a17f9f3d1474932df06d8ea6d3905d6

Download Submit
C:\Windows\SysWOW64\Fkmchi32.exe

Filesize
45KB

MD5
2f3fc8523a7872fa67ae728cf612a6b1

SHA1
d1bb36bd44bc7ab8f1723d47f4e910beff7ea5a6

SHA256
f02224b0b7893b1d877c3a0ecb051a25344837778c3a162a4a09c2d8f1c48acf

SHA512
dfd6fe6a55712fbe21b8f810a94fe0521f1c3c8244c9a200bcf39ad3eab12c184113b68fd977b310620a7149812bddce34eec2cfe21eab0db8aa076ff4e0bff1

Download Submit
C:\Windows\SysWOW64\Fojlngce.exe

Filesize
45KB

MD5
beb82c4f503b9bb4267710fea8a4d6bb

SHA1
11497b5f323f90cccffd9fc44c8c02c8246de50b

SHA256
cabbeb6e9a3a45b793ec99a36f7479b1979f5d43aa12a8e2d854dc33af158f0c

SHA512
c400f5c62be4405914321f5316e02f0cc8c56fae877608d0576b472efab5c6fb5e265bc2e9bc10d25337d6dfe34e07e5863f39c53558f97dd9fe98dd679235b2

Download Submit
C:\Windows\SysWOW64\Gcddpdpo.exe

Filesize
45KB

MD5
5461e8f0a0a99d763bce6bdd0022664e

SHA1
7d2f13bab58cc80b1138ef2470407277841de52e

SHA256
b8c6f9cfc82e8e58cb072f5da5bab9ebf5f1d0264e2ef3f362fb798be5a87b09

SHA512
339d23fbc5ed632acbb7d7332c4762055a71e8d6abcc93f4103e8fe04c71e65f1586ec481ce3797e3fafb6727c87e7c8a98251628ddca95f1293a73112e3493e

Download Submit
C:\Windows\SysWOW64\Gcojed32.exe

Filesize
45KB

MD5
cbfe635e44b75cf4d800451a8cbf7539

SHA1
8d8df4131978af73921658269530a09971341f53

SHA256
9e4287f7999ba10881a48ed87bff6c78550bf836bb90a23cf37de0398ca90422

SHA512
8a640e791666e30c9bda8f45f100ec182d2b080eadc57e26a3e109125515c81f6675b3685638004ff2fdda2b24d0f2e43381f31f5eb77bc26e8a6a7bd5c83263

Download Submit
C:\Windows\SysWOW64\Gdeqhl32.exe

Filesize
45KB

MD5
607927dc4d16dac714e89868095bf7ee

SHA1
a937836a2382206496e31d00703f0db9066d3e9c

SHA256
f42515c3aba9dc45f3726dc9d327cc55c61a1f05b26ab6937cfed775b074fed2

SHA512
80f94fa38151d09e34b805b37a347abbcaba01f7ede276395824afc25248b7c5f5c2338d24dd791aa1073c11d4a4120becd454c1aa013d381fe5325e2005edd5

Download Submit
C:\Windows\SysWOW64\Gdqgmmjb.exe

Filesize
45KB

MD5
680c8ab02cc0b1746eefbb17ee38cce4

SHA1
5d0c3d15f65befb7337d0468cc5fad3b78dbee55

SHA256
1a7850db9466e5b469bcd900234ff422a528ee34aca20874d75c56d7f96ac6a7

SHA512
c15ccb0222d29b7b47d8f087414933a5445a1498ba4f9ef0575bd80b372c11cc9ddf83ae2858cbee73a421a9018b2a67911475b046248a67dcf66fc681bce10f

Download Submit
C:\Windows\SysWOW64\Gfembo32.exe

Filesize
45KB

MD5
4d25f7d6b6c19a59664049d0e712aa45

SHA1
011f682209575fa6bfd06c3131ef3429000f6812

SHA256
4225c191b05581eca905f0e230ab82fe67a3baa3fdbf55a344bbd00d8afd163e

SHA512
af7c6644b2ad40ea85583d9c5c4037d5373f3e32ea994a4b1687875f18559f03e6f7179d10139b765ad7cc0840897f8c4ff85ca80c6c741f3dfd82c6044857a0

Download Submit
C:\Windows\SysWOW64\Gfgjgo32.exe

Filesize
45KB

MD5
ed0e9a6d989e7dfef998a10416e98731

SHA1
e8c41ed1e7d558f277afe95bf8a2ccf35445ba17

SHA256
893e7b642c5cc1ea895636a06807e4b7b6bb215cb4efda4b704ae7bc739693ee

SHA512
4216f88f3f173ee28855f0c1c1ae24aca2a0250e772d65e2ba45346dad202da5e5b259fabbcdb05a84b4a4733c2fc43731c7e1a92c4eebd05bc147315b052e8e

Download Submit
C:\Windows\SysWOW64\Gmbmkpie.exe

Filesize
45KB

MD5
b3e6ea0b4120397732b56c41ba876c78

SHA1
091927598644ddab528098208b48571e21aba9b8

SHA256
f346ffedacd0f68c8faf4552035f7738ab088fb497702353abffbac1dba25926

SHA512
a52cb5ea6b97523c64338859d8475d0d03afeae0885167e4deef2872160ca558a3aa3164c1a537b1babf8b47b5ce94add819f67c667b526daba55b560a3e215a

Download Submit
C:\Windows\SysWOW64\Gmoeoidl.exe

Filesize
45KB

MD5
629c78fe1bcf4a5ed5dd83a9514b9649

SHA1
5bf7b3fe20449f89c678fca782780fbec42da070

SHA256
15ad843655215c8d90d3edb08312f01330d8482c90fa48ca522bc101c613520b

SHA512
d35907503fe50fdbc05bb499910679e87f776510e6b4de3128f0f0c2b92735b2dcfe605e877a240d1faa867cd25b31981447b77e4cdb7e3655d5beb7880fa150

Download Submit
C:\Windows\SysWOW64\Gokdeeec.exe

Filesize
45KB

MD5
5d6be4652d20727c91bb0aa5737a6cd3

SHA1
2cb96bd9e7323fc80252ac887a3edc3902451c24

SHA256
6719b187230e7ae487d0e0b55ef5b54f5f23ff183f73a28eacfdfc26ec55423c

SHA512
c71108193e070403fdf933d792f78013dc90abb1491c55c058b98fd28130405ca056577639c3a21dc6eebfa08391c5b1659b444ec7eec512357eeebbb8646bc7

Download Submit
C:\Windows\SysWOW64\Hbpgbo32.exe

Filesize
45KB

MD5
db07582202ab51b305ef955808dfcc5f

SHA1
40481620efc145c0e8b050883010123a77c0898d

SHA256
4095a609972f008180a3f98795c2752cee78d36d0ce0a1237650f1a3c3240c92

SHA512
95d7051bcdfcbdf99ed33fb1d8a0e773b88268f4fe72d3b1b62f19130730deafc3478fa126d4071bdc3dd344e7e488f7588b034a7c1d6f95e6c917177d32f010

Download Submit
C:\Windows\SysWOW64\Hckjacjg.exe

Filesize
45KB

MD5
3719fab96b4511da5477a75c74d17737

SHA1
3e08bc8b66c5f5f086098016fd75efe9da672758

SHA256
b9d8cfa19dffc64ef5312b64dcb513f7b1624433ae637f1b2cc23495ccfce1d1

SHA512
ec51667e91477d02c7abfa89da48ec972a0c877caa826c697e9b2e0766a2f94dce508e9a97d82db6f91001b851ad3088b99b4c7b60eb3053cf72f8ab1983c1f5

Download Submit
C:\Windows\SysWOW64\Helfik32.exe

Filesize
45KB

MD5
766bdf55a22502a41b53c7f1e7404fd0

SHA1
a1d2c3399ca2d8e5156fa1126dc0fbb895e77a68

SHA256
7d86e99a8c0c2da8f476c93bbc0d83174ac045f2aa369fc37dc432dc9614fcd6

SHA512
1ce0305704f5464d8c9c5905816f67393388ad1f95948ff3897f50ad818102f3b75614cb250dfaeef1db877cb3f45f738d06818442214616c773d2396d1f424f

Download Submit
C:\Windows\SysWOW64\Hkfoeega.exe

Filesize
45KB

MD5
405c9040ad394876e4830a47442fae19

SHA1
56c957fe4e83a9966fd91f060679f2b425027a90

SHA256
5636692189eb3363b3842923eafa972182723eace318bacda6efa371699c7281

SHA512
20d1bdde8fb0b53ec990fc422d68f0dbec8ca24186aea97bbcbe752b9ce3e6d0ddf593f8c1ce10011f6ea77d970abd99d3eff69ef99ccf8d1a7cd253044ffa6d

Download Submit
C:\Windows\SysWOW64\Hmabdibj.exe

Filesize
45KB

MD5
ac8170409eaeeb0ab389d89b0c9984fd

SHA1
0a13431dfca0f090d4d8a0e674d06adf4918e266

SHA256
f4c8cd2b8c6df13162858e1ffd2cd7ac55ee98489799e1ae32a6f2d6cde334be

SHA512
f9533019e87fc35b16218c2bf30889e4734d977e20654eed6499bbfa30e8e74307ac9114acacc0b21e957d090add0dca993698bfd2ff4a4b2374cbaac1f6f4ae

Download Submit
C:\Windows\SysWOW64\Inpccihl.exe

Filesize
45KB

MD5
a2f77864c872f989f616c3a90a97cfb4

SHA1
97054dded1aa57bcb68f6ee0c6fd146c60a336d8

SHA256
559fefb696b80b2b712cd5622f635e05babca242711daf3f4d9bbf08ed784bf6

SHA512
beead4fd136b297820d141fc0fd15e437b18f0d9da60aaa9a6cea9e953d185a79947a476d878a986e58c4993b2c8400e2a456a27770bc17ed7a4294b2c280536

Download Submit
C:\Windows\SysWOW64\Jbdbjf32.exe

Filesize
45KB

MD5
20afc62a6eeb0631d6c81ab79dd847af

SHA1
f3e14e3c3fe22e58227555423b184099e5650017

SHA256
57add40f082754abe5bb92c49545a90963e7f1a40d5bb1d86343549be9acb0f2

SHA512
17d1438e8d9492bfca2a1c237b2c814711a9c3670e6604668b4cf57a3744c63369a146455433cc7f266cfb50c1f3d467453f5e51e5ee194f1a52b346be708a0c

Download Submit
C:\Windows\SysWOW64\Kbbokdlk.exe

Filesize
45KB

MD5
649565226770c4fcd63742efab57be8a

SHA1
c35ffd884040e3343c4e474040c2dcccbd08ee01

SHA256
db0beba6389eaeb777c028490c01bfb020d44a739674f327062f7f3112b3d4a6

SHA512
3d7bcd80d9f8b9b62de5887ddb3232e5fd21fe0aa34b39431bac37235a52784e8dbcc9d6d92f186036c95efff1cd9351bee8c1f0802ef8ffc40b1959214e2d77

Download Submit
C:\Windows\SysWOW64\Lphoelqn.exe

Filesize
45KB

MD5
51377ec6dee4af43acca2a33570fd6a0

SHA1
5606a3e98373fa26f7834898e25278751f1f8166

SHA256
1917ce85479328d53327eb81bc9f8ee145ad511b2ef341a62e990eec4f7dc872

SHA512
64670413bbc2b5b9945f10bdbbb28a64cefacad755f49483018a3a78787ffcc08b2c8e443732a4aaf945b939a0296b3403c14a6487a572cecce85ba33891d14a

Download Submit
C:\Windows\SysWOW64\Mbhamajc.exe

Filesize
45KB

MD5
de75a4922a21c02ed35f9255ecb2cb92

SHA1
08ac7e32bcc9d1c78327efac45d13d9180dc589c

SHA256
1ff56bd66b908e1e3f9cb038d65a5bf2ef8789a5f82a96d20c63e8a4ac3c0451

SHA512
3e14770f66b5dc954b844a9f2ac5385e0395ff6dce7966a764d75d987538daf50c533f7a4c677134ba003c46e6e1fd81066bea997570a98acac6a5f62fe8afcc

Download Submit
C:\Windows\SysWOW64\Neppokal.exe

Filesize
45KB

MD5
d63a2af6c7370f84a36d9914b51550b2

SHA1
287ac218edbd4723cbe05c7baacd5c9391a20ecd

SHA256
e04b66b271c3217d2f672e3689fe4c15b8fa7a8cd9c73cc9baa99f271f9feb30

SHA512
13b6692ef7fccc93c08cb276a370af1061ad8a199229439a3b58e75099d1f8c8f4132d3b7d44c925199d17aeca7cdaee0c8fa1d654318e2f3a00c1fa9b84032d

Download Submit
C:\Windows\SysWOW64\Oileggkb.exe

Filesize
45KB

MD5
76ebd1e21247ffb07ba7b2a544055351

SHA1
3043133b0bf315d2d5ffd6329bae21efff95be37

SHA256
ff61d9ac8f984ecffb224380309cbb0da3ace743cad8e86f5c48fbca57267fba

SHA512
642709e85f4a332cc70a4adc82f1ef266dca95d41722b42afddc0422533af864de22f6d9ff556ada28ab45ed5d6082dc996aa8d057266e20a535b5d72cfec777

Download Submit
C:\Windows\SysWOW64\Phincl32.exe

Filesize
45KB

MD5
f6d5254a0c95fd07e93738b8cca4a098

SHA1
8b20ff922d6977041f3470705c1612c0a7b80f40

SHA256
66a1ba43e4b10eb9dbfdbc29882fdb867079b5135f69274739ff58cf08842f95

SHA512
6574d3f824a4cdb44fe499cac1c63084a00bb5cccd8f4689ecc6181bab5d446953e51971f804114433ba68ad1cff7cd4d1367c500baed79d66451af1824be60e

Download Submit
memory/212-286-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/348-424-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/464-340-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/536-398-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/552-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1088-224-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1116-436-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1140-120-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1288-87-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1352-272-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1360-192-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1448-308-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1540-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1552-370-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1592-207-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1620-376-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1676-79-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1720-406-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1792-292-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1844-430-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1848-216-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1920-442-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1996-104-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2056-167-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2072-422-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2148-72-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2172-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2192-335-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2204-280-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2256-156-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2384-417-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2428-400-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2452-310-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2472-135-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2476-382-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2600-160-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2884-328-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3004-39-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3016-200-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3160-128-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3164-352-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3212-358-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3264-346-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3288-23-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3544-316-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3688-240-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3812-302-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3836-260-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3980-247-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4020-176-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4140-48-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4260-262-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4284-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4296-232-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4388-322-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4404-364-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4540-274-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4560-96-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4616-116-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4672-392-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4784-183-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4872-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4876-36-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5016-144-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads