8182dfd9f4baf145f38a7b35b2ffee168c85d265ab6c3367871575adee4a2f72

Analysis

max time kernel
155s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8182dfd9f4baf145f38a7b35b2ffee168c85d265ab6c3367871575adee4a2f72.exe
Size

45KB
MD5

1898baaa2292419eda485d8745376243
SHA1

3af7eefbce64e075c20eb6f9dcf1856ab16514b2
SHA256

8182dfd9f4baf145f38a7b35b2ffee168c85d265ab6c3367871575adee4a2f72
SHA512

387f55b5bb33d3b1e1e6761c3572ac76bcaa74fc85b37229f2f86cedbf82dc599b8236b2d7ee3437250b6ba341b176d5278846b982331e54fc0cc3f42172ed17
SSDEEP

768:OjpIuzWF9VLbloC3dx3wdc83EkxDu8M7gDnhv7VhHvvfzAkcv5/1H5gb:WIumLJdtxg7vtp7Xv5cvz2

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Enhpao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Geoapenf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kiphjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdgejmdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpelhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppjbmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebejem32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdodeedi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Neebkkgi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgkan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkcjlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mqfpckhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngjkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npepkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmdcfidg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfaajnfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbnopbdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ialhdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npbceggm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgcihgaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbpedjnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flmqlg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqdcio32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nombnc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hefnkkkj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kflide32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpochfji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Idmafc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhkkjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgmjmjnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ihbponja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ihdldn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmifkecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Haobnpkc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmimll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqfpoope.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nopfpgip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agdcpkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekonpckp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Copajm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egnhcgeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbbldp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ickglm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gokbgpeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbgkei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfldgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocdnln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khmoionj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eomffaag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cggikk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gffkpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhapmphg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nofmndkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaldccip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dipgpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhkkjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgkfnh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lncjlq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbdehlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hifmmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jblmgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjaleemj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nildajdg.exe

Executes dropped EXE 64 IoCs

pid	Process
2504	Emhkdmlg.exe
1388	Ebdcld32.exe
2172	Eecphp32.exe
1540	Emjgim32.exe
1636	Efblbbqd.exe
2132	Ebimgcfi.exe
5008	Epmmqheb.exe
4792	Eifaim32.exe
4980	Enbjad32.exe
488	Fihnomjp.exe
4456	Fflohaij.exe
1408	Fmfgek32.exe
740	Ffnknafg.exe
5036	Fmhdkknd.exe
4112	Ffqhcq32.exe
3080	Flmqlg32.exe
4740	Fefedmil.exe
1396	Fpkibf32.exe
3116	Gfeaopqo.exe
1088	Gbnoiqdq.exe
1788	Gmdcfidg.exe
456	Gflhoo32.exe
4672	Gpelhd32.exe
4900	Geaepk32.exe
1816	Hfaajnfb.exe
4472	Hpiecd32.exe
4860	Hefnkkkj.exe
2832	Hplbickp.exe
3552	Hehkajig.exe
4560	Hoaojp32.exe
4152	Iepaaico.exe
716	Iebngial.exe
3088	Iojbpo32.exe
3316	Iipfmggc.exe
1652	Ilnbicff.exe
2332	Ibhkfm32.exe
484	Ilqoobdd.exe
3820	Ickglm32.exe
3120	Impliekg.exe
3428	Jcmdaljn.exe
4512	Jiglnf32.exe
1108	Jpaekqhh.exe
3032	Jgkmgk32.exe
4632	Jlgepanl.exe
3852	Jgmjmjnb.exe
4480	Jljbeali.exe
3888	Jgbchj32.exe
904	Jlolpq32.exe
400	Kgdpni32.exe
5004	Kpmdfonj.exe
4524	Knqepc32.exe
4012	Koaagkcb.exe
1360	Kflide32.exe
2780	Klfaapbl.exe
5128	Kgkfnh32.exe
5172	Kpcjgnhb.exe
5212	Kjlopc32.exe
5256	Lljklo32.exe
5296	Ljnlecmp.exe
5344	Lokdnjkg.exe
5384	Lqkqhm32.exe
5424	Lgdidgjg.exe
5464	Lnoaaaad.exe
5504	Lopmii32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Khihgadg.dll	Amfobp32.exe
File opened for modification	C:\Windows\SysWOW64\Ebimgcfi.exe	Efblbbqd.exe
File created	C:\Windows\SysWOW64\Dpaagldf.dll	Fmfgek32.exe
File created	C:\Windows\SysWOW64\Lopmii32.exe	Lnoaaaad.exe
File opened for modification	C:\Windows\SysWOW64\Kplmliko.exe	Klpakj32.exe
File created	C:\Windows\SysWOW64\Ljkdeeod.dll	Qclmck32.exe
File opened for modification	C:\Windows\SysWOW64\Flmqlg32.exe	Ffqhcq32.exe
File created	C:\Windows\SysWOW64\Kghfphob.dll	Impliekg.exe
File opened for modification	C:\Windows\SysWOW64\Lpjjmg32.exe	Lhcali32.exe
File created	C:\Windows\SysWOW64\Mdgejmdi.exe	Mbhina32.exe
File opened for modification	C:\Windows\SysWOW64\Mgphpe32.exe	Mqfpckhm.exe
File created	C:\Windows\SysWOW64\Lpjjmg32.exe	Lhcali32.exe
File opened for modification	C:\Windows\SysWOW64\Ddqbbo32.exe	Cmgjee32.exe
File created	C:\Windows\SysWOW64\Emhkdmlg.exe	8182dfd9f4baf145f38a7b35b2ffee168c85d265ab6c3367871575adee4a2f72.exe
File opened for modification	C:\Windows\SysWOW64\Fkhpfbce.exe	Fqbliicp.exe
File created	C:\Windows\SysWOW64\Igkilc32.dll	Noblkqca.exe
File opened for modification	C:\Windows\SysWOW64\Ocgkan32.exe	Ookoaokf.exe
File created	C:\Windows\SysWOW64\Ilnbicff.exe	Iipfmggc.exe
File created	C:\Windows\SysWOW64\Fbdehlip.exe	Fofilp32.exe
File created	C:\Windows\SysWOW64\Hpaoan32.dll	Fnkfmm32.exe
File created	C:\Windows\SysWOW64\Jhgiim32.exe	Ibjqaf32.exe
File created	C:\Windows\SysWOW64\Mkoaagmh.exe	Mhpeelnd.exe
File created	C:\Windows\SysWOW64\Njjmni32.exe	Nodiqp32.exe
File created	C:\Windows\SysWOW64\Gccmaack.exe	Dhbqalle.exe
File opened for modification	C:\Windows\SysWOW64\Fmkqknci.exe	Fnhppa32.exe
File created	C:\Windows\SysWOW64\Oclkgccf.exe	Oanokhdb.exe
File opened for modification	C:\Windows\SysWOW64\Pfiddm32.exe	Ppolhcnm.exe
File opened for modification	C:\Windows\SysWOW64\Bdmmeo32.exe	Aaoaic32.exe
File created	C:\Windows\SysWOW64\Jggocdgo.dll	Hbihjifh.exe
File created	C:\Windows\SysWOW64\Mjjkejin.dll	Jhnojl32.exe
File opened for modification	C:\Windows\SysWOW64\Fnmjkahi.exe	Fjanjb32.exe
File created	C:\Windows\SysWOW64\Lhbggd32.dll	Mdibplaf.exe
File created	C:\Windows\SysWOW64\Pafpga32.dll	Qapnmopa.exe
File opened for modification	C:\Windows\SysWOW64\Djgbmffn.exe	Dqomdppm.exe
File created	C:\Windows\SysWOW64\Lippqp32.dll	Flmqlg32.exe
File created	C:\Windows\SysWOW64\Hplbickp.exe	Hefnkkkj.exe
File opened for modification	C:\Windows\SysWOW64\Nmfcok32.exe	Ngjkfd32.exe
File opened for modification	C:\Windows\SysWOW64\Eqncnj32.exe	Eomffaag.exe
File created	C:\Windows\SysWOW64\Hnlodjpa.exe	Hhaggp32.exe
File created	C:\Windows\SysWOW64\Qnbidcgp.dll	Bdmmeo32.exe
File created	C:\Windows\SysWOW64\Eohmkb32.exe	Ehndnh32.exe
File created	C:\Windows\SysWOW64\Fplimi32.exe	Fjoadbbc.exe
File created	C:\Windows\SysWOW64\Bmeandma.exe	Bdmmeo32.exe
File opened for modification	C:\Windows\SysWOW64\Fndpmndl.exe	Fgjhpcmo.exe
File created	C:\Windows\SysWOW64\Pfhmjf32.exe	Pakdbp32.exe
File created	C:\Windows\SysWOW64\Fbbnpn32.dll	Mofmobmo.exe
File opened for modification	C:\Windows\SysWOW64\Opbean32.exe	Omdieb32.exe
File opened for modification	C:\Windows\SysWOW64\Jcjodbgl.exe	Ddhhbngi.exe
File created	C:\Windows\SysWOW64\Bdbhbf32.dll	Fmkqknci.exe
File opened for modification	C:\Windows\SysWOW64\Gceaofmc.exe	Gmkibl32.exe
File opened for modification	C:\Windows\SysWOW64\Noblkqca.exe	Nhhdnf32.exe
File created	C:\Windows\SysWOW64\Fiinbn32.dll	Dlncla32.exe
File opened for modification	C:\Windows\SysWOW64\Iajkohmj.exe	Hoibmmpi.exe
File created	C:\Windows\SysWOW64\Iooogokm.dll	Kpcjgnhb.exe
File created	C:\Windows\SysWOW64\Dgcihgaj.exe	Cogddd32.exe
File opened for modification	C:\Windows\SysWOW64\Egohdegl.exe	Eqdpgk32.exe
File opened for modification	C:\Windows\SysWOW64\Gpaihooo.exe	Ggkqgaol.exe
File created	C:\Windows\SysWOW64\Jpehef32.dll	Ghojbq32.exe
File created	C:\Windows\SysWOW64\Lncjgddf.exe	Lkenkhec.exe
File opened for modification	C:\Windows\SysWOW64\Lfjfecno.exe	Lopmii32.exe
File opened for modification	C:\Windows\SysWOW64\Aogbfi32.exe	Qacameaj.exe
File created	C:\Windows\SysWOW64\Hemmac32.exe	Hppeim32.exe
File opened for modification	C:\Windows\SysWOW64\Iffcgoka.exe	Iajkohmj.exe
File opened for modification	C:\Windows\SysWOW64\Ldkfno32.exe	Lnanadfi.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7028	2344	WerFault.exe	598

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eehnaq32.dll"	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Doccpcja.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dodjemee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkdnjmck.dll"	Khmoionj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdibplaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejbgidpn.dll"	Neebkkgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgagea32.dll"	Nfohgqlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddkbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iahgad32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhplpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kplmliko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhoped32.dll"	Pmhbqbae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmifkecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghfedh32.dll"	Filapfbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gccmaack.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Headon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jkplilgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohofdmkm.dll"	Enbjad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dagdgfkf.dll"	Ipgkjlmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcmhel32.dll"	Iajdgcab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egopbhnc.dll"	Lpjjmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfgnho32.dll"	Pakdbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iffcgoka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baampdgc.dll"	Finnef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jggocdgo.dll"	Hbihjifh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Inebjihf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jdhpba32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgbefe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Figfoijn.dll"	Mgbefe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ggkqgaol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kefiopki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkangg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkmmbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idaiki32.dll"	Ppolhcnm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hppeim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpjjmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghkgkc.dll"	Jhapmphg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkenkhec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdibplaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akkeajoj.dll"	Mnjqmpgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgiiclkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpkqbq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkoaagmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkodcb32.dll"	Mjlhgaqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dqfceoje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Panhbfep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jefjbddd.dll"	Jgkmgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfdjinjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhhlki32.dll"	Qpcecb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hahokfag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Johggfha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Clhbhc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nfgklkoc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmimll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jolhjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpeejfjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jponoqjl.dll"	Ojhpimhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddkbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmapoggk.dll"	Gpolbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmphaaln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amfobp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enpjkjkh.dll"	Icjengld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojnhdjoc.dll"	Eonmkkmj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 2504	968	8182dfd9f4baf145f38a7b35b2ffee168c85d265ab6c3367871575adee4a2f72.exe	94
PID 968 wrote to memory of 2504	968	8182dfd9f4baf145f38a7b35b2ffee168c85d265ab6c3367871575adee4a2f72.exe	94
PID 968 wrote to memory of 2504	968	8182dfd9f4baf145f38a7b35b2ffee168c85d265ab6c3367871575adee4a2f72.exe	94
PID 2504 wrote to memory of 1388	2504	Emhkdmlg.exe	95
PID 2504 wrote to memory of 1388	2504	Emhkdmlg.exe	95
PID 2504 wrote to memory of 1388	2504	Emhkdmlg.exe	95
PID 1388 wrote to memory of 2172	1388	Ebdcld32.exe	96
PID 1388 wrote to memory of 2172	1388	Ebdcld32.exe	96
PID 1388 wrote to memory of 2172	1388	Ebdcld32.exe	96
PID 2172 wrote to memory of 1540	2172	Eecphp32.exe	97
PID 2172 wrote to memory of 1540	2172	Eecphp32.exe	97
PID 2172 wrote to memory of 1540	2172	Eecphp32.exe	97
PID 1540 wrote to memory of 1636	1540	Emjgim32.exe	98
PID 1540 wrote to memory of 1636	1540	Emjgim32.exe	98
PID 1540 wrote to memory of 1636	1540	Emjgim32.exe	98
PID 1636 wrote to memory of 2132	1636	Efblbbqd.exe	99
PID 1636 wrote to memory of 2132	1636	Efblbbqd.exe	99
PID 1636 wrote to memory of 2132	1636	Efblbbqd.exe	99
PID 2132 wrote to memory of 5008	2132	Ebimgcfi.exe	100
PID 2132 wrote to memory of 5008	2132	Ebimgcfi.exe	100
PID 2132 wrote to memory of 5008	2132	Ebimgcfi.exe	100
PID 5008 wrote to memory of 4792	5008	Epmmqheb.exe	101
PID 5008 wrote to memory of 4792	5008	Epmmqheb.exe	101
PID 5008 wrote to memory of 4792	5008	Epmmqheb.exe	101
PID 4792 wrote to memory of 4980	4792	Eifaim32.exe	102
PID 4792 wrote to memory of 4980	4792	Eifaim32.exe	102
PID 4792 wrote to memory of 4980	4792	Eifaim32.exe	102
PID 4980 wrote to memory of 488	4980	Enbjad32.exe	103
PID 4980 wrote to memory of 488	4980	Enbjad32.exe	103
PID 4980 wrote to memory of 488	4980	Enbjad32.exe	103
PID 488 wrote to memory of 4456	488	Fihnomjp.exe	104
PID 488 wrote to memory of 4456	488	Fihnomjp.exe	104
PID 488 wrote to memory of 4456	488	Fihnomjp.exe	104
PID 4456 wrote to memory of 1408	4456	Fflohaij.exe	105
PID 4456 wrote to memory of 1408	4456	Fflohaij.exe	105
PID 4456 wrote to memory of 1408	4456	Fflohaij.exe	105
PID 1408 wrote to memory of 740	1408	Fmfgek32.exe	107
PID 1408 wrote to memory of 740	1408	Fmfgek32.exe	107
PID 1408 wrote to memory of 740	1408	Fmfgek32.exe	107
PID 740 wrote to memory of 5036	740	Ffnknafg.exe	108
PID 740 wrote to memory of 5036	740	Ffnknafg.exe	108
PID 740 wrote to memory of 5036	740	Ffnknafg.exe	108
PID 5036 wrote to memory of 4112	5036	Fmhdkknd.exe	109
PID 5036 wrote to memory of 4112	5036	Fmhdkknd.exe	109
PID 5036 wrote to memory of 4112	5036	Fmhdkknd.exe	109
PID 4112 wrote to memory of 3080	4112	Ffqhcq32.exe	110
PID 4112 wrote to memory of 3080	4112	Ffqhcq32.exe	110
PID 4112 wrote to memory of 3080	4112	Ffqhcq32.exe	110
PID 3080 wrote to memory of 4740	3080	Flmqlg32.exe	111
PID 3080 wrote to memory of 4740	3080	Flmqlg32.exe	111
PID 3080 wrote to memory of 4740	3080	Flmqlg32.exe	111
PID 4740 wrote to memory of 1396	4740	Fefedmil.exe	112
PID 4740 wrote to memory of 1396	4740	Fefedmil.exe	112
PID 4740 wrote to memory of 1396	4740	Fefedmil.exe	112
PID 1396 wrote to memory of 3116	1396	Fpkibf32.exe	113
PID 1396 wrote to memory of 3116	1396	Fpkibf32.exe	113
PID 1396 wrote to memory of 3116	1396	Fpkibf32.exe	113
PID 3116 wrote to memory of 1088	3116	Gfeaopqo.exe	114
PID 3116 wrote to memory of 1088	3116	Gfeaopqo.exe	114
PID 3116 wrote to memory of 1088	3116	Gfeaopqo.exe	114
PID 1088 wrote to memory of 1788	1088	Gbnoiqdq.exe	115
PID 1088 wrote to memory of 1788	1088	Gbnoiqdq.exe	115
PID 1088 wrote to memory of 1788	1088	Gbnoiqdq.exe	115
PID 1788 wrote to memory of 456	1788	Gmdcfidg.exe	116

C:\Users\Admin\AppData\Local\Temp\8182dfd9f4baf145f38a7b35b2ffee168c85d265ab6c3367871575adee4a2f72.exe
"C:\Users\Admin\AppData\Local\Temp\8182dfd9f4baf145f38a7b35b2ffee168c85d265ab6c3367871575adee4a2f72.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\Emhkdmlg.exe
  C:\Windows\system32\Emhkdmlg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SysWOW64\Ebdcld32.exe
    C:\Windows\system32\Ebdcld32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1388
  - - C:\Windows\SysWOW64\Eecphp32.exe
      C:\Windows\system32\Eecphp32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2172
    - - C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1540
      - C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:488
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4456
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1408
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4740
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1088
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        23⤵
        Executes dropped EXE
        
        PID:456
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4672
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        25⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1816
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        27⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4860
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        29⤵
        Executes dropped EXE
        
        PID:2832
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        30⤵
        Executes dropped EXE
        
        PID:3552
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        31⤵
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        32⤵
        Executes dropped EXE
        
        PID:4152
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        33⤵
        Executes dropped EXE
        
        PID:716
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        34⤵
        Executes dropped EXE
        
        PID:3088
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3316
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        36⤵
        Executes dropped EXE
        
        PID:1652
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        37⤵
        Executes dropped EXE
        
        PID:2332
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        38⤵
        Executes dropped EXE
        
        PID:484
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3820
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3120
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        41⤵
        Executes dropped EXE
        
        PID:3428
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        42⤵
        Executes dropped EXE
        
        PID:4512
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        43⤵
        Executes dropped EXE
        
        PID:1108
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3032
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        45⤵
        Executes dropped EXE
        
        PID:4632
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3852
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        47⤵
        Executes dropped EXE
        
        PID:4480
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        48⤵
        Executes dropped EXE
        
        PID:3888
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        49⤵
        Executes dropped EXE
        
        PID:904
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        50⤵
        Executes dropped EXE
        
        PID:400
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        51⤵
        Executes dropped EXE
        
        PID:5004
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        52⤵
        Executes dropped EXE
        
        PID:4524
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        53⤵
        Executes dropped EXE
        
        PID:4012
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1360
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        55⤵
        Executes dropped EXE
        
        PID:2780
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5128
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5172
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        58⤵
        Executes dropped EXE
        
        PID:5212
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        59⤵
        Executes dropped EXE
        
        PID:5256
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        60⤵
        Executes dropped EXE
        
        PID:5296
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        61⤵
        Executes dropped EXE
        
        PID:5344
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        62⤵
        Executes dropped EXE
        
        PID:5384
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        63⤵
        Executes dropped EXE
        
        PID:5424
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5464
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5504
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        66⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        67⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        68⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5672
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        70⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        71⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        72⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        73⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        74⤵
        Modifies registry class
        
        PID:5876
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5916
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        76⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        77⤵
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        78⤵
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        79⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        80⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        81⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        82⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5284
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        84⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5456
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5520
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        87⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5680
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        89⤵
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        90⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        91⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        92⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        93⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        94⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        95⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        96⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        97⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        98⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        99⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        100⤵
        Drops file in System32 directory
        
        PID:5780
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        101⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        102⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        103⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        104⤵
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5628
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        106⤵
        Modifies registry class
        
        PID:5868
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        107⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        108⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        109⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        110⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        111⤵
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        112⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        113⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        114⤵
        Modifies registry class
        
        PID:6260
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        115⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        116⤵
        Drops file in System32 directory
        
        PID:6352
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        117⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        118⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6488
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        120⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6592
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        122⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        123⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        124⤵
        Drops file in System32 directory
        
        PID:6744
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        125⤵
        Drops file in System32 directory
        
        PID:6816
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        126⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        127⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        128⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        129⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        130⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        131⤵
        Modifies registry class
        
        PID:7108
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        132⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        133⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6296
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        135⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        136⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        137⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        138⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        139⤵
        Modifies registry class
        
        PID:6752
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        140⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        141⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        142⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        143⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        144⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        145⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        146⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        147⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        148⤵
        Drops file in System32 directory
        
        PID:6728
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6856
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        150⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        151⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        152⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        153⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        154⤵
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        155⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        156⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        157⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        158⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        159⤵
        Modifies registry class
        
        PID:6964
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        160⤵
        Drops file in System32 directory
        
        PID:6576
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        161⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6880
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        163⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        164⤵
        Drops file in System32 directory
        
        PID:7184
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        165⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        166⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        167⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7356
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        169⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        170⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7484
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        172⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        173⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        174⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        175⤵
        Drops file in System32 directory
        
        PID:7660
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        176⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        177⤵
        Drops file in System32 directory
        
        PID:7760
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        178⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        179⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        180⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        181⤵
        Modifies registry class
        
        PID:7940
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        182⤵
        Drops file in System32 directory
        
        PID:7980
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8024
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        184⤵
        Modifies registry class
        
        PID:8072
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        185⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        186⤵
        Drops file in System32 directory
        
        PID:8156
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        187⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7308
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        189⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        190⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        191⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        192⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        193⤵
        Modifies registry class
        
        PID:7648
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        194⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        195⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7776
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        196⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7948
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8004
        
        C:\Windows\SysWOW64\Ggmmlamj.exe
        
        C:\Windows\system32\Ggmmlamj.exe
        199⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        200⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        201⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        202⤵
        Drops file in System32 directory
        
        PID:7336
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        203⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        204⤵
        Modifies registry class
        
        PID:7600
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        205⤵
        Drops file in System32 directory
        
        PID:7716
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        206⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7928
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        208⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        209⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8136
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        210⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        211⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7640
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        213⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7792
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        214⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        215⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        216⤵
        Modifies registry class
        
        PID:7180
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        217⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        218⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        219⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        220⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        221⤵
        Modifies registry class
        
        PID:7740
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        222⤵
        Modifies registry class
        
        PID:7212
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7864
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        224⤵
        Modifies registry class
        
        PID:7868
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8200
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        226⤵
        Drops file in System32 directory
        
        PID:8240
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        227⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8324
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        229⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        230⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        231⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        232⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        233⤵
        Drops file in System32 directory
        
        PID:8540
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        234⤵
        Modifies registry class
        
        PID:8576
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        235⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        236⤵
        Modifies registry class
        
        PID:8672
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        237⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8756
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        239⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        240⤵
        Modifies registry class
        
        PID:8844
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        241⤵
        Drops file in System32 directory
        
        PID:8884
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        242⤵
        Modifies registry class
        
        PID:8920
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        243⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        244⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        245⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        246⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        247⤵
        Drops file in System32 directory
        
        PID:9172
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        248⤵
        Modifies registry class
        
        PID:8100
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        249⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        250⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        251⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        252⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8564
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        254⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        255⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        256⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        257⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        258⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        259⤵
        Drops file in System32 directory
        
        PID:9092
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        260⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        261⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        262⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        263⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        264⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        265⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        266⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        267⤵
        Modifies registry class
        
        PID:9152
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        268⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        269⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        270⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        271⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        272⤵
        Drops file in System32 directory
        
        PID:8236
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        273⤵
        Drops file in System32 directory
        
        PID:8392
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8788
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        275⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        276⤵
        Drops file in System32 directory
        
        PID:8700
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        277⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        278⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        279⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        280⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9300
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        282⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        283⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        284⤵
        Drops file in System32 directory
        
        PID:9436
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9476
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        286⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        287⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        288⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        289⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        290⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        291⤵
        Drops file in System32 directory
        
        PID:9752
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        292⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        293⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        294⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        295⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        296⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        297⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        298⤵
        Modifies registry class
        
        PID:10048
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        299⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        300⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        301⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        302⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        303⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        304⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        305⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        306⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9516
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        308⤵
        Modifies registry class
        
        PID:9592
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        309⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9668
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        310⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Pmbegqjk.exe
        
        C:\Windows\system32\Pmbegqjk.exe
        311⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Qppaclio.exe
        
        C:\Windows\system32\Qppaclio.exe
        312⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Qclmck32.exe
        
        C:\Windows\system32\Qclmck32.exe
        313⤵
        Drops file in System32 directory
        
        PID:9936
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        314⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Qiiflaoo.exe
        
        C:\Windows\system32\Qiiflaoo.exe
        315⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        316⤵
        Drops file in System32 directory
        
        PID:10144
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        317⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        318⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        319⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9380
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        320⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Cdjlap32.exe
        
        C:\Windows\system32\Cdjlap32.exe
        321⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Cleqfb32.exe
        
        C:\Windows\system32\Cleqfb32.exe
        322⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Cpqlfa32.exe
        
        C:\Windows\system32\Cpqlfa32.exe
        323⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Cboibm32.exe
        
        C:\Windows\system32\Cboibm32.exe
        324⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Ciiaogon.exe
        
        C:\Windows\system32\Ciiaogon.exe
        325⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Cdnelpod.exe
        
        C:\Windows\system32\Cdnelpod.exe
        326⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Cepadh32.exe
        
        C:\Windows\system32\Cepadh32.exe
        327⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Cmgjee32.exe
        
        C:\Windows\system32\Cmgjee32.exe
        328⤵
        Drops file in System32 directory
        
        PID:9960
        
        C:\Windows\SysWOW64\Ddqbbo32.exe
        
        C:\Windows\system32\Ddqbbo32.exe
        329⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Dfonnk32.exe
        
        C:\Windows\system32\Dfonnk32.exe
        330⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\Dmifkecb.exe
        
        C:\Windows\system32\Dmifkecb.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9248
        
        C:\Windows\SysWOW64\Dpgbgpbe.exe
        
        C:\Windows\system32\Dpgbgpbe.exe
        332⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Dbfoclai.exe
        
        C:\Windows\system32\Dbfoclai.exe
        333⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Dipgpf32.exe
        
        C:\Windows\system32\Dipgpf32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2568
        
        C:\Windows\SysWOW64\Dlncla32.exe
        
        C:\Windows\system32\Dlncla32.exe
        335⤵
        Drops file in System32 directory
        
        PID:10096
        
        C:\Windows\SysWOW64\Dpjompqc.exe
        
        C:\Windows\system32\Dpjompqc.exe
        336⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Ddhhbngi.exe
        
        C:\Windows\system32\Ddhhbngi.exe
        337⤵
        Drops file in System32 directory
        
        PID:9296
        
        C:\Windows\SysWOW64\Jcjodbgl.exe
        
        C:\Windows\system32\Jcjodbgl.exe
        338⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\Kfkamk32.exe
        
        C:\Windows\system32\Kfkamk32.exe
        339⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Ldfhgn32.exe
        
        C:\Windows\system32\Ldfhgn32.exe
        340⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\Maoakaip.exe
        
        C:\Windows\system32\Maoakaip.exe
        341⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\Mklpof32.exe
        
        C:\Windows\system32\Mklpof32.exe
        342⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\Ndkjik32.exe
        
        C:\Windows\system32\Ndkjik32.exe
        343⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Dhbqalle.exe
        
        C:\Windows\system32\Dhbqalle.exe
        344⤵
        Drops file in System32 directory
        
        PID:4320
        
        C:\Windows\SysWOW64\Gccmaack.exe
        
        C:\Windows\system32\Gccmaack.exe
        345⤵
        Modifies registry class
        
        PID:2548
        
        C:\Windows\SysWOW64\Ihjafd32.exe
        
        C:\Windows\system32\Ihjafd32.exe
        346⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Icdoolge.exe
        
        C:\Windows\system32\Icdoolge.exe
        347⤵
        
        PID:488
        
        C:\Windows\SysWOW64\Kgcqlh32.exe
        
        C:\Windows\system32\Kgcqlh32.exe
        348⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Kidmcqeg.exe
        
        C:\Windows\system32\Kidmcqeg.exe
        349⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Likcdpop.exe
        
        C:\Windows\system32\Likcdpop.exe
        350⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Nagngjmj.exe
        
        C:\Windows\system32\Nagngjmj.exe
        351⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\Canocm32.exe
        
        C:\Windows\system32\Canocm32.exe
        352⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Eblgon32.exe
        
        C:\Windows\system32\Eblgon32.exe
        353⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Ejglcq32.exe
        
        C:\Windows\system32\Ejglcq32.exe
        354⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\Ebejem32.exe
        
        C:\Windows\system32\Ebejem32.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1372
        
        C:\Windows\SysWOW64\Giahndcf.exe
        
        C:\Windows\system32\Giahndcf.exe
        356⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Icjengld.exe
        
        C:\Windows\system32\Icjengld.exe
        357⤵
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Jbnopbdl.exe
        
        C:\Windows\system32\Jbnopbdl.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5680
        
        C:\Windows\SysWOW64\Lopkkdgf.exe
        
        C:\Windows\system32\Lopkkdgf.exe
        359⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Mppdbb32.exe
        
        C:\Windows\system32\Mppdbb32.exe
        360⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\Ccendc32.exe
        
        C:\Windows\system32\Ccendc32.exe
        361⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Felbmqpl.exe
        
        C:\Windows\system32\Felbmqpl.exe
        362⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Haobnpkc.exe
        
        C:\Windows\system32\Haobnpkc.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6736
        
        C:\Windows\SysWOW64\Hmhphqoe.exe
        
        C:\Windows\system32\Hmhphqoe.exe
        364⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Headon32.exe
        
        C:\Windows\system32\Headon32.exe
        365⤵
        Modifies registry class
        
        PID:7008
        
        C:\Windows\SysWOW64\Komhkn32.exe
        
        C:\Windows\system32\Komhkn32.exe
        366⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Bleebc32.exe
        
        C:\Windows\system32\Bleebc32.exe
        367⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Clhbhc32.exe
        
        C:\Windows\system32\Clhbhc32.exe
        368⤵
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Cohkinob.exe
        
        C:\Windows\system32\Cohkinob.exe
        369⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\Cnjkgf32.exe
        
        C:\Windows\system32\Cnjkgf32.exe
        370⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Cfglahbj.exe
        
        C:\Windows\system32\Cfglahbj.exe
        371⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Copajm32.exe
        
        C:\Windows\system32\Copajm32.exe
        372⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7052
        
        C:\Windows\SysWOW64\Cggikk32.exe
        
        C:\Windows\system32\Cggikk32.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8084
        
        C:\Windows\SysWOW64\Dqomdppm.exe
        
        C:\Windows\system32\Dqomdppm.exe
        374⤵
        Drops file in System32 directory
        
        PID:7360
        
        C:\Windows\SysWOW64\Djgbmffn.exe
        
        C:\Windows\system32\Djgbmffn.exe
        375⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\Dodjemee.exe
        
        C:\Windows\system32\Dodjemee.exe
        376⤵
        Modifies registry class
        
        PID:7624
        
        C:\Windows\SysWOW64\Dcbckk32.exe
        
        C:\Windows\system32\Dcbckk32.exe
        377⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Dqfceoje.exe
        
        C:\Windows\system32\Dqfceoje.exe
        378⤵
        Modifies registry class
        
        PID:7824
        
        C:\Windows\SysWOW64\Dcdpakii.exe
        
        C:\Windows\system32\Dcdpakii.exe
        379⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Dokqfl32.exe
        
        C:\Windows\system32\Dokqfl32.exe
        380⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Ejaecdnc.exe
        
        C:\Windows\system32\Ejaecdnc.exe
        381⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Eonmkkmj.exe
        
        C:\Windows\system32\Eonmkkmj.exe
        382⤵
        Modifies registry class
        
        PID:7660
        
        C:\Windows\SysWOW64\Eopjakkg.exe
        
        C:\Windows\system32\Eopjakkg.exe
        383⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\Enajobbf.exe
        
        C:\Windows\system32\Enajobbf.exe
        384⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\Eflocepa.exe
        
        C:\Windows\system32\Eflocepa.exe
        385⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Efolidno.exe
        
        C:\Windows\system32\Efolidno.exe
        386⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Eqdpfm32.exe
        
        C:\Windows\system32\Eqdpfm32.exe
        387⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Egnhcgeb.exe
        
        C:\Windows\system32\Egnhcgeb.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3232
        
        C:\Windows\SysWOW64\Fnhppa32.exe
        
        C:\Windows\system32\Fnhppa32.exe
        389⤵
        Drops file in System32 directory
        
        PID:7372
        
        C:\Windows\SysWOW64\Fmkqknci.exe
        
        C:\Windows\system32\Fmkqknci.exe
        390⤵
        Drops file in System32 directory
        
        PID:7760
        
        C:\Windows\SysWOW64\Fpimgjbm.exe
        
        C:\Windows\system32\Fpimgjbm.exe
        391⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Fjoadbbc.exe
        
        C:\Windows\system32\Fjoadbbc.exe
        392⤵
        Drops file in System32 directory
        
        PID:8080
        
        C:\Windows\SysWOW64\Fplimi32.exe
        
        C:\Windows\system32\Fplimi32.exe
        393⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Fgcang32.exe
        
        C:\Windows\system32\Fgcang32.exe
        394⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Fjanjb32.exe
        
        C:\Windows\system32\Fjanjb32.exe
        395⤵
        Drops file in System32 directory
        
        PID:5824
        
        C:\Windows\SysWOW64\Fnmjkahi.exe
        
        C:\Windows\system32\Fnmjkahi.exe
        396⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Fpnfbi32.exe
        
        C:\Windows\system32\Fpnfbi32.exe
        397⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\Fgencf32.exe
        
        C:\Windows\system32\Fgencf32.exe
        398⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Fnofpqff.exe
        
        C:\Windows\system32\Fnofpqff.exe
        399⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Gjhdkajh.exe
        
        C:\Windows\system32\Gjhdkajh.exe
        400⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Gpelchhp.exe
        
        C:\Windows\system32\Gpelchhp.exe
        401⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Gmimll32.exe
        
        C:\Windows\system32\Gmimll32.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7516
        
        C:\Windows\SysWOW64\Gjmmfq32.exe
        
        C:\Windows\system32\Gjmmfq32.exe
        403⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Gmkibl32.exe
        
        C:\Windows\system32\Gmkibl32.exe
        404⤵
        Drops file in System32 directory
        
        PID:9076
        
        C:\Windows\SysWOW64\Gceaofmc.exe
        
        C:\Windows\system32\Gceaofmc.exe
        405⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Gmnfglcd.exe
        
        C:\Windows\system32\Gmnfglcd.exe
        406⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Gffkpa32.exe
        
        C:\Windows\system32\Gffkpa32.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5504
        
        C:\Windows\SysWOW64\Hnblmnfa.exe
        
        C:\Windows\system32\Hnblmnfa.exe
        408⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Hdodeedi.exe
        
        C:\Windows\system32\Hdodeedi.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8456
        
        C:\Windows\SysWOW64\Hpeejfjm.exe
        
        C:\Windows\system32\Hpeejfjm.exe
        410⤵
        Modifies registry class
        
        PID:5432
        
        C:\Windows\SysWOW64\Hfonfp32.exe
        
        C:\Windows\system32\Hfonfp32.exe
        411⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Hphbpehj.exe
        
        C:\Windows\system32\Hphbpehj.exe
        412⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Hoibmmpi.exe
        
        C:\Windows\system32\Hoibmmpi.exe
        413⤵
        Drops file in System32 directory
        
        PID:7632
        
        C:\Windows\SysWOW64\Iajkohmj.exe
        
        C:\Windows\system32\Iajkohmj.exe
        414⤵
        Drops file in System32 directory
        
        PID:8960
        
        C:\Windows\SysWOW64\Iffcgoka.exe
        
        C:\Windows\system32\Iffcgoka.exe
        415⤵
        Modifies registry class
        
        PID:8352
        
        C:\Windows\SysWOW64\Ionlhlld.exe
        
        C:\Windows\system32\Ionlhlld.exe
        416⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Ialhdh32.exe
        
        C:\Windows\system32\Ialhdh32.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8804
        
        C:\Windows\SysWOW64\Ihfpabbd.exe
        
        C:\Windows\system32\Ihfpabbd.exe
        418⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Idmafc32.exe
        
        C:\Windows\system32\Idmafc32.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5696
        
        C:\Windows\SysWOW64\Igmjhnej.exe
        
        C:\Windows\system32\Igmjhnej.exe
        420⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Jgpfmncg.exe
        
        C:\Windows\system32\Jgpfmncg.exe
        421⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Jognokdi.exe
        
        C:\Windows\system32\Jognokdi.exe
        422⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\Jddggb32.exe
        
        C:\Windows\system32\Jddggb32.exe
        423⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\Jahgpf32.exe
        
        C:\Windows\system32\Jahgpf32.exe
        424⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Jhapmphg.exe
        
        C:\Windows\system32\Jhapmphg.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9408
        
        C:\Windows\SysWOW64\Jkplilgk.exe
        
        C:\Windows\system32\Jkplilgk.exe
        426⤵
        Modifies registry class
        
        PID:9768
        
        C:\Windows\SysWOW64\Jolhjj32.exe
        
        C:\Windows\system32\Jolhjj32.exe
        427⤵
        Modifies registry class
        
        PID:10020
        
        C:\Windows\SysWOW64\Jdhpba32.exe
        
        C:\Windows\system32\Jdhpba32.exe
        428⤵
        Modifies registry class
        
        PID:9412
        
        C:\Windows\SysWOW64\Jgiiclkl.exe
        
        C:\Windows\system32\Jgiiclkl.exe
        429⤵
        Modifies registry class
        
        PID:9824
        
        C:\Windows\SysWOW64\Jncapf32.exe
        
        C:\Windows\system32\Jncapf32.exe
        430⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Kobnji32.exe
        
        C:\Windows\system32\Kobnji32.exe
        431⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Kpdjbapj.exe
        
        C:\Windows\system32\Kpdjbapj.exe
        432⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Kgnbol32.exe
        
        C:\Windows\system32\Kgnbol32.exe
        433⤵
        
        PID:640
        
        C:\Windows\SysWOW64\Kacgld32.exe
        
        C:\Windows\system32\Kacgld32.exe
        434⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Kpfggang.exe
        
        C:\Windows\system32\Kpfggang.exe
        435⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Khmoionj.exe
        
        C:\Windows\system32\Khmoionj.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9268
        
        C:\Windows\SysWOW64\Kklkej32.exe
        
        C:\Windows\system32\Kklkej32.exe
        437⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Knjhae32.exe
        
        C:\Windows\system32\Knjhae32.exe
        438⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Kafcadej.exe
        
        C:\Windows\system32\Kafcadej.exe
        439⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Kddpnpdn.exe
        
        C:\Windows\system32\Kddpnpdn.exe
        440⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Kgbljkca.exe
        
        C:\Windows\system32\Kgbljkca.exe
        441⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Kojdkhdd.exe
        
        C:\Windows\system32\Kojdkhdd.exe
        442⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Kpkqbq32.exe
        
        C:\Windows\system32\Kpkqbq32.exe
        443⤵
        Modifies registry class
        
        PID:8904
        
        C:\Windows\SysWOW64\Khbhdn32.exe
        
        C:\Windows\system32\Khbhdn32.exe
        444⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Kolaqh32.exe
        
        C:\Windows\system32\Kolaqh32.exe
        445⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Lajmmc32.exe
        
        C:\Windows\system32\Lajmmc32.exe
        446⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Lhdeinhb.exe
        
        C:\Windows\system32\Lhdeinhb.exe
        447⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Lnanadfi.exe
        
        C:\Windows\system32\Lnanadfi.exe
        448⤵
        Drops file in System32 directory
        
        PID:9716
        
        C:\Windows\SysWOW64\Ldkfno32.exe
        
        C:\Windows\system32\Ldkfno32.exe
        449⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Lkenkhec.exe
        
        C:\Windows\system32\Lkenkhec.exe
        450⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6232
        
        C:\Windows\SysWOW64\Lncjgddf.exe
        
        C:\Windows\system32\Lncjgddf.exe
        451⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Laofhbmp.exe
        
        C:\Windows\system32\Laofhbmp.exe
        452⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Lglopjkg.exe
        
        C:\Windows\system32\Lglopjkg.exe
        453⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Locgagli.exe
        
        C:\Windows\system32\Locgagli.exe
        454⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Lqdcio32.exe
        
        C:\Windows\system32\Lqdcio32.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1796
        
        C:\Windows\SysWOW64\Lhkkjl32.exe
        
        C:\Windows\system32\Lhkkjl32.exe
        456⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6808
        
        C:\Windows\SysWOW64\Lkjhfh32.exe
        
        C:\Windows\system32\Lkjhfh32.exe
        457⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Lnhdbc32.exe
        
        C:\Windows\system32\Lnhdbc32.exe
        458⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Lqfpoope.exe
        
        C:\Windows\system32\Lqfpoope.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6092
        
        C:\Windows\SysWOW64\Lhnhplpg.exe
        
        C:\Windows\system32\Lhnhplpg.exe
        460⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Mbfmha32.exe
        
        C:\Windows\system32\Mbfmha32.exe
        461⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Mddidm32.exe
        
        C:\Windows\system32\Mddidm32.exe
        462⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Mhpeelnd.exe
        
        C:\Windows\system32\Mhpeelnd.exe
        463⤵
        Drops file in System32 directory
        
        PID:332
        
        C:\Windows\SysWOW64\Mkoaagmh.exe
        
        C:\Windows\system32\Mkoaagmh.exe
        464⤵
        Modifies registry class
        
        PID:3724
        
        C:\Windows\SysWOW64\Mnmmmbll.exe
        
        C:\Windows\system32\Mnmmmbll.exe
        465⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Mbhina32.exe
        
        C:\Windows\system32\Mbhina32.exe
        466⤵
        Drops file in System32 directory
        
        PID:5896
        
        C:\Windows\SysWOW64\Mdgejmdi.exe
        
        C:\Windows\system32\Mdgejmdi.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6136
        
        C:\Windows\SysWOW64\Mgebfhcl.exe
        
        C:\Windows\system32\Mgebfhcl.exe
        468⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Mkangg32.exe
        
        C:\Windows\system32\Mkangg32.exe
        469⤵
        Modifies registry class
        
        PID:5020
        
        C:\Windows\SysWOW64\Mbkfcabb.exe
        
        C:\Windows\system32\Mbkfcabb.exe
        470⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\Mdibplaf.exe
        
        C:\Windows\system32\Mdibplaf.exe
        471⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7084
        
        C:\Windows\SysWOW64\Mkcjlf32.exe
        
        C:\Windows\system32\Mkcjlf32.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4908
        
        C:\Windows\SysWOW64\Mqpcdn32.exe
        
        C:\Windows\system32\Mqpcdn32.exe
        473⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Mhgkfkhl.exe
        
        C:\Windows\system32\Mhgkfkhl.exe
        474⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Mndcnafd.exe
        
        C:\Windows\system32\Mndcnafd.exe
        475⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\Nkhdgfen.exe
        
        C:\Windows\system32\Nkhdgfen.exe
        476⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Nbbldp32.exe
        
        C:\Windows\system32\Nbbldp32.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6264
        
        C:\Windows\SysWOW64\Nildajdg.exe
        
        C:\Windows\system32\Nildajdg.exe
        478⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6056
        
        C:\Windows\SysWOW64\Nofmndkd.exe
        
        C:\Windows\system32\Nofmndkd.exe
        479⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9700
        
        C:\Windows\SysWOW64\Ninafj32.exe
        
        C:\Windows\system32\Ninafj32.exe
        480⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Nkmmbe32.exe
        
        C:\Windows\system32\Nkmmbe32.exe
        481⤵
        Modifies registry class
        
        PID:9564
        
        C:\Windows\SysWOW64\Nnkioq32.exe
        
        C:\Windows\system32\Nnkioq32.exe
        482⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Neebkkgi.exe
        
        C:\Windows\system32\Neebkkgi.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1652
        
        C:\Windows\SysWOW64\Nkojheoe.exe
        
        C:\Windows\system32\Nkojheoe.exe
        484⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Nnmfdpni.exe
        
        C:\Windows\system32\Nnmfdpni.exe
        485⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Nicjaino.exe
        
        C:\Windows\system32\Nicjaino.exe
        486⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Nombnc32.exe
        
        C:\Windows\system32\Nombnc32.exe
        487⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2204
        
        C:\Windows\SysWOW64\Nqnofkkj.exe
        
        C:\Windows\system32\Nqnofkkj.exe
        488⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Nieggill.exe
        
        C:\Windows\system32\Nieggill.exe
        489⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\Okcccdkp.exe
        
        C:\Windows\system32\Okcccdkp.exe
        490⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\Obnlpnbm.exe
        
        C:\Windows\system32\Obnlpnbm.exe
        491⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Oigdmh32.exe
        
        C:\Windows\system32\Oigdmh32.exe
        492⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\Okfpid32.exe
        
        C:\Windows\system32\Okfpid32.exe
        493⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 400
        494⤵
        Program crash
        
        PID:7028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=2432,i,12161922670941700748,3348345705955601576,262144 --variations-seed-version /prefetch:8
1⤵
PID:9848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2344 -ip 2344
1⤵
PID:3888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Dhbebj32.exe

Filesize
45KB

MD5
d4cff24a8b82faa72c8effd98d67e2bf

SHA1
fa4e1d42fd3c03d9ff343fa37d5da70a8bfbf18b

SHA256
f4f1a67f111bfddae3ec28c4f6b66930f3bc89ca7b74b5ef55a13ab93bd3014f

SHA512
66530bfef114a553d923b3c96d357f93fdbc460f7a620ddc80b73b116b4e065d89196407f931f104f7482ad46bc9fa92c319b3aba027b9a08589c124082bbb00

Download Submit
C:\Windows\SysWOW64\Ebdcld32.exe

Filesize
45KB

MD5
566c3eb62eb80e1d378cbacf6e0dba0d

SHA1
19e4900389fcd0e30ccd0b4697f4e1f899921621

SHA256
53b48c167b317e18426921cf08c37e4cc52af1b8aa9cbfe6aa7058f1107cb7e6

SHA512
3208cee0225eb167ed07b4a6f773b8c854485a12d56172b3ab642d2000869d110f113e2d366e44882f72df5b37f6d8c31865fba6708e45b084a9db070f482721

Download Submit
C:\Windows\SysWOW64\Ebimgcfi.exe

Filesize
45KB

MD5
92e25d0d4e2f0bc45712119d2aa76d0c

SHA1
043c2e9b7032963a57dbf63b4f9542265311cf12

SHA256
80b92e76e1e6f066b4c08ad5335cb6c93b09abba17318ca27af7c43fa6d8d099

SHA512
5b59fcf2444d044490b0c52fb58c5f9839bed4d76d83b6386ddc382842de17fb49f54eb8dc51be551f8bd28e080a3432221498c1a8d69bf105a5268f126e1f69

Download Submit
C:\Windows\SysWOW64\Eecphp32.exe

Filesize
45KB

MD5
e7860c9b78c301bdfc64c43d3e8ac08c

SHA1
d4834db1218a4dc2b81dbf26b05d2fe0da37723c

SHA256
758709041acb989bd906c9e812ddc0697bbd536e95af138df89a1279c1f2fdf7

SHA512
e89b5ac8be5559e7907d4cc0801ae820e318e251261f23284d212fa7efe4fdb2601708344b0e8523a2c6b74cff21736591f938f2df7bf921fdb18a26c8723a8e

Download Submit
C:\Windows\SysWOW64\Efblbbqd.exe

Filesize
45KB

MD5
5715d76b21a47406f85014dbe5334262

SHA1
b31f0eb0242786747eb940908384133305ac364f

SHA256
da190fd7c5aeb6c121cf26ff56f54d48822d6ca3699b3d7d485a7abb5770276c

SHA512
a470233fc6ac83fd2f72a441f7840f9f3f96ae80022c1b5d99933493136fbd66138aea0a50b85f86715a7b4e99bcfd99d41ad9979f7348943a551636708da857

Download Submit
C:\Windows\SysWOW64\Eflocepa.exe

Filesize
45KB

MD5
357f8b270069623cb1c02bb24f2f3071

SHA1
c14604708ff34aa03b631524bbe71d233ae4aed5

SHA256
f5c10cd2f4f316c5c49598d7e6ce653103887cf647fdaddb96cbcfd93d5a240f

SHA512
db8521d812820fb104588b87e86ad456ed22ac8fa5b8605936c2ce2b414fcb9c674b05b4de5b0409743f14fd1aed3363309143dd30dae1d42680f7b6a76277db

Download Submit
C:\Windows\SysWOW64\Eifaim32.exe

Filesize
45KB

MD5
cf2af730c2459af78304308d50caa195

SHA1
5aa6389e61d023ce3ac2ee17dc181135b4bad193

SHA256
3d88ca7610c2e3b8981fa4ee66eb4a2813e670e2a3077c81e8661e3cfc389ad0

SHA512
2a81816738b33fa6eff7216306c41ce69a5f67de6aaa49ae1a90db3859744d8374298b16259d45238df4a2a2ca2a9433f469b53ab1fc92696001265b334068be

Download Submit
C:\Windows\SysWOW64\Emhkdmlg.exe

Filesize
45KB

MD5
fbbe7dd4c6d5e7b1f0099ed0ccf247c3

SHA1
53907b1675b21ecdcb86a63083b8fa112567f0dd

SHA256
8db0c7d8e513191cdc6bfdcaa6da97456b5a3a5afa2069765269ecf2bd678888

SHA512
51b3b02961e4c302b49aa95dba9e3f8e94f1bc8e1e30fac9aa98b24ba9fbee1c0a176ddae4d5c1ef10707522b73c5b14610d8b439dd068d5ef139c8e8b561f57

Download Submit
C:\Windows\SysWOW64\Emjgim32.exe

Filesize
45KB

MD5
2768158f8fe5b14fc36442b8dcc63a9a

SHA1
9b7f751d5ac58c331b6b44da7b0d4a3279af0966

SHA256
1f0bfb4ba780a7694b76f95fc8ed13b14e9f5d613f2191022dd7d60fd878de73

SHA512
7134d1a3f76a76367ab1b7737eac919666312a039eb610dae898871bd0929378177630e8191018feeedb822aa3881ae93c44cf564a951d4979601f3197b152a6

Download Submit
C:\Windows\SysWOW64\Enbjad32.exe

Filesize
45KB

MD5
81463351081aea35c68929973b4d5f1a

SHA1
0a7f4651ab33de8a285d34a782fd7a5cecd476a3

SHA256
b334e936e3e633afe06399af86a8a1f2016203e3d155e14593aa2fa6496565e4

SHA512
f0e5cf2cb5b540923eb7f76d8072f679383b0900d1f391f0a875a0b5dde4553d42bf9d585cd3aef7b18171f533e7752b71018c0534249db45bf080474af59bdd

Download Submit
C:\Windows\SysWOW64\Eonmkkmj.exe

Filesize
45KB

MD5
e2a5db767dec34e3b1061a590693170a

SHA1
d35d558e4ae2aec8edd50a0d3ea2b46c6b3f2a49

SHA256
666c7e1527a3630e0a1a2200507e3cc82b85d3eff0cd70d555e877cf1a88a189

SHA512
675e18949885cd5cf5a558b0cd42956947046758fd9cc10c08b69b4c0bd9c12003aa5619802c4c8adba7363398541c06e8205de9b4a488bfd82c47ed1bb9ae22

Download Submit
C:\Windows\SysWOW64\Epmmqheb.exe

Filesize
45KB

MD5
261480f1288e22524b0481db15a561a3

SHA1
a5c6dcdcb418b7f6b0d224ebbd145355a26aff05

SHA256
7a6462c2775625b5c742f3ceca6134b4c8f2e9e294ed3fabda14563957ed1ce3

SHA512
cd825c1fecab245db190265cbc0f93fd064beda815d3329ef8885a74cd05253d86a38b944a97b960334aa6346f8b2c3e0382626e23e6311c74786b4011b0a9d6

Download Submit
C:\Windows\SysWOW64\Fefedmil.exe

Filesize
45KB

MD5
653d68c6bb356e73d6237a0e6eb3637e

SHA1
713a5a6d5b4a3137c03523a912e20309d302d226

SHA256
ee6f1e068db46ff5417dfcd3f71d2ed4c42ef77b1385410180ee9ce4fdf9ae22

SHA512
3f6e06e7a2a28fcb1f0b0a56ebc1f245a58b1a0a04da05fae8fdf66ea3dadbc8a5b2b75fe9d01c51d5d72403020af750499f239b8a7bcbcc8147c4d25baa0612

Download Submit
C:\Windows\SysWOW64\Fflohaij.exe

Filesize
45KB

MD5
27794b11bebcff4eb84ca09dc67e4ea2

SHA1
290609d48bc94e78c3eea2700b383190fb591c8b

SHA256
db7a4a031eb793138f8b53f7ed1cd7f47164252b414e55fb9cdcd55dcfe14641

SHA512
f53d781e40a0da02cb4d7ea43b47655abf52a8ce24969d39e52b24a1aca863e213c4ca2fbaa218c6ae032ed288933fc5e3d4bcd085a4fa31c194af9e305979fe

Download Submit
C:\Windows\SysWOW64\Ffnknafg.exe

Filesize
45KB

MD5
b1a474f329c53c8d2275c8c84faaba0d

SHA1
ead550e2079656e0516ea0bfdb2a33af57b6ed28

SHA256
a3a8ffd0be07766c1898b7bb21966015c397390f9d3869827e2864a8b16a87b6

SHA512
4d38eb09b8b5cee3a79fcc19a291356e2db2c7338c40c39b8402e587839240f1e113f6010fb07ce2e04382ed31f70281049e803bb5a5685b87c4e5d8da36baaa

Download Submit
C:\Windows\SysWOW64\Ffqhcq32.exe

Filesize
45KB

MD5
41f7ffbe0fd2b1f32137c048029e55a4

SHA1
81dc8b17027b4484ae85fd39f41ca9c6766116af

SHA256
eab899ff7e86fc0e0a066ad764428bd2e8d87e55d5db382af7814084e905d039

SHA512
a1db63f6eda52f06934c786113182d2399423dd356bfee33a4f5b09bb35fecef31c8f43242cdc3405a8cdca46391990269b5b2a4990db3a75ed94b56ff323f73

Download Submit
C:\Windows\SysWOW64\Fihnomjp.exe

Filesize
45KB

MD5
a12a9644ae280e99685ead827f6e8d71

SHA1
9e98c37c528e28d35e52b2945fcaf886f7095127

SHA256
b277cb81fa626a998ffb613e4247f592cbe5209d95850e52fe356535d3a9fabb

SHA512
b2837fd575a98ab626c20d30e4f7b164cfdaccc039a33998191c26fa7a5f8e622b462c94629a545cf0c6c474b56ac6fc330c618acf24315199ff6ce29f72f8f4

Download Submit
C:\Windows\SysWOW64\Fjanjb32.exe

Filesize
45KB

MD5
0e8f8b1eec5164383618134be5f65975

SHA1
6ab263c9d70fabe0d012780816fddbc1fee2f74b

SHA256
a489ec79c88101d33b54a21ffe77ef70370473e5d3206870474c0fe68c307447

SHA512
68429d856d8e8a82b4854b41015ecd542ee75339ff8711650a046d0aff840556e5ef2906a5cfe0ef8eb0630780f593547e07c78593b4ff0ba72a29fecd7c5bfc

Download Submit
C:\Windows\SysWOW64\Fjoadbbc.exe

Filesize
45KB

MD5
5872c340774f48bab93df7146acbafc9

SHA1
3a6f43ab3ea2bb1cc2618749c7dd2d0d7e9b7068

SHA256
240817a9824d0ac794d478919716ffacc9ee4c3172d638e7dd20f5bc7b2dbf9a

SHA512
0b08f51ccb5d9ac009c5588ff74f7ce3a740db090522ce2eb7169cd8fd2e9c4dba4e92b9df1f23a09fdf8b214ce30a72be7a16b3bc8cb79c4e5228b7f60ddda3

Download Submit
C:\Windows\SysWOW64\Flmqlg32.exe

Filesize
45KB

MD5
d2c73f3bc479d2247f56581c0956ebcf

SHA1
bd43b19d3866bcd24c15254e8636711413549ade

SHA256
282afb2f21f743b4aa43a16e4f1f0903c6e1b493348ac5ce7020291e78337677

SHA512
c961964e3af0f28137394c5a89422aaec78b428f6ad0cd2dad7bafc8c1caf0ec67cd8c7fdc9db61e7b434405409601db75f4b792370f05286dabc0926a95e5b2

Download Submit
C:\Windows\SysWOW64\Fmfgek32.exe

Filesize
45KB

MD5
4fa8afb79186c9e4700c22ecd458bc69

SHA1
b6c10a94b937b737a2a9d890dd074bf2c5745f4d

SHA256
58683dae7c11c7c7e253bd0c4d2dd0f3def56f4a8dfdf3f62fa02b6f45fb546f

SHA512
9ebb43454101f77c1c713232fb01e27f50cd33bf4e5b33ba1f29ea775cf6387f81313defbb4a8e944bc399ae9ca7427aa167a6fe76ff25776ddc3c1596b2ad80

Download Submit
C:\Windows\SysWOW64\Fmhdkknd.exe

Filesize
45KB

MD5
23a925d5d53df79cb8c9c8fc93949852

SHA1
ec890a0d0702b2d0bc16f3deef9a1021fa003677

SHA256
9394da38ca1beff9a7f69fca67f1e7c74fffe60d140d49a1c4f89d31855f9896

SHA512
4ccdabf77d9f4f67ebee3b7698fb08edad9ddaf7f1007b470534d72e779ef77fad39357873fd94da23922a2937bcfc92f9c483a26c26930fbd7f8298f0e540e2

Download Submit
C:\Windows\SysWOW64\Fpkibf32.exe

Filesize
45KB

MD5
26dee564395c9566413f3f1ec28db022

SHA1
6e4a436e906fa6e6150359868f858a1d5ae3d85a

SHA256
ac3cd0599a973c3fcbc7e2501d29f0385655cec2bf1fea81724745b64f54b4f2

SHA512
03128d01ebf256d60279ec53b6e4bc7122216087ffbf539fd38b20c3db265bd1e78cd1050430643fdbe0cf5f5b011d6601264c0e7ffd872ea3fa0332e951c727

Download Submit
C:\Windows\SysWOW64\Gaebef32.exe

Filesize
45KB

MD5
034d2a133c092107b4fcbed3826f5a9a

SHA1
707909a684195d4383935ef0fd988a3e8bd05661

SHA256
045bfc55e4c4ea4df5c5a084ae8e4b0b3fb7ccab5ca80594b63e9e8db600644c

SHA512
85dec8028357d010283f6db2f0a07a7311e4f4b5dd1cd25e0bc48aabb9fd572bb5b3856edad4e0515d22a688824096213f25bbf04dc9857dadce695d98708743

Download Submit
C:\Windows\SysWOW64\Gbnoiqdq.exe

Filesize
45KB

MD5
cc2faf580d1bf439d02afd268df904d6

SHA1
16edb8338cb6639d0c2a4b5bb10c5dc326de714c

SHA256
399506c681b39ec545e87d7e8242769dc35bb2968d1e7298dbe4aa62c2247140

SHA512
bacb4e2c40481e164d7b09f2e740ebdaf148184b0e87a6f4bc5eb0288aa8c96846351a0894a5e220020d4f97228123e48f35e92d73f3e4292146e205b9aba8c3

Download Submit
C:\Windows\SysWOW64\Geaepk32.exe

Filesize
45KB

MD5
d0b1e0ba48a62f042fa824d4e593c296

SHA1
f9a428f18e7952c3794844ba146f8dfad955929d

SHA256
e0ef951630436836a4e19546de9fb049f6f7bafcbabc8894318ea3ca78b9cfa2

SHA512
071b0cca4be410af5a42efcb248d152061b94f4732671d5c047215ca1c717956bc8235d99a0cdeb17b48e6fe3a02c0ce0fcdd7997b68558e460309fb940d039d

Download Submit
C:\Windows\SysWOW64\Gfeaopqo.exe

Filesize
45KB

MD5
b89fd5a53903f95c77645e4f476e963c

SHA1
6039436c6a3b2f8a7077d886bc833ff37868cc9a

SHA256
48dde34b284ce9ce61e5dccbaef6f43ab3bbba747ecce0a9b5cd163c8611a6df

SHA512
e35dff75ebe3dee73a9d0777e3b5a047b5c8a8cb84c2f6075fa74d3c995cf80803126d9936d5a3b5c2e6dedb57e4491635968eaee2826aa3cb763d785411405e

Download Submit
C:\Windows\SysWOW64\Gflhoo32.exe

Filesize
45KB

MD5
a72ec4edfabcd1f766805cc99e3cf0bb

SHA1
c296ff297fa1eda799ea2bed6e76e5074d85da8f

SHA256
3be78fdf57162b22b0edb68bbdecd4bb579a4abc64fb793a49e17ddeeea53b5c

SHA512
a0e17a01dc7e15f7ba6fa779a783fcbe272a8d8326b94ced39e7d97a9ca52d30770ae8ed4d4540696806dbdef578e8b195563873d2be4b15b65c634924d7fe58

Download Submit
C:\Windows\SysWOW64\Giahndcf.exe

Filesize
45KB

MD5
78a67a589bb09a5748c27a74415cd063

SHA1
5c9789877990bc3d3d855e675673cbf247944a79

SHA256
e4ff113915b8ce0e41d626d83afc473bd3d0f4be45b9df0ffc8c9b1a4aa31478

SHA512
220e5ad8dc592ec2193670fd35c93c20a781880a5127bba44234b37fcfd42b5054944cd2c1717a9fec028c987527229665e0cbff77781d8533b8f2ffbcb53be0

Download Submit
C:\Windows\SysWOW64\Gmdcfidg.exe

Filesize
45KB

MD5
66e0a75508043dd580ad1e675a9970ca

SHA1
3d28ad3e9d47e96715abe983f80ddc39d2fb3253

SHA256
ebed5199bb9d286f57085a0fd629e792676178561ada54e384dd64635dc25738

SHA512
79d4563a42c90132eb4efb0420255c2beb76cdfed7a3197b000e2d03aed60287ca05d2f09e48c070684ece7a9cd0600283d1d2164490f5b5f25cedf767fbe919

Download Submit
C:\Windows\SysWOW64\Gpelhd32.exe

Filesize
45KB

MD5
42cb87a9c70fafe8844fda172e1a42f4

SHA1
bec99637b96471176721908b180389201dc27f94

SHA256
92b5ba8f18b3197c3c88258d1486a57cf1dc5745b849728d4d9dddab8b342e3c

SHA512
0e99204b15c7112c66a026feb4142caad912d9af813ebb275573ff2e1c1292b682db1a35d2acb20689a7aa20c3ce9e618bae6d84da42112210073984b56b7a44

Download Submit
C:\Windows\SysWOW64\Haobnpkc.exe

Filesize
45KB

MD5
5322343999f5fa16a51d1c6a33ddfc4b

SHA1
fa53ddb33042336a743dd3a8aaed5d9d07a7c564

SHA256
2045a511e28e169b39a82414e292e9756e2a45cc702725ac8949331b8a50c842

SHA512
c794f5af082a987b263fa60d78634ac83cc6f6f89f7436a3575be5e5b1d981aa62218b5852c690ff5c80bd5433bbe755aa83c3c9f430435503425ce755b569fe

Download Submit
C:\Windows\SysWOW64\Hdodeedi.exe

Filesize
45KB

MD5
bdb1afced3dade8b3fbdddb15136d4c9

SHA1
5d85e52116f497e36b46f32ac164d746458bcc98

SHA256
c33e441a26c5ea51d4edfebc121011ce4d0d61448c735aa479c18cd51b6e23a6

SHA512
82e5addfd73c3d17fb083999a771b7a22490e3109a283b78ecabfb58990b996c3e35e06ded8209d9f26f7eb11e99ebb6dc91fa3d59504385b17d91c2bd53a0d6

Download Submit
C:\Windows\SysWOW64\Hefnkkkj.exe

Filesize
45KB

MD5
4354d6173a31a5c162ce470312336091

SHA1
1b526a1821b5b9a77217c680a3212a03106ef382

SHA256
117915bfcb1b5c93283ae27c964db4459b4371feebe77bc2ebb7865a4a2ad6d3

SHA512
80ac34b4c58d644b12ceb7cee1bb5d8e399255a378bcff80d6c5cefaac8425251b4cefbf7948f0a15d21175b9d7da57371b2deb96cbec8d9ee66d865dad19066

Download Submit
C:\Windows\SysWOW64\Hehkajig.exe

Filesize
45KB

MD5
6b570cd287c3c37905bd5fd631f42c53

SHA1
5ce236e42e3843f0a728beaa45d890e28aac979b

SHA256
ec1f50564d9887e8c360ea09ccd35b69bef457e13ba0d766d5546a388f5d7f25

SHA512
75e5654f69a0606268e446b330d3979edb9dcd224567ffdce02352b7f91c876950da744084cc593786308e16fb821dbeda741369bc805a7b2a93fe77825dec46

Download Submit
C:\Windows\SysWOW64\Hfaajnfb.exe

Filesize
45KB

MD5
8c7e1b09f8e2b51239a3210e06935cac

SHA1
96fa544e7f88c5586630da8f29a7e17faba22bcb

SHA256
f14c73cd4653e18acc699a8499f2ff69e00a885cc7ed840c3d5c6e8834af9057

SHA512
871c04f17f5226789392243805897b75a17700908864e5ee6789bce95c4d2524e53b5308f7a3f4cd9ff77391029b3323cb283c0fc7b8c2f38273e7494085b302

Download Submit
C:\Windows\SysWOW64\Hoaojp32.exe

Filesize
45KB

MD5
2388d8c65ba18ed6dc181928d21ce0df

SHA1
5637efcb8ec4de7b75f76286bed684eef52846ca

SHA256
9d5acfaae975327f638957d0fae213e02bff2f073a8b80bf0b415b319ad1bd7e

SHA512
0dcdd8d542d62017cc7877c6cf4315937d0bf4ea7b6b4a29c4145bb534d3eb050335141f8b477b2c4cea7ec5c60192345332a9a96f33718e4f9368dee0829ebd

Download Submit
C:\Windows\SysWOW64\Hpiecd32.exe

Filesize
45KB

MD5
fd7cdcaf5d7a23f38169484aedf99b35

SHA1
b9aa32d0ee9da68c1e0beac246e93f59885efba6

SHA256
f51f7310b517ba3ebad8a34418b769c014344d506d682a02b5116acea191e68b

SHA512
ac7c6bdf5d4f5b15034e250090fbb43bd968dacaac2c1bad1aeb04187249ca8b7aed361274dc94c6b52af3b96e3256fdc34789a3df2954d51e7138bf5a8bdd73

Download Submit
C:\Windows\SysWOW64\Hplbickp.exe

Filesize
45KB

MD5
362e785884a09c647ae885cbecc26012

SHA1
ecae6d4f286d2f841e3c22b48aa3a74e7bd21699

SHA256
e5a9458b1370930d0a0c85c1b754ae80047bd3b81334616fb1cf496e04eaf90b

SHA512
13117f61487bc4e8f932e0ebf05d216e0ce6cbd4fd58e38282bcf6146092064bda2f3b7fc4bf83a458335fd89b06f33696fa0dec7c4075acb8b1e717532185cd

Download Submit
C:\Windows\SysWOW64\Iajkohmj.exe

Filesize
45KB

MD5
3fc7facd281dca51c260f6f8b731ef3d

SHA1
9c7dd7eea6d75092c7ffcd63c87b6db993c35e00

SHA256
d91fc742ba1fbbb7cd69a4e4f54aec71d297f22a688382784d3b2819135deee9

SHA512
324a384d4768bfecdaeb2a0e731215b57e70eb5fd6fe636744b018e17deb390a6a807d19d37f59fe94446c4474fe59d770be9ff6e299cb7ccfceb7c759709ea0

Download Submit
C:\Windows\SysWOW64\Iebngial.exe

Filesize
45KB

MD5
b6a4988e2e62f1bcd384c6544147b960

SHA1
a68f9bd55fb108efb98d15d25af038d377690280

SHA256
d4be08e87ee480cd3b807ea734f51fb3146ef008e226c91ed41c1485da414897

SHA512
dad911031afdae702f49b0761d0c6e0e0b8583d560e27c9ec835f847ebff9500a787eafd6a27aaa59fd000b50061a29f3b206e528c98769709ce86fcc5d3edb2

Download Submit
C:\Windows\SysWOW64\Iepaaico.exe

Filesize
45KB

MD5
e662562a77d7c7f80f15178492e21bee

SHA1
d7aed61c697d0aabf069a12dcfa295a957ce77ec

SHA256
39019131d81cac564a5eb4570214d8753d4dd75f11d5b2be6be9742006376fbb

SHA512
71b27c40d57d843bab972c54b3a60011a605ccb34b95170f0b5832ee608fe534a12653ff30f4eaec664773aaa4a1b3b1d19949d2a4e65e09abf491fff55252a1

Download Submit
C:\Windows\SysWOW64\Igmjhnej.exe

Filesize
45KB

MD5
76dd0219e1e4c0b0dfc5056249ce21ca

SHA1
e72c6cc54ec66bea5744e4de69467813a0269098

SHA256
49d2ce6e3390e142d068812cc20f37fdbc55b044e73fb9cbf1eab4fad460795d

SHA512
e41307c12c339c0cdc096d49f4f2ca8926b1dc44a59a97816d6464e4890956de20248af486b6bb32063547cf24b08945dbe49a9553ac680117aceb30e1cd10e8

Download Submit
C:\Windows\SysWOW64\Jddggb32.exe

Filesize
45KB

MD5
4bfc082ae1880ad6a5942df54fa75ecc

SHA1
29d982c0018cac8a4b9df7594374920ff7fa17cf

SHA256
e7884d126a79f3874938d00eca36772a95d8670955c27b969baad4d660ef69b2

SHA512
1e3c0ad785c3a6d9b97ab37558750b10daaa3d1d35be16f0f882136b4fb59a31fa6169bb34c119759163cfddfa74c5cda1740ee6815aa92ff5928059e54bfbfa

Download Submit
C:\Windows\SysWOW64\Lmdnbn32.exe

Filesize
45KB

MD5
0a7901eb800c9f91cc863e7dfff74f74

SHA1
997094ff8800a50a0eefa7ba9b7475002d6ba99e

SHA256
4009bc07185e569742a4a54c821a110c7301f933147880e7285e1dc88880d25d

SHA512
0630f7f8e1673263ee1d9b2f20b905ac3fb64f551d1070e4eae567261edfd17440bc7b9ef5976581db2bfaf925e2453075664f8860464df7d2ad58ee22a29569

Download Submit
C:\Windows\SysWOW64\Mgbefe32.exe

Filesize
45KB

MD5
dd98b639a83e5bd7d29c461f59bc1e1a

SHA1
819d64989346af86363701a64af748639f0005d7

SHA256
5ed2ffdad6a733eb939132b29e73dc173cc5b0b767ea4c5813eb371ae1b5f788

SHA512
570cdc13d1aeb9cf0222364d21f71414c9c4184cb6ad703ceea79968f5f099dd10091da5c6c9d09e1a58dea66665c54bc2d32257182916277729a6943e95c9e0

Download Submit
C:\Windows\SysWOW64\Nmjfodne.exe

Filesize
45KB

MD5
ebdf9a1b568f83164ecea471a8df3bb4

SHA1
ec62516c496e67bf53eb0939b1b8d59b472e8f17

SHA256
967ef08480f79f98963ce8a54b62b4befe0822de028a2ba89128222e70351f77

SHA512
ea548d715de8b6def551277ce0463338b9d53c9b0e1915c0b24c2348b61bbf314a81a836997c26a7aab14588dd567bed0d5af9a9921790e76d28f5cdadf7e27b

Download Submit
C:\Windows\SysWOW64\Onapdl32.exe

Filesize
45KB

MD5
d86f160fa0eceba766348588bd61b6f0

SHA1
fcbd81eba8ecd245c5e8d1313096496e682462ab

SHA256
a5bac7437a970f6eed43a15554f751e74c0725db566b3dbcef987482dfbffe40

SHA512
463f71b30f194c18db8516f84bdcfb46c015d961a7095fe7f97e17e34530e5745fbca0721e186670ac6f0db67d3190afedbd811982da009130bae295ec8b36d3

Download Submit
memory/400-358-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/456-176-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/484-286-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/488-79-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/716-256-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/740-104-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/904-352-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/968-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1088-162-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1108-316-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1360-382-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1388-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1396-144-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1408-95-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1540-31-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1636-39-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1652-274-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1788-168-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1816-201-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2132-48-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2172-23-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2332-280-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2504-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2780-388-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2832-224-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3032-322-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3080-127-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3088-262-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3116-152-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3120-298-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3316-268-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3428-304-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3552-232-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3820-292-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3852-334-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3888-346-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4012-376-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4112-120-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4152-247-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4456-88-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4472-212-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4480-340-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4512-310-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4524-370-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4560-239-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4632-328-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4672-188-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4740-136-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4792-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4860-216-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4900-191-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4980-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5004-364-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5008-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5036-112-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5128-394-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5172-400-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5212-406-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5256-412-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5296-418-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5344-424-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5384-430-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5424-436-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5464-442-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads