41e92de3ba3aaff85e9929088e16124385c92be5a5dd1aa4982a2edf0438da66

Analysis

max time kernel
144s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41e92de3ba3aaff85e9929088e16124385c92be5a5dd1aa4982a2edf0438da66.exe
Size

128KB
MD5

594dc1d592d5b69a71fc3a5dd4ae2213
SHA1

da007bdc2c76323733d3f4e46c8e530b66158ae9
SHA256

41e92de3ba3aaff85e9929088e16124385c92be5a5dd1aa4982a2edf0438da66
SHA512

a33a96fa189bbb4f2508c5c999bb5a22683de6a38583a840092c1fa8b9c9781986808104a3694c2304a5422c87d8f796bdfedc8aa697a5d3cf8eabd5b33328b2
SSDEEP

3072:uaG0722kbEE1KseugB66bDrLXfzoeqarm9mTKpAImA:uaja2AKsevB9vXfxqySSKpRmA

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Efjbcakl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjjbjd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emeoooml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fggfnc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aokcklid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmbbhkjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lnangaoa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inmpcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Inmpcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Anmfbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jghpbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcikgacl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfjka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmbhoeid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpfgmnfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apaadpng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbgcih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcfahbpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdkoch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aknifq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hnddgjbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngomin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfngdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dlkbjqgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jncoikmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Peahgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qlgpod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aknifq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jcikgacl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fahaplon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjomap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcclld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hkfglb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idkkpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kgkfnh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibkpcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Injmcmej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pehngkcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iokgal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cimcan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ghpocngo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jjdjoane.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bgpgng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgnbdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qlgpod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cgmhcaac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ggqida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lhmmjbkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcnqpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fjhacf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ifdonfka.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oafcqcea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkdcbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcimdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpnbog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdpbon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgonlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dcogje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qhjmdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbajbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpdhkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djfcaohp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Haoimcgg.exe

Executes dropped EXE 64 IoCs

pid	Process
2908	Cabfga32.exe
744	Cfpnph32.exe
564	Chokikeb.exe
540	Cagobalc.exe
3328	Cnkplejl.exe
2504	Chcddk32.exe
2416	Djdmffnn.exe
3796	Dhhnpjmh.exe
2488	Delnin32.exe
2468	Daconoae.exe
4000	Dkkcge32.exe
2732	Daekdooc.exe
2300	Dknpmdfc.exe
4512	Edfdej32.exe
4828	Edhakj32.exe
1836	Ealadnik.exe
1332	Emcbio32.exe
4932	Ehiffh32.exe
3264	Emeoooml.exe
688	Eoekia32.exe
4372	Fkllnbjc.exe
1432	Fafdkmap.exe
2364	Fahaplon.exe
3576	Fhbimf32.exe
2568	Fefjfked.exe
4404	Fggfnc32.exe
1848	Fehfljca.exe
2064	Fkeodaai.exe
4216	Ghklce32.exe
2704	Ggqida32.exe
2836	Gfbibikg.exe
1952	Ggcfja32.exe
2924	Gfdfgiid.exe
2176	Gkaopp32.exe
2980	Hakgmjoh.exe
3700	Hghoeqmp.exe
3280	Hbmcbime.exe
456	Hhgloc32.exe
4576	Hnddgjbj.exe
1304	Hdnldd32.exe
3632	Hocqam32.exe
4840	Hfningai.exe
4076	Hdbfodfa.exe
3820	Hkmnln32.exe
4084	Ibffhhek.exe
4236	Ihqoeb32.exe
3924	Iokgal32.exe
5032	Ifdonfka.exe
5088	Ikaggmii.exe
1336	Ibkpcg32.exe
3528	Ighhln32.exe
2964	Igjeanmj.exe
3720	Indmnh32.exe
5144	Igmagnkg.exe
5188	Jngjch32.exe
5224	Jeqbpb32.exe
5268	Jgonlm32.exe
5308	Jbdbjf32.exe
5348	Jiokfpph.exe
5408	Joiccj32.exe
5452	Jehhaaci.exe
5492	Jblijebc.exe
5536	Klfjijgq.exe
5576	Kijjbofj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fhbimf32.exe	Fahaplon.exe
File opened for modification	C:\Windows\SysWOW64\Kjgeedch.exe	Kgiiiidd.exe
File created	C:\Windows\SysWOW64\Ojjhjm32.dll	Paiogf32.exe
File created	C:\Windows\SysWOW64\Dapgni32.dll	Ahdpjn32.exe
File created	C:\Windows\SysWOW64\Kpqggh32.exe	Hbldphde.exe
File created	C:\Windows\SysWOW64\Gcbpne32.dll	Mhdckaeo.exe
File created	C:\Windows\SysWOW64\Igfclkdj.exe	Ilqoobdd.exe
File opened for modification	C:\Windows\SysWOW64\Omgmeigd.exe	Lncjlq32.exe
File opened for modification	C:\Windows\SysWOW64\Qfmmplad.exe	Qhjmdp32.exe
File created	C:\Windows\SysWOW64\Dbfpagon.dll	Aogbfi32.exe
File opened for modification	C:\Windows\SysWOW64\Kelkaj32.exe	Kjffdalb.exe
File opened for modification	C:\Windows\SysWOW64\Hpjmnjqn.exe	Fbfcmhpg.exe
File opened for modification	C:\Windows\SysWOW64\Llmhaold.exe	Lnjgfb32.exe
File created	C:\Windows\SysWOW64\Amnlme32.exe	Akpoaj32.exe
File created	C:\Windows\SysWOW64\Akblfj32.exe	Ahdpjn32.exe
File created	C:\Windows\SysWOW64\Nlhlkhcm.dll	Ngomin32.exe
File opened for modification	C:\Windows\SysWOW64\Kqbkfkal.exe	Kgjgne32.exe
File created	C:\Windows\SysWOW64\Nijeec32.exe	Nobdbkhf.exe
File created	C:\Windows\SysWOW64\Jiiicf32.exe	Jocefm32.exe
File opened for modification	C:\Windows\SysWOW64\Ibkpcg32.exe	Ikaggmii.exe
File created	C:\Windows\SysWOW64\Ogpepl32.exe	Opcqnb32.exe
File created	C:\Windows\SysWOW64\Jjafok32.exe	Jgbjbp32.exe
File created	C:\Windows\SysWOW64\Jpmcbhlp.dll	Qachgk32.exe
File created	C:\Windows\SysWOW64\Jgmjmjnb.exe	Jiiicf32.exe
File created	C:\Windows\SysWOW64\Apmhiq32.exe	Amnlme32.exe
File created	C:\Windows\SysWOW64\Dmpfbk32.exe	Ccgajfeh.exe
File opened for modification	C:\Windows\SysWOW64\Jnmijq32.exe	Jkomneim.exe
File opened for modification	C:\Windows\SysWOW64\Bkdcbd32.exe	Bcfahbpo.exe
File created	C:\Windows\SysWOW64\Fbfcmhpg.exe	Fdqfll32.exe
File created	C:\Windows\SysWOW64\Bqbijpeo.dll	Kkconn32.exe
File opened for modification	C:\Windows\SysWOW64\Pomgjn32.exe	Pedbahod.exe
File created	C:\Windows\SysWOW64\Mhdckaeo.exe	Mlkepaam.exe
File opened for modification	C:\Windows\SysWOW64\Fpgpgfmh.exe	Fmhdkknd.exe
File opened for modification	C:\Windows\SysWOW64\Mhdckaeo.exe	Mlkepaam.exe
File created	C:\Windows\SysWOW64\Jejechjg.dll	Flinkojm.exe
File created	C:\Windows\SysWOW64\Poliea32.exe	Phaahggp.exe
File opened for modification	C:\Windows\SysWOW64\Gfhndpol.exe	Gpnfge32.exe
File created	C:\Windows\SysWOW64\Kbqceofn.dll	Bhhiemoj.exe
File created	C:\Windows\SysWOW64\Hikemehi.dll	Cggimh32.exe
File created	C:\Windows\SysWOW64\Qlmgopjq.exe	Qoifflkg.exe
File created	C:\Windows\SysWOW64\Gpcpak32.dll	Efffmo32.exe
File created	C:\Windows\SysWOW64\Cgaaeham.dll	Hdilnojp.exe
File opened for modification	C:\Windows\SysWOW64\Dlieda32.exe	Dikihe32.exe
File created	C:\Windows\SysWOW64\Afpjel32.exe	Qdaniq32.exe
File created	C:\Windows\SysWOW64\Edhakj32.exe	Edfdej32.exe
File created	C:\Windows\SysWOW64\Aaafckfg.dll	Emcbio32.exe
File opened for modification	C:\Windows\SysWOW64\Ggqida32.exe	Ghklce32.exe
File opened for modification	C:\Windows\SysWOW64\Hkmnln32.exe	Hdbfodfa.exe
File created	C:\Windows\SysWOW64\Dfokdq32.dll	Hajpbckl.exe
File opened for modification	C:\Windows\SysWOW64\Dbcmakpl.exe	Dlieda32.exe
File created	C:\Windows\SysWOW64\Cfpnph32.exe	Cabfga32.exe
File opened for modification	C:\Windows\SysWOW64\Pkcadhgm.exe	Pibdmp32.exe
File opened for modification	C:\Windows\SysWOW64\Paoollik.exe	Popbpqjh.exe
File opened for modification	C:\Windows\SysWOW64\Fkeodaai.exe	Fehfljca.exe
File created	C:\Windows\SysWOW64\Bfqkddfd.exe	Aijnep32.exe
File created	C:\Windows\SysWOW64\Hplfookn.dll	Hpfcdojl.exe
File created	C:\Windows\SysWOW64\Fpbfpack.dll	Jqdoem32.exe
File opened for modification	C:\Windows\SysWOW64\Bobabg32.exe	Bhhiemoj.exe
File opened for modification	C:\Windows\SysWOW64\Hakgmjoh.exe	Gkaopp32.exe
File created	C:\Windows\SysWOW64\Iokgal32.exe	Ihqoeb32.exe
File opened for modification	C:\Windows\SysWOW64\Fibojhim.exe	Fgdbnmji.exe
File created	C:\Windows\SysWOW64\Oilbhkaa.dll	Hnfjbdmk.exe
File created	C:\Windows\SysWOW64\Cglblmfn.dll	Aafemk32.exe
File opened for modification	C:\Windows\SysWOW64\Pfandnla.exe	Paeelgnj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7048	5940	WerFault.exe	579

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pkcadhgm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jcdala32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fbgihaji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hkmnln32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Giqkkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbbmaq32.dll"	Edhakj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kkpbin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pkgcea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdmkhgho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fpbflg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojmjcf32.dll"	Gpnfge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbfpagon.dll"	Aogbfi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hnddgjbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jkjcbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmnogj32.dll"	Olanmgig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oboijgbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbandhne.dll"	Qacameaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ifdonfka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Podmkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oidhlb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jnelok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emhgcipb.dll"	Pdmkhgho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Flfkkhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ljqhkckn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pomgjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nocckb32.dll"	Ejdocm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lehagi32.dll"	Fgdbnmji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hkfglb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdnacn32.dll"	Paoollik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnffoibg.dll"	Omgmeigd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oabhfg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jgonlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fibojhim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aokcklid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fgdbnmji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hclnnc32.dll"	Fbajbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jjafok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kcidmkpq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ibkpcg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jehhaaci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Llpmoiof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbqceofn.dll"	Bhhiemoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pcjiff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Peahgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Llmhaold.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jeqbpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kelkaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kbddfmgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pnfiplog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aknbkjfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnpckhnk.dll"	Lpgmhg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fjhacf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Phdnngdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gpnfge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Injmcmej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pkbjjbda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckbcpc32.dll"	Panhbfep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkoaeldi.dll"	Bhpofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eddbpnlg.dll"	Indmnh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmpfbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Injmcmej.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2908	2040	41e92de3ba3aaff85e9929088e16124385c92be5a5dd1aa4982a2edf0438da66.exe	95
PID 2040 wrote to memory of 2908	2040	41e92de3ba3aaff85e9929088e16124385c92be5a5dd1aa4982a2edf0438da66.exe	95
PID 2040 wrote to memory of 2908	2040	41e92de3ba3aaff85e9929088e16124385c92be5a5dd1aa4982a2edf0438da66.exe	95
PID 2908 wrote to memory of 744	2908	Cabfga32.exe	96
PID 2908 wrote to memory of 744	2908	Cabfga32.exe	96
PID 2908 wrote to memory of 744	2908	Cabfga32.exe	96
PID 744 wrote to memory of 564	744	Cfpnph32.exe	98
PID 744 wrote to memory of 564	744	Cfpnph32.exe	98
PID 744 wrote to memory of 564	744	Cfpnph32.exe	98
PID 564 wrote to memory of 540	564	Chokikeb.exe	99
PID 564 wrote to memory of 540	564	Chokikeb.exe	99
PID 564 wrote to memory of 540	564	Chokikeb.exe	99
PID 540 wrote to memory of 3328	540	Cagobalc.exe	100
PID 540 wrote to memory of 3328	540	Cagobalc.exe	100
PID 540 wrote to memory of 3328	540	Cagobalc.exe	100
PID 3328 wrote to memory of 2504	3328	Cnkplejl.exe	101
PID 3328 wrote to memory of 2504	3328	Cnkplejl.exe	101
PID 3328 wrote to memory of 2504	3328	Cnkplejl.exe	101
PID 2504 wrote to memory of 2416	2504	Chcddk32.exe	102
PID 2504 wrote to memory of 2416	2504	Chcddk32.exe	102
PID 2504 wrote to memory of 2416	2504	Chcddk32.exe	102
PID 2416 wrote to memory of 3796	2416	Djdmffnn.exe	103
PID 2416 wrote to memory of 3796	2416	Djdmffnn.exe	103
PID 2416 wrote to memory of 3796	2416	Djdmffnn.exe	103
PID 3796 wrote to memory of 2488	3796	Dhhnpjmh.exe	105
PID 3796 wrote to memory of 2488	3796	Dhhnpjmh.exe	105
PID 3796 wrote to memory of 2488	3796	Dhhnpjmh.exe	105
PID 2488 wrote to memory of 2468	2488	Delnin32.exe	106
PID 2488 wrote to memory of 2468	2488	Delnin32.exe	106
PID 2488 wrote to memory of 2468	2488	Delnin32.exe	106
PID 2468 wrote to memory of 4000	2468	Daconoae.exe	107
PID 2468 wrote to memory of 4000	2468	Daconoae.exe	107
PID 2468 wrote to memory of 4000	2468	Daconoae.exe	107
PID 4000 wrote to memory of 2732	4000	Dkkcge32.exe	108
PID 4000 wrote to memory of 2732	4000	Dkkcge32.exe	108
PID 4000 wrote to memory of 2732	4000	Dkkcge32.exe	108
PID 2732 wrote to memory of 2300	2732	Daekdooc.exe	109
PID 2732 wrote to memory of 2300	2732	Daekdooc.exe	109
PID 2732 wrote to memory of 2300	2732	Daekdooc.exe	109
PID 2300 wrote to memory of 4512	2300	Dknpmdfc.exe	110
PID 2300 wrote to memory of 4512	2300	Dknpmdfc.exe	110
PID 2300 wrote to memory of 4512	2300	Dknpmdfc.exe	110
PID 4512 wrote to memory of 4828	4512	Edfdej32.exe	111
PID 4512 wrote to memory of 4828	4512	Edfdej32.exe	111
PID 4512 wrote to memory of 4828	4512	Edfdej32.exe	111
PID 4828 wrote to memory of 1836	4828	Edhakj32.exe	112
PID 4828 wrote to memory of 1836	4828	Edhakj32.exe	112
PID 4828 wrote to memory of 1836	4828	Edhakj32.exe	112
PID 1836 wrote to memory of 1332	1836	Ealadnik.exe	113
PID 1836 wrote to memory of 1332	1836	Ealadnik.exe	113
PID 1836 wrote to memory of 1332	1836	Ealadnik.exe	113
PID 1332 wrote to memory of 4932	1332	Emcbio32.exe	114
PID 1332 wrote to memory of 4932	1332	Emcbio32.exe	114
PID 1332 wrote to memory of 4932	1332	Emcbio32.exe	114
PID 4932 wrote to memory of 3264	4932	Ehiffh32.exe	115
PID 4932 wrote to memory of 3264	4932	Ehiffh32.exe	115
PID 4932 wrote to memory of 3264	4932	Ehiffh32.exe	115
PID 3264 wrote to memory of 688	3264	Emeoooml.exe	116
PID 3264 wrote to memory of 688	3264	Emeoooml.exe	116
PID 3264 wrote to memory of 688	3264	Emeoooml.exe	116
PID 688 wrote to memory of 4372	688	Eoekia32.exe	117
PID 688 wrote to memory of 4372	688	Eoekia32.exe	117
PID 688 wrote to memory of 4372	688	Eoekia32.exe	117
PID 4372 wrote to memory of 1432	4372	Fkllnbjc.exe	118

C:\Users\Admin\AppData\Local\Temp\41e92de3ba3aaff85e9929088e16124385c92be5a5dd1aa4982a2edf0438da66.exe
"C:\Users\Admin\AppData\Local\Temp\41e92de3ba3aaff85e9929088e16124385c92be5a5dd1aa4982a2edf0438da66.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\Cabfga32.exe
  C:\Windows\system32\Cabfga32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\SysWOW64\Cfpnph32.exe
    C:\Windows\system32\Cfpnph32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:744
  - - C:\Windows\SysWOW64\Chokikeb.exe
      C:\Windows\system32\Chokikeb.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:564
    - - C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:540
      - C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2488
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\SysWOW64\Edfdej32.exe
        
        C:\Windows\system32\Edfdej32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SysWOW64\Edhakj32.exe
        
        C:\Windows\system32\Edhakj32.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4828
        
        C:\Windows\SysWOW64\Ealadnik.exe
        
        C:\Windows\system32\Ealadnik.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\SysWOW64\Emcbio32.exe
        
        C:\Windows\system32\Emcbio32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1332
        
        C:\Windows\SysWOW64\Ehiffh32.exe
        
        C:\Windows\system32\Ehiffh32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\SysWOW64\Emeoooml.exe
        
        C:\Windows\system32\Emeoooml.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\SysWOW64\Eoekia32.exe
        
        C:\Windows\system32\Eoekia32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:688
        
        C:\Windows\SysWOW64\Fkllnbjc.exe
        
        C:\Windows\system32\Fkllnbjc.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4372
        
        C:\Windows\SysWOW64\Fafdkmap.exe
        
        C:\Windows\system32\Fafdkmap.exe
        23⤵
        Executes dropped EXE
        
        PID:1432
        
        C:\Windows\SysWOW64\Fahaplon.exe
        
        C:\Windows\system32\Fahaplon.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2364
        
        C:\Windows\SysWOW64\Fhbimf32.exe
        
        C:\Windows\system32\Fhbimf32.exe
        25⤵
        Executes dropped EXE
        
        PID:3576
        
        C:\Windows\SysWOW64\Fefjfked.exe
        
        C:\Windows\system32\Fefjfked.exe
        26⤵
        Executes dropped EXE
        
        PID:2568
        
        C:\Windows\SysWOW64\Fggfnc32.exe
        
        C:\Windows\system32\Fggfnc32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4404
        
        C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1848
        
        C:\Windows\SysWOW64\Fkeodaai.exe
        
        C:\Windows\system32\Fkeodaai.exe
        29⤵
        Executes dropped EXE
        
        PID:2064
        
        C:\Windows\SysWOW64\Ghklce32.exe
        
        C:\Windows\system32\Ghklce32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4216
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2704
        
        C:\Windows\SysWOW64\Gfbibikg.exe
        
        C:\Windows\system32\Gfbibikg.exe
        32⤵
        Executes dropped EXE
        
        PID:2836
        
        C:\Windows\SysWOW64\Ggcfja32.exe
        
        C:\Windows\system32\Ggcfja32.exe
        33⤵
        Executes dropped EXE
        
        PID:1952
        
        C:\Windows\SysWOW64\Gfdfgiid.exe
        
        C:\Windows\system32\Gfdfgiid.exe
        34⤵
        Executes dropped EXE
        
        PID:2924
        
        C:\Windows\SysWOW64\Gkaopp32.exe
        
        C:\Windows\system32\Gkaopp32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2176
        
        C:\Windows\SysWOW64\Hakgmjoh.exe
        
        C:\Windows\system32\Hakgmjoh.exe
        36⤵
        Executes dropped EXE
        
        PID:2980
        
        C:\Windows\SysWOW64\Hghoeqmp.exe
        
        C:\Windows\system32\Hghoeqmp.exe
        37⤵
        Executes dropped EXE
        
        PID:3700
        
        C:\Windows\SysWOW64\Hbmcbime.exe
        
        C:\Windows\system32\Hbmcbime.exe
        38⤵
        Executes dropped EXE
        
        PID:3280
        
        C:\Windows\SysWOW64\Hhgloc32.exe
        
        C:\Windows\system32\Hhgloc32.exe
        39⤵
        Executes dropped EXE
        
        PID:456
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4576
        
        C:\Windows\SysWOW64\Hdnldd32.exe
        
        C:\Windows\system32\Hdnldd32.exe
        41⤵
        Executes dropped EXE
        
        PID:1304
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        42⤵
        Executes dropped EXE
        
        PID:3632
        
        C:\Windows\SysWOW64\Hfningai.exe
        
        C:\Windows\system32\Hfningai.exe
        43⤵
        Executes dropped EXE
        
        PID:4840
        
        C:\Windows\SysWOW64\Hdbfodfa.exe
        
        C:\Windows\system32\Hdbfodfa.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4076
        
        C:\Windows\SysWOW64\Hkmnln32.exe
        
        C:\Windows\system32\Hkmnln32.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3820
        
        C:\Windows\SysWOW64\Ibffhhek.exe
        
        C:\Windows\system32\Ibffhhek.exe
        46⤵
        Executes dropped EXE
        
        PID:4084
        
        C:\Windows\SysWOW64\Ihqoeb32.exe
        
        C:\Windows\system32\Ihqoeb32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4236
        
        C:\Windows\SysWOW64\Iokgal32.exe
        
        C:\Windows\system32\Iokgal32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3924
        
        C:\Windows\SysWOW64\Ifdonfka.exe
        
        C:\Windows\system32\Ifdonfka.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5032
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5088
        
        C:\Windows\SysWOW64\Ibkpcg32.exe
        
        C:\Windows\system32\Ibkpcg32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1336
        
        C:\Windows\SysWOW64\Ighhln32.exe
        
        C:\Windows\system32\Ighhln32.exe
        52⤵
        Executes dropped EXE
        
        PID:3528
        
        C:\Windows\SysWOW64\Igjeanmj.exe
        
        C:\Windows\system32\Igjeanmj.exe
        53⤵
        Executes dropped EXE
        
        PID:2964
        
        C:\Windows\SysWOW64\Indmnh32.exe
        
        C:\Windows\system32\Indmnh32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3720
        
        C:\Windows\SysWOW64\Igmagnkg.exe
        
        C:\Windows\system32\Igmagnkg.exe
        55⤵
        Executes dropped EXE
        
        PID:5144
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        56⤵
        Executes dropped EXE
        
        PID:5188
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Jgonlm32.exe
        
        C:\Windows\system32\Jgonlm32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Jbdbjf32.exe
        
        C:\Windows\system32\Jbdbjf32.exe
        59⤵
        Executes dropped EXE
        
        PID:5308
        
        C:\Windows\SysWOW64\Jiokfpph.exe
        
        C:\Windows\system32\Jiokfpph.exe
        60⤵
        Executes dropped EXE
        
        PID:5348
        
        C:\Windows\SysWOW64\Joiccj32.exe
        
        C:\Windows\system32\Joiccj32.exe
        61⤵
        Executes dropped EXE
        
        PID:5408
        
        C:\Windows\SysWOW64\Jehhaaci.exe
        
        C:\Windows\system32\Jehhaaci.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5452
        
        C:\Windows\SysWOW64\Jblijebc.exe
        
        C:\Windows\system32\Jblijebc.exe
        63⤵
        Executes dropped EXE
        
        PID:5492
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        64⤵
        Executes dropped EXE
        
        PID:5536
        
        C:\Windows\SysWOW64\Kijjbofj.exe
        
        C:\Windows\system32\Kijjbofj.exe
        65⤵
        Executes dropped EXE
        
        PID:5576
        
        C:\Windows\SysWOW64\Kbekqdjh.exe
        
        C:\Windows\system32\Kbekqdjh.exe
        66⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Kiodmn32.exe
        
        C:\Windows\system32\Kiodmn32.exe
        67⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        68⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        69⤵
        Modifies registry class
        
        PID:5752
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        70⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        71⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        72⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Mfaqhp32.exe
        
        C:\Windows\system32\Mfaqhp32.exe
        73⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Midfokpm.exe
        
        C:\Windows\system32\Midfokpm.exe
        74⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Mfhfhong.exe
        
        C:\Windows\system32\Mfhfhong.exe
        75⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Nhlpfgbb.exe
        
        C:\Windows\system32\Nhlpfgbb.exe
        76⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Niklpj32.exe
        
        C:\Windows\system32\Niklpj32.exe
        77⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6128
        
        C:\Windows\SysWOW64\Ngdfdmdi.exe
        
        C:\Windows\system32\Ngdfdmdi.exe
        79⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        80⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Ohgoaehe.exe
        
        C:\Windows\system32\Ohgoaehe.exe
        81⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Oigllh32.exe
        
        C:\Windows\system32\Oigllh32.exe
        82⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        83⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        84⤵
        Drops file in System32 directory
        
        PID:5480
        
        C:\Windows\SysWOW64\Ogpepl32.exe
        
        C:\Windows\system32\Ogpepl32.exe
        85⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Pedbahod.exe
        
        C:\Windows\system32\Pedbahod.exe
        86⤵
        Drops file in System32 directory
        
        PID:5624
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        87⤵
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        88⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\Pgflqkdd.exe
        
        C:\Windows\system32\Pgflqkdd.exe
        89⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        90⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Podmkm32.exe
        
        C:\Windows\system32\Podmkm32.exe
        91⤵
        Modifies registry class
        
        PID:5860
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        92⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Qljjjqlc.exe
        
        C:\Windows\system32\Qljjjqlc.exe
        93⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Qoifflkg.exe
        
        C:\Windows\system32\Qoifflkg.exe
        94⤵
        Drops file in System32 directory
        
        PID:6116
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        95⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Aokcklid.exe
        
        C:\Windows\system32\Aokcklid.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Acilajpk.exe
        
        C:\Windows\system32\Acilajpk.exe
        97⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        98⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        99⤵
        Drops file in System32 directory
        
        PID:5612
        
        C:\Windows\SysWOW64\Bfqkddfd.exe
        
        C:\Windows\system32\Bfqkddfd.exe
        100⤵
        
        PID:244
        
        C:\Windows\SysWOW64\Bgpgng32.exe
        
        C:\Windows\system32\Bgpgng32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4432
        
        C:\Windows\SysWOW64\Bjodjb32.exe
        
        C:\Windows\system32\Bjodjb32.exe
        102⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        103⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Bidqko32.exe
        
        C:\Windows\system32\Bidqko32.exe
        104⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Bfhadc32.exe
        
        C:\Windows\system32\Bfhadc32.exe
        105⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5340
        
        C:\Windows\SysWOW64\Cqpbglno.exe
        
        C:\Windows\system32\Cqpbglno.exe
        107⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4344
        
        C:\Windows\SysWOW64\Caghhk32.exe
        
        C:\Windows\system32\Caghhk32.exe
        109⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Cjomap32.exe
        
        C:\Windows\system32\Cjomap32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5940
        
        C:\Windows\SysWOW64\Ccgajfeh.exe
        
        C:\Windows\system32\Ccgajfeh.exe
        111⤵
        Drops file in System32 directory
        
        PID:5220
        
        C:\Windows\SysWOW64\Dmpfbk32.exe
        
        C:\Windows\system32\Dmpfbk32.exe
        112⤵
        Modifies registry class
        
        PID:5376
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5680
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        114⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        115⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Dmbbhkjf.exe
        
        C:\Windows\system32\Dmbbhkjf.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5468
        
        C:\Windows\SysWOW64\Dpqodfij.exe
        
        C:\Windows\system32\Dpqodfij.exe
        117⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Dhhfedil.exe
        
        C:\Windows\system32\Dhhfedil.exe
        118⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Djfcaohp.exe
        
        C:\Windows\system32\Djfcaohp.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5992
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        120⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\Dpckjfgg.exe
        
        C:\Windows\system32\Dpckjfgg.exe
        121⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6196
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        123⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        124⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        125⤵
        Drops file in System32 directory
        
        PID:6324
        
        C:\Windows\SysWOW64\Ealkjh32.exe
        
        C:\Windows\system32\Ealkjh32.exe
        126⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Edjgfcec.exe
        
        C:\Windows\system32\Edjgfcec.exe
        127⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Ejdocm32.exe
        
        C:\Windows\system32\Ejdocm32.exe
        128⤵
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Eangpgcl.exe
        
        C:\Windows\system32\Eangpgcl.exe
        129⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Ehjlaaig.exe
        
        C:\Windows\system32\Ehjlaaig.exe
        130⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        131⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        132⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        133⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Fgdbnmji.exe
        
        C:\Windows\system32\Fgdbnmji.exe
        134⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6724
        
        C:\Windows\SysWOW64\Fibojhim.exe
        
        C:\Windows\system32\Fibojhim.exe
        135⤵
        Modifies registry class
        
        PID:6772
        
        C:\Windows\SysWOW64\Fggocmhf.exe
        
        C:\Windows\system32\Fggocmhf.exe
        136⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Gnhnaf32.exe
        
        C:\Windows\system32\Gnhnaf32.exe
        137⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        138⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Ghpocngo.exe
        
        C:\Windows\system32\Ghpocngo.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6940
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        140⤵
        Modifies registry class
        
        PID:6984
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        141⤵
        Drops file in System32 directory
        
        PID:7020
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        142⤵
        Drops file in System32 directory
        
        PID:7076
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        143⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Haoimcgg.exe
        
        C:\Windows\system32\Haoimcgg.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5180
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        145⤵
        Drops file in System32 directory
        
        PID:6184
        
        C:\Windows\SysWOW64\Hdpbon32.exe
        
        C:\Windows\system32\Hdpbon32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6252
        
        C:\Windows\SysWOW64\Hpfcdojl.exe
        
        C:\Windows\system32\Hpfcdojl.exe
        147⤵
        Drops file in System32 directory
        
        PID:6308
        
        C:\Windows\SysWOW64\Igqkqiai.exe
        
        C:\Windows\system32\Igqkqiai.exe
        148⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        149⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Inmpcc32.exe
        
        C:\Windows\system32\Inmpcc32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6528
        
        C:\Windows\SysWOW64\Iqklon32.exe
        
        C:\Windows\system32\Iqklon32.exe
        151⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Ikcmbfcj.exe
        
        C:\Windows\system32\Ikcmbfcj.exe
        152⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        153⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        154⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        155⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        156⤵
        Drops file in System32 directory
        
        PID:6964
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        157⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        158⤵
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Jqiipljg.exe
        
        C:\Windows\system32\Jqiipljg.exe
        159⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        160⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        161⤵
        Drops file in System32 directory
        
        PID:6312
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        162⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Jdgafjpn.exe
        
        C:\Windows\system32\Jdgafjpn.exe
        163⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6672
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        165⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Kjffdalb.exe
        
        C:\Windows\system32\Kjffdalb.exe
        166⤵
        Drops file in System32 directory
        
        PID:6880
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        167⤵
        Modifies registry class
        
        PID:6952
        
        C:\Windows\SysWOW64\Kgjgne32.exe
        
        C:\Windows\system32\Kgjgne32.exe
        168⤵
        Drops file in System32 directory
        
        PID:7084
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        169⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        170⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        171⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        172⤵
        Modifies registry class
        
        PID:6676
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        173⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        174⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Lbkkgl32.exe
        
        C:\Windows\system32\Lbkkgl32.exe
        175⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        176⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Lgkpdcmi.exe
        
        C:\Windows\system32\Lgkpdcmi.exe
        177⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        178⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6804
        
        C:\Windows\SysWOW64\Mngegmbc.exe
        
        C:\Windows\system32\Mngegmbc.exe
        180⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        181⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        182⤵
        Drops file in System32 directory
        
        PID:1428
        
        C:\Windows\SysWOW64\Mhdckaeo.exe
        
        C:\Windows\system32\Mhdckaeo.exe
        183⤵
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        184⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        185⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        186⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        187⤵
        Drops file in System32 directory
        
        PID:7036
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        188⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        189⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Nbcjnilj.exe
        
        C:\Windows\system32\Nbcjnilj.exe
        190⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        191⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7324
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        193⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        194⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        195⤵
        Modifies registry class
        
        PID:7452
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        196⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        197⤵
        Modifies registry class
        
        PID:7540
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        198⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        199⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        200⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        201⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Oafcqcea.exe
        
        C:\Windows\system32\Oafcqcea.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7756
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        203⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Pkogiikb.exe
        
        C:\Windows\system32\Pkogiikb.exe
        204⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        205⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        206⤵
        Drops file in System32 directory
        
        PID:7944
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        207⤵
        Modifies registry class
        
        PID:7988
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        208⤵
        Modifies registry class
        
        PID:8036
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        209⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Pocfpf32.exe
        
        C:\Windows\system32\Pocfpf32.exe
        210⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        211⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        212⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7268
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        214⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        215⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        216⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        217⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        218⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        219⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7796
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        221⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        222⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8020
        
        C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8088
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        225⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        226⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        227⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        228⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        229⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Ccdnjp32.exe
        
        C:\Windows\system32\Ccdnjp32.exe
        230⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        231⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        232⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8116
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        234⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        235⤵
        Drops file in System32 directory
        
        PID:7420
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        236⤵
        Drops file in System32 directory
        
        PID:7700
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        237⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        238⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7228
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        240⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        241⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        242⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        243⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        244⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        245⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        246⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        247⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        248⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8368
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8416
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        251⤵
        Drops file in System32 directory
        
        PID:8480
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        252⤵
        Drops file in System32 directory
        
        PID:8552
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        253⤵
        Drops file in System32 directory
        
        PID:8596
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        254⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        255⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        256⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        257⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        258⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        259⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        260⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8948
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        262⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        263⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        264⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9128
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        266⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        267⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        268⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8300
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        270⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8464
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        272⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        273⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        274⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        275⤵
        Modifies registry class
        
        PID:8756
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8872
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        277⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        278⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        279⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        280⤵
        Modifies registry class
        
        PID:9156
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        281⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        282⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        283⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        284⤵
        Drops file in System32 directory
        
        PID:8540
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        285⤵
        Modifies registry class
        
        PID:8668
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        286⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        287⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9028
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        289⤵
        Modifies registry class
        
        PID:9124
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        290⤵
        Drops file in System32 directory
        
        PID:8356
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        291⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        292⤵
        Modifies registry class
        
        PID:8852
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        293⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        294⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        295⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        296⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        297⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        298⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        299⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        300⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9228
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        302⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        303⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        304⤵
        Drops file in System32 directory
        
        PID:9352
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        305⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        306⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        307⤵
        Modifies registry class
        
        PID:9488
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        308⤵
        Modifies registry class
        
        PID:9532
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        309⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9620
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9660
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        312⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        313⤵
        Drops file in System32 directory
        
        PID:9744
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        314⤵
        Modifies registry class
        
        PID:9784
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        315⤵
        Modifies registry class
        
        PID:9824
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        316⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        317⤵
        Modifies registry class
        
        PID:9920
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        318⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10016
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        320⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        321⤵
        Drops file in System32 directory
        
        PID:10100
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        322⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        323⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        324⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        325⤵
        Drops file in System32 directory
        
        PID:9252
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        326⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        327⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9480
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9512
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        330⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        331⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        332⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        333⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        334⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        335⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        336⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        337⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        338⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        339⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        340⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9524
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        342⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        343⤵
        Modifies registry class
        
        PID:9728
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        344⤵
        Modifies registry class
        
        PID:9860
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        345⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        346⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        347⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        348⤵
        Drops file in System32 directory
        
        PID:2480
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        349⤵
        
        PID:800
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        350⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        351⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        352⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        353⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        354⤵
        Modifies registry class
        
        PID:9684
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        355⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        356⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        357⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        358⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4444
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        359⤵
        
        PID:3268
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        360⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        361⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        362⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        363⤵
        Drops file in System32 directory
        
        PID:9520
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        364⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        365⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        366⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2132
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2788
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        369⤵
        Drops file in System32 directory
        
        PID:4476
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        370⤵
        Drops file in System32 directory
        
        PID:64
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        371⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        372⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        373⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        374⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        375⤵
        
        PID:772
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        376⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        377⤵
        Modifies registry class
        
        PID:1624
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        378⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        379⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        380⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        381⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        382⤵
        
        PID:928
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        383⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        384⤵
        Drops file in System32 directory
        
        PID:4292
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        385⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        386⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        387⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2472
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4780
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        390⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        391⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        392⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2980
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        393⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5552
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        395⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        396⤵
        Drops file in System32 directory
        
        PID:9852
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        397⤵
        Modifies registry class
        
        PID:5032
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        398⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        399⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        400⤵
        Modifies registry class
        
        PID:1260
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        401⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5456
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        403⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        404⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        405⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        406⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5768
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        408⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        409⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        410⤵
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        411⤵
        Modifies registry class
        
        PID:5580
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        412⤵
        Modifies registry class
        
        PID:3120
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        413⤵
        
        PID:876
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        414⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        415⤵
        Modifies registry class
        
        PID:4644
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        416⤵
        Drops file in System32 directory
        
        PID:2292
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        417⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        418⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        419⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        420⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        421⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        422⤵
        Drops file in System32 directory
        
        PID:5384
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        423⤵
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        424⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        425⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        426⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        427⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        428⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1224
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        429⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        430⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        431⤵
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        432⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        433⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        434⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5360
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        435⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        436⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        437⤵
        Modifies registry class
        
        PID:4600
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        438⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        439⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        440⤵
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        441⤵
        Drops file in System32 directory
        
        PID:5636
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        442⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        443⤵
        Drops file in System32 directory
        
        PID:6584
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        444⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        445⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        446⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        447⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        448⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3416
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        450⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5860
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        451⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        452⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        453⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        454⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        455⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        456⤵
        Modifies registry class
        
        PID:1652
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        457⤵
        
        PID:856
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        458⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        459⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        460⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        461⤵
        Drops file in System32 directory
        
        PID:5544
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        462⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        463⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        464⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        465⤵
        Drops file in System32 directory
        
        PID:5564
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        466⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        467⤵
        Modifies registry class
        
        PID:6740
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        468⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        469⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        470⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Cgmhcaac.exe
        
        C:\Windows\system32\Cgmhcaac.exe
        471⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6264
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        472⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        473⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 412
        474⤵
        Program crash
        
        PID:7048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1688 --field-trial-handle=2264,i,13734085038406049477,12426093271221802693,262144 --variations-seed-version /prefetch:8
1⤵
PID:5996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5940 -ip 5940
1⤵
PID:244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aggegh32.exe

Filesize
128KB

MD5
bcbcdeb9ac7a174bdb66d67a8e515646

SHA1
975e820c73b6490d48fc080d14f042398215a08a

SHA256
52c8722cf1e13b414d366e651423d4efb57bab54cd3c6627fe931cbe32a6bcd4

SHA512
df1c3602b7ba6b5a2aa372771fc0de6c7e486d124b8e4b0126d038d02fa01c162678f7b4dabd0fd337f348de502a98b897ec26469006bc059204f966468352af

Download Submit
C:\Windows\SysWOW64\Ajpqnneo.exe

Filesize
128KB

MD5
69e30e3911c8875e5f6d042b66c304a8

SHA1
3dce323520e72ca0f2f14cff5baf35bb6f468775

SHA256
c80b121fdad4c6501db18a88fcefcf7cbd0207528598cd3744ab74e17dbb5ab8

SHA512
53c692a69c5e5d35216269437a250b67e5a2836696e161503d0a64cd44a1fa5ff68b12d4b692be9ae428dbdb9c6a412879cf33c0c136d5b90458ea2b7d4abffa

Download Submit
C:\Windows\SysWOW64\Bcfahbpo.exe

Filesize
128KB

MD5
81c7264de8090f758784a58be13efa6d

SHA1
5d678ea0db77d76e374dcf6ed81fd40db3678fef

SHA256
07d7913982590196069671ee79d0b3cb5f1f1eea3edec11376e5c04f4f8999b1

SHA512
9c96e9c8ffa2ccdfee6f5505ef239ca79289333c2886e7f3e19a6a837ca08efb6e7ad4a24183cdd0a6e5d86a26483c4ccc4f5dfa126f489dddb79dc42a68d44f

Download Submit
C:\Windows\SysWOW64\Bfqkddfd.exe

Filesize
128KB

MD5
828507108c1bca5841b599ac603d7ada

SHA1
1367e3b6f9b560533a4e16c79d1a850c6918c67b

SHA256
af12e72759a6c898a30eaa6c58187e4fe1deeab32b56a950fba4099d5a29df3f

SHA512
64f770e420f200f58b7219b135b0671cdd58f1b69b87e2ca147e2de097777f7a155fcab1769930a796d83d6c4890c028e344eef45f3d5eb938861b13cc8d370b

Download Submit
C:\Windows\SysWOW64\Cabfga32.exe

Filesize
128KB

MD5
b94130cfa4f90cfb0df60a39f347f91e

SHA1
d6c0068df0ba95cd0a628e32563cd80c0571813f

SHA256
a61c3b7193a5c3a62fa449a38970a5e01d4e835585b6f9f5b7618fdcdb3cde69

SHA512
9660240e91d3fad093c51723ef206f53075aca177d0e8f4f762d6ed42ca64a814b9557707c6dbe0af9988be9891d725f973fe4c671889c65e4f20fad27b1c631

Download Submit
C:\Windows\SysWOW64\Caghhk32.exe

Filesize
128KB

MD5
392594d0dd02a72e773aec7213da5585

SHA1
13794c41074b2120548778c944a2377ca1b99e6d

SHA256
0bfe48515dda487c31bd567f6c0ac551e08bc339836e644eed6cdfcb095fc8fb

SHA512
62957e51439ffb88a38aed4906ec5336a63e4a7dc4cd53b9c92a6395fb21a7b2a9fd93bbcd4c8a16f47f64319559502374cca5b1e73f36b5e9287d90d6c620e4

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
128KB

MD5
d21bdaf903f0425dc3ae5a691dfa5352

SHA1
5972d51cc8bf5dcb2a8b379627757793d418d06a

SHA256
307b34909437bc8c9a0a53e3e610b47d371fa1a62a6b092786a886d334f6db0f

SHA512
08a7618515fd4d88483a10a246e2abdf9082c485ecd92b6a2b2a430fcce3c48c77c187db7ace5182419fa8f7cbf56e95a0df9e26164102dc0f18bf5fe0a92190

Download Submit
C:\Windows\SysWOW64\Cfpnph32.exe

Filesize
128KB

MD5
0961e2aa70ca195af4afb2cf77bed6fc

SHA1
f7d3e7275e9d3c179588e0fe284e6e4e97da3ea8

SHA256
f683d086f872fe195ef53fcf41e6d780da26b7abfcfb7a6ca80b68cf9e69299b

SHA512
b628de7a1469a60044a4ed6b2a53608f6fcbc5537f5acde0c80bb0e33607dca9ca118f661155529fb883e2b380230422ad1d014a0dc78e22eec02761c53cf157

Download Submit
C:\Windows\SysWOW64\Chcddk32.exe

Filesize
128KB

MD5
5021fa31e251a715043ecef66ce276da

SHA1
23ad4aece4587d59187d14cb50063bf245836221

SHA256
c44fe70662845ca3d1ea041cf6092e33e89de0e01efc6127a1b62350ce67f6cb

SHA512
7073094333359dcaa7bd0aa9d2064a27958c207e615f94bf180354ddd1e55ff5e71d1827ad796369d976c2569b92f61339f7bee22cf564151913d6c3bd424d2b

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
128KB

MD5
b3956aaa62c48042c1bf748c31936f1b

SHA1
7c91f4c2964c911650283084c556e7c9e1c8e00c

SHA256
67693d1698538f953e8133dca5433b4bca9b338d9a75aaee3f5a5f8ea0278cd1

SHA512
729ba3cb112468896356cebc66ea393ea29f158fc7bfa865177002c5f9f30fef8f1d9f3baa0aeee647a58c7b65e941aa34fadaba9df6e57b517821b24bbd9b08

Download Submit
C:\Windows\SysWOW64\Cnkplejl.exe

Filesize
128KB

MD5
9220b6d46e0fafc8b88fb9e70062f4f4

SHA1
56247cc5d387ccb1bfd7e82b3390bbfab9be329e

SHA256
622e4e5c6f7b15ae30eac8f5f485ae789198609c7b616cb2c19ac150af2c2fe4

SHA512
8ecbf9c25033f6c1b8b5e4aec539ce0d6bbb902c4012a9b774c9f73947b882c3de82a67b6c8043f8e4d30428f20678f313c5f35d3c25a79dcf16b0a1e46ade23

Download Submit
C:\Windows\SysWOW64\Cqpbglno.exe

Filesize
128KB

MD5
4ce29b750919d11c4b50e7db53846182

SHA1
4c647ddf35e11089796c27d2b3cc52308e4a59f0

SHA256
e06666720df65849e42ec2eae4274a0d51e9d715bf3a413e47c819477d9bd062

SHA512
d4a26422a65dd0ddaedc8179bd001fb681b38963acfa456cd559f1db9c6d09f77706bb9866cd13a552d724938863f47f2b037f6a71ed3f73790d1e8afa7e848b

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
128KB

MD5
610d85025d5c50cdd940545c8472cf6d

SHA1
739aa8f44f62c9b98eb91b192dd8f9b6fae1193e

SHA256
41c4ef17655613f520d7a5cc7a81f33bc5fd87652a576e062bc831cb197866d8

SHA512
35246e19b7f7ff835f2d308609363fd2a8987aea891d8c4f1fba55ee4365062d616ae02f88ee79a4ea46f698446c00647d0c46f022b6983f7f0783b918bfb1a7

Download Submit
C:\Windows\SysWOW64\Daekdooc.exe

Filesize
128KB

MD5
37323bc8c6823bc7233a9bf61bde800f

SHA1
21bf2a9f35fc53416a8f041b9ad5487301dd3e99

SHA256
0a6b92e5528889d6f31fd9c639cc44fd25459a36cce5e1cca48cc99a19e7efab

SHA512
20b4635edb7995ce224adb99e672127524a665ab0c4570b9ca5193e439db33254e5cb0453a84030cbfbf8f692d3dd3c61ae7c470ecd6f6e628e7329e8adc8412

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
128KB

MD5
eb77fcf02edb1649f14758eaef9df03a

SHA1
f37e5b0fa92d850b63faa125cdd3fe6ee06e1e0d

SHA256
bbf09d7fa9f0615837921c7480f13c331c3538c47602bddd034c634e5a936a27

SHA512
2472c33db2d5a1fceb347a072344cd869b3aca673176d8865968a77f3f52e4c705ea58f8e43e64c7719c13891e7020edecc3045559d7094c2532035639ce53f5

Download Submit
C:\Windows\SysWOW64\Dhhnpjmh.exe

Filesize
128KB

MD5
7f6a0cda4bef45acf7142d81b8310e92

SHA1
e239dc2c3750b71701dc8b145792596a77de4017

SHA256
c354a80e2e0551955be11ab6fa90f1a03a0c400a6fc644036d3b3edb49d098e1

SHA512
236331ca290afc25744d93cee6632c1d3bd9f7398f38a1c1a6188358d1959e11354fcbc408bb2d30b907770ab2312754d829c112af0c4a3da982da1fa3c20a81

Download Submit
C:\Windows\SysWOW64\Djdmffnn.exe

Filesize
128KB

MD5
4f3199a767a9810fd6aef8ce426106fc

SHA1
27b079fcd0883b17e5fa6e7d10e6a9287506ca03

SHA256
a8040354b9cd91f571d73a98018eb627bc06e3ba19210c98642bffffce835f6c

SHA512
36d8a0d89b3ba971228842bbd8bb840307a0ec9ae022edad53baa681c3aa6de45298776eb18f674f6819d6da4bb30d1339f8702a794c099c90e473e9477b850e

Download Submit
C:\Windows\SysWOW64\Dkkcge32.exe

Filesize
128KB

MD5
e9fcf97f8151409d2b3898a905a30677

SHA1
69ed71d5d82b77593bf8f6c9954b8094c2cbeb06

SHA256
1ed7cd16842bdfb5fa95d2b562cf01f2336a9eea69c47478d2b1ad5f5c1b124c

SHA512
1ba5454ca60b41ef31c794f916c17584466f63cb517d69e142b735cd5afa7e918fa15d754cc7466d902e803a815ea163b46f1c51817e782a58cbd6fd0a416777

Download Submit
C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
128KB

MD5
f2386b95262dcaa5163ad51e889c7388

SHA1
48cb749952c4edfa0396bfb43f059c4c55b25533

SHA256
803daa5d6a4973bd88c9ba25338da6722d3741b7d02492ad45303afb946cfe2f

SHA512
6c8fcf27c07cb60e8557d7c0b88f3090ecd87b3209ff66ee3329796a0c36b8b093ed31aaaa688f7e9cd1d8a6eb9878fd2933ded3ee849de5a338aba633c0db7c

Download Submit
C:\Windows\SysWOW64\Ealadnik.exe

Filesize
128KB

MD5
93b46266fee154133944fe92daa230a0

SHA1
1a78891770f1be770612b739b7f01c3f9895163c

SHA256
05518cff8de751929168e2ace8bc7baebb19d632da2b921a9e8c3cfb11946c01

SHA512
4c7f08e570d35064ea68af3a165b9cede63ffa3af70c2fba7e99bd77c616e7c5339e3371d92fcbc9bc757df17e30634ff930d30f9226c907254721374585a66e

Download Submit
C:\Windows\SysWOW64\Edfdej32.exe

Filesize
128KB

MD5
867e724536678f9fbbf9acb703ff1a8e

SHA1
c49426060885e58c6d6d89010bd40ced51f356c4

SHA256
a187f6a40e101881c370af098cd8d9eb7c6b485ab76db93e35dbc0c24d637bcb

SHA512
6be02ae301177f4bbd8fe825998bfd5d5c5d103d1638e93e49fe9c01261702ba6ab2fb39577dd0b756f5204d393387f97e6d0b66980b24e6580cd931d6b90ad7

Download Submit
C:\Windows\SysWOW64\Edhakj32.exe

Filesize
128KB

MD5
d508b595a01c7035d86130b5accb3633

SHA1
9da64b43438e802e59ab33edacd10943311abec2

SHA256
2ce55f8ebbebe45b310467ca870a6ca7d7ae94c434335560b666013320f7720d

SHA512
023b0b05a5c598af6af525dc70c732078ea3aaef51b826c6641af0d40a361a46f7c02df31877ba59fe3907e45efb13c91b6ef13c5ec8b8a9ff184553dafe01da

Download Submit
C:\Windows\SysWOW64\Ehiffh32.exe

Filesize
128KB

MD5
5d8445cdddc3efa48b30c4d008204959

SHA1
221d528bc5de0bb09a0c840246b7071393ae879b

SHA256
ef7a3e494224048b6bc9260d0a1bca94c323e3abdcf870b8826abbb4beb300c3

SHA512
461e7e5a9e4fa74f42560c4a15fd1b6d15a2b68576e689e49a40bacd57d2481167ad5b40802d061971bc8c7f13236eaee075de48e2a54c18cdf76ec1d194f753

Download Submit
C:\Windows\SysWOW64\Emcbio32.exe

Filesize
128KB

MD5
a61b43ff783be824249b29d286f1f130

SHA1
39585842de7e611b6c97a477f3fcdd90873ee618

SHA256
8af3c93a6f3f1872f39193b967fd26c5c1dd3a804967fca0864e1348e585cd95

SHA512
1d661354c2ddd19b7d0418e10a2edc16f29dca14147b5b13915f73f6955a8715b73e67dae2101edd8b62238e2e5d2bf899b4a2f744a7901a10d258744c2cae09

Download Submit
C:\Windows\SysWOW64\Emeoooml.exe

Filesize
128KB

MD5
d2b1c6113c279fa57729eb525a2a10ba

SHA1
78d570f74735c13e2ec761e957f3a0850c122853

SHA256
9487f654d28deb1fa3d23fdddb6f3eee52a1bb94e8aaeea1b8f10bf004f01043

SHA512
68ad5cdeb72200c82665403426651f6749029ddd0205c4f07587b9d248d0f26aadcfc225ff368efb201eef8038b6a1c8772beed389c8b21f24234fd7cfaff278

Download Submit
C:\Windows\SysWOW64\Eoekia32.exe

Filesize
128KB

MD5
509005ca06f23d3e80f843ad568992ec

SHA1
93760941bbfe8f72c62482fb02680d1702fd634a

SHA256
9987463d64b21b1fca0454d51cad5f333522d143dd0c740bbfe11531b53c2f51

SHA512
644e949aaf759565c01af530851d2bfa53ab424d31ef4f3ef17562248d56ce61e982a4246c199d066654c9d5fb377cf8a7ea10dfe7493d1dd3e784e1fe704958

Download Submit
C:\Windows\SysWOW64\Fafdkmap.exe

Filesize
128KB

MD5
53a5bde5f74a075d103a5705d85f0c96

SHA1
76bd179dcfb206b38594b3349c9f43a4242ce929

SHA256
ef27aa12ab78d146efc1e979cebfe1b409b7b7d81291e4057259d1c6d8db9e28

SHA512
149eedadb100dd86e097b2a6624e688fffa8669c9ec940034afa0a11afd4f734519b71678dc9c0dce44be44d53c2d84818364312fbf5450271dbda315b900057

Download Submit
C:\Windows\SysWOW64\Fahaplon.exe

Filesize
128KB

MD5
90cdfddf0b226d08274f88974b2430a4

SHA1
424ab00a5e69e991c3587c522ffb99644076586d

SHA256
ae45babe1d3246afcc7500e0a6841aba83a42070716f95d2e19f3e415352648a

SHA512
5479028f581071cd176d5ca2f2065e46a7db0f45c236e2f83e150ff3e7582cd724a87400998b305aa4a5bd8355d4b2d19dc4e82d39debb6ef083b72224f125bf

Download Submit
C:\Windows\SysWOW64\Fefjfked.exe

Filesize
128KB

MD5
e2991e722d2a5324ce601acbfa4a2d49

SHA1
473ba792662044c36458a1ec700d490b1acd243b

SHA256
138df9a08fde37555074f891415a62065d4896a2011af0380cdbc646ffc3f2e8

SHA512
089f49cfd5ca38f5409c71967b83ff946d2853bcf66b4385902e8135f433885cc48ba1fad1856286c3befd7b01850605d1ac73f8125bdd86046d3bfe279a9012

Download Submit
C:\Windows\SysWOW64\Fehfljca.exe

Filesize
128KB

MD5
558d97a747ce9241a2f07c473d053f98

SHA1
fbe2c13f094648572705cd6bc3e4a0c0d9aa317c

SHA256
14c43b216b36114605c23ac8e7dcc349b98ea527502426ef1b7a79c14f860dd7

SHA512
f1c02bc0cb12f4cc2f9cfa719bbc1043258db42a6d1c1dac0b45fcd71803477eccdbaf2391401b7f2b3e0b111f6c629973bc2c4e5342cab1a8a3bd0ad8950b6c

Download Submit
C:\Windows\SysWOW64\Fggfnc32.exe

Filesize
128KB

MD5
85361f30eba1e1fea5a3667b8a061497

SHA1
93e8884ced844838498e0f6c8eb1a8bf5d4d5c55

SHA256
268138793aa439a983644e4cef53ef93b77ed87f000a510bc4aa2e4041c5a6be

SHA512
1e2234b77b9bc6fc3278fd60640f96d8bcc2df47ac0c9ecf4bc10b74dec816e58bb5078e52ed4316b9ce1b39349a05f2889184efeb92f4c7835e1ec29322f25a

Download Submit
C:\Windows\SysWOW64\Fhbimf32.exe

Filesize
128KB

MD5
682cea3f97892c99a85e95a708e0e192

SHA1
8edc8babb870817ab8b0879538f2720309d54ff1

SHA256
b045f32e844d24de8f92df26c1e2c7cb32561b6f7d24fe18bd598aec9ddf3bad

SHA512
dd1a66a1b8393b0a79955aa2642d15466a469b9075452fb4b8a61bff12c36787ee1af1b434023bd9c86ac35b87b6004523b8e9e21f583de3d339523c2354acbf

Download Submit
C:\Windows\SysWOW64\Fkeodaai.exe

Filesize
128KB

MD5
f62f8f8d4577634b7c711cac93182bfd

SHA1
2cba9f59c871cded29a50b64435b70e999b27229

SHA256
6159481ea6f05dcce1b861d72f307b44c5783daf7ad623f087da8e862fb26bc2

SHA512
537b45569196ca1cd4c6f4d7958a9dac9073f302381c60f4735acbd7859778caa076952fde2ee633d88f519aeada411662ebd7736403847d7bb086e876fa3551

Download Submit
C:\Windows\SysWOW64\Fkllnbjc.exe

Filesize
128KB

MD5
7203a084b9974da40a6fcb6b20d8d910

SHA1
9023951285a807717718af93b56fa1686e66620b

SHA256
ce42aec895da76ff98f4871126fdbc30e2c0d475a180d021f3ed41d6a03dc87f

SHA512
5f4ad87c073a992303a71f9a371fccfc7941d0f9f2303171f626cd50d51b79ebdfd75b88ba0c3f2f14ebd4944467cf459ba7b8ec30effd9563d9e2833e68dc2f

Download Submit
C:\Windows\SysWOW64\Gfbibikg.exe

Filesize
128KB

MD5
5f0a7900c4f457fe563410c1c4ca2338

SHA1
92cb5261bca2c2b45951e36a7cdfd9ae945b3689

SHA256
172dab5174bae3f9cc9a0016ff8b0c5938a0a57675d1a2c2102f4fa9a9a952cd

SHA512
52bc0cc10234d8e9251211229bf345b015f130d99e47259347794f5da5bcb6635812a77d17366564dc96237dd503a2ee119576b41669ddb498b4e7776ab1e741

Download Submit
C:\Windows\SysWOW64\Ggcfja32.exe

Filesize
128KB

MD5
0f950f85b0691f780233c22de7ccf76c

SHA1
2c6b25c04f8a6e320da2fbde3a0fd3d953ecc219

SHA256
c7785c13267da69a463ec601971ad35eb6e99be63a6e4753d254b4bc42d99848

SHA512
3edfbb63866b87f21e0b55463a151e2c8e61b5f9bcdf243dea370086f869fc36b694237cb8c4767c22b3db9bb96af52e2ddc28cbb3a9d3406ae9be74ae66e484

Download Submit
C:\Windows\SysWOW64\Ggqida32.exe

Filesize
128KB

MD5
c3d19aa274d8e0215b6fc24f51163834

SHA1
5c23e2fb23a494176b5797daaaa550f1ef9a0eef

SHA256
55ee561d4e19d0acaa40718b01d8cff5c1524cc42328e779c1b3c0545b690666

SHA512
7e3ec24c669bead2a7a9cd7a4aadb7908b39ca292ec124dc9c0d6a3c8bd21fd7321d642f3a16f62b108210ef3c743d7f6cb812c7a781a5c8034d1d867966dc56

Download Submit
C:\Windows\SysWOW64\Ghklce32.exe

Filesize
128KB

MD5
6dc91699f59060b210bc6a3c8c79be54

SHA1
317982456f2464e8e619a21b5f4117cef31ea7fd

SHA256
e6971a8ebca3929731a1eefea927d3c2015003632daa4904ee95910018a4344f

SHA512
4b88a2c2150282f6a73b7c675233ec9284e01f88d862261f873cedfced9dc1fe2ee11f9f8f1d80a34a02cb53734a84ba8468e1691a629aa4c158ab52c2f7b15e

Download Submit
C:\Windows\SysWOW64\Hildmn32.exe

Filesize
128KB

MD5
560c332e763d0425de63d9cca7c4536b

SHA1
a78f72e9d8d386d84aa7b42c66e02b8c0ec0db53

SHA256
e47528625116a32012b9cb6bc9c400801fbdc29de429da3e529866c3b795669b

SHA512
b460f5dec3aeb61ac423ef693b7865ccf44560214e8426403a296d1f21d2eec98d38a7ae6bcc256aab0d2e8b1d79d12345d089589bcf9bd3de765876355578a6

Download Submit
C:\Windows\SysWOW64\Ikcmbfcj.exe

Filesize
128KB

MD5
97b2470fabcc568873e9a9bf368245be

SHA1
d36dd83a5b083d7a5db8f29604b6da6dface49d7

SHA256
a5ba74b1e1536c2c65ec43a4f807c61712157e42301bfc6d1c57107ddb819992

SHA512
6c5566bab8010bb9c020d5648419ab16562ac01820a50a89032d773099550015a54bbc4a5211a3c978990dac54e8b9a2ec576403ca966a0a93e11c2d2f968b39

Download Submit
C:\Windows\SysWOW64\Indmnh32.exe

Filesize
128KB

MD5
66f5b7677d11683280c87de9dca9ea59

SHA1
2079f09396d8b10816c2c4d5e07c177d98ae93db

SHA256
38d130df3d8e18f7c8596eeaad4dae1cc6848778483d48e9262497ae34b2bd54

SHA512
5ada173b12da86bab7a3527a6209bb7ea509ffb5790f520e529e7c2cf6a4137a15162180981a30a664c347405a2ce5dde8c7dcac9332f4bee01eb7fb515c6650

Download Submit
C:\Windows\SysWOW64\Jgonlm32.exe

Filesize
128KB

MD5
a8fdd3d702603366fd7a95061403f0e3

SHA1
559cf7dc57d787172fd21576c8508f014035ffd4

SHA256
869cb425de1c662406a47a0b878db2e8a78bac0dd357179bad908df8949e46a2

SHA512
570b029c1f9e0aca5d9ca7fed39d96e15945788da4f699ac8dfc1e572c302ed9260c72d4a29cc9e835685f57d9bb48c38efbdf7bf5b13dc3af324b74cda8f99b

Download Submit
C:\Windows\SysWOW64\Kiodmn32.exe

Filesize
128KB

MD5
26c807771c1dfbcfcdeb20fb64d00fdd

SHA1
210368ae1f27cfdb54956ff619e4436785ccb328

SHA256
37c55e1fc180bf8597a74e34b1e426c450f4fca95631756e9f79b2ba2b74882e

SHA512
1415f1e8353337323bb05d866590b19de481573f53c21844914e7fe27b3d9a3b0751b0f288284d59a1c1e777be86ff43080075c6d3597de0ee6bee2ca8ab972e

Download Submit
C:\Windows\SysWOW64\Lejnmncd.exe

Filesize
128KB

MD5
9d82a832d102795cf42a5e45df6ded30

SHA1
901b851e2376b3fe76d81ed173dd8a690b93c121

SHA256
3730d33da6cbc4a1cecd4286887bf105c8b501b23b8de828ccea9c0b08d0903a

SHA512
e25db8ba53923b9eecb975caf1374ed52732a4d410f49f949461da49538c07ec6bad27b5626a47694c88399976e28b61fbeb3956d7f8b5007a4da6c035c0fde7

Download Submit
C:\Windows\SysWOW64\Mfhfhong.exe

Filesize
128KB

MD5
93dee4da7fa52d227f84ebfa8c309c9f

SHA1
27bb6be1a0fdbd1697300da2db2f0b5e7c52370e

SHA256
25ebf16220f79bd80388c8a235acf6b374e99c5a528603920281fb4c16f3ae12

SHA512
2b0434999de0412f16ba9aa98b2c16f87bf6ffaaaf3bbb94a9747b81c2a0343bc2e9fb71b0eb0eaf1140d8fba3c97525660b3a470dec41eda2c8d6ec69567be6

Download Submit
C:\Windows\SysWOW64\Mjbogmdb.exe

Filesize
128KB

MD5
7f888e98db3a1bc8c391f64ec9195a11

SHA1
cee035d9bb495ed29d9f2c7a11776855871b5bde

SHA256
253f6742348fbec4c9885908ba9fa6a8912431f1dd80235710ebe92158f1e9ce

SHA512
ad3d2ff5a3b55847f3e88692a6998ffc072ca03b178fa8a30e560ff279cde848a9bb65387885053f2f457521fba8d5e36da3da8c6de66bec295b339abeaab024

Download Submit
C:\Windows\SysWOW64\Nhlpfgbb.exe

Filesize
128KB

MD5
4373f96b39b9f780b4d29fabe52c1739

SHA1
8ff6ababd4ee75d90b6f60078409d09ca8b2dc70

SHA256
0788bd2e9d562e065b7f60e98f034c1d07af5717a9b7783dff404971882cf868

SHA512
9eb31f487a3862bdcf6ce17091b674eb7a666d28829a5ff8762da2531d5e57dfda7b37321afff188dc6ca582ee690a56ff027cd8c16958b956a4ac0aaa584439

Download Submit
C:\Windows\SysWOW64\Nobdbkhf.exe

Filesize
128KB

MD5
dd2a652423e2d53a2cae0ef83d739d0d

SHA1
c0d11037d26c8a6cea6d5ac8179665ddee51cf6a

SHA256
24e51ca68ba79f0a3278a7be5145355c46cc1af6b8a86c27d3f05c54577a9b58

SHA512
74183fcaf353f58fcb4ffecd077d38656b7e05983accf267d40fa6a8ead631aa7a844da3951225591ece7a832d817bb95b9a9807275beaaf2d0c25e474105fb4

Download Submit
C:\Windows\SysWOW64\Oeheqm32.exe

Filesize
128KB

MD5
3ba51eb53cb94916c68e6c4a18b9ff24

SHA1
bab4666a840af622253b155beb726f6414f7a13e

SHA256
2c3a1fd04ac7d45ba453d4628615beafa0ad19b68284aff4a558c8b94aba6e5b

SHA512
b50f2eee7437a307dfa7ee4afbee2d4a5c9ee40ea137035b9cf6aed9c2f1a8d0c4c1a18b15f73ecf9f92a9981a58e3fc3bbaae9e2c882277b8a032ba5ee9e3b1

Download Submit
C:\Windows\SysWOW64\Ohiemobf.exe

Filesize
128KB

MD5
cf943526de7910b3d031ae0caf2acb20

SHA1
6f1bd77bfa02edd7042456b07e5349d7c5cb54c2

SHA256
b55eb7bbe9cdc05524686624a37f88d69b23ee1b8a9ad56b06597261a6a72811

SHA512
2c2cae53d8e3c6f5ccbdf58964f728aacbc54e11b9fdaad2b4a97508994fde4a68286a65f2fe87a3698fa5fb83959ae06d5018236a126b9ce61c47bd523f5a3d

Download Submit
C:\Windows\SysWOW64\Pjngmo32.dll

Filesize
7KB

MD5
69fb2935880a26581e6f6d1885763c15

SHA1
791db7736a508ae9dd48f5d36b65171ca466da16

SHA256
b6598cbc2e90f17b1511a83254d95ded21e1a96c154dadc2ffde5f1a104ea306

SHA512
47077bc1ddcf3b0d75a5923baae559c5867770e6c759dd78926be4c1b849dfa9993dba074cbd7e4d5f7e66292fd57e2fe0022cea83ca8cf5c1b0cdc83d5efdd9

Download Submit
C:\Windows\SysWOW64\Pocfpf32.exe

Filesize
128KB

MD5
637b3bcd0ee0dce7ab8fb2688ab9fbf9

SHA1
8d98d43e326ec4799675f32f91fd009638325c2c

SHA256
4d053cad8fdeb1456d0ae48983a234c14450fad5520956baf74fc6b9581f1e12

SHA512
e5a0c56efea765fa24fa564b14675dde179fd193a19a47fc3cb1fdbd3ce0f89f6e810e0c37bf7fe10941c580263a9949a3e188b703ffcdbbe9e11d68d892553d

Download Submit
C:\Windows\SysWOW64\Podmkm32.exe

Filesize
128KB

MD5
9759377fd3c74ab5dbbeb32b48fd2cd8

SHA1
1168be314d32b8e33a44b9821f236dfc72b8509c

SHA256
08ce75bbf0213c3ff0888825936cbfcdbf9fe2244059d7ed355b4e8356d321b2

SHA512
3cd2309fef158d4c2c111a3c643a63e3bafca8ca9f5c6f043d074296d63456dbb47e7a0683fca88919264f8977cc23e2e233845b354b75faada737b89c9d00ff

Download Submit
memory/456-292-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/540-31-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/564-24-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/688-159-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/744-16-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1304-304-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1332-136-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1336-364-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1432-175-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1836-127-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1848-216-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1952-256-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2040-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2064-223-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2176-268-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2300-104-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2364-184-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2416-55-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2468-79-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2488-71-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2504-47-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2568-200-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2704-239-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2732-96-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2836-252-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2908-8-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2924-262-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2964-376-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2980-274-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3264-152-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3280-286-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3328-39-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3528-370-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3576-192-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3632-314-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3700-280-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3720-386-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3796-63-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3820-332-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3924-346-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4000-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4076-322-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4084-334-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4216-232-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4236-340-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4372-167-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4404-207-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4512-112-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4576-298-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4828-119-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4840-320-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4932-148-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5032-352-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5088-362-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5144-388-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5188-399-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5224-400-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5268-406-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5308-412-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5348-418-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5408-424-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5452-430-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5492-436-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5536-442-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads