6fea7c97dcddb78ff934c28bcf3cc44274efa44520fbbc6c23ca7be88c054d20

Analysis

max time kernel
141s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 19:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4b093d4d9eed7e6f6ed20eb7bf4edc58.exe
Size

259KB
MD5

4b093d4d9eed7e6f6ed20eb7bf4edc58
SHA1

dc664ee8e4bb5e69b4d2638ddfc177162e4fa9e9
SHA256

6fea7c97dcddb78ff934c28bcf3cc44274efa44520fbbc6c23ca7be88c054d20
SHA512

78ec9b09fc45adba42b62ad73d525afda9718c538980f860e79eaa8f9b86c4f4ef78094faea5e35d99b1a70507904299aef3fddd1dd549ff5661b81dcc5a85bb
SSDEEP

3072:tRGLcGfACqz9JJ9IDlRxyhTbhgu+tAcrzkAqSxYIhOmTsF93UYfwC6GIoutz5yLp:aLcGhqJsDshsrYIcm4FmowdHoSa

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Andqol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eohhie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hobcgdjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipjoee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdhpba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kanbjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhelddln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bekmei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igjlibib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ejiiippb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aikijjon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndmgnkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogjpld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jookjpam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmhglopl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejennd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpchdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbnjcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deidjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gglpgd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofadlbhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mggolhaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgcmeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfcnka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doqbifpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpdgbkab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfcjhphd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfnnmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfcdaehf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfcdaehf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpchdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmagch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfjnhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cebdcmhh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geabbfoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emfgpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jknocljn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnoacp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agobna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlnlak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdpmmf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmhphqoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofjokc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aidcjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nifnao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olidijjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkjegb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnjbbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oihkgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jddggb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbhina32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Moefdljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlefjnno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcmpgpkp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abjkmqni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpemkcck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfkpiled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oeahap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhkkjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mglhgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkmkfncf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pehnboko.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggfobofl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmnheggo.exe

Executes dropped EXE 64 IoCs

pid	Process
2424	Moefdljc.exe
2304	Nlefjnno.exe
3828	Obkahddl.exe
2720	Odljjo32.exe
4492	Pmeoqlpl.exe
2788	Pcpgmf32.exe
612	Qkfkng32.exe
3324	Apddce32.exe
1240	Aioebj32.exe
2636	Alpnde32.exe
4776	Bmagch32.exe
3312	Bemlhj32.exe
392	Bflham32.exe
2024	Bpemkcck.exe
2336	Cbhbbn32.exe
3148	Cmmgof32.exe
1608	Cmbpjfij.exe
4324	Cbaehl32.exe
4856	Dbcbnlcl.exe
556	Dfakcj32.exe
3700	Dmnpfd32.exe
3136	Deidjf32.exe
4736	Dpoiho32.exe
2960	Eleimp32.exe
1712	Emeffcid.exe
4496	Eepkkefp.exe
3380	Emioab32.exe
3052	Fdjnolfd.exe
3816	Fjgfgbek.exe
4168	Fcpkph32.exe
368	Fdogjk32.exe
3620	Ffpcbchm.exe
4608	Fcddkggf.exe
4252	Glmhdm32.exe
4396	Ggbmafnm.exe
2768	Gdfmkjlg.exe
1172	Gnoacp32.exe
3092	Gjhonp32.exe
2744	Gqagkjne.exe
436	Gglpgd32.exe
2376	Hdppaidl.exe
3736	Hdbmfhbi.exe
1124	Hmmakk32.exe
5052	Hfefdpfe.exe
4216	Hgebnc32.exe
4784	Hnokjm32.exe
1960	Hclccd32.exe
4160	Inagpm32.exe
4664	Igjlibib.exe
672	Icciccmd.exe
1180	Inhmqlmj.exe
4240	Ijonfmbn.exe
212	Jjakkmpk.exe
4612	Jakchf32.exe
3596	Jfhlpnfp.exe
1328	Jclljaei.exe
2196	Jnapgjdo.exe
2784	Jabiie32.exe
2508	Jglaepim.exe
1092	Jnfjbj32.exe
4284	Lmnlpcel.exe
4224	Loniiflo.exe
940	Mdkabmjf.exe
3292	Moglpedd.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Emjfif32.dll	Clbmfm32.exe
File opened for modification	C:\Windows\SysWOW64\Defajqko.exe	Dlnlak32.exe
File opened for modification	C:\Windows\SysWOW64\Bjjmfn32.exe	Bcpdidol.exe
File created	C:\Windows\SysWOW64\Fcpkph32.exe	Fjgfgbek.exe
File opened for modification	C:\Windows\SysWOW64\Bdphnmjk.exe	Bnfoac32.exe
File opened for modification	C:\Windows\SysWOW64\Dijppjfd.exe	Dndlba32.exe
File created	C:\Windows\SysWOW64\Oecopk32.dll	Abjkmqni.exe
File created	C:\Windows\SysWOW64\Clbmfm32.exe	Cbihmg32.exe
File opened for modification	C:\Windows\SysWOW64\Jfehpg32.exe	Jqhphq32.exe
File created	C:\Windows\SysWOW64\Aemqdk32.exe	Aochga32.exe
File created	C:\Windows\SysWOW64\Pdofgooa.dll	Hpqlof32.exe
File created	C:\Windows\SysWOW64\Apddce32.exe	Qkfkng32.exe
File created	C:\Windows\SysWOW64\Lokceimi.dll	Bkcjjhgp.exe
File created	C:\Windows\SysWOW64\Boahmbic.dll	Jliimf32.exe
File created	C:\Windows\SysWOW64\Egpofhkf.dll	Apeagd32.exe
File created	C:\Windows\SysWOW64\Pfkpiled.exe	Ogjpld32.exe
File created	C:\Windows\SysWOW64\Jkbhok32.exe	Jdhpba32.exe
File created	C:\Windows\SysWOW64\Bmagch32.exe	Alpnde32.exe
File created	C:\Windows\SysWOW64\Cmqljn32.dll	Gogjflhf.exe
File opened for modification	C:\Windows\SysWOW64\Fmpaqd32.exe	Fjbddh32.exe
File created	C:\Windows\SysWOW64\Amibqhed.exe	Agojdnng.exe
File created	C:\Windows\SysWOW64\Dlfniafa.exe	Dflflg32.exe
File opened for modification	C:\Windows\SysWOW64\Dqhpjohb.exe	Dfclmfhl.exe
File created	C:\Windows\SysWOW64\Nnmfdpni.exe	Nohicdia.exe
File opened for modification	C:\Windows\SysWOW64\Ipohpdbb.exe	Ikbphn32.exe
File created	C:\Windows\SysWOW64\Jabiie32.exe	Jnapgjdo.exe
File opened for modification	C:\Windows\SysWOW64\Pbapom32.exe	Pkhhbbck.exe
File created	C:\Windows\SysWOW64\Kkbbbm32.dll	Qbmpjkqk.exe
File created	C:\Windows\SysWOW64\Kfcdaehf.exe	Jfehpg32.exe
File created	C:\Windows\SysWOW64\Fgekcecd.dll	Bcpdidol.exe
File created	C:\Windows\SysWOW64\Pifghmae.exe	Pfhklabb.exe
File created	C:\Windows\SysWOW64\Ifhpbcgm.dll	Dqhpjohb.exe
File created	C:\Windows\SysWOW64\Fhgkhi32.dll	Hhegjdag.exe
File created	C:\Windows\SysWOW64\Onhhmpoo.exe	Nemchn32.exe
File created	C:\Windows\SysWOW64\Ghgljg32.exe	Ggfobofl.exe
File created	C:\Windows\SysWOW64\Kanbjn32.exe	Kgemahmg.exe
File created	C:\Windows\SysWOW64\Calbnnkj.exe	Cgcmeh32.exe
File opened for modification	C:\Windows\SysWOW64\Kkhidaeo.exe	Jdnqgg32.exe
File created	C:\Windows\SysWOW64\Eeocem32.dll	Fjanjb32.exe
File opened for modification	C:\Windows\SysWOW64\Hhegjdag.exe	Galonj32.exe
File opened for modification	C:\Windows\SysWOW64\Ffpcbchm.exe	Fdogjk32.exe
File created	C:\Windows\SysWOW64\Hhleefhe.exe	Hpaqqdjj.exe
File opened for modification	C:\Windows\SysWOW64\Mfomda32.exe	Mdodbf32.exe
File created	C:\Windows\SysWOW64\Jibdpo32.dll	Cbnknpqj.exe
File opened for modification	C:\Windows\SysWOW64\Dqdnjfpc.exe	Dkgeao32.exe
File opened for modification	C:\Windows\SysWOW64\Jdnqgg32.exe	Joahop32.exe
File created	C:\Windows\SysWOW64\Ecpomiok.exe	Emfgpo32.exe
File created	C:\Windows\SysWOW64\Ofocia32.dll	Ppgeff32.exe
File opened for modification	C:\Windows\SysWOW64\Dgbhgi32.exe	Dqhpjohb.exe
File opened for modification	C:\Windows\SysWOW64\Enomic32.exe	Eciilj32.exe
File created	C:\Windows\SysWOW64\Obkahddl.exe	Nlefjnno.exe
File created	C:\Windows\SysWOW64\Jglaepim.exe	Jabiie32.exe
File created	C:\Windows\SysWOW64\Fpcdof32.exe	Fempbm32.exe
File opened for modification	C:\Windows\SysWOW64\Amibqhed.exe	Agojdnng.exe
File created	C:\Windows\SysWOW64\Caikpked.dll	Jkkbnl32.exe
File created	C:\Windows\SysWOW64\Eojppe32.dll	Nmlhaa32.exe
File opened for modification	C:\Windows\SysWOW64\Anfmeldl.exe	Aijeme32.exe
File created	C:\Windows\SysWOW64\Cgnhmg32.dll	Belemd32.exe
File created	C:\Windows\SysWOW64\Dlpigk32.exe	Defajqko.exe
File created	C:\Windows\SysWOW64\Lceajc32.dll	Cgpjebcp.exe
File created	C:\Windows\SysWOW64\Cekmph32.dll	Mkdagm32.exe
File opened for modification	C:\Windows\SysWOW64\Ejjgic32.exe	Ecpomiok.exe
File created	C:\Windows\SysWOW64\Kpignncc.dll	Jmnheggo.exe
File created	C:\Windows\SysWOW64\Ccldebeo.exe	Cddjofbj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3924	1048	WerFault.exe	558

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eelifc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpboakjk.dll"	Pbjbfclk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bedgejbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Joljlakk.dll"	Ijpcbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jaekkfcm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pkjegb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cndpaojf.dll"	Cblebgfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgjjoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkokbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghfnej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjmmohcf.dll"	Nppfnige.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ppgeff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Danoae32.dll"	Bcfkiock.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eckfaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kenognbk.dll"	Dlkplk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghgljg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hoiihcde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onecof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pifghmae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcfkiock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipndco32.dll"	Fggkifmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jmnheggo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jglaepim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aogbkmdk.dll"	Dfngcdhi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hhleefhe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjlaoioh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agbmiaob.dll"	Pehnboko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qmnbej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dqhpjohb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iaqapggb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlcdjfpl.dll"	Jgdphm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjhonp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chkjpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egfghn32.dll"	Lpbokjho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oahgnh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkhidaeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enbhpkpn.dll"	Kdpmmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhjkjd32.dll"	Djeegf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkoaagmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nohicdia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Igjlibib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdjjgggk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdbhbf32.dll"	Fnhppa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeeomegd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aikijjon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dellcg32.dll"	Ipaeedpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jclljaei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egeflakp.dll"	Elnehifk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmhphqoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbahgbfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgdcom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cifmoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdqgcnml.dll"	Febogbhg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmmakk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aaocfebe.dll"	Eelifc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dglpfmji.dll"	Ejmkiiha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofjokc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qfcjhphd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggjgofkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmnbkc32.dll"	Gnoacp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gndpkp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ioicnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdphnmjk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnidcg32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 2424	832	4b093d4d9eed7e6f6ed20eb7bf4edc58.exe	95
PID 832 wrote to memory of 2424	832	4b093d4d9eed7e6f6ed20eb7bf4edc58.exe	95
PID 832 wrote to memory of 2424	832	4b093d4d9eed7e6f6ed20eb7bf4edc58.exe	95
PID 2424 wrote to memory of 2304	2424	Moefdljc.exe	96
PID 2424 wrote to memory of 2304	2424	Moefdljc.exe	96
PID 2424 wrote to memory of 2304	2424	Moefdljc.exe	96
PID 2304 wrote to memory of 3828	2304	Nlefjnno.exe	97
PID 2304 wrote to memory of 3828	2304	Nlefjnno.exe	97
PID 2304 wrote to memory of 3828	2304	Nlefjnno.exe	97
PID 3828 wrote to memory of 2720	3828	Obkahddl.exe	98
PID 3828 wrote to memory of 2720	3828	Obkahddl.exe	98
PID 3828 wrote to memory of 2720	3828	Obkahddl.exe	98
PID 2720 wrote to memory of 4492	2720	Odljjo32.exe	99
PID 2720 wrote to memory of 4492	2720	Odljjo32.exe	99
PID 2720 wrote to memory of 4492	2720	Odljjo32.exe	99
PID 4492 wrote to memory of 2788	4492	Pmeoqlpl.exe	100
PID 4492 wrote to memory of 2788	4492	Pmeoqlpl.exe	100
PID 4492 wrote to memory of 2788	4492	Pmeoqlpl.exe	100
PID 2788 wrote to memory of 612	2788	Pcpgmf32.exe	101
PID 2788 wrote to memory of 612	2788	Pcpgmf32.exe	101
PID 2788 wrote to memory of 612	2788	Pcpgmf32.exe	101
PID 612 wrote to memory of 3324	612	Qkfkng32.exe	102
PID 612 wrote to memory of 3324	612	Qkfkng32.exe	102
PID 612 wrote to memory of 3324	612	Qkfkng32.exe	102
PID 3324 wrote to memory of 1240	3324	Apddce32.exe	103
PID 3324 wrote to memory of 1240	3324	Apddce32.exe	103
PID 3324 wrote to memory of 1240	3324	Apddce32.exe	103
PID 1240 wrote to memory of 2636	1240	Aioebj32.exe	104
PID 1240 wrote to memory of 2636	1240	Aioebj32.exe	104
PID 1240 wrote to memory of 2636	1240	Aioebj32.exe	104
PID 2636 wrote to memory of 4776	2636	Alpnde32.exe	105
PID 2636 wrote to memory of 4776	2636	Alpnde32.exe	105
PID 2636 wrote to memory of 4776	2636	Alpnde32.exe	105
PID 4776 wrote to memory of 3312	4776	Bmagch32.exe	106
PID 4776 wrote to memory of 3312	4776	Bmagch32.exe	106
PID 4776 wrote to memory of 3312	4776	Bmagch32.exe	106
PID 3312 wrote to memory of 392	3312	Bemlhj32.exe	107
PID 3312 wrote to memory of 392	3312	Bemlhj32.exe	107
PID 3312 wrote to memory of 392	3312	Bemlhj32.exe	107
PID 392 wrote to memory of 2024	392	Bflham32.exe	108
PID 392 wrote to memory of 2024	392	Bflham32.exe	108
PID 392 wrote to memory of 2024	392	Bflham32.exe	108
PID 2024 wrote to memory of 2336	2024	Bpemkcck.exe	109
PID 2024 wrote to memory of 2336	2024	Bpemkcck.exe	109
PID 2024 wrote to memory of 2336	2024	Bpemkcck.exe	109
PID 2336 wrote to memory of 3148	2336	Cbhbbn32.exe	110
PID 2336 wrote to memory of 3148	2336	Cbhbbn32.exe	110
PID 2336 wrote to memory of 3148	2336	Cbhbbn32.exe	110
PID 3148 wrote to memory of 1608	3148	Cmmgof32.exe	111
PID 3148 wrote to memory of 1608	3148	Cmmgof32.exe	111
PID 3148 wrote to memory of 1608	3148	Cmmgof32.exe	111
PID 1608 wrote to memory of 4324	1608	Cmbpjfij.exe	112
PID 1608 wrote to memory of 4324	1608	Cmbpjfij.exe	112
PID 1608 wrote to memory of 4324	1608	Cmbpjfij.exe	112
PID 4324 wrote to memory of 4856	4324	Cbaehl32.exe	113
PID 4324 wrote to memory of 4856	4324	Cbaehl32.exe	113
PID 4324 wrote to memory of 4856	4324	Cbaehl32.exe	113
PID 4856 wrote to memory of 556	4856	Dbcbnlcl.exe	114
PID 4856 wrote to memory of 556	4856	Dbcbnlcl.exe	114
PID 4856 wrote to memory of 556	4856	Dbcbnlcl.exe	114
PID 556 wrote to memory of 3700	556	Dfakcj32.exe	115
PID 556 wrote to memory of 3700	556	Dfakcj32.exe	115
PID 556 wrote to memory of 3700	556	Dfakcj32.exe	115
PID 3700 wrote to memory of 3136	3700	Dmnpfd32.exe	116

C:\Users\Admin\AppData\Local\Temp\4b093d4d9eed7e6f6ed20eb7bf4edc58.exe
"C:\Users\Admin\AppData\Local\Temp\4b093d4d9eed7e6f6ed20eb7bf4edc58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\Moefdljc.exe
  C:\Windows\system32\Moefdljc.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\Nlefjnno.exe
    C:\Windows\system32\Nlefjnno.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\SysWOW64\Obkahddl.exe
      C:\Windows\system32\Obkahddl.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3828
    - - C:\Windows\SysWOW64\Odljjo32.exe
        
        C:\Windows\system32\Odljjo32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2720
      - C:\Windows\SysWOW64\Pmeoqlpl.exe
        
        C:\Windows\system32\Pmeoqlpl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4492
        
        C:\Windows\SysWOW64\Pcpgmf32.exe
        
        C:\Windows\system32\Pcpgmf32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2788
        
        C:\Windows\SysWOW64\Qkfkng32.exe
        
        C:\Windows\system32\Qkfkng32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:612
        
        C:\Windows\SysWOW64\Apddce32.exe
        
        C:\Windows\system32\Apddce32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\SysWOW64\Aioebj32.exe
        
        C:\Windows\system32\Aioebj32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1240
        
        C:\Windows\SysWOW64\Alpnde32.exe
        
        C:\Windows\system32\Alpnde32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\SysWOW64\Bmagch32.exe
        
        C:\Windows\system32\Bmagch32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\SysWOW64\Bemlhj32.exe
        
        C:\Windows\system32\Bemlhj32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\SysWOW64\Bflham32.exe
        
        C:\Windows\system32\Bflham32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:392
        
        C:\Windows\SysWOW64\Bpemkcck.exe
        
        C:\Windows\system32\Bpemkcck.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\SysWOW64\Cbhbbn32.exe
        
        C:\Windows\system32\Cbhbbn32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2336
        
        C:\Windows\SysWOW64\Cmmgof32.exe
        
        C:\Windows\system32\Cmmgof32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\SysWOW64\Cmbpjfij.exe
        
        C:\Windows\system32\Cmbpjfij.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\SysWOW64\Cbaehl32.exe
        
        C:\Windows\system32\Cbaehl32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\SysWOW64\Dbcbnlcl.exe
        
        C:\Windows\system32\Dbcbnlcl.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SysWOW64\Dfakcj32.exe
        
        C:\Windows\system32\Dfakcj32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\SysWOW64\Dmnpfd32.exe
        
        C:\Windows\system32\Dmnpfd32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Windows\SysWOW64\Deidjf32.exe
        
        C:\Windows\system32\Deidjf32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3136
        
        C:\Windows\SysWOW64\Dpoiho32.exe
        
        C:\Windows\system32\Dpoiho32.exe
        24⤵
        Executes dropped EXE
        
        PID:4736
        
        C:\Windows\SysWOW64\Eleimp32.exe
        
        C:\Windows\system32\Eleimp32.exe
        25⤵
        Executes dropped EXE
        
        PID:2960
        
        C:\Windows\SysWOW64\Emeffcid.exe
        
        C:\Windows\system32\Emeffcid.exe
        26⤵
        Executes dropped EXE
        
        PID:1712
        
        C:\Windows\SysWOW64\Eepkkefp.exe
        
        C:\Windows\system32\Eepkkefp.exe
        27⤵
        Executes dropped EXE
        
        PID:4496
        
        C:\Windows\SysWOW64\Emioab32.exe
        
        C:\Windows\system32\Emioab32.exe
        28⤵
        Executes dropped EXE
        
        PID:3380
        
        C:\Windows\SysWOW64\Fdjnolfd.exe
        
        C:\Windows\system32\Fdjnolfd.exe
        29⤵
        Executes dropped EXE
        
        PID:3052
        
        C:\Windows\SysWOW64\Fjgfgbek.exe
        
        C:\Windows\system32\Fjgfgbek.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3816
        
        C:\Windows\SysWOW64\Fcpkph32.exe
        
        C:\Windows\system32\Fcpkph32.exe
        31⤵
        Executes dropped EXE
        
        PID:4168
        
        C:\Windows\SysWOW64\Fdogjk32.exe
        
        C:\Windows\system32\Fdogjk32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:368
        
        C:\Windows\SysWOW64\Ffpcbchm.exe
        
        C:\Windows\system32\Ffpcbchm.exe
        33⤵
        Executes dropped EXE
        
        PID:3620
        
        C:\Windows\SysWOW64\Fcddkggf.exe
        
        C:\Windows\system32\Fcddkggf.exe
        34⤵
        Executes dropped EXE
        
        PID:4608
        
        C:\Windows\SysWOW64\Glmhdm32.exe
        
        C:\Windows\system32\Glmhdm32.exe
        35⤵
        Executes dropped EXE
        
        PID:4252
        
        C:\Windows\SysWOW64\Ggbmafnm.exe
        
        C:\Windows\system32\Ggbmafnm.exe
        36⤵
        Executes dropped EXE
        
        PID:4396
        
        C:\Windows\SysWOW64\Gdfmkjlg.exe
        
        C:\Windows\system32\Gdfmkjlg.exe
        37⤵
        Executes dropped EXE
        
        PID:2768
        
        C:\Windows\SysWOW64\Gnoacp32.exe
        
        C:\Windows\system32\Gnoacp32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1172
        
        C:\Windows\SysWOW64\Gjhonp32.exe
        
        C:\Windows\system32\Gjhonp32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3092
        
        C:\Windows\SysWOW64\Gqagkjne.exe
        
        C:\Windows\system32\Gqagkjne.exe
        40⤵
        Executes dropped EXE
        
        PID:2744
        
        C:\Windows\SysWOW64\Gglpgd32.exe
        
        C:\Windows\system32\Gglpgd32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Hdppaidl.exe
        
        C:\Windows\system32\Hdppaidl.exe
        42⤵
        Executes dropped EXE
        
        PID:2376
        
        C:\Windows\SysWOW64\Hdbmfhbi.exe
        
        C:\Windows\system32\Hdbmfhbi.exe
        43⤵
        Executes dropped EXE
        
        PID:3736
        
        C:\Windows\SysWOW64\Hmmakk32.exe
        
        C:\Windows\system32\Hmmakk32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1124
        
        C:\Windows\SysWOW64\Hfefdpfe.exe
        
        C:\Windows\system32\Hfefdpfe.exe
        45⤵
        Executes dropped EXE
        
        PID:5052
        
        C:\Windows\SysWOW64\Hgebnc32.exe
        
        C:\Windows\system32\Hgebnc32.exe
        46⤵
        Executes dropped EXE
        
        PID:4216
        
        C:\Windows\SysWOW64\Hnokjm32.exe
        
        C:\Windows\system32\Hnokjm32.exe
        47⤵
        Executes dropped EXE
        
        PID:4784
        
        C:\Windows\SysWOW64\Hclccd32.exe
        
        C:\Windows\system32\Hclccd32.exe
        48⤵
        Executes dropped EXE
        
        PID:1960
        
        C:\Windows\SysWOW64\Inagpm32.exe
        
        C:\Windows\system32\Inagpm32.exe
        49⤵
        Executes dropped EXE
        
        PID:4160
        
        C:\Windows\SysWOW64\Igjlibib.exe
        
        C:\Windows\system32\Igjlibib.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4664
        
        C:\Windows\SysWOW64\Icciccmd.exe
        
        C:\Windows\system32\Icciccmd.exe
        51⤵
        Executes dropped EXE
        
        PID:672
        
        C:\Windows\SysWOW64\Inhmqlmj.exe
        
        C:\Windows\system32\Inhmqlmj.exe
        52⤵
        Executes dropped EXE
        
        PID:1180
        
        C:\Windows\SysWOW64\Ijonfmbn.exe
        
        C:\Windows\system32\Ijonfmbn.exe
        53⤵
        Executes dropped EXE
        
        PID:4240
        
        C:\Windows\SysWOW64\Jjakkmpk.exe
        
        C:\Windows\system32\Jjakkmpk.exe
        54⤵
        Executes dropped EXE
        
        PID:212
        
        C:\Windows\SysWOW64\Jakchf32.exe
        
        C:\Windows\system32\Jakchf32.exe
        55⤵
        Executes dropped EXE
        
        PID:4612
        
        C:\Windows\SysWOW64\Jfhlpnfp.exe
        
        C:\Windows\system32\Jfhlpnfp.exe
        56⤵
        Executes dropped EXE
        
        PID:3596
        
        C:\Windows\SysWOW64\Jclljaei.exe
        
        C:\Windows\system32\Jclljaei.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1328
        
        C:\Windows\SysWOW64\Jnapgjdo.exe
        
        C:\Windows\system32\Jnapgjdo.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2196
        
        C:\Windows\SysWOW64\Jabiie32.exe
        
        C:\Windows\system32\Jabiie32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2784
        
        C:\Windows\SysWOW64\Jglaepim.exe
        
        C:\Windows\system32\Jglaepim.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2508
        
        C:\Windows\SysWOW64\Jnfjbj32.exe
        
        C:\Windows\system32\Jnfjbj32.exe
        61⤵
        Executes dropped EXE
        
        PID:1092
        
        C:\Windows\SysWOW64\Lmnlpcel.exe
        
        C:\Windows\system32\Lmnlpcel.exe
        62⤵
        Executes dropped EXE
        
        PID:4284
        
        C:\Windows\SysWOW64\Loniiflo.exe
        
        C:\Windows\system32\Loniiflo.exe
        63⤵
        Executes dropped EXE
        
        PID:4224
        
        C:\Windows\SysWOW64\Mdkabmjf.exe
        
        C:\Windows\system32\Mdkabmjf.exe
        64⤵
        Executes dropped EXE
        
        PID:940
        
        C:\Windows\SysWOW64\Moglpedd.exe
        
        C:\Windows\system32\Moglpedd.exe
        65⤵
        Executes dropped EXE
        
        PID:3292
        
        C:\Windows\SysWOW64\Mgbpdgap.exe
        
        C:\Windows\system32\Mgbpdgap.exe
        66⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Nmlhaa32.exe
        
        C:\Windows\system32\Nmlhaa32.exe
        67⤵
        Drops file in System32 directory
        
        PID:3872
        
        C:\Windows\SysWOW64\Nggjog32.exe
        
        C:\Windows\system32\Nggjog32.exe
        68⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\Nhffijdm.exe
        
        C:\Windows\system32\Nhffijdm.exe
        69⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\Noqofdlj.exe
        
        C:\Windows\system32\Noqofdlj.exe
        70⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\Ndmgnkja.exe
        
        C:\Windows\system32\Ndmgnkja.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1508
        
        C:\Windows\SysWOW64\Nkgoke32.exe
        
        C:\Windows\system32\Nkgoke32.exe
        72⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Nemchn32.exe
        
        C:\Windows\system32\Nemchn32.exe
        73⤵
        Drops file in System32 directory
        
        PID:5164
        
        C:\Windows\SysWOW64\Onhhmpoo.exe
        
        C:\Windows\system32\Onhhmpoo.exe
        74⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Odbpij32.exe
        
        C:\Windows\system32\Odbpij32.exe
        75⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Oddmoj32.exe
        
        C:\Windows\system32\Oddmoj32.exe
        76⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Oojalb32.exe
        
        C:\Windows\system32\Oojalb32.exe
        77⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Ohbfeh32.exe
        
        C:\Windows\system32\Ohbfeh32.exe
        78⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Odifjipd.exe
        
        C:\Windows\system32\Odifjipd.exe
        79⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Okcogc32.exe
        
        C:\Windows\system32\Okcogc32.exe
        80⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Odkcpi32.exe
        
        C:\Windows\system32\Odkcpi32.exe
        81⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Ogjpld32.exe
        
        C:\Windows\system32\Ogjpld32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5652
        
        C:\Windows\SysWOW64\Pfkpiled.exe
        
        C:\Windows\system32\Pfkpiled.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5696
        
        C:\Windows\SysWOW64\Pkhhbbck.exe
        
        C:\Windows\system32\Pkhhbbck.exe
        84⤵
        Drops file in System32 directory
        
        PID:5744
        
        C:\Windows\SysWOW64\Pbapom32.exe
        
        C:\Windows\system32\Pbapom32.exe
        85⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Pkjegb32.exe
        
        C:\Windows\system32\Pkjegb32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5828
        
        C:\Windows\SysWOW64\Phneqf32.exe
        
        C:\Windows\system32\Phneqf32.exe
        87⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Pfbfjk32.exe
        
        C:\Windows\system32\Pfbfjk32.exe
        88⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Pdgckg32.exe
        
        C:\Windows\system32\Pdgckg32.exe
        89⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Qnpgdmjd.exe
        
        C:\Windows\system32\Qnpgdmjd.exe
        90⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Qbmpjkqk.exe
        
        C:\Windows\system32\Qbmpjkqk.exe
        91⤵
        Drops file in System32 directory
        
        PID:6076
        
        C:\Windows\SysWOW64\Qhghge32.exe
        
        C:\Windows\system32\Qhghge32.exe
        92⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Andqol32.exe
        
        C:\Windows\system32\Andqol32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5132
        
        C:\Windows\SysWOW64\Aijeme32.exe
        
        C:\Windows\system32\Aijeme32.exe
        94⤵
        Drops file in System32 directory
        
        PID:5204
        
        C:\Windows\SysWOW64\Anfmeldl.exe
        
        C:\Windows\system32\Anfmeldl.exe
        95⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Agobna32.exe
        
        C:\Windows\system32\Agobna32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5360
        
        C:\Windows\SysWOW64\Ainnhdbp.exe
        
        C:\Windows\system32\Ainnhdbp.exe
        97⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Aohfdnil.exe
        
        C:\Windows\system32\Aohfdnil.exe
        98⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Aeeomegd.exe
        
        C:\Windows\system32\Aeeomegd.exe
        99⤵
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Aokcjngj.exe
        
        C:\Windows\system32\Aokcjngj.exe
        100⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Afdkfh32.exe
        
        C:\Windows\system32\Afdkfh32.exe
        101⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Bkadoo32.exe
        
        C:\Windows\system32\Bkadoo32.exe
        102⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Bejhhd32.exe
        
        C:\Windows\system32\Bejhhd32.exe
        103⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Bpomem32.exe
        
        C:\Windows\system32\Bpomem32.exe
        104⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Belemd32.exe
        
        C:\Windows\system32\Belemd32.exe
        105⤵
        Drops file in System32 directory
        
        PID:1404
        
        C:\Windows\SysWOW64\Bfnnmg32.exe
        
        C:\Windows\system32\Bfnnmg32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5200
        
        C:\Windows\SysWOW64\Chddpn32.exe
        
        C:\Windows\system32\Chddpn32.exe
        107⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Cbihmg32.exe
        
        C:\Windows\system32\Cbihmg32.exe
        108⤵
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\Clbmfm32.exe
        
        C:\Windows\system32\Clbmfm32.exe
        109⤵
        Drops file in System32 directory
        
        PID:5640
        
        C:\Windows\SysWOW64\Cblebgfh.exe
        
        C:\Windows\system32\Cblebgfh.exe
        110⤵
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Cifmoa32.exe
        
        C:\Windows\system32\Cifmoa32.exe
        111⤵
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Cfjnhe32.exe
        
        C:\Windows\system32\Cfjnhe32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6016
        
        C:\Windows\SysWOW64\Chkjpm32.exe
        
        C:\Windows\system32\Chkjpm32.exe
        113⤵
        Modifies registry class
        
        PID:1576
        
        C:\Windows\SysWOW64\Cbqonf32.exe
        
        C:\Windows\system32\Cbqonf32.exe
        114⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Dijgjpip.exe
        
        C:\Windows\system32\Dijgjpip.exe
        115⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Dfngcdhi.exe
        
        C:\Windows\system32\Dfngcdhi.exe
        116⤵
        Modifies registry class
        
        PID:5600
        
        C:\Windows\SysWOW64\Dlkplk32.exe
        
        C:\Windows\system32\Dlkplk32.exe
        117⤵
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Dlnlak32.exe
        
        C:\Windows\system32\Dlnlak32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6012
        
        C:\Windows\SysWOW64\Defajqko.exe
        
        C:\Windows\system32\Defajqko.exe
        119⤵
        Drops file in System32 directory
        
        PID:5076
        
        C:\Windows\SysWOW64\Dlpigk32.exe
        
        C:\Windows\system32\Dlpigk32.exe
        120⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Doqbifpl.exe
        
        C:\Windows\system32\Doqbifpl.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Eifffoob.exe
        
        C:\Windows\system32\Eifffoob.exe
        122⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Eoconenj.exe
        
        C:\Windows\system32\Eoconenj.exe
        123⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Eeodqocd.exe
        
        C:\Windows\system32\Eeodqocd.exe
        124⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Eohhie32.exe
        
        C:\Windows\system32\Eohhie32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5868
        
        C:\Windows\SysWOW64\Ellicihn.exe
        
        C:\Windows\system32\Ellicihn.exe
        126⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Efampahd.exe
        
        C:\Windows\system32\Efampahd.exe
        127⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\Elnehifk.exe
        
        C:\Windows\system32\Elnehifk.exe
        128⤵
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Fgcjea32.exe
        
        C:\Windows\system32\Fgcjea32.exe
        129⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Flpbnh32.exe
        
        C:\Windows\system32\Flpbnh32.exe
        130⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Fbjjkble.exe
        
        C:\Windows\system32\Fbjjkble.exe
        131⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Fpnkdfko.exe
        
        C:\Windows\system32\Fpnkdfko.exe
        132⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Fekclnif.exe
        
        C:\Windows\system32\Fekclnif.exe
        133⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Fpqgjf32.exe
        
        C:\Windows\system32\Fpqgjf32.exe
        134⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Fempbm32.exe
        
        C:\Windows\system32\Fempbm32.exe
        135⤵
        Drops file in System32 directory
        
        PID:6496
        
        C:\Windows\SysWOW64\Fpcdof32.exe
        
        C:\Windows\system32\Fpcdof32.exe
        136⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Ggoiap32.exe
        
        C:\Windows\system32\Ggoiap32.exe
        137⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Gpgnjebd.exe
        
        C:\Windows\system32\Gpgnjebd.exe
        138⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Gomkkagl.exe
        
        C:\Windows\system32\Gomkkagl.exe
        139⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Giboijgb.exe
        
        C:\Windows\system32\Giboijgb.exe
        140⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Ggfobofl.exe
        
        C:\Windows\system32\Ggfobofl.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6764
        
        C:\Windows\SysWOW64\Ghgljg32.exe
        
        C:\Windows\system32\Ghgljg32.exe
        142⤵
        Modifies registry class
        
        PID:6804
        
        C:\Windows\SysWOW64\Gcmpgpkp.exe
        
        C:\Windows\system32\Gcmpgpkp.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6856
        
        C:\Windows\SysWOW64\Hpaqqdjj.exe
        
        C:\Windows\system32\Hpaqqdjj.exe
        144⤵
        Drops file in System32 directory
        
        PID:6892
        
        C:\Windows\SysWOW64\Hhleefhe.exe
        
        C:\Windows\system32\Hhleefhe.exe
        145⤵
        Modifies registry class
        
        PID:6936
        
        C:\Windows\SysWOW64\Hcaibo32.exe
        
        C:\Windows\system32\Hcaibo32.exe
        146⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Hjlaoioh.exe
        
        C:\Windows\system32\Hjlaoioh.exe
        147⤵
        Modifies registry class
        
        PID:7036
        
        C:\Windows\SysWOW64\Ioffhn32.exe
        
        C:\Windows\system32\Ioffhn32.exe
        148⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Ifqoehhl.exe
        
        C:\Windows\system32\Ifqoehhl.exe
        149⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Ioicnn32.exe
        
        C:\Windows\system32\Ioicnn32.exe
        150⤵
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Ifckkhfi.exe
        
        C:\Windows\system32\Ifckkhfi.exe
        151⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Jqhphq32.exe
        
        C:\Windows\system32\Jqhphq32.exe
        152⤵
        Drops file in System32 directory
        
        PID:6268
        
        C:\Windows\SysWOW64\Jfehpg32.exe
        
        C:\Windows\system32\Jfehpg32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6436
        
        C:\Windows\SysWOW64\Kfcdaehf.exe
        
        C:\Windows\system32\Kfcdaehf.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6492
        
        C:\Windows\SysWOW64\Kcgekjgp.exe
        
        C:\Windows\system32\Kcgekjgp.exe
        155⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Kgemahmg.exe
        
        C:\Windows\system32\Kgemahmg.exe
        156⤵
        Drops file in System32 directory
        
        PID:6628
        
        C:\Windows\SysWOW64\Kanbjn32.exe
        
        C:\Windows\system32\Kanbjn32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6704
        
        C:\Windows\SysWOW64\Kggjghkd.exe
        
        C:\Windows\system32\Kggjghkd.exe
        158⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Lpbokjho.exe
        
        C:\Windows\system32\Lpbokjho.exe
        159⤵
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Lfmghdpl.exe
        
        C:\Windows\system32\Lfmghdpl.exe
        160⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Lpelqj32.exe
        
        C:\Windows\system32\Lpelqj32.exe
        161⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Mdjjgggk.exe
        
        C:\Windows\system32\Mdjjgggk.exe
        162⤵
        Modifies registry class
        
        PID:7008
        
        C:\Windows\SysWOW64\Mdlgmgdh.exe
        
        C:\Windows\system32\Mdlgmgdh.exe
        163⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Mdodbf32.exe
        
        C:\Windows\system32\Mdodbf32.exe
        164⤵
        Drops file in System32 directory
        
        PID:5756
        
        C:\Windows\SysWOW64\Mfomda32.exe
        
        C:\Windows\system32\Mfomda32.exe
        165⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Mmiealgc.exe
        
        C:\Windows\system32\Mmiealgc.exe
        166⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Nkboeobh.exe
        
        C:\Windows\system32\Nkboeobh.exe
        167⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Ngipjp32.exe
        
        C:\Windows\system32\Ngipjp32.exe
        168⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Ndmpddfe.exe
        
        C:\Windows\system32\Ndmpddfe.exe
        169⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Ogbbqo32.exe
        
        C:\Windows\system32\Ogbbqo32.exe
        170⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Oahgnh32.exe
        
        C:\Windows\system32\Oahgnh32.exe
        171⤵
        Modifies registry class
        
        PID:2992
        
        C:\Windows\SysWOW64\Pgbkgmao.exe
        
        C:\Windows\system32\Pgbkgmao.exe
        172⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Pahpee32.exe
        
        C:\Windows\system32\Pahpee32.exe
        173⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Qhbhapha.exe
        
        C:\Windows\system32\Qhbhapha.exe
        174⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Ahgamo32.exe
        
        C:\Windows\system32\Ahgamo32.exe
        175⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Akgjnj32.exe
        
        C:\Windows\system32\Akgjnj32.exe
        176⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Ahkkhnpg.exe
        
        C:\Windows\system32\Ahkkhnpg.exe
        177⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Anhcpeon.exe
        
        C:\Windows\system32\Anhcpeon.exe
        178⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Ahngmnnd.exe
        
        C:\Windows\system32\Ahngmnnd.exe
        179⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Anjpeelk.exe
        
        C:\Windows\system32\Anjpeelk.exe
        180⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Addhbo32.exe
        
        C:\Windows\system32\Addhbo32.exe
        181⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Ajaqjfbp.exe
        
        C:\Windows\system32\Ajaqjfbp.exe
        182⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Bkamdi32.exe
        
        C:\Windows\system32\Bkamdi32.exe
        183⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Bqnemp32.exe
        
        C:\Windows\system32\Bqnemp32.exe
        184⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Bkcjjhgp.exe
        
        C:\Windows\system32\Bkcjjhgp.exe
        185⤵
        Drops file in System32 directory
        
        PID:4364
        
        C:\Windows\SysWOW64\Bbmbgb32.exe
        
        C:\Windows\system32\Bbmbgb32.exe
        186⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Bgjjoi32.exe
        
        C:\Windows\system32\Bgjjoi32.exe
        187⤵
        Modifies registry class
        
        PID:6328
        
        C:\Windows\SysWOW64\Bndblcdq.exe
        
        C:\Windows\system32\Bndblcdq.exe
        188⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Biigildg.exe
        
        C:\Windows\system32\Biigildg.exe
        189⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Bnfoac32.exe
        
        C:\Windows\system32\Bnfoac32.exe
        190⤵
        Drops file in System32 directory
        
        PID:7236
        
        C:\Windows\SysWOW64\Bdphnmjk.exe
        
        C:\Windows\system32\Bdphnmjk.exe
        191⤵
        Modifies registry class
        
        PID:7272
        
        C:\Windows\SysWOW64\Bjmpfdhb.exe
        
        C:\Windows\system32\Bjmpfdhb.exe
        192⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Cebdcmhh.exe
        
        C:\Windows\system32\Cebdcmhh.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7352
        
        C:\Windows\SysWOW64\Cbfema32.exe
        
        C:\Windows\system32\Cbfema32.exe
        194⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Cgcmeh32.exe
        
        C:\Windows\system32\Cgcmeh32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7444
        
        C:\Windows\SysWOW64\Calbnnkj.exe
        
        C:\Windows\system32\Calbnnkj.exe
        196⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Cbnknpqj.exe
        
        C:\Windows\system32\Cbnknpqj.exe
        197⤵
        Drops file in System32 directory
        
        PID:7528
        
        C:\Windows\SysWOW64\Dndlba32.exe
        
        C:\Windows\system32\Dndlba32.exe
        198⤵
        Drops file in System32 directory
        
        PID:7568
        
        C:\Windows\SysWOW64\Dijppjfd.exe
        
        C:\Windows\system32\Dijppjfd.exe
        199⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Djmima32.exe
        
        C:\Windows\system32\Djmima32.exe
        200⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Dnnoip32.exe
        
        C:\Windows\system32\Dnnoip32.exe
        201⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Dhfcae32.exe
        
        C:\Windows\system32\Dhfcae32.exe
        202⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Ebnddn32.exe
        
        C:\Windows\system32\Ebnddn32.exe
        203⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Ejiiippb.exe
        
        C:\Windows\system32\Ejiiippb.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7824
        
        C:\Windows\SysWOW64\Gikbneio.exe
        
        C:\Windows\system32\Gikbneio.exe
        205⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Gogjflhf.exe
        
        C:\Windows\system32\Gogjflhf.exe
        206⤵
        Drops file in System32 directory
        
        PID:7908
        
        C:\Windows\SysWOW64\Geabbfoc.exe
        
        C:\Windows\system32\Geabbfoc.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7988
        
        C:\Windows\SysWOW64\Hlgjko32.exe
        
        C:\Windows\system32\Hlgjko32.exe
        208⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Bqokhi32.exe
        
        C:\Windows\system32\Bqokhi32.exe
        209⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Bgicdc32.exe
        
        C:\Windows\system32\Bgicdc32.exe
        210⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Bnclamqe.exe
        
        C:\Windows\system32\Bnclamqe.exe
        211⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Bcpdidol.exe
        
        C:\Windows\system32\Bcpdidol.exe
        212⤵
        Drops file in System32 directory
        
        PID:7268
        
        C:\Windows\SysWOW64\Bjjmfn32.exe
        
        C:\Windows\system32\Bjjmfn32.exe
        213⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Bmhibi32.exe
        
        C:\Windows\system32\Bmhibi32.exe
        214⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Cgpjebcp.exe
        
        C:\Windows\system32\Cgpjebcp.exe
        215⤵
        Drops file in System32 directory
        
        PID:7484
        
        C:\Windows\SysWOW64\Cnjbbl32.exe
        
        C:\Windows\system32\Cnjbbl32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7556
        
        C:\Windows\SysWOW64\Cddjofbj.exe
        
        C:\Windows\system32\Cddjofbj.exe
        217⤵
        Drops file in System32 directory
        
        PID:7592
        
        C:\Windows\SysWOW64\Ccldebeo.exe
        
        C:\Windows\system32\Ccldebeo.exe
        218⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Dkgeao32.exe
        
        C:\Windows\system32\Dkgeao32.exe
        219⤵
        Drops file in System32 directory
        
        PID:7620
        
        C:\Windows\SysWOW64\Dqdnjfpc.exe
        
        C:\Windows\system32\Dqdnjfpc.exe
        220⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Dkokbn32.exe
        
        C:\Windows\system32\Dkokbn32.exe
        221⤵
        Modifies registry class
        
        PID:7960
        
        C:\Windows\SysWOW64\Dmphjfab.exe
        
        C:\Windows\system32\Dmphjfab.exe
        222⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Ecjpfp32.exe
        
        C:\Windows\system32\Ecjpfp32.exe
        223⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\Eghimo32.exe
        
        C:\Windows\system32\Eghimo32.exe
        224⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Enaaiifb.exe
        
        C:\Windows\system32\Enaaiifb.exe
        225⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\Eelifc32.exe
        
        C:\Windows\system32\Eelifc32.exe
        226⤵
        Modifies registry class
        
        PID:812
        
        C:\Windows\SysWOW64\Eepbabjj.exe
        
        C:\Windows\system32\Eepbabjj.exe
        227⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\Ejmkiiha.exe
        
        C:\Windows\system32\Ejmkiiha.exe
        228⤵
        Modifies registry class
        
        PID:8148
        
        C:\Windows\SysWOW64\Febogbhg.exe
        
        C:\Windows\system32\Febogbhg.exe
        229⤵
        Modifies registry class
        
        PID:4716
        
        C:\Windows\SysWOW64\Flmhclod.exe
        
        C:\Windows\system32\Flmhclod.exe
        230⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Fmndkd32.exe
        
        C:\Windows\system32\Fmndkd32.exe
        231⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Fchlhnlo.exe
        
        C:\Windows\system32\Fchlhnlo.exe
        232⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Fjbddh32.exe
        
        C:\Windows\system32\Fjbddh32.exe
        233⤵
        Drops file in System32 directory
        
        PID:7460
        
        C:\Windows\SysWOW64\Fmpaqd32.exe
        
        C:\Windows\system32\Fmpaqd32.exe
        234⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Fmejlcoj.exe
        
        C:\Windows\system32\Fmejlcoj.exe
        235⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\Fdobhm32.exe
        
        C:\Windows\system32\Fdobhm32.exe
        236⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Ghadjkhh.exe
        
        C:\Windows\system32\Ghadjkhh.exe
        237⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Gokmfe32.exe
        
        C:\Windows\system32\Gokmfe32.exe
        238⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Ghfnej32.exe
        
        C:\Windows\system32\Ghfnej32.exe
        239⤵
        Modifies registry class
        
        PID:7944
        
        C:\Windows\SysWOW64\Hhhkjj32.exe
        
        C:\Windows\system32\Hhhkjj32.exe
        240⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Hobcgdjm.exe
        
        C:\Windows\system32\Hobcgdjm.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:832
        
        C:\Windows\SysWOW64\Helkdnaj.exe
        
        C:\Windows\system32\Helkdnaj.exe
        242⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Hmhphqoe.exe
        
        C:\Windows\system32\Hmhphqoe.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1116
        
        C:\Windows\SysWOW64\Hhpaki32.exe
        
        C:\Windows\system32\Hhpaki32.exe
        244⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\Hoiihcde.exe
        
        C:\Windows\system32\Hoiihcde.exe
        245⤵
        Modifies registry class
        
        PID:8124
        
        C:\Windows\SysWOW64\Hdfapjbl.exe
        
        C:\Windows\system32\Hdfapjbl.exe
        246⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Ikpjmd32.exe
        
        C:\Windows\system32\Ikpjmd32.exe
        247⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Jliimf32.exe
        
        C:\Windows\system32\Jliimf32.exe
        248⤵
        Drops file in System32 directory
        
        PID:4556
        
        C:\Windows\SysWOW64\Jnjednnp.exe
        
        C:\Windows\system32\Jnjednnp.exe
        249⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Jddnah32.exe
        
        C:\Windows\system32\Jddnah32.exe
        250⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Jlkfbe32.exe
        
        C:\Windows\system32\Jlkfbe32.exe
        251⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\Jahnkl32.exe
        
        C:\Windows\system32\Jahnkl32.exe
        252⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Jakkplbc.exe
        
        C:\Windows\system32\Jakkplbc.exe
        253⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\Jhdcmf32.exe
        
        C:\Windows\system32\Jhdcmf32.exe
        254⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\Jookjpam.exe
        
        C:\Windows\system32\Jookjpam.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4560
        
        C:\Windows\SysWOW64\Jamhflqq.exe
        
        C:\Windows\system32\Jamhflqq.exe
        256⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\Jhgpbf32.exe
        
        C:\Windows\system32\Jhgpbf32.exe
        257⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Joahop32.exe
        
        C:\Windows\system32\Joahop32.exe
        258⤵
        Drops file in System32 directory
        
        PID:8032
        
        C:\Windows\SysWOW64\Jdnqgg32.exe
        
        C:\Windows\system32\Jdnqgg32.exe
        259⤵
        Drops file in System32 directory
        
        PID:3488
        
        C:\Windows\SysWOW64\Kkhidaeo.exe
        
        C:\Windows\system32\Kkhidaeo.exe
        260⤵
        Modifies registry class
        
        PID:3092
        
        C:\Windows\SysWOW64\Knfepldb.exe
        
        C:\Windows\system32\Knfepldb.exe
        261⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\Kdpmmf32.exe
        
        C:\Windows\system32\Kdpmmf32.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2516
        
        C:\Windows\SysWOW64\Kkjejqcl.exe
        
        C:\Windows\system32\Kkjejqcl.exe
        263⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Kfpjgi32.exe
        
        C:\Windows\system32\Kfpjgi32.exe
        264⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Klibdcjo.exe
        
        C:\Windows\system32\Klibdcjo.exe
        265⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\Knkokl32.exe
        
        C:\Windows\system32\Knkokl32.exe
        266⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\Kdeghfhj.exe
        
        C:\Windows\system32\Kdeghfhj.exe
        267⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Lhelddln.exe
        
        C:\Windows\system32\Lhelddln.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4636
        
        C:\Windows\SysWOW64\Lkchpoka.exe
        
        C:\Windows\system32\Lkchpoka.exe
        269⤵
        
        PID:748
        
        C:\Windows\SysWOW64\Loaafnah.exe
        
        C:\Windows\system32\Loaafnah.exe
        270⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\Lfkich32.exe
        
        C:\Windows\system32\Lfkich32.exe
        271⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\Locnlmoe.exe
        
        C:\Windows\system32\Locnlmoe.exe
        272⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Lfnfhg32.exe
        
        C:\Windows\system32\Lfnfhg32.exe
        273⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\Lmhnea32.exe
        
        C:\Windows\system32\Lmhnea32.exe
        274⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Lfpcngdo.exe
        
        C:\Windows\system32\Lfpcngdo.exe
        275⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Lkmkfncf.exe
        
        C:\Windows\system32\Lkmkfncf.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4612
        
        C:\Windows\SysWOW64\Lbgcch32.exe
        
        C:\Windows\system32\Lbgcch32.exe
        277⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Mbiphhhq.exe
        
        C:\Windows\system32\Mbiphhhq.exe
        278⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Micheb32.exe
        
        C:\Windows\system32\Micheb32.exe
        279⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\Mnpami32.exe
        
        C:\Windows\system32\Mnpami32.exe
        280⤵
        
        PID:232
        
        C:\Windows\SysWOW64\Mkdagm32.exe
        
        C:\Windows\system32\Mkdagm32.exe
        281⤵
        Drops file in System32 directory
        
        PID:536
        
        C:\Windows\SysWOW64\Mbnjcg32.exe
        
        C:\Windows\system32\Mbnjcg32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3648
        
        C:\Windows\SysWOW64\Mpdgbkab.exe
        
        C:\Windows\system32\Mpdgbkab.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3576
        
        C:\Windows\SysWOW64\Nfnooe32.exe
        
        C:\Windows\system32\Nfnooe32.exe
        284⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\Nmhglopl.exe
        
        C:\Windows\system32\Nmhglopl.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3148
        
        C:\Windows\SysWOW64\Nnidcg32.exe
        
        C:\Windows\system32\Nnidcg32.exe
        286⤵
        Modifies registry class
        
        PID:1376
        
        C:\Windows\SysWOW64\Nfpled32.exe
        
        C:\Windows\system32\Nfpled32.exe
        287⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\Nblfee32.exe
        
        C:\Windows\system32\Nblfee32.exe
        288⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Nifnao32.exe
        
        C:\Windows\system32\Nifnao32.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7340
        
        C:\Windows\SysWOW64\Nppfnige.exe
        
        C:\Windows\system32\Nppfnige.exe
        290⤵
        Modifies registry class
        
        PID:2784
        
        C:\Windows\SysWOW64\Ofjokc32.exe
        
        C:\Windows\system32\Ofjokc32.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1092
        
        C:\Windows\SysWOW64\Oihkgo32.exe
        
        C:\Windows\system32\Oihkgo32.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1028
        
        C:\Windows\SysWOW64\Onecof32.exe
        
        C:\Windows\system32\Onecof32.exe
        293⤵
        Modifies registry class
        
        PID:2916
        
        C:\Windows\SysWOW64\Oeoklp32.exe
        
        C:\Windows\system32\Oeoklp32.exe
        294⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\Olidijjf.exe
        
        C:\Windows\system32\Olidijjf.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2108
        
        C:\Windows\SysWOW64\Oeahap32.exe
        
        C:\Windows\system32\Oeahap32.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3292
        
        C:\Windows\SysWOW64\Opgloh32.exe
        
        C:\Windows\system32\Opgloh32.exe
        297⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Ofadlbhj.exe
        
        C:\Windows\system32\Ofadlbhj.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7476
        
        C:\Windows\SysWOW64\Omkmhlpf.exe
        
        C:\Windows\system32\Omkmhlpf.exe
        299⤵
        
        PID:764
        
        C:\Windows\SysWOW64\Opiidhoj.exe
        
        C:\Windows\system32\Opiidhoj.exe
        300⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\Oefamoma.exe
        
        C:\Windows\system32\Oefamoma.exe
        301⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Olpjii32.exe
        
        C:\Windows\system32\Olpjii32.exe
        302⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\Pbjbfclk.exe
        
        C:\Windows\system32\Pbjbfclk.exe
        303⤵
        Modifies registry class
        
        PID:2988
        
        C:\Windows\SysWOW64\Pehnboko.exe
        
        C:\Windows\system32\Pehnboko.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4408
        
        C:\Windows\SysWOW64\Ppnbpg32.exe
        
        C:\Windows\system32\Ppnbpg32.exe
        305⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\Pfhklabb.exe
        
        C:\Windows\system32\Pfhklabb.exe
        306⤵
        Drops file in System32 directory
        
        PID:3880
        
        C:\Windows\SysWOW64\Pifghmae.exe
        
        C:\Windows\system32\Pifghmae.exe
        307⤵
        Modifies registry class
        
        PID:1696
        
        C:\Windows\SysWOW64\Pppoeg32.exe
        
        C:\Windows\system32\Pppoeg32.exe
        308⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Pfjgbapo.exe
        
        C:\Windows\system32\Pfjgbapo.exe
        309⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Pmdpok32.exe
        
        C:\Windows\system32\Pmdpok32.exe
        310⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\Pbahgbfc.exe
        
        C:\Windows\system32\Pbahgbfc.exe
        311⤵
        Modifies registry class
        
        PID:2508
        
        C:\Windows\SysWOW64\Pikqcl32.exe
        
        C:\Windows\system32\Pikqcl32.exe
        312⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\Pbcelacq.exe
        
        C:\Windows\system32\Pbcelacq.exe
        313⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Pimmil32.exe
        
        C:\Windows\system32\Pimmil32.exe
        314⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\Ppgeff32.exe
        
        C:\Windows\system32\Ppgeff32.exe
        315⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:208
        
        C:\Windows\SysWOW64\Qipjokik.exe
        
        C:\Windows\system32\Qipjokik.exe
        316⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Qpibke32.exe
        
        C:\Windows\system32\Qpibke32.exe
        317⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Qfcjhphd.exe
        
        C:\Windows\system32\Qfcjhphd.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Qmnbej32.exe
        
        C:\Windows\system32\Qmnbej32.exe
        319⤵
        Modifies registry class
        
        PID:1580
        
        C:\Windows\SysWOW64\Abjkmqni.exe
        
        C:\Windows\system32\Abjkmqni.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5752
        
        C:\Windows\SysWOW64\Aidcjk32.exe
        
        C:\Windows\system32\Aidcjk32.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5284
        
        C:\Windows\SysWOW64\Apnkfelb.exe
        
        C:\Windows\system32\Apnkfelb.exe
        322⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Abmhbplf.exe
        
        C:\Windows\system32\Abmhbplf.exe
        323⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\Amblpikl.exe
        
        C:\Windows\system32\Amblpikl.exe
        324⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Aochga32.exe
        
        C:\Windows\system32\Aochga32.exe
        325⤵
        Drops file in System32 directory
        
        PID:5784
        
        C:\Windows\SysWOW64\Aemqdk32.exe
        
        C:\Windows\system32\Aemqdk32.exe
        326⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Amdiei32.exe
        
        C:\Windows\system32\Amdiei32.exe
        327⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Aofemaog.exe
        
        C:\Windows\system32\Aofemaog.exe
        328⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Aikijjon.exe
        
        C:\Windows\system32\Aikijjon.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Apeagd32.exe
        
        C:\Windows\system32\Apeagd32.exe
        330⤵
        Drops file in System32 directory
        
        PID:5320
        
        C:\Windows\SysWOW64\Agojdnng.exe
        
        C:\Windows\system32\Agojdnng.exe
        331⤵
        Drops file in System32 directory
        
        PID:5700
        
        C:\Windows\SysWOW64\Amibqhed.exe
        
        C:\Windows\system32\Amibqhed.exe
        332⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Bcfkiock.exe
        
        C:\Windows\system32\Bcfkiock.exe
        333⤵
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Bedgejbo.exe
        
        C:\Windows\system32\Bedgejbo.exe
        334⤵
        Modifies registry class
        
        PID:2604
        
        C:\Windows\SysWOW64\Bpjkbcbe.exe
        
        C:\Windows\system32\Bpjkbcbe.exe
        335⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Bgdcom32.exe
        
        C:\Windows\system32\Bgdcom32.exe
        336⤵
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Blqlgdhi.exe
        
        C:\Windows\system32\Blqlgdhi.exe
        337⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Bckddn32.exe
        
        C:\Windows\system32\Bckddn32.exe
        338⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Bidlqhgc.exe
        
        C:\Windows\system32\Bidlqhgc.exe
        339⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Bpodmb32.exe
        
        C:\Windows\system32\Bpodmb32.exe
        340⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Bekmei32.exe
        
        C:\Windows\system32\Bekmei32.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5308
        
        C:\Windows\SysWOW64\Bleebc32.exe
        
        C:\Windows\system32\Bleebc32.exe
        342⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\Bcomonkq.exe
        
        C:\Windows\system32\Bcomonkq.exe
        343⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Bjielh32.exe
        
        C:\Windows\system32\Bjielh32.exe
        344⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Djeegf32.exe
        
        C:\Windows\system32\Djeegf32.exe
        345⤵
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Dobnpm32.exe
        
        C:\Windows\system32\Dobnpm32.exe
        346⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Dflflg32.exe
        
        C:\Windows\system32\Dflflg32.exe
        347⤵
        Drops file in System32 directory
        
        PID:5968
        
        C:\Windows\SysWOW64\Dlfniafa.exe
        
        C:\Windows\system32\Dlfniafa.exe
        348⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Dcpffk32.exe
        
        C:\Windows\system32\Dcpffk32.exe
        349⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Dmhkoaco.exe
        
        C:\Windows\system32\Dmhkoaco.exe
        350⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Dcdpakii.exe
        
        C:\Windows\system32\Dcdpakii.exe
        351⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Dfclmfhl.exe
        
        C:\Windows\system32\Dfclmfhl.exe
        352⤵
        Drops file in System32 directory
        
        PID:6052
        
        C:\Windows\SysWOW64\Dqhpjohb.exe
        
        C:\Windows\system32\Dqhpjohb.exe
        353⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Dgbhgi32.exe
        
        C:\Windows\system32\Dgbhgi32.exe
        354⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Enlqdc32.exe
        
        C:\Windows\system32\Enlqdc32.exe
        355⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Eciilj32.exe
        
        C:\Windows\system32\Eciilj32.exe
        356⤵
        Drops file in System32 directory
        
        PID:5396
        
        C:\Windows\SysWOW64\Enomic32.exe
        
        C:\Windows\system32\Enomic32.exe
        357⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Eckfaj32.exe
        
        C:\Windows\system32\Eckfaj32.exe
        358⤵
        Modifies registry class
        
        PID:5836
        
        C:\Windows\SysWOW64\Ejennd32.exe
        
        C:\Windows\system32\Ejennd32.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5952
        
        C:\Windows\SysWOW64\Eqpfknbj.exe
        
        C:\Windows\system32\Eqpfknbj.exe
        360⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Egiohh32.exe
        
        C:\Windows\system32\Egiohh32.exe
        361⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Emfgpo32.exe
        
        C:\Windows\system32\Emfgpo32.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5976
        
        C:\Windows\SysWOW64\Ecpomiok.exe
        
        C:\Windows\system32\Ecpomiok.exe
        363⤵
        Drops file in System32 directory
        
        PID:5552
        
        C:\Windows\SysWOW64\Ejjgic32.exe
        
        C:\Windows\system32\Ejjgic32.exe
        364⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Eqdpfm32.exe
        
        C:\Windows\system32\Eqdpfm32.exe
        365⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Egnhcgeb.exe
        
        C:\Windows\system32\Egnhcgeb.exe
        366⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Fnhppa32.exe
        
        C:\Windows\system32\Fnhppa32.exe
        367⤵
        Modifies registry class
        
        PID:8208
        
        C:\Windows\SysWOW64\Fpimgjbm.exe
        
        C:\Windows\system32\Fpimgjbm.exe
        368⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Fgqehgco.exe
        
        C:\Windows\system32\Fgqehgco.exe
        369⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Fnjmea32.exe
        
        C:\Windows\system32\Fnjmea32.exe
        370⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Fplimi32.exe
        
        C:\Windows\system32\Fplimi32.exe
        371⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Fjanjb32.exe
        
        C:\Windows\system32\Fjanjb32.exe
        372⤵
        Drops file in System32 directory
        
        PID:8416
        
        C:\Windows\SysWOW64\Fakfglhm.exe
        
        C:\Windows\system32\Fakfglhm.exe
        373⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Fgencf32.exe
        
        C:\Windows\system32\Fgencf32.exe
        374⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Fnofpqff.exe
        
        C:\Windows\system32\Fnofpqff.exe
        375⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Fanbll32.exe
        
        C:\Windows\system32\Fanbll32.exe
        376⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Fggkifmg.exe
        
        C:\Windows\system32\Fggkifmg.exe
        377⤵
        Modifies registry class
        
        PID:8620
        
        C:\Windows\SysWOW64\Fnacfp32.exe
        
        C:\Windows\system32\Fnacfp32.exe
        378⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Fpbpmhjb.exe
        
        C:\Windows\system32\Fpbpmhjb.exe
        379⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Ggjgofkd.exe
        
        C:\Windows\system32\Ggjgofkd.exe
        380⤵
        Modifies registry class
        
        PID:8752
        
        C:\Windows\SysWOW64\Gndpkp32.exe
        
        C:\Windows\system32\Gndpkp32.exe
        381⤵
        Modifies registry class
        
        PID:8788
        
        C:\Windows\SysWOW64\Gpelchhp.exe
        
        C:\Windows\system32\Gpelchhp.exe
        382⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Gjkqpa32.exe
        
        C:\Windows\system32\Gjkqpa32.exe
        383⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Gadimkpb.exe
        
        C:\Windows\system32\Gadimkpb.exe
        384⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Ggoaje32.exe
        
        C:\Windows\system32\Ggoaje32.exe
        385⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Gnhifonl.exe
        
        C:\Windows\system32\Gnhifonl.exe
        386⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Gpjfng32.exe
        
        C:\Windows\system32\Gpjfng32.exe
        387⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Gfcnka32.exe
        
        C:\Windows\system32\Gfcnka32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9080
        
        C:\Windows\SysWOW64\Gnkflo32.exe
        
        C:\Windows\system32\Gnkflo32.exe
        389⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Gcgndf32.exe
        
        C:\Windows\system32\Gcgndf32.exe
        390⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Gjagapbn.exe
        
        C:\Windows\system32\Gjagapbn.exe
        391⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Galonj32.exe
        
        C:\Windows\system32\Galonj32.exe
        392⤵
        Drops file in System32 directory
        
        PID:6024
        
        C:\Windows\SysWOW64\Hhegjdag.exe
        
        C:\Windows\system32\Hhegjdag.exe
        393⤵
        Drops file in System32 directory
        
        PID:8252
        
        C:\Windows\SysWOW64\Hnpognhd.exe
        
        C:\Windows\system32\Hnpognhd.exe
        394⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Hpqlof32.exe
        
        C:\Windows\system32\Hpqlof32.exe
        395⤵
        Drops file in System32 directory
        
        PID:8364
        
        C:\Windows\SysWOW64\Hfkdkqeo.exe
        
        C:\Windows\system32\Hfkdkqeo.exe
        396⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Hpchdf32.exe
        
        C:\Windows\system32\Hpchdf32.exe
        397⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5948
        
        C:\Windows\SysWOW64\Hfmqapcl.exe
        
        C:\Windows\system32\Hfmqapcl.exe
        398⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Habeni32.exe
        
        C:\Windows\system32\Habeni32.exe
        399⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Hhmmkcko.exe
        
        C:\Windows\system32\Hhmmkcko.exe
        400⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Hmifcjif.exe
        
        C:\Windows\system32\Hmifcjif.exe
        401⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Hdcnpd32.exe
        
        C:\Windows\system32\Hdcnpd32.exe
        402⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Hjmfmnhp.exe
        
        C:\Windows\system32\Hjmfmnhp.exe
        403⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Ipjoee32.exe
        
        C:\Windows\system32\Ipjoee32.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8784
        
        C:\Windows\SysWOW64\Ijpcbn32.exe
        
        C:\Windows\system32\Ijpcbn32.exe
        405⤵
        Modifies registry class
        
        PID:6364
        
        C:\Windows\SysWOW64\Imnoni32.exe
        
        C:\Windows\system32\Imnoni32.exe
        406⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Ihcclb32.exe
        
        C:\Windows\system32\Ihcclb32.exe
        407⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Ikbphn32.exe
        
        C:\Windows\system32\Ikbphn32.exe
        408⤵
        Drops file in System32 directory
        
        PID:8980
        
        C:\Windows\SysWOW64\Ipohpdbb.exe
        
        C:\Windows\system32\Ipohpdbb.exe
        409⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Iophnl32.exe
        
        C:\Windows\system32\Iophnl32.exe
        410⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Ipaeedpp.exe
        
        C:\Windows\system32\Ipaeedpp.exe
        411⤵
        Modifies registry class
        
        PID:9152
        
        C:\Windows\SysWOW64\Igkmbn32.exe
        
        C:\Windows\system32\Igkmbn32.exe
        412⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Iaqapggb.exe
        
        C:\Windows\system32\Iaqapggb.exe
        413⤵
        Modifies registry class
        
        PID:6580
        
        C:\Windows\SysWOW64\Ihkila32.exe
        
        C:\Windows\system32\Ihkila32.exe
        414⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Iodaikfl.exe
        
        C:\Windows\system32\Iodaikfl.exe
        415⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Jpfnqc32.exe
        
        C:\Windows\system32\Jpfnqc32.exe
        416⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Jkkbnl32.exe
        
        C:\Windows\system32\Jkkbnl32.exe
        417⤵
        Drops file in System32 directory
        
        PID:8448
        
        C:\Windows\SysWOW64\Jaekkfcm.exe
        
        C:\Windows\system32\Jaekkfcm.exe
        418⤵
        Modifies registry class
        
        PID:4464
        
        C:\Windows\SysWOW64\Jddggb32.exe
        
        C:\Windows\system32\Jddggb32.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8568
        
        C:\Windows\SysWOW64\Jknocljn.exe
        
        C:\Windows\system32\Jknocljn.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6860
        
        C:\Windows\SysWOW64\Jpjhlche.exe
        
        C:\Windows\system32\Jpjhlche.exe
        421⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Jgdphm32.exe
        
        C:\Windows\system32\Jgdphm32.exe
        422⤵
        Modifies registry class
        
        PID:8732
        
        C:\Windows\SysWOW64\Jmnheggo.exe
        
        C:\Windows\system32\Jmnheggo.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6324
        
        C:\Windows\SysWOW64\Jdhpba32.exe
        
        C:\Windows\system32\Jdhpba32.exe
        424⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8848
        
        C:\Windows\SysWOW64\Jkbhok32.exe
        
        C:\Windows\system32\Jkbhok32.exe
        425⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Jpoagb32.exe
        
        C:\Windows\system32\Jpoagb32.exe
        426⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Jhfihp32.exe
        
        C:\Windows\system32\Jhfihp32.exe
        427⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Jopaejlo.exe
        
        C:\Windows\system32\Jopaejlo.exe
        428⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Kdmjmqjf.exe
        
        C:\Windows\system32\Kdmjmqjf.exe
        429⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Knenffqf.exe
        
        C:\Windows\system32\Knenffqf.exe
        430⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Kdpfbp32.exe
        
        C:\Windows\system32\Kdpfbp32.exe
        431⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Kojdkhdd.exe
        
        C:\Windows\system32\Kojdkhdd.exe
        432⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Lqbgcp32.exe
        
        C:\Windows\system32\Lqbgcp32.exe
        433⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Lglopjkg.exe
        
        C:\Windows\system32\Lglopjkg.exe
        434⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Lnfgmc32.exe
        
        C:\Windows\system32\Lnfgmc32.exe
        435⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Lhkkjl32.exe
        
        C:\Windows\system32\Lhkkjl32.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6356
        
        C:\Windows\SysWOW64\Loecgfjf.exe
        
        C:\Windows\system32\Loecgfjf.exe
        437⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Lqfpoope.exe
        
        C:\Windows\system32\Lqfpoope.exe
        438⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Lhnhplpg.exe
        
        C:\Windows\system32\Lhnhplpg.exe
        439⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Mnjqhcno.exe
        
        C:\Windows\system32\Mnjqhcno.exe
        440⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Mddidm32.exe
        
        C:\Windows\system32\Mddidm32.exe
        441⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Mkoaagmh.exe
        
        C:\Windows\system32\Mkoaagmh.exe
        442⤵
        Modifies registry class
        
        PID:8232
        
        C:\Windows\SysWOW64\Mbhina32.exe
        
        C:\Windows\system32\Mbhina32.exe
        443⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6504
        
        C:\Windows\SysWOW64\Moljgeco.exe
        
        C:\Windows\system32\Moljgeco.exe
        444⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\Mbkfcabb.exe
        
        C:\Windows\system32\Mbkfcabb.exe
        445⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Mggolhaj.exe
        
        C:\Windows\system32\Mggolhaj.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8532
        
        C:\Windows\SysWOW64\Mglhgg32.exe
        
        C:\Windows\system32\Mglhgg32.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6624
        
        C:\Windows\SysWOW64\Nkjqme32.exe
        
        C:\Windows\system32\Nkjqme32.exe
        448⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Nbdijpjh.exe
        
        C:\Windows\system32\Nbdijpjh.exe
        449⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Ninafj32.exe
        
        C:\Windows\system32\Ninafj32.exe
        450⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Nohicdia.exe
        
        C:\Windows\system32\Nohicdia.exe
        451⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6312
        
        C:\Windows\SysWOW64\Nnmfdpni.exe
        
        C:\Windows\system32\Nnmfdpni.exe
        452⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Nqnofkkj.exe
        
        C:\Windows\system32\Nqnofkkj.exe
        453⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Onbpop32.exe
        
        C:\Windows\system32\Onbpop32.exe
        454⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Oelhljaq.exe
        
        C:\Windows\system32\Oelhljaq.exe
        455⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Okfpid32.exe
        
        C:\Windows\system32\Okfpid32.exe
        456⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 400
        457⤵
        Program crash
        
        PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:7980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1048 -ip 1048
1⤵
PID:6804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aioebj32.exe

Filesize
259KB

MD5
f581f50553a8c8d5faeb1cf5da4402e5

SHA1
610fb4aaf37f843144eafde39df59454eda5b9aa

SHA256
e7efa2dbf50493ab42349d0b4efdc2e08f3eb1ee822f2874c4195db88ae51191

SHA512
7c9f583688fed6f0c6b025a6ceb26170ee0a2d96919ab6e05a8895ff588edf306c5cb66a43eb6742fb26348a523a8674107ebec2b55cdc6e0f6a2f1871faa8c3

Download Submit
C:\Windows\SysWOW64\Alpnde32.exe

Filesize
259KB

MD5
625b9236ab6d96d8291ed054b16582a6

SHA1
0e0c13d341e72a5cd5312f25fc170f11e35b0361

SHA256
c09f0f747f698e18dd1c98c027e37b476796bde5f7046af29dc4811e58f794a9

SHA512
fecc6bd3d9ca7bfccd986695469f2cb5468b0ca0e7ce8924350b473502c5a071e1ec40c19ff11a954c62f9db812680f3358de21f9b08d4e48a3a86e785105c96

Download Submit
C:\Windows\SysWOW64\Apddce32.exe

Filesize
259KB

MD5
4b575c1b3203b63e05d8f9272db60c4b

SHA1
2f35764771043ca24fd2103edcf09021e2ba07b0

SHA256
8b5cfc612d7670d82cbc5f5ff47a71fcf69a6b55ee07986bbe8476f772d97308

SHA512
2f063fdb89dbc6b033eae4bf48fb748a660d8d2be59f5bdffbd1a2e9f7cd7d9f27a13073522e0801ba597a63d62ccaf0238c3daf90193e79db629a339b899343

Download Submit
C:\Windows\SysWOW64\Bemlhj32.exe

Filesize
259KB

MD5
59052793d228fa6f92d6a5f4aa712498

SHA1
51c1a00ee227b4c7946bd5c906f2190e7b77f3af

SHA256
b635a304a8ce9a2c973c15f5d0d84ccf25983c1b7042ed85e132e798a0579635

SHA512
6f0d3b74eb329b5b85a6724a4d8e760d37255dac3349bdedf54790c2dcde9e823d91b8412235b1f7cf748fa1f4076c67d6802e5f60b9528701cac7b1415a9da6

Download Submit
C:\Windows\SysWOW64\Bflham32.exe

Filesize
259KB

MD5
fe7e76d5e293a5427e26c561462bff40

SHA1
01d77c661db4cc889638b0c4cc95748586fb6a9f

SHA256
98f4ab49227f46dbcdfe989567fd4b42a127cf0c915903c20f9dca5adaf78150

SHA512
f141f786995acb03d3c9d5af2482aae01f02ef2bd959021800a15fb2e4b5d2803af73e12d85d36152a43a5b6ab5bfa9665341566f5c6d9ceea696010aac8af44

Download Submit
C:\Windows\SysWOW64\Bidlqhgc.exe

Filesize
259KB

MD5
264289913f18dd2e6e841dce3473f872

SHA1
b74c484ab44628675aa33d85b80476aee3473de5

SHA256
359667f38604d23ff2613958ccbb25c8746e9ba73699f4d7d6b53ef42089d3c8

SHA512
6df4da5b15915607a2aa8d43b16fc050c2ce1d80be30841fc8cc10f24ad7c99d1d55a6ec0b9c46346182f24ddef75b9fde2711516a3fd2664f07a23cfc590265

Download Submit
C:\Windows\SysWOW64\Bmagch32.exe

Filesize
259KB

MD5
2a8b826087b491195e90fe08c581cdde

SHA1
600e8d76c7abc0215f81201327c70bc04992a34d

SHA256
9e914904fbe847a0ef26cc9d1e6db4034578a205edce9ac832cb4fd3c5e1fa8e

SHA512
30194d163ca39345517cc91a4c1fdef819bc9e69d79032e0c6c23b1d12ff88612e0101f9fbc958062f8526d47be493a4adda1bc6e4b82b91ea5bec753cb6082b

Download Submit
C:\Windows\SysWOW64\Bpemkcck.exe

Filesize
259KB

MD5
77f23aa98697331a5c1909b4939c2687

SHA1
2acc35a0b7680b0a565c045e32064af326e40035

SHA256
01f990b8cd260c1ca89af4c518d05aa17873dd311bb715b0e1daa7c42551dbe8

SHA512
17ba2b35339dc0bcecbeea8a5717d62b581a50f453e453b2e5de99fead9df4c0c8fe0f2c873c9ca72e443320ffa0749be7f41dcdc60979af296d0252a47d503b

Download Submit
C:\Windows\SysWOW64\Cbaehl32.exe

Filesize
259KB

MD5
e131e78f4501aff2035bd12662b67385

SHA1
09fd889a3372d8312aa3483d80979fa9be75dadf

SHA256
3b1698d9ee92fec55f32bab6e66a1b46d634944cf00dedeeb65675fdf63c43ff

SHA512
a5ea6739916decc023ce288f7dec3aa3317ff5363c317754bd0a731cf548cd3e08ec6b5af7a4b8cf678e3b00e129bb36a5de296a4ecc36e78e7f078a0577b7c6

Download Submit
C:\Windows\SysWOW64\Cbhbbn32.exe

Filesize
259KB

MD5
54d8bfa57f26095964201fc7796b06e9

SHA1
bf0fc209aac66c7635914578b58f0a487f5df6e4

SHA256
22683fa726785e583604fe5c78253f484055303b3a310e008c8fd7669c5bda39

SHA512
34465b47fd9f1aed73f4ce92f123f42128e4752928d6f3d16c44841074312aee8fde2aba01edc2eabfb196ae92541cbe9a51064383141eccb346ef708ab7728d

Download Submit
C:\Windows\SysWOW64\Cddjofbj.exe

Filesize
259KB

MD5
337d0c7f63645f2795a71238f2f36558

SHA1
6e8019ea3a69f64297cb728b59c8201186142ead

SHA256
5dae0716dd01640e14d824dffb922e404ea68d6145fbe2f3dc54d5ac654881a9

SHA512
2477ebe6c3e97a70068c825300260f40f8236a870ad699885207f21f35ebc9c7293002c10d2c823564edebbbf48979f9cb9af1e8fcf8858cf30f48164d8b4ced

Download Submit
C:\Windows\SysWOW64\Cmbpjfij.exe

Filesize
259KB

MD5
6c8028c841d8d823b6166aec4d1b6098

SHA1
8ddb9b509a1b6ee600a1e3db7a320b6fb05b0945

SHA256
71cc6b77b3a5f3c89d81ecfa0adba831eaa0ae48be0d533e12c726239ec5c307

SHA512
b5f4ec3d5482793bfc8bbc55dae9fbade79c3279257cdb95ced117a51a0a7a23549a33be13b2f28d7f79b5c4cc3f6b1ab6fb9b1507ab1940926a2328b1015e3e

Download Submit
C:\Windows\SysWOW64\Cmmgof32.exe

Filesize
259KB

MD5
4a441158f6aaff212640b9c9c187adb8

SHA1
116b187da12c88bfc34c6f6de7ead67508f6aee0

SHA256
0ca61dea1c4c1b75c9841583c79645f6f77ade79d9d94e0ebc30f6a0aaea41da

SHA512
e508eda49f20ca4ef2d696bd191f68882d6d46613a164be3629c04901b90fbe6f215037b61b799451f3bafda4fbd0484b75aa87cbd8b0f707b142c02ee9ed519

Download Submit
C:\Windows\SysWOW64\Dbcbnlcl.exe

Filesize
259KB

MD5
78d1b8ea02421b144ffc84543cca7f1c

SHA1
75daef16b06c95bf0a100667e3ffa9bfe8ab939e

SHA256
d104d8dd9961eb43723c55965eccf890b88c25d26bc3592af90097124303fd44

SHA512
7fe5994f5850e3a32885705e3b0ebd3a7f6a794352d907da4216464e7f972bc74a02e533709c06996944d1b21c65e318742ed6c3328cfa9e641d223d57410910

Download Submit
C:\Windows\SysWOW64\Deidjf32.exe

Filesize
259KB

MD5
3642877a27c843019965967d2489cca6

SHA1
b1038417691101d53e2b785dac3c85c5ee134e37

SHA256
fa5e388d902e2ba80127ccbd51e0b9ff0c4126805cdb1568ae39e759f74b0e2c

SHA512
f6aeea1daea598d9c922ab26d552eaba9ae310a4c54098aa5ea6278a259b99121a5c233f76cf1888ab7d57833d087c3cfe27dbb56e9071d7e429ccdccc4cd5e9

Download Submit
C:\Windows\SysWOW64\Dfakcj32.exe

Filesize
259KB

MD5
50b1754f41af567c6de6c923d0a3aefb

SHA1
5509cfcf0b04cd912b0e55918bc1b35131b568ce

SHA256
1e028038cf4216109612ce327cf675ce6ff8ad096b0cc2ff5615c905ea116f2f

SHA512
f4312d0622edcdb4323d2be3e43bc6fc5d39e0e7418553ae5f6273dd9ac483729b9f66c0e76568c7b88bcb27f64c23ce8798eacaa3fa632509d3e7a553dd301f

Download Submit
C:\Windows\SysWOW64\Dmnpfd32.exe

Filesize
259KB

MD5
b835ab22c9e8d7103c1d4cb91f0770f3

SHA1
bb5e60f6d147bf3b94084bccbf90272c211234e5

SHA256
e152234743d7a320c4cee29e2d4a0177526362002d42053447804042807f5589

SHA512
0be5dc7886634af313b89eced5b6953bc21c75a07031d79fa2d622b99de4a48ba475c37b57ad2a1c1e922379d40a90871ce7a29cfd02ae709a8514984fc7209f

Download Submit
C:\Windows\SysWOW64\Dpoiho32.exe

Filesize
259KB

MD5
02bccf3a40620e0c9a77c23df50b69c4

SHA1
ada7bdf58113dffc3f9a0d71c0474060266e589b

SHA256
d65c83418a7ad318896e55ad9fb966c4774f102a340a0654c4622359b2f5597e

SHA512
2e535f63b2d01f9d9242f3bc33deae5707db0fc733ca1b1f2328c86b2d24c4e920a6b49d281db11ee0c17adc83b4409ee0232ec46531e902d58646be8b0bd0fc

Download Submit
C:\Windows\SysWOW64\Eepkkefp.exe

Filesize
259KB

MD5
7e52173847694aefff3bc0324b29fd9c

SHA1
ed8fc9bbcab5beab214bcf9faea6fd4aadde0a26

SHA256
c438097b0f1fe8d887ccb77852369d39fd2832201e0e445dee33e6d6c33fdc07

SHA512
f789c6cdd31d153d557d6bf6d21d6ff960dcf99ebbd8c6cbaedb69027f1f28ffe1667cf913bfeefaad3080c466d2109d7bfe5a63b34b7a26be237aea24487571

Download Submit
C:\Windows\SysWOW64\Eghimo32.exe

Filesize
259KB

MD5
d3a4b9116da47b9b41f943ad81309b3c

SHA1
100657e6d77321729d1d9f1ffe8a99bc01b52419

SHA256
523fad9e8e4dc19fbf46e5a96dbbf4d25d1239a677ff3d9d5a4b335d0b69cc25

SHA512
fe9a3450e19301b8f62e0fdf03770d9d0ce32be6452c5f1a603d2bda70dba8d595c4cd1b8664fd7a96695403c23180ae19b3abe77f44466ba99e777f43011349

Download Submit
C:\Windows\SysWOW64\Eleimp32.exe

Filesize
259KB

MD5
971b8aedfa7c1ec871430e6bf346ee38

SHA1
69dbbd8b6424722b057e3f3049d454c9e0e69d48

SHA256
155f96395a6113e0f0bf2f4acd583c60e0c1659f6e3f4355963a2550bfa203b5

SHA512
8970c6b0e4f19933398a8ef1ddc891adf7ae6914e09a3ad6ff937d7a39570fd20f30b03a4efdeb913c18f8e86b94fd37cbab07f0a2d953fde04b5844a620c779

Download Submit
C:\Windows\SysWOW64\Emeffcid.exe

Filesize
259KB

MD5
a09b1731bc7eeed2b57cc45acaaf1400

SHA1
215ee1d8b373a07bfb49828897bf6962826eccfd

SHA256
fe22b8a711e8ab0a5cb62f7f8bd1378b04e5cdeeaea0a7ad9fb854d64204dd6a

SHA512
e2a969ab23f8c8e7900cf9ccd9a3e0f96d801d361b35d8d22d01697c85cae73c4d245b4733a928449c5ec1230308e7dfb38ce3e4b5b8d5087fccdd9f353736e7

Download Submit
C:\Windows\SysWOW64\Emioab32.exe

Filesize
259KB

MD5
3df43c6170c87e62de15f43d345474b1

SHA1
ee1529c624cda2660f6b2ed4f5f3e8f17ea9bcee

SHA256
0023d4bdba28d6de53a06750f8fa7631629834e42d8a5adb916a392d6b4a9fd2

SHA512
f54453f8c939128521c21e8b2bc35e616a29fa6b0f3db1cb59580dfa8884e6e56d46ecc38df555f407b2821dc71f1963f737ecc4e4fcc846ae06c1e1f1f9fb36

Download Submit
C:\Windows\SysWOW64\Fcddkggf.exe

Filesize
259KB

MD5
394fa110d246e17fea7bb96faa1deaf7

SHA1
5e04dbd7ca3434b507d526bfc28efdbbc49747e6

SHA256
36a6017478d10fc783fadac81eb85415c89d19ad8fe9eec35c2aeda6661876e2

SHA512
df194bd744479d568005e83537d9214e9bddaaf648f09044eba35e56cc4c2f49e929895ee52b46b41480b138bb5156b0585430845997cf36910c8de874f1eb3e

Download Submit
C:\Windows\SysWOW64\Fcpkph32.exe

Filesize
259KB

MD5
37634e86e5d5f5b47ab35b04f3b8dd08

SHA1
783628d3fe43b6403ef4f17a2f32adc77a1204ec

SHA256
896e81a4ff83db03f08d43fb51fda6973be64ec1049380b52e37640bc7ccea53

SHA512
bd1558fe38a6c91e776a847d672366282235077457cbe3c54b520164757c66590b41fa13df54ce9fbd254395c6dd813c133e9283b7dc67bf6af15ade37726add

Download Submit
C:\Windows\SysWOW64\Fdjnolfd.exe

Filesize
259KB

MD5
eecd7fe51e991fb20a5ac5f1a79944b6

SHA1
110510a4afa01932b87e8ffa173ae07beef2d772

SHA256
29925063ae64a21f431188d350b80131c89ae142c8be51e09159b39ced0fd8db

SHA512
07d37fb801c24cc88596aef3e76ed33d43e64b59fe6560e0d9ac473c906730646ba21a3507eb829d98e44e381f547352956aea15a9ba5be731c28e02135791a7

Download Submit
C:\Windows\SysWOW64\Fdogjk32.exe

Filesize
259KB

MD5
45f8d4d19c07281d9430ce1c5aea2e9c

SHA1
dc0c8e802caa490b32e5a24ded28d56da3416461

SHA256
6a44b3369f75bcc7017b397d187ad4a3cd66a4faa0af1793c87eb29b8afbef91

SHA512
9683fdfa59828613963814bf22eb91052dd36336694bc6aba8aa6a439a5590cff910f8638a8783f048fb47ca164b5c764c8f6e1069692e8d3bf7b18a1df00da0

Download Submit
C:\Windows\SysWOW64\Fjgfgbek.exe

Filesize
259KB

MD5
ed74d4a8c3cf16584374c360f85d9f3a

SHA1
29660202fcd06bc74f4520ed10178deedf667739

SHA256
ca9dfcf51e188935bcd6ce05a09d7650933e331830d4b09c2cf07c6fd9b15f44

SHA512
fa5986b66e9d61e2d7f6055468d7b5c81e0e8d66c865b32594c18b9994ec2c6bb7587c2e180ad4f1f196170665104ea21db00d5ab559d73481871be8491a5050

Download Submit
C:\Windows\SysWOW64\Hclccd32.exe

Filesize
259KB

MD5
8255c7f899d37f3157034ee2b605968f

SHA1
7f8602eebf5f25585db253dd3e82567a67cb003d

SHA256
4d58a873587e7fbc7b8305b2b82924926011bc2f7789759fc5edbd4b700479d9

SHA512
88a99522e4213545d14f0cfa04a424b65d8213da9e2aac4c035f92db5505c1756e3189bf94877b752fe40e3d117ffc0c16d4bf3920fecd1aaee88a5016ba46eb

Download Submit
C:\Windows\SysWOW64\Hdbmfhbi.exe

Filesize
259KB

MD5
bb04fd6b942796ff8f2cff27d3723e84

SHA1
734e6e4be650a3643d3e03c25a33fb8fdab0af90

SHA256
a2eecc7bf03bb41ed157f1dd1237fd8c56fe8d726100979c810a063bcb83e933

SHA512
e2036011b0050c9d980942b5919a1471a6d7be6e117807211627972b0ec121bfe37291ca8c6900d454a8a8e61a87253026d1e2135deeed99e930bc12c3bd0ff2

Download Submit
C:\Windows\SysWOW64\Hgebnc32.exe

Filesize
259KB

MD5
3958b2e7a375fce2e60abf3fb152ea64

SHA1
9edbc15d9c3a503f2adc6d2ba2a153432bab9630

SHA256
1285a330223c13c0568af12728c8d947f47cc30a762e6a71ec81aad7fdf84119

SHA512
9cdbc9ffdc45965fa011c51654f7f617f75ede7d01c9174d59b6f87f77a64fdbac386f0b41d6f4d3642aa18d783c10777d120f3f0b9c5d94edd93d2e2380bcdf

Download Submit
C:\Windows\SysWOW64\Jnapgjdo.exe

Filesize
259KB

MD5
57b711c83c1d1d4d86d480715cccb884

SHA1
da63dba35e17ac1d6d4ef708c466cb4e1dfb124a

SHA256
814433b42a1c378ae057b17cd357e3fef91620e7f4d1fdabe5cf130daff94689

SHA512
2000855e0bd745926a58e4dcdf834179a30f1843186a6f1a3728b1ef4a8e7e1fee934f32a1539812214f0224f224f86bbf8edbc09d2d80931fc97ffadbb03d60

Download Submit
C:\Windows\SysWOW64\Jnfjbj32.exe

Filesize
259KB

MD5
ad508b9307fb97c51761cfe64e1dc5e0

SHA1
77ad48295d26c6d17c5f56bbca5ec36042859365

SHA256
4fa57a108ad7116dabea76d5af2bbc3649b51ac9638ca2e4efa380e7969de060

SHA512
43bd92a15de4c1334ccf85eaeaf19acda094117b592c81416067b71d09100f47cfbe0195f6bb4fa6af5caef1ee42b7c43153c12a91380dd9f2005ca0484b3089

Download Submit
C:\Windows\SysWOW64\Mbhina32.exe

Filesize
259KB

MD5
4198c9ebc10b301cdc0f3aa8c2fd1606

SHA1
3132f8fa6128a6347d342af8f17333f8d5019dde

SHA256
763e39fdf1d68b003030eb5f56444d26daf46c221275e4da82d2dbabdebc2b8a

SHA512
90ce5654de1272ca5edb8a6e6cdc1c6b28fae783548bfc2036208df914e02cacda0af3b5d0401f781ab68234cf89466547f4f442bcf8452f6fe8261ebb58a10f

Download Submit
C:\Windows\SysWOW64\Mdlgmgdh.exe

Filesize
259KB

MD5
8df03654b0e7d79dad380247b5123d60

SHA1
c3884723d4c5daa6b75135539a422a6fd5d644a7

SHA256
863461b37107a4fe90ba4881a1b335d6d0d4c86df50995daeed003c5d9c2a18c

SHA512
84d81190d2c5b2c68bcd826cd78b052c85e16660a4341009538c2d4564dea9e8e83ae9270fcf571beedbeeb9381900a47891bb2a9a10a7c5b427bd6585452992

Download Submit
C:\Windows\SysWOW64\Moefdljc.exe

Filesize
259KB

MD5
490771189de818d63c4a0e1562587169

SHA1
d85b838bcebfbf9e0200be6d395416860e9c3ed9

SHA256
ae34ce1fbadb102b0cf963d3d2c53a558505adc870e945307f5b42d3807a20f3

SHA512
bafb79ed1c50cd5f0783a4d68cc3ca135ebdfbfa14419e7c849f96e7e3aa206ac9b27faff7271b12fc344c2ac85b685c7d1becde566d068bcc6ea7059c7715e1

Download Submit
C:\Windows\SysWOW64\Moglpedd.exe

Filesize
259KB

MD5
6999443e5252231af532b660fd1f062b

SHA1
82a196c0cb5943a1c9373f39a4db40cbdbc5794b

SHA256
662d5326334e16daebc5ee6dc15a4fd4acd5d9f2e282a1bd8f43ff631fcfb90c

SHA512
36bc6cc23565636fbd98ff7997a8c0f4640a101e2163c3ee1c372595c26e400920cbf6115c70304c86cf2de53cc1b737af36dfc351869180ba63ce14e18b0857

Download Submit
C:\Windows\SysWOW64\Nggjog32.exe

Filesize
259KB

MD5
8b1a308b9598e4b54802ddfe7da2ff29

SHA1
5152ee0b810acb4cd20b4e2d3d14ee6363ab7d1d

SHA256
4e1410b938af54b84ffd61aade55241fc09c83b992e3471f9a1a2acd3617edc5

SHA512
0c2fa1fdfeb01f6a55798deef935319ba70f967387443457c28be3b15edc496f35fed07d21b120d49963eedd071a5f0aae5f5e9189b2ad2d7a83b5dd56a12367

Download Submit
C:\Windows\SysWOW64\Ngipjp32.exe

Filesize
259KB

MD5
2b03a0aac3a445ea4c3c981dc40aca52

SHA1
2a93248350e659847a2d5bcd5112d4c58848e37a

SHA256
e1232beb6279113bd30afc90d9d6bde20f3848aa375fab65b787d5d848cb05b8

SHA512
42a285df3885a0ff4e33169b85ddde7cfa04d284f0461a8dc9e1d63dad950464cb6c4e6acf3a793e53e2ede2d8a119a62be580c41c269b1d9fab33879cbc009e

Download Submit
C:\Windows\SysWOW64\Nlefjnno.exe

Filesize
259KB

MD5
d5815afffbac30b0135375a440697371

SHA1
407216dda1d07d96fc38cf6fdfdafb6d2f890646

SHA256
7010affac540a9d7f39458b36eb8ab7432bb3df72cff88cfbf4f70520a01ef83

SHA512
03ae367b6c0ed98258c04f86af5b939ea257bb378101bd6ec2b92c6470cffa1e630b65d3aade5cffd0b925fb7136ed712a5e9dcb7f4bf75c55370e353f718609

Download Submit
C:\Windows\SysWOW64\Nqnofkkj.exe

Filesize
259KB

MD5
1e1cfa86c252e1374257c0c8508d9890

SHA1
7d6823883c139cf6f8c78cd263c531145d585787

SHA256
eca4aa63a44feeb2ad7835a56f2ce3b8d417d33c7c39a44b5c5a855374e540ae

SHA512
dc0fbb5d0e86b6f013746980a308f4d93ad5dafa9df35ebf3d7fa76a668cdf28416f13a188e21783e73e3fc32840b6ac111c14c232c0521dbc0c1e2053203c8b

Download Submit
C:\Windows\SysWOW64\Obkahddl.exe

Filesize
259KB

MD5
feff300918895fd9e93b0b239d5a0f1b

SHA1
110cefc01034650cf1d40d20cb03ab99bb415aa8

SHA256
e2eda1814ba1e7fd7d3fae1b8ccbe19d76a9dd4c2bc9d0dfcecab2147c078203

SHA512
f9d748ce6a5074b7a0ba40a82207029b2d9c9e6a2f126212d524e4c683a6fe040e7d0303038029e0bfe5fe7676501a6b9af3e22382ec11a34fe5dddaf8491ea1

Download Submit
C:\Windows\SysWOW64\Odljjo32.exe

Filesize
259KB

MD5
7a60e5f9ceb65dfdb65ef1d162698012

SHA1
8649849700867cc6fd564d94bcea535ede7c546e

SHA256
8ff0d7b2b9b90b5baf9afdb5c3c59f395414fa9600780ad7ad85ec7ba778b01e

SHA512
1a39bcd4e045434d2a59ccb33511344636ba0ca340b5833059628df7aae6258b1fc5f27beb4835dba24f022cec473aed7eb68c5fbe16e4db40991385cc968cd6

Download Submit
C:\Windows\SysWOW64\Pcpgmf32.exe

Filesize
259KB

MD5
9bbebf3d79cddb837c4008a301bf3249

SHA1
5b83370bb57b83cd6e7f8f1ff8744eb81754695d

SHA256
2d8e2ecc1a8cf9ea02870f188d62f60b886277b6056e90bc243a343fb955a8f7

SHA512
5706b6621695fbac79730514a7f0970d470ae8a3446ee966f9113f008bd6eb1be00c1edf489aacd37d4b720cd2899d79f7b8c6265f514eaa621f289e9dadc254

Download Submit
C:\Windows\SysWOW64\Pmeoqlpl.exe

Filesize
259KB

MD5
3229872f431fcc3aee5e5a7a1835e0de

SHA1
6cac89b78bd0057eb57d35ba8ed9e47c662cff74

SHA256
3c07fa7517135195ce2d96ce63da1c7bcf10d11913061984acf16598b5465586

SHA512
1244757abb81678a6e157b8335bb65506d53a914136ebd6b3d12af3acd9ded7dcd9cc0c238eed4d691ea74fbeda5ed59ae6f241b6e8bed6547644aaa30c01100

Download Submit
C:\Windows\SysWOW64\Qkfkng32.exe

Filesize
259KB

MD5
6ed440eb82bedacd41e23d68e1eb503f

SHA1
d4ca9ae9f8dced40636764be1553fa751d08c3b1

SHA256
8cf05d754d0be1c8513f3117d759eb21699eec0a5eba89146abf17a86b259b5f

SHA512
8ce1eb14442649fcfb7f63a02f7dbe7720a1f702b570aa1d84e075cf5c8c26580fba1a7ffe6baa5924c0254eb40aceb3fdaa57679bb525f33db9fcf6d0e109aa

Download Submit
memory/212-384-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/368-250-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/392-105-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/436-306-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/556-161-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/612-57-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/672-366-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/832-80-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/832-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/832-1-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1092-426-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1124-324-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1172-288-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1180-372-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1240-72-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1328-402-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1608-138-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1712-201-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1960-348-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2024-113-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2196-408-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2304-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2336-121-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2376-312-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2424-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2508-420-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2636-82-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2720-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2744-300-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2768-282-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2784-414-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2788-49-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2960-193-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3052-226-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3092-294-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3136-178-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3148-129-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3312-97-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3324-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3380-217-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3596-396-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3620-257-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3700-170-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3736-318-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3816-233-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3828-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4160-354-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4168-242-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4216-336-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4240-378-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4252-270-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4284-432-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4324-146-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4396-276-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4492-41-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4496-210-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4608-264-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4612-390-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4664-360-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4736-186-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4776-90-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4784-342-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4856-154-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5052-330-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads