1acc7db553b77a927292ca85604f89588a6ef1ee2271070cac45ae6fcafc1fd0

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1acc7db553b77a927292ca85604f89588a6ef1ee2271070cac45ae6fcafc1fd0.exe
Size

1.4MB
MD5

5efa18414c2b45f1950c2bd87f60dd91
SHA1

f2e0050695104590cfe2c4bba584a7091d2168a0
SHA256

1acc7db553b77a927292ca85604f89588a6ef1ee2271070cac45ae6fcafc1fd0
SHA512

814b460874af22f5ae64856e13cc8d871ff7aafa01358a08745ffc2c95d94a52530f32470f6d8f0286615783ead2c7c6a31e9faef0db4aa07bc970d7ab023f11
SSDEEP

24576:Aq5h3q5htaSHFaZRBEYyqmaf2qwiHPKgRC4gvGZl6snARmaH1aUu:WaSHFaZRBEYyqmS2DiHPKQgmZUu

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nklfoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abemjmgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Andqdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bopgjmhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Leihbeib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ieolehop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qajadlja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlopkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcijeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kemhff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qdbiedpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cknnpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehimanbq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqpnombl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceaehfjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clbceo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlmllkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjmoibog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmbklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kaqcbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ickchq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekhjmiad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hodgkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Paegjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jidbflcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cenahpha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmfkoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okolkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chpada32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibccic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laefdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkmlofol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncbknfed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpklpkio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obidhaog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Behbag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlpkba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgmngglp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlefklpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Goiojk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdaldd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afoeiklb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcgbco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpebpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onjegled.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ficgacna.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjmhppqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bebblb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cahfmgoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehimanbq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlefklpj.exe

Executes dropped EXE 64 IoCs

pid	Process
4888	Eofinnkf.exe
4964	Eqfeha32.exe
4952	Fhajlc32.exe
1208	Ficgacna.exe
2224	Fmapha32.exe
3272	Fqohnp32.exe
984	Fodeolof.exe
2932	Gmhfhp32.exe
3100	Gbenqg32.exe
4384	Giofnacd.exe
3532	Goiojk32.exe
2148	Gfcgge32.exe
1960	Gpklpkio.exe
4796	Gfedle32.exe
1836	Gqkhjn32.exe
1596	Gcidfi32.exe
3732	Gfhqbe32.exe
8	Gifmnpnl.exe
2436	Gameonno.exe
4892	Gppekj32.exe
3040	Hboagf32.exe
4396	Hmdedo32.exe
1472	Hpbaqj32.exe
4468	Hbanme32.exe
3504	Hfljmdjc.exe
1020	Hikfip32.exe
1756	Hmfbjnbp.exe
1464	Hpenfjad.exe
4304	Hcqjfh32.exe
2168	Hfofbd32.exe
3940	Himcoo32.exe
4232	Hadkpm32.exe
4776	Hccglh32.exe
3140	Hfachc32.exe
1700	Hjmoibog.exe
5000	Haggelfd.exe
5076	Hcedaheh.exe
3216	Hfcpncdk.exe
4188	Hjolnb32.exe
3268	Hmmhjm32.exe
1924	Ipldfi32.exe
3284	Icgqggce.exe
3020	Iffmccbi.exe
5108	Iidipnal.exe
1632	Impepm32.exe
432	Ipnalhii.exe
3452	Icjmmg32.exe
2044	Ifhiib32.exe
920	Iiffen32.exe
2552	Imbaemhc.exe
3052	Ipqnahgf.exe
3044	Icljbg32.exe
4088	Ifjfnb32.exe
316	Ijfboafl.exe
2788	Imdnklfp.exe
4792	Ipckgh32.exe
2072	Idofhfmm.exe
1144	Ifmcdblq.exe
4164	Iikopmkd.exe
3556	Iabgaklg.exe
2708	Ipegmg32.exe
1496	Ibccic32.exe
3928	Ijkljp32.exe
2752	Imihfl32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ipldfi32.exe	Hmmhjm32.exe
File created	C:\Windows\SysWOW64\Bqhimici.dll	Fljcmlfd.exe
File opened for modification	C:\Windows\SysWOW64\Febgea32.exe	Fohoigfh.exe
File opened for modification	C:\Windows\SysWOW64\Gdjjckag.exe	Gblngpbd.exe
File created	C:\Windows\SysWOW64\Mmhjbhod.dll	Agffge32.exe
File opened for modification	C:\Windows\SysWOW64\Cbcilkjg.exe	Cliaoq32.exe
File created	C:\Windows\SysWOW64\Fplmmdoj.dll	Ldoaklml.exe
File created	C:\Windows\SysWOW64\Alcidkmm.dll	Dejacond.exe
File created	C:\Windows\SysWOW64\Phkjck32.dll	Lmiciaaj.exe
File opened for modification	C:\Windows\SysWOW64\Nnlhfn32.exe	Ngbpidjh.exe
File created	C:\Windows\SysWOW64\Ddhbep32.dll	Fhajlc32.exe
File created	C:\Windows\SysWOW64\Pckgbakk.dll	Jdcpcf32.exe
File created	C:\Windows\SysWOW64\Pengdk32.exe	Pbpjhp32.exe
File created	C:\Windows\SysWOW64\Jianff32.exe	Jefbfgig.exe
File created	C:\Windows\SysWOW64\Aceghl32.dll	Kikame32.exe
File opened for modification	C:\Windows\SysWOW64\Doqpak32.exe	Clbceo32.exe
File opened for modification	C:\Windows\SysWOW64\Immapg32.exe	Hfcicmqp.exe
File opened for modification	C:\Windows\SysWOW64\Mlampmdo.exe	Megdccmb.exe
File opened for modification	C:\Windows\SysWOW64\Cfdhkhjj.exe	Ceckcp32.exe
File opened for modification	C:\Windows\SysWOW64\Mgekbljc.exe	Mnlfigcc.exe
File created	C:\Windows\SysWOW64\Kcfcjd32.dll	Cknnpm32.exe
File created	C:\Windows\SysWOW64\Panjjlqo.dll	Qajadlja.exe
File created	C:\Windows\SysWOW64\Kpmmhi32.dll	Dkoggkjo.exe
File opened for modification	C:\Windows\SysWOW64\Ncianepl.exe	Nnlhfn32.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Dejacond.exe
File created	C:\Windows\SysWOW64\Eeanii32.dll	Jpgmha32.exe
File created	C:\Windows\SysWOW64\Nkbjac32.dll	Klngdpdd.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Eagncfoj.dll	Gppekj32.exe
File opened for modification	C:\Windows\SysWOW64\Ijkljp32.exe	Ibccic32.exe
File opened for modification	C:\Windows\SysWOW64\Mnocof32.exe	Mgekbljc.exe
File opened for modification	C:\Windows\SysWOW64\Dhnnep32.exe	Dbaemi32.exe
File created	C:\Windows\SysWOW64\Gkoiefmj.exe	Gdeqhl32.exe
File created	C:\Windows\SysWOW64\Ceaklo32.dll	Hjmoibog.exe
File created	C:\Windows\SysWOW64\Jdmcidam.exe	Jpaghf32.exe
File created	C:\Windows\SysWOW64\Mhciec32.dll	Cdfbibnb.exe
File created	C:\Windows\SysWOW64\Jbeidl32.exe	Jpgmha32.exe
File created	C:\Windows\SysWOW64\Mbfkbhpa.exe	Lphoelqn.exe
File opened for modification	C:\Windows\SysWOW64\Olcbmj32.exe	Nfjjppmm.exe
File opened for modification	C:\Windows\SysWOW64\Gmhfhp32.exe	Fodeolof.exe
File created	C:\Windows\SysWOW64\Jbfpobpb.exe	Jdcpcf32.exe
File opened for modification	C:\Windows\SysWOW64\Jidbflcj.exe	Jfffjqdf.exe
File created	C:\Windows\SysWOW64\Bkblkg32.dll	Ipbdmaah.exe
File created	C:\Windows\SysWOW64\Jlpkba32.exe	Jianff32.exe
File created	C:\Windows\SysWOW64\Bejkjg32.dll	Hikfip32.exe
File created	C:\Windows\SysWOW64\Cliaoq32.exe	Cacmah32.exe
File opened for modification	C:\Windows\SysWOW64\Jehokgge.exe	Jcgbco32.exe
File opened for modification	C:\Windows\SysWOW64\Mchhggno.exe	Mlopkm32.exe
File created	C:\Windows\SysWOW64\Hefffnbk.dll	Kipabjil.exe
File opened for modification	C:\Windows\SysWOW64\Acmflf32.exe	Anpncp32.exe
File opened for modification	C:\Windows\SysWOW64\Hcmgfbhd.exe	Hihbijhn.exe
File created	C:\Windows\SysWOW64\Bgehcmmm.exe	Beglgani.exe
File opened for modification	C:\Windows\SysWOW64\Npfkgjdn.exe	Ncbknfed.exe
File created	C:\Windows\SysWOW64\Ngpccdlj.exe	Npfkgjdn.exe
File created	C:\Windows\SysWOW64\Ncianepl.exe	Nnlhfn32.exe
File created	C:\Windows\SysWOW64\Abemjmgg.exe	Ajneip32.exe
File created	C:\Windows\SysWOW64\Hodgkc32.exe	Hmfkoh32.exe
File created	C:\Windows\SysWOW64\Kbhoqj32.exe	Klngdpdd.exe
File created	C:\Windows\SysWOW64\Ahioknai.dll	Ngpccdlj.exe
File opened for modification	C:\Windows\SysWOW64\Pqnaim32.exe	Pjdilcla.exe
File created	C:\Windows\SysWOW64\Keajjc32.dll	Hkkhqd32.exe
File created	C:\Windows\SysWOW64\Lpebpm32.exe	Lmgfda32.exe
File created	C:\Windows\SysWOW64\Hjolnb32.exe	Hfcpncdk.exe
File opened for modification	C:\Windows\SysWOW64\Jmbklj32.exe	Jfhbppbc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10784	10732	WerFault.exe	506

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oggacefk.dll"	Fdialn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gilnhifk.dll"	Ligqhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fplmmdoj.dll"	Ldoaklml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijkljp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfedle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekmihm32.dll"	Ijfboafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocdehlgh.dll"	Gfcgge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Immapg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cenahpha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfhbppbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Febgea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ceacpg32.dll"	Immapg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fohoigfh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngbpidjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnbbbabh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknpkhch.dll"	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbkmec32.dll"	Jmpngk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jaimbj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbapjafe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjhmqf32.dll"	Himldi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jedeph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjkiobic.dll"	Ipldfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbmfoa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfkoeppq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdiihjon.dll"	Kgphpo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbcaee32.dll"	Cacmah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijnlbk32.dll"	Cahfmgoo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Flceckoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddhbep32.dll"	Fhajlc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lfkaag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oedbld32.dll"	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pclneicb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpmmhi32.dll"	Dkoggkjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcojed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeanii32.dll"	Jpgmha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jpgmha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfhqbe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnlhfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocljjj32.dll"	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opdghh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlmllkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keoakjca.dll"	Chpada32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjpqmmkb.dll"	Dbaemi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmkdlkph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbhmdbnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpjjod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khehmdgi.dll"	Lkiqbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcobhnfc.dll"	Pjdilcla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqnaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfoiokfb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 4888	2440	1acc7db553b77a927292ca85604f89588a6ef1ee2271070cac45ae6fcafc1fd0.exe	84
PID 2440 wrote to memory of 4888	2440	1acc7db553b77a927292ca85604f89588a6ef1ee2271070cac45ae6fcafc1fd0.exe	84
PID 2440 wrote to memory of 4888	2440	1acc7db553b77a927292ca85604f89588a6ef1ee2271070cac45ae6fcafc1fd0.exe	84
PID 4888 wrote to memory of 4964	4888	Eofinnkf.exe	85
PID 4888 wrote to memory of 4964	4888	Eofinnkf.exe	85
PID 4888 wrote to memory of 4964	4888	Eofinnkf.exe	85
PID 4964 wrote to memory of 4952	4964	Eqfeha32.exe	86
PID 4964 wrote to memory of 4952	4964	Eqfeha32.exe	86
PID 4964 wrote to memory of 4952	4964	Eqfeha32.exe	86
PID 4952 wrote to memory of 1208	4952	Fhajlc32.exe	88
PID 4952 wrote to memory of 1208	4952	Fhajlc32.exe	88
PID 4952 wrote to memory of 1208	4952	Fhajlc32.exe	88
PID 1208 wrote to memory of 2224	1208	Ficgacna.exe	89
PID 1208 wrote to memory of 2224	1208	Ficgacna.exe	89
PID 1208 wrote to memory of 2224	1208	Ficgacna.exe	89
PID 2224 wrote to memory of 3272	2224	Fmapha32.exe	91
PID 2224 wrote to memory of 3272	2224	Fmapha32.exe	91
PID 2224 wrote to memory of 3272	2224	Fmapha32.exe	91
PID 3272 wrote to memory of 984	3272	Fqohnp32.exe	93
PID 3272 wrote to memory of 984	3272	Fqohnp32.exe	93
PID 3272 wrote to memory of 984	3272	Fqohnp32.exe	93
PID 984 wrote to memory of 2932	984	Fodeolof.exe	94
PID 984 wrote to memory of 2932	984	Fodeolof.exe	94
PID 984 wrote to memory of 2932	984	Fodeolof.exe	94
PID 2932 wrote to memory of 3100	2932	Gmhfhp32.exe	95
PID 2932 wrote to memory of 3100	2932	Gmhfhp32.exe	95
PID 2932 wrote to memory of 3100	2932	Gmhfhp32.exe	95
PID 3100 wrote to memory of 4384	3100	Gbenqg32.exe	96
PID 3100 wrote to memory of 4384	3100	Gbenqg32.exe	96
PID 3100 wrote to memory of 4384	3100	Gbenqg32.exe	96
PID 4384 wrote to memory of 3532	4384	Giofnacd.exe	97
PID 4384 wrote to memory of 3532	4384	Giofnacd.exe	97
PID 4384 wrote to memory of 3532	4384	Giofnacd.exe	97
PID 3532 wrote to memory of 2148	3532	Goiojk32.exe	98
PID 3532 wrote to memory of 2148	3532	Goiojk32.exe	98
PID 3532 wrote to memory of 2148	3532	Goiojk32.exe	98
PID 2148 wrote to memory of 1960	2148	Gfcgge32.exe	100
PID 2148 wrote to memory of 1960	2148	Gfcgge32.exe	100
PID 2148 wrote to memory of 1960	2148	Gfcgge32.exe	100
PID 1960 wrote to memory of 4796	1960	Gpklpkio.exe	101
PID 1960 wrote to memory of 4796	1960	Gpklpkio.exe	101
PID 1960 wrote to memory of 4796	1960	Gpklpkio.exe	101
PID 4796 wrote to memory of 1836	4796	Gfedle32.exe	102
PID 4796 wrote to memory of 1836	4796	Gfedle32.exe	102
PID 4796 wrote to memory of 1836	4796	Gfedle32.exe	102
PID 1836 wrote to memory of 1596	1836	Gqkhjn32.exe	103
PID 1836 wrote to memory of 1596	1836	Gqkhjn32.exe	103
PID 1836 wrote to memory of 1596	1836	Gqkhjn32.exe	103
PID 1596 wrote to memory of 3732	1596	Gcidfi32.exe	104
PID 1596 wrote to memory of 3732	1596	Gcidfi32.exe	104
PID 1596 wrote to memory of 3732	1596	Gcidfi32.exe	104
PID 3732 wrote to memory of 8	3732	Gfhqbe32.exe	105
PID 3732 wrote to memory of 8	3732	Gfhqbe32.exe	105
PID 3732 wrote to memory of 8	3732	Gfhqbe32.exe	105
PID 8 wrote to memory of 2436	8	Gifmnpnl.exe	106
PID 8 wrote to memory of 2436	8	Gifmnpnl.exe	106
PID 8 wrote to memory of 2436	8	Gifmnpnl.exe	106
PID 2436 wrote to memory of 4892	2436	Gameonno.exe	107
PID 2436 wrote to memory of 4892	2436	Gameonno.exe	107
PID 2436 wrote to memory of 4892	2436	Gameonno.exe	107
PID 4892 wrote to memory of 3040	4892	Gppekj32.exe	108
PID 4892 wrote to memory of 3040	4892	Gppekj32.exe	108
PID 4892 wrote to memory of 3040	4892	Gppekj32.exe	108
PID 3040 wrote to memory of 4396	3040	Hboagf32.exe	109

C:\Users\Admin\AppData\Local\Temp\1acc7db553b77a927292ca85604f89588a6ef1ee2271070cac45ae6fcafc1fd0.exe
"C:\Users\Admin\AppData\Local\Temp\1acc7db553b77a927292ca85604f89588a6ef1ee2271070cac45ae6fcafc1fd0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\Eofinnkf.exe
  C:\Windows\system32\Eofinnkf.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\SysWOW64\Eqfeha32.exe
    C:\Windows\system32\Eqfeha32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\SysWOW64\Fhajlc32.exe
      C:\Windows\system32\Fhajlc32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4952
    - - C:\Windows\SysWOW64\Ficgacna.exe
        
        C:\Windows\system32\Ficgacna.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1208
      - C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Windows\SysWOW64\Fqohnp32.exe
        
        C:\Windows\system32\Fqohnp32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3272
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:984
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Windows\SysWOW64\Gbenqg32.exe
        
        C:\Windows\system32\Gbenqg32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\SysWOW64\Giofnacd.exe
        
        C:\Windows\system32\Giofnacd.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Windows\SysWOW64\Goiojk32.exe
        
        C:\Windows\system32\Goiojk32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3532
        
        C:\Windows\SysWOW64\Gfcgge32.exe
        
        C:\Windows\system32\Gfcgge32.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2148
        
        C:\Windows\SysWOW64\Gpklpkio.exe
        
        C:\Windows\system32\Gpklpkio.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1960
        
        C:\Windows\SysWOW64\Gfedle32.exe
        
        C:\Windows\system32\Gfedle32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        23⤵
        Executes dropped EXE
        
        PID:4396
        
        C:\Windows\SysWOW64\Hpbaqj32.exe
        
        C:\Windows\system32\Hpbaqj32.exe
        24⤵
        Executes dropped EXE
        
        PID:1472
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        25⤵
        Executes dropped EXE
        
        PID:4468
        
        C:\Windows\SysWOW64\Hfljmdjc.exe
        
        C:\Windows\system32\Hfljmdjc.exe
        26⤵
        Executes dropped EXE
        
        PID:3504
        
        C:\Windows\SysWOW64\Hikfip32.exe
        
        C:\Windows\system32\Hikfip32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1020
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        28⤵
        Executes dropped EXE
        
        PID:1756
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        29⤵
        Executes dropped EXE
        
        PID:1464
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        30⤵
        Executes dropped EXE
        
        PID:4304
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        31⤵
        Executes dropped EXE
        
        PID:2168
        
        C:\Windows\SysWOW64\Himcoo32.exe
        
        C:\Windows\system32\Himcoo32.exe
        32⤵
        Executes dropped EXE
        
        PID:3940
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        33⤵
        Executes dropped EXE
        
        PID:4232
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        34⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        35⤵
        Executes dropped EXE
        
        PID:3140
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1700
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        37⤵
        Executes dropped EXE
        
        PID:5000
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        38⤵
        Executes dropped EXE
        
        PID:5076
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3216
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        40⤵
        Executes dropped EXE
        
        PID:4188
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3268
        
        C:\Windows\SysWOW64\Ipldfi32.exe
        
        C:\Windows\system32\Ipldfi32.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1924
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        43⤵
        Executes dropped EXE
        
        PID:3284
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        44⤵
        Executes dropped EXE
        
        PID:3020
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        45⤵
        Executes dropped EXE
        
        PID:5108
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        46⤵
        Executes dropped EXE
        
        PID:1632
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        47⤵
        Executes dropped EXE
        
        PID:432
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        48⤵
        Executes dropped EXE
        
        PID:3452
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        49⤵
        Executes dropped EXE
        
        PID:2044
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        50⤵
        Executes dropped EXE
        
        PID:920
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        51⤵
        Executes dropped EXE
        
        PID:2552
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        52⤵
        Executes dropped EXE
        
        PID:3052
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        53⤵
        Executes dropped EXE
        
        PID:3044
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        54⤵
        Executes dropped EXE
        
        PID:4088
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:316
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        56⤵
        Executes dropped EXE
        
        PID:2788
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        57⤵
        Executes dropped EXE
        
        PID:4792
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        58⤵
        Executes dropped EXE
        
        PID:2072
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        59⤵
        Executes dropped EXE
        
        PID:1144
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        60⤵
        Executes dropped EXE
        
        PID:4164
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        61⤵
        Executes dropped EXE
        
        PID:3556
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        62⤵
        Executes dropped EXE
        
        PID:2708
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1496
        
        C:\Windows\SysWOW64\Ijkljp32.exe
        
        C:\Windows\system32\Ijkljp32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3928
        
        C:\Windows\SysWOW64\Imihfl32.exe
        
        C:\Windows\system32\Imihfl32.exe
        65⤵
        Executes dropped EXE
        
        PID:2752
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        66⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        67⤵
        Drops file in System32 directory
        
        PID:3852
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        68⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3660
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        70⤵
        Modifies registry class
        
        PID:2152
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        71⤵
        
        PID:412
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        72⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        73⤵
        Modifies registry class
        
        PID:5168
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        74⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        75⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        76⤵
        Modifies registry class
        
        PID:5276
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        77⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        78⤵
        Drops file in System32 directory
        
        PID:5348
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5384
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        80⤵
        Modifies registry class
        
        PID:5420
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        81⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        82⤵
        Modifies registry class
        
        PID:5492
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        83⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5564
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        85⤵
        Drops file in System32 directory
        
        PID:5600
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        86⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        87⤵
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        88⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5744
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        90⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        91⤵
        Modifies registry class
        
        PID:5816
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        92⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        93⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        94⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5960
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        96⤵
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        97⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        98⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        99⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        100⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        101⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        102⤵
        Drops file in System32 directory
        
        PID:2544
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        103⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        104⤵
        Modifies registry class
        
        PID:3796
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        105⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        106⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        107⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        108⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        109⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        110⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        111⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        112⤵
        Modifies registry class
        
        PID:5948
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        113⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        114⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        115⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        116⤵
        Modifies registry class
        
        PID:2900
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        117⤵
        Modifies registry class
        
        PID:5144
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        118⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        119⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5504
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        121⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        122⤵
        Drops file in System32 directory
        
        PID:5628
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        123⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        124⤵
        Modifies registry class
        
        PID:3120
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        125⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        126⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        127⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        128⤵
        
        PID:680
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        129⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        131⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        132⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5912
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6044
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        135⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        136⤵
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        137⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        138⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        139⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        140⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        141⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        142⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        143⤵
        
        PID:628
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        144⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        145⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        146⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        147⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        148⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        149⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4284
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5300
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        152⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        153⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6196
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        154⤵
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        155⤵
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        156⤵
        Modifies registry class
        
        PID:6316
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6356
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        158⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        159⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        160⤵
        Drops file in System32 directory
        
        PID:6476
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        161⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        162⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6608
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        164⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        165⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        166⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        167⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        168⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6884
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        170⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        171⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        172⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        173⤵
        Drops file in System32 directory
        
        PID:7064
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        174⤵
        Drops file in System32 directory
        
        PID:7112
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        175⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        176⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        177⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        178⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        179⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        180⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        181⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        182⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        183⤵
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6676
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        185⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        186⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        187⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        188⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        189⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5488
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        191⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6340
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        193⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        194⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        195⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        196⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        197⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        198⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        199⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        200⤵
        Drops file in System32 directory
        
        PID:6284
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        201⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6940
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6204
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6624
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7088
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        206⤵
        Drops file in System32 directory
        
        PID:6696
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        207⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        208⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        209⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        210⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7312
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        212⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        213⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        214⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        215⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        216⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        217⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        218⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7644
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        219⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        220⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        221⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        222⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7820
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        223⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        224⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        225⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        226⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8052
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8084
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        229⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        230⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        231⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        232⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        233⤵
        Drops file in System32 directory
        
        PID:7340
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        234⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7416
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        235⤵
        Modifies registry class
        
        PID:7496
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        236⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        237⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        238⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        239⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        240⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        241⤵
        
        PID:1136
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        242⤵
        Modifies registry class
        
        PID:1488
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        243⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        244⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        245⤵
        Modifies registry class
        
        PID:8144
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        246⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        247⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        248⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        249⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        250⤵
        Modifies registry class
        
        PID:7628
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        251⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        252⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        253⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7984
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        255⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        256⤵
        Drops file in System32 directory
        
        PID:7240
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        257⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        258⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        259⤵
        Drops file in System32 directory
        
        PID:7892
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        260⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        261⤵
        Drops file in System32 directory
        
        PID:6384
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        262⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        263⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7656
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8024
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        266⤵
        Modifies registry class
        
        PID:7540
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        267⤵
        Drops file in System32 directory
        
        PID:7940
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        268⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        269⤵
        Drops file in System32 directory
        
        PID:8168
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        270⤵
        Modifies registry class
        
        PID:8204
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        271⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        272⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        273⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        274⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8412
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        276⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        277⤵
        Drops file in System32 directory
        
        PID:8492
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8536
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        279⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        280⤵
        Modifies registry class
        
        PID:8616
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        281⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        282⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8696
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        283⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        284⤵
        Modifies registry class
        
        PID:8780
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        285⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        286⤵
        Drops file in System32 directory
        
        PID:8876
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        287⤵
        Drops file in System32 directory
        
        PID:8916
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8960
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9008
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        290⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        291⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        292⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        293⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7760
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        295⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        296⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        297⤵
        Drops file in System32 directory
        
        PID:8360
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        298⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        299⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        300⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        301⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        302⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        303⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        304⤵
        Drops file in System32 directory
        
        PID:8856
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        305⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        306⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        307⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        308⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9168
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        310⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        311⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        312⤵
        Modifies registry class
        
        PID:8420
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6700
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        314⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        315⤵
        Modifies registry class
        
        PID:8668
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        316⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        317⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8868
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8092
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        319⤵
        Drops file in System32 directory
        
        PID:9080
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9196
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        321⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        322⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        323⤵
        Drops file in System32 directory
        
        PID:6588
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        324⤵
        Drops file in System32 directory
        
        PID:8980
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        325⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        326⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        327⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8488
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        329⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        330⤵
        Drops file in System32 directory
        
        PID:8764
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        331⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        332⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        333⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        334⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        335⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        336⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        337⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9260
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        339⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        340⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        341⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9424
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        343⤵
        Drops file in System32 directory
        
        PID:9468
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        344⤵
        Drops file in System32 directory
        
        PID:9508
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        345⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9592
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        347⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9644
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        348⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9684
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        349⤵
        Modifies registry class
        
        PID:9728
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        350⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        351⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        352⤵
        Drops file in System32 directory
        
        PID:9848
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        353⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        354⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        355⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        356⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        357⤵
        Modifies registry class
        
        PID:10068
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        358⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        359⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10192
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        361⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        362⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        363⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        364⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9476
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        366⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6600
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        368⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        369⤵
        Modifies registry class
        
        PID:9604
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        370⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        371⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        372⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9864
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        374⤵
        Modifies registry class
        
        PID:9920
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        375⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        376⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        377⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        378⤵
        Modifies registry class
        
        PID:10180
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        379⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9328
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        381⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6660
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9516
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9628
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        385⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9756
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        386⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        387⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        388⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10172
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        390⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        391⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        392⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9696
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        393⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9708
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        394⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        395⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        396⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        397⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9664
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9844
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        400⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        401⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        402⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        403⤵
        Drops file in System32 directory
        
        PID:9364
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        404⤵
        Modifies registry class
        
        PID:9636
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        405⤵
        Drops file in System32 directory
        
        PID:3252
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        406⤵
        Modifies registry class
        
        PID:10116
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        407⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        408⤵
        Drops file in System32 directory
        
        PID:10296
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        409⤵
        Modifies registry class
        
        PID:10344
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        410⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        411⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        412⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        413⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10504
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        414⤵
        Modifies registry class
        
        PID:10548
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        415⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        416⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        417⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        418⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10732 -s 396
        419⤵
        Program crash
        
        PID:10784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 10732 -ip 10732
1⤵
PID:10760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acmflf32.exe

Filesize
1.4MB

MD5
fefae39aed242c0ae58a78d2296ec916

SHA1
5022427eb4ae7211e977abf203cd053b3029f671

SHA256
a63df6ce2a5fbb7e6022359d20d515e4202820cc5b4feec462c96be432b1e7b2

SHA512
0838a9f0987006b457261e33678699179f2299b0c4f21d98cad914cbdb37461d87b637346f206e88d2b34b4b35afcd2a80be3b6400e53a882b24fe64c3f6f4a1

Download Submit
C:\Windows\SysWOW64\Anogiicl.exe

Filesize
1.4MB

MD5
2515334b2c626620648e58edca86a16a

SHA1
ff9e9812f4af7e4132da21c659b7353fd8efe41a

SHA256
1bbfc71b6e76489b83793e220aa07354d98612668aab1b10d98f6e2b4936cc32

SHA512
a72330d76782db40d3d6d7f7d767837087b4d326c790b818bb8ff4a181e0f62d1da37e241085ad0dd7762dbcc2956ed17250f0f4585b4dcd561281c7ac6ad2ac

Download Submit
C:\Windows\SysWOW64\Baicac32.exe

Filesize
1.4MB

MD5
e9ed118da72d7445017d31d3e9a43f4e

SHA1
0aef0e261b591a6d9a0eb11714ab516fa005f148

SHA256
dea1547da849d19469a1d05423aa735129e76af5401eeecd288af768f2baea76

SHA512
fcd6f0b21db5bee11cbe50e984014f9693c65fdc8aad36e72fad5d46d16a89a81bc402496a3a9ee478527f235b894f842249c6221004938497e11486e27d4109

Download Submit
C:\Windows\SysWOW64\Becifhfj.exe

Filesize
1.4MB

MD5
eb97e2465623bbe0e4801d6d1515ed8b

SHA1
5ee1b4f9056b9f56fb0e68ac2bca0e81d4d2da83

SHA256
967b5df0f37ab8ad6b881eb3d70299458dd05a0c62fe104cfc730937786802c3

SHA512
82a923c5edfb04d559b5a54d7e494ae26960ce574053cc12fc95483e60c9c5988d6a0e67f422ed2c3535722f42cef8889f6b9d785738e1c06905459fe07f0040

Download Submit
C:\Windows\SysWOW64\Bfkedibe.exe

Filesize
1.4MB

MD5
7c8d95d20dc6ab420d08a7cc1363a7cb

SHA1
8d71cb2abaa0e7b67cbf9d3eb97e45e6496caede

SHA256
f17b394e1e9afa06896cd4d1ccee33c78d94ceaae7fb38cde687514ae50f6dca

SHA512
99e4a0c2a82a6b9d381c765064559ed1fddc9135263365281729a1234a6037bcd3bc931ef6478f7bff026e116d9d22d749c44ff2c22e11b7d7c2ae02e29aa83a

Download Submit
C:\Windows\SysWOW64\Cacmah32.exe

Filesize
1.4MB

MD5
7f4c3f70710ba3a1069328ea6a969bf8

SHA1
db17bb5104e8820e3c3deaa865fb8f40f6e30661

SHA256
b003d5c0c75e689826ecb2b4ae5c364beb25ddf267ce40ddb699d0d794efd9d2

SHA512
71310ee435534bb4e41e44e19966f7c073551d08de08e2e5dad51a3bae14325f5c89bbfa860e6448f1bef0114771e6e11ccd60d17171d0ae63e9a0bb9b8f2711

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
1.1MB

MD5
e904033ba15cba33cb44c1e506142ac1

SHA1
6a987ac9bc84f884b2348d46f469d4e0a8368ede

SHA256
115862d23c3eb307c646615c14d4b999d4858a31503ae6ef0cf9a0b0bbcb1654

SHA512
1f2b89af27567dd3d9bdae35edd76fd81f3c42c5379c7fb3978416847c383ef8d5fc04888db3e120750767339f1ecd3f67e0d0ed71a83b4339330193c6c7f608

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
640KB

MD5
c387ec588233b85f7b21a3718a5db842

SHA1
e9f02f267a00c199e348a901ae1c3d0162dae5fe

SHA256
8388a30e3ee8b586d16ca25e80da5e4829b49d06ab231320c0e83f019d23cf7a

SHA512
4d9ab173d300bd837c74e0bd09ff6ccf623a98ad3621c58b63df26c823548107a3f0f0cbb65f4d2913df9ae075800c5e7f012452b4d9cfef6bff73db274f16f0

Download Submit
C:\Windows\SysWOW64\Ckcgkldl.exe

Filesize
1.4MB

MD5
7822c84e2160ddc75bbcbdac41abecd3

SHA1
cddb99d00892685a35e9493ce6ba50806d316662

SHA256
80a28892178e5b8723e45aacdfc2ae6d4c37f4274539a248328582f95960f636

SHA512
08ae997a1d6c0d452f69117901335ebdb86c3aa50981da8fb44231a74956e6504c2356b26ce42a9a265905edd21cc6198740495b0ce1e8b18dea79faff7fdd35

Download Submit
C:\Windows\SysWOW64\Dfnjafap.exe

Filesize
1.4MB

MD5
707323b5306b9997d22a4f070a8012bf

SHA1
a634ccbbba2458c18089ea75fb68988c3ec66416

SHA256
de7d85f09f0873817f1c14bd4e5a1ef35960c2b1bd70b6632055331c5396875a

SHA512
30ef518527b9f6e25aaf55d7eea3857ab693d788dbb013f23f93820d48d13e3d20a288513e9265005b308e4123507d1ff01b6a46d2241b67526f0e8d9e54812e

Download Submit
C:\Windows\SysWOW64\Edihepnm.exe

Filesize
1.4MB

MD5
0468596b2bb71cede70bb0f4265812fa

SHA1
3d20f0313e3377cd92e1837baa72377ff9d0eacf

SHA256
057c416a1ce3cdaba5ce644586fbd0ff15fbbe6546d00fdc5af5d789b079546e

SHA512
57f660773b6bba6277417331c595fbfc9ce60ff1c2c3d04aa6604970c95f5af6ae6dd4447d519842aef8eed2afb61fce44896da90a87af0e19e19cbb10246099

Download Submit
C:\Windows\SysWOW64\Eofinnkf.exe

Filesize
1.4MB

MD5
7d5f9c156966f1f54260ac064adad927

SHA1
0c0df16d5747d1df24df13989587228283ad4e27

SHA256
8d37d613d7c8c21eb9d48a58a5fe44fa8ea5b6049aee8fd909435d5fc745c201

SHA512
d714574bbae563c0fc26e7a65a9511cf9250ce124f1d506fa4b74ff66db8890800d8c83e435a1a7ee5e583687985222c51677191cbde13767d51d1f638fc7a1c

Download Submit
C:\Windows\SysWOW64\Eqfeha32.exe

Filesize
1.4MB

MD5
e6eeb147ca408c9be44711c99ec69e4b

SHA1
627d90d3b6a6fe8e9b50734b87d22ee2e9585821

SHA256
5c87dc7923d3e3d7d352819a08a081f8d2976dd65de4abbe22b6a5c6675555a6

SHA512
ffb47f8f34d3892c5a53528aa714c1308802c1ab66478c00c6ae4e2772d7a586360896d0b5ef592053797763459da1b1fa3ebf70ea2e9cb013caefafb074e169

Download Submit
C:\Windows\SysWOW64\Fhajlc32.exe

Filesize
1.4MB

MD5
f13b4fba7b73f80ad4fe6e9beb5728e4

SHA1
6e71f032b6d63313d898a4709ed72700c9449689

SHA256
8f6e377dedeb442fcfb077e99cde6a9425c3f64d08b46e504f41d2356f842096

SHA512
d7bf1d6832f3c1afc33fd896586549045fc377a29cad0e357ec87bb6278926c2134150a6615196a012dbef117c3b87c5ad37834e3f2d5d3a260d1ea35910dcc8

Download Submit
C:\Windows\SysWOW64\Ficgacna.exe

Filesize
1.4MB

MD5
c82d2be730b555f345552e1b95a02c09

SHA1
42442f6c0286b86e82a8747ac17426e01d82debe

SHA256
01899724c755682c05087fadb20685c84d0f0a13da22182083644ece349d9132

SHA512
e84748cb4aea1f87d4e87d93a34b7ec832907378d819e047d3340d60665443631972e94bcc2eebe151c4ed33983a97b6e67cf05a2357b9da4a0a3e94c3ac2398

Download Submit
C:\Windows\SysWOW64\Fmapha32.exe

Filesize
1.4MB

MD5
d23a3ab88770b977ff855e7aba9704b6

SHA1
1b3b0e842e03e14ad32847cece5024633bb09c2b

SHA256
eddc33350e52b5bcdc5b6e8ba87b680f0a6284f0f4a3d13fb06250e9ae8d509d

SHA512
68dfa34c9175daf93818f21150a51871f7e83c4151aa4aa005d01bdcdbacf5fd0938056ec1bfa03758a3c8385672363faadc56a4fa21d2d92f2326423fbd2669

Download Submit
C:\Windows\SysWOW64\Fodeolof.exe

Filesize
1.4MB

MD5
9cf12a4eff558e57afcd7b56b69b7180

SHA1
bf83649f4b5ef4a2e8f48c78e1568361a906150a

SHA256
d4e0766b996bae40ccc06b1d5e11ccc2943846defa31b100eb429c40754ed74b

SHA512
74455f18d71d3deea34d8550227a159d42d83914afff065a527e16da7a165a880cc68a3baf93843e7f945cd58ef33e487418cbb5d52a37b2bad2130474cb3379

Download Submit
C:\Windows\SysWOW64\Fqohnp32.exe

Filesize
1.4MB

MD5
804704ac36379832ed36b4e118cc9ed6

SHA1
63e719969fde226422db95b4c550dac97812f41b

SHA256
666e08f9e1208f3d7088be3b5557cd336b41980f6b79956953e3d415ac3e1a4e

SHA512
7a7595f1fc881718be48084ff3f2a8c43b9213ca717e4bee349d7caf7042e181faa5d568811ef041000ef149b03e115fef43cb854e80c668bb25ef0a37d5370e

Download Submit
C:\Windows\SysWOW64\Gameonno.exe

Filesize
1.4MB

MD5
cac8cf74b8830254286e5dabd8fb9632

SHA1
81aa8d3ce76b7d70e880b0ec032207dcd0ce9f87

SHA256
3db7321367e304e921fcabf0f23cbb6de7b090c7e6acf92a2845c43331a1d9e0

SHA512
9d171a38510dabe24c55dc7c91a2cfa5661074b9803d69364417451b9be4b72067969d97b5bcb2a44269caf65b88aa31b681112ff6d66d8b7600b84920449362

Download Submit
C:\Windows\SysWOW64\Gbenqg32.exe

Filesize
1.4MB

MD5
90f94e401c0c544c8aeaca3dd6cdce73

SHA1
3fb409514d19bac7211297bbbd22a14e519a763e

SHA256
1cb576c0a1342007dfee931651e76bd3e419c055e66272bbbda740da3420b1b0

SHA512
68a69e31f550a60f81c2f9969d685dec19e196bd9c215a78e9ea4124c95acc9179f8a9fee56d93de6c4a5859fe55a91586d9f693a137d9e0d00b4de279dd9e81

Download Submit
C:\Windows\SysWOW64\Gcidfi32.exe

Filesize
1.4MB

MD5
6c7ba9018c565ee3ebfdce3428e84538

SHA1
069e3e9e87bed90e4fda300d627d299b9fe4bc83

SHA256
1b2d31e1e8567c21cbe3301aa4d1a9f660934f1c029c9364aa00f5f64a5c3ef0

SHA512
fa65c6058ee9097444106390b5576f911c2713c6d1b41656eb9132134c360336877f3f5761bcc0aefb68ede5b933a15147e0f46774218c33290bfda7c2564d3e

Download Submit
C:\Windows\SysWOW64\Gfcgge32.exe

Filesize
1.4MB

MD5
59ce7052f6aa267a013fb3aeff984baf

SHA1
6bd5e53bc234652501d85b9b1f927a2c9ae7cd5e

SHA256
00a111d230ac8dbcdb4568508a258da503b45da70bc307bb96baa4abeefb8e49

SHA512
328a6ace6d05694adc3f331bb08f98d0b2f6ea967a05b62a9b6875785e6b0266dfd2cc637969207580ae19f04b3957601c07cdc471b82cf01f51add1ef11fa70

Download Submit
C:\Windows\SysWOW64\Gfedle32.exe

Filesize
1.4MB

MD5
37b56a094d2b006369b59c2ac69eb7e5

SHA1
044eb38a3dd4c11d1024da69d3dceb591fd4360e

SHA256
26358bde7c2f48eaef5b0d1ecaffa5ee19f467cf629eab80c72ff43396adb6c8

SHA512
e39f0e64cc9096fe7c7c98f75906876546c2762168cfc3f8569a0fac0f0b5de13754ed6afc221a6115953f157f68308075a0d29c270c8b7ab6e3783b471124d6

Download Submit
C:\Windows\SysWOW64\Gfhqbe32.exe

Filesize
1.4MB

MD5
a14e16a82a7ab8e6c5858de6feea8cec

SHA1
0eeaff4d7b192fec2d01938e7b7ccd8464991659

SHA256
25b4030f9ac537bc26110bce33a2cfb575ca652f893665438a4e6ec374f9724a

SHA512
634b874cc6e4e8c57b3a4b19ac60bbca701ac10b8ff0225f06ce1133dfd06e88a11f01951b69a5b29fa33d36eb4a9b72fb5172b3e7aa3fd7e55c6def5846f302

Download Submit
C:\Windows\SysWOW64\Gifmnpnl.exe

Filesize
1.4MB

MD5
30be593d3f2fe7cfa5d44ddd613fef75

SHA1
6725861896ac66eda53ffb67db58b59c0a72d584

SHA256
b385cddbba3da7dac2826aca173008b56da4337ddfbc9abb08076f19811e8743

SHA512
d4ddb6fb980739f89a55e2431371bdfead60a758d4cd4a46f94b4e3067ad9f5e33731bc175da8a15f474028b3dfceeb163aba96c53c04f8e534a89b75bd7487c

Download Submit
C:\Windows\SysWOW64\Giofnacd.exe

Filesize
1.4MB

MD5
2fec2f964330ec025d3b8b632262eea6

SHA1
f2181554e173ca875e3b4c1c871ede57b0bfe969

SHA256
0ebf3d9cfd6ce64cd78c3e120b50406342a9e8f96f8cd826363bb3c2b6979b17

SHA512
d01fe7be019f849fb0b096d810de293c3410d83380900e240cdad38daec1c7206d793fd483d7c45138d2cdb7c9e6ea26920412b5ab86087a684add4de70b68ef

Download Submit
C:\Windows\SysWOW64\Gmhfhp32.exe

Filesize
1.4MB

MD5
f0ef1974434e1a69b7c9f26befe243bd

SHA1
c026f03d319df6006f96c9c4a816a999babecdcd

SHA256
6ac04ca5cc97e64dfc56fba0b6405d9d58be066ac485948fd51390a723146f1f

SHA512
deb9e1da0fe559b11480a60e6746e6e5957a428db345df9a401f368058bdc8609e08ddfff79fa2b47c54a697ae2d6021e2354c75dd6bce290c6f5f5bc77e3fcf

Download Submit
C:\Windows\SysWOW64\Goiojk32.exe

Filesize
1.4MB

MD5
e4944979f3268b93545258ae8eb20d65

SHA1
be8cab220b27ad46721240f9398af69e870094a7

SHA256
b87b391b7b278251198b254d100a72e977a90d4c0770e28820636302c8a3076b

SHA512
d462e8f991a95d179a5f2d168eb7a5a4473146606a2dfcef8375e17f56dfb62ab7f273af684d4ddd8551c76fcf94288a6d8b4de18aca6d49cbedee70dd161262

Download Submit
C:\Windows\SysWOW64\Gpklpkio.exe

Filesize
1.4MB

MD5
9de80a0c55f61e6370d82417f29701e7

SHA1
34bef35e74624839fff92ededa195731d65def6a

SHA256
5bfff53cc157f58434e8e0ab5a319755167e3338518ff183034ee1cdce026f12

SHA512
44b5099661258f1aadf0cb62bc2ff761941bd52b96eb5df3a1ad6b698ee8b5d89f2e92897262f51ad5fb29f04328f13af46706d6676155399f484dd322db5c58

Download Submit
C:\Windows\SysWOW64\Gppekj32.exe

Filesize
1.4MB

MD5
2ea489a2b6423ad5f894cd5c5bb90e59

SHA1
c2529ab08d48f55b0a1e3f8d7867f729b86e2edf

SHA256
ea435b8fc7531b2eeb7cf321cea977037a349e0796bfee1edd124c3f93e20d35

SHA512
41b658a24aefb65bd9f74d8a547c424822f2e9de47cfef078a2986e7ec36074777d6ab5dafc60c2db1d6f60c4439e0b4b5fd62d2bcecfee6af583408d5a2733c

Download Submit
C:\Windows\SysWOW64\Gqkhjn32.exe

Filesize
1.4MB

MD5
b17dfed7b9ad030c0473e5e28e503bd2

SHA1
0f2aa068269c0ddef206c9eb49e752558b7bd3a9

SHA256
b4caf4b563f67c5d331f222d12e9aeca08d8de27c7aefc0758b6e16b6b642486

SHA512
5cffb5fcca94d8404fd31eb0dcf7c6ebdeefacb35d43159e19bb25776f6eb2f7549089087a986f37dfe1d19bcead48868aee715f3f02fd551a088e1aa0b38e7a

Download Submit
C:\Windows\SysWOW64\Hadkpm32.exe

Filesize
1.4MB

MD5
f9947a8406c0958fba04f4c1f7e9010b

SHA1
2969236102917e52005afe36d775b3c64557c415

SHA256
e5cf0bb2dcafb76ddb96f5300fbfd22a79df81e303c69885878a444c4fd2d837

SHA512
9280175bed6632ec79e9ec18cf94556fce53c5236540ede0245e86db693f8c96acb57a1e1bf8e2310bca08fad44a99981cf226f92fa9f0cd07bc0a331ae50251

Download Submit
C:\Windows\SysWOW64\Hbanme32.exe

Filesize
1.4MB

MD5
f2f2fb0fd9ed2eac0192190e5fbd9580

SHA1
4562d3c8b727962d48575dec6857318c8e5456ce

SHA256
95f2da2fe67d51c310872b047bf9eeac407d7406630d0054ec513a54c35f0ed0

SHA512
764f3c96c2b37cf7ac6e47cd9d140de77a5781464d8806b25d88ffcfbd325e5e68396ecd1adba053813b2cd79641d29ff945e0c40b543275c7a189afb1cce860

Download Submit
C:\Windows\SysWOW64\Hboagf32.exe

Filesize
1.4MB

MD5
685e3a75ae7d568753be4b5c153807d4

SHA1
1a5147a2d16b7440bbf88839fc33507551f916a5

SHA256
19bed2eabe3530d40d0b2d0d88af9ab4aa89b2777c9d9c86d20d55fc631735b7

SHA512
18e011ff470931cb51c803f66f8df420c24a1f76e78fa271d0bf3e72ad99e3b09bd5d0073551d3e99a808402d861ba62e92ddef2298ee70c2b526a20f9a8fd4c

Download Submit
C:\Windows\SysWOW64\Hcqjfh32.exe

Filesize
1.4MB

MD5
29c89c4069d93e3c09f4cadd156fa915

SHA1
d419e130c0307af27079555c79ced16ae4774854

SHA256
41a7e20444d76ce1ed81f06e9bc686cb06e05956d719ebee0f1ec67804d5955d

SHA512
3a6230e2eab8c1a699753c5926d1d49ef5f079e860f0891010bc83e1d79b1cd3b77cfa292bf91cd9a98ba588a1fdbe2097b7b5316e9efa63922a0ac397b97140

Download Submit
C:\Windows\SysWOW64\Hfljmdjc.exe

Filesize
1.4MB

MD5
5b395e85e9a97ee379c06d085acd83d7

SHA1
0fb0b03e576ed4dcca6afa30eab66913944c20ca

SHA256
fbd1f8c906713bde789678e9d5ba87733e15a27bb9879f3bf2f904bcf8382391

SHA512
d1e6ba3bd3cf6ef27d5764f7d614e3b58fe67727bb73f7a6a5386a8fae1aacd3d27c0fae72e829fae5ecfe704b22a1a0e1aa9d4b7ee99493e2de2e72fb1bea81

Download Submit
C:\Windows\SysWOW64\Hfofbd32.exe

Filesize
1.4MB

MD5
032a31337308227832e471746be11cec

SHA1
397104fdea09ddbedaba95790a051a2d4cd9083b

SHA256
54fd2b9d3d4e21e048f3173376840ccd10d6e3df6c36f25b12e8ed36d3d63e85

SHA512
cdab1c193606838c53fa462789514dbc7f1e294194ff9a35c42e125faabe9ddbbe6066d2549e7e4754924e4b7d1381f1fc1cdb5f3d301bb8b996d878d889f844

Download Submit
C:\Windows\SysWOW64\Hikfip32.exe

Filesize
1.4MB

MD5
0013840167987d061dca3aa5cf46f8c0

SHA1
7b32d64083671e43ddffe926535e07160874ffda

SHA256
f282aedfc642999eff9b251e843e46b796f4b4f3c502919842655f0fb669152b

SHA512
f96ada331225a0e70fb49eb898cbc97fdd35bd18b0adb171282f6859562c8e03132e2d4a4d5d17c44ea533e0391446ced49b46f2d7bb674881ae5814d669ba09

Download Submit
C:\Windows\SysWOW64\Himcoo32.exe

Filesize
1.4MB

MD5
cfce221f969338f727a61293371ddd9c

SHA1
e504c9918ed940195b628e2a55eb7048027a9c37

SHA256
8476f3cd2f45f79756566b63f49405673b40fc42ca741e1f780915fe621a8433

SHA512
4449e8490e8d7d7e623f9012d038ab07bd241172b739d777d4220b02bbc33a138960f048530e0781e1778fa57b375b7d69414e112779c3bdd39aeff38504b58b

Download Submit
C:\Windows\SysWOW64\Hmdedo32.exe

Filesize
1.4MB

MD5
a6f9c3e2cbaaa4a32e8fe088465fefcd

SHA1
fadc93cef8a4d18287b37d45de97f995a465c6f4

SHA256
a8f779a686b4057b05cf39ec602826f95d766f3ff465ce22d244c6c40a57d7f6

SHA512
9147cfa7922a4bf4e598e50424d1934e67b1d47a94555d6b9641122c2af8122b50f9e591f8d7b67d78c8f384097fd532bff61037442553d70d8a52cd1e538341

Download Submit
C:\Windows\SysWOW64\Hmfbjnbp.exe

Filesize
1.4MB

MD5
313d996f122512e4426699a6efe2e585

SHA1
36807d8249c20d875cf1c35526f01004b77ad08a

SHA256
73f5b782d8d9367ed13a5351efcc30de691d0aae290de01c54e9e699ba2d1cfc

SHA512
7c4c9a6f54403f25ecd8d1e1b2f11a39ea21a6e3a5b59b4b2c9a31cabdb81ba84fc07eed483e225cb32b95fa200ba7914c75eccd3d2e2549f4282371231b8d47

Download Submit
C:\Windows\SysWOW64\Hpbaqj32.exe

Filesize
1.4MB

MD5
3a73ef81a07591680ea3cfc8b646f88e

SHA1
46938a66bf99284fbdd45fa97edbd9b5824c8a43

SHA256
bb21162da2847aeae5da79c1bc07566f7687eb9a33d2300096b7449df82bdcd8

SHA512
3cbac5e9131a1726f0ab0f36fa140b562fd2561f777bad079700c9b730f6051b2d112f4407fdeed926a68fde013bbd31984cfe9e31569ffb113898f5f024874e

Download Submit
C:\Windows\SysWOW64\Hpenfjad.exe

Filesize
1.4MB

MD5
430d3b3af8bb74baf9c307cfc7f68b7d

SHA1
69ab30076ca741056f31309ce0a9b5cc106dd72a

SHA256
800034a0b25a83ce3b0beea99995fb20fac1290ac1349216ff255465b391c0e4

SHA512
ec8399a33fadb25a6f216881963f1513fc7a6ef1a46e7f93e3635998bd2bd914dff48749e2ba02a134abaf8d04040c154c5b03dfcfeb4d6b4fc457b59342c533

Download Submit
C:\Windows\SysWOW64\Ikbnacmd.exe

Filesize
1.4MB

MD5
e426ed075d683f96e836b9781d3e04cb

SHA1
145443307430e3de5b6becf14072081dde620945

SHA256
b9d17405bf4668cd2b07ac0cb363a332013c62fd334a6490b8c55410718a0677

SHA512
e6d450fdfde9a0c362942961e165ea58eda6d4aa80b3eca452758fcb83715427a43d41fa3ec3c1e709f1ff99c89bb62a3352c292f9a11c136f7dee30ae121e52

Download Submit
C:\Windows\SysWOW64\Ipdqba32.exe

Filesize
1.4MB

MD5
9690dd83003dc97cdf99ada3246f1eba

SHA1
c59aaa4ba2e37e6e53e07cfb9519376c6417ca7c

SHA256
85e4bbf7c0493b3ce499e7df72000d4507f4173b17304a49df114caafbb3dcf6

SHA512
7a03c6fd14e4c99a4e69d0867362012bf37591e72cf68cb78fc64b59102ddc898760452c39d0da4c9d0d90f52a9c1d904cb28644b0d0bbff2e575c6ffa84d8c5

Download Submit
C:\Windows\SysWOW64\Opdghh32.exe

Filesize
1.4MB

MD5
0a182772f43b80d17b995599be2a11c3

SHA1
6f03dba2dc05e1537196d76ea131829b9bd540cb

SHA256
62717f1fcedf3b79f21d0bece0f14830790c0184944a65d0581701d0cc05a867

SHA512
e9710200b2c34c1fb6bb330b7fe4a4154cb4c37dd4f2e895a4437e4fdbd6fa3a4ac78b5de7569783db3e477b987621757d6ee70cf4719861a742993ad31e5668

Download Submit
C:\Windows\SysWOW64\Pcijeb32.exe

Filesize
1.4MB

MD5
caa2fbb9455c60cef8cc93bac36f2b59

SHA1
9eab4019c54eaf060945dccc42ee708eb7c5f17e

SHA256
117a869467f885ad8706cd03e6edac0ce22c4b331429ed9cbfca821c47aa0e32

SHA512
79c1480717798505442e067e8e21a2dd935e25388ea703b5e0ef55beffd65a690e7a1dcdedf08e5f8044df4fc5406a37c70567775143f7d369b779f1068d4ed4

Download Submit
C:\Windows\SysWOW64\Pjhlml32.exe

Filesize
1.4MB

MD5
999e4e285fa2f1a49e63de1607e7d81a

SHA1
74a95f6c389a36c57343325640a0b6fa6e7c0275

SHA256
ac481462ae89db1fcf02256d29013cb1b5f62eb9744519701be410092c687f51

SHA512
1f597160f9da2b1a7c6a4444a92b3969a31704603bb20cc7a630c58f257d963b5cf6e4157a0a266c826a963709b73228980936b91f7f663ace1d98ac2d83f80e

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
1.4MB

MD5
cf4fd149d72bd3862e0338e1c897b403

SHA1
e738d97f4ed785279559cacdfbeb6863c8a9f3ec

SHA256
8453c6d64625e49aaf860678e478c3f3ee9f5a9b9d985311ac2e2b40ccb35966

SHA512
10dcd7e6f323709397c4df021c89096e56edbcf15ec22980618e40a94ce9c19b748973f5116c70a7233377356224de99a0d3a08268fc5921e5d994c6ae12174a

Download Submit
C:\Windows\SysWOW64\Qbimoo32.exe

Filesize
1.4MB

MD5
7b657803162794243654fedda821513d

SHA1
324244ecd95ee3c47dcb645bfb3ea9378cc61aae

SHA256
375ad372d167afb803b078b7cd32599e5b910019297806f6aa4eaf7559c62acf

SHA512
3e5ace6f915c48356d88e3f852ab3b7d5c44eb85dec58d0d80c09277062b9586a8965a4409be05935889ef3cd3238611cb23af6d059255b910e03ef1a18162fc

Download Submit
memory/8-633-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/316-724-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/432-706-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/920-714-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/984-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1020-651-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1144-738-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1208-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1464-658-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1472-643-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1496-747-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1596-626-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1632-705-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1700-675-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1756-656-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1836-620-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1924-696-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1960-109-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2044-712-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2072-737-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2148-100-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2168-664-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2224-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2436-634-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2440-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2440-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2552-720-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2708-745-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2788-730-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2932-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3020-702-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3040-641-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3044-722-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3052-721-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3100-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3140-674-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3216-683-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3268-690-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3272-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3284-697-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3452-707-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3504-650-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3532-93-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3556-740-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3732-631-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3940-666-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4088-723-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4164-739-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4188-689-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4232-667-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4304-659-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4384-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4396-642-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4468-648-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4776-673-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4792-731-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4796-618-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4888-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4892-635-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4952-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4964-21-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5000-681-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5076-682-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5108-704-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/9312-2722-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/9364-2709-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/9460-2715-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/9636-2708-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/9696-2720-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/9708-2719-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/9824-2710-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/9844-2713-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/9960-2725-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10064-2724-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10172-2723-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10188-2716-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10244-2705-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10548-2698-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10592-2697-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10640-2696-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10680-2695-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads