d7e1e4d47a06a5d9a308d6247fe990064d290a508e2e9869a71994fb6a84ad76

Analysis

max time kernel
93s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7e1e4d47a06a5d9a308d6247fe990064d290a508e2e9869a71994fb6a84ad76.exe
Size

63KB
MD5

c5dcaa6af0f652baa66b432d2f8b70d2
SHA1

765e2fae8d6ff766011319bd7a5c4b60b6cf83d0
SHA256

d7e1e4d47a06a5d9a308d6247fe990064d290a508e2e9869a71994fb6a84ad76
SHA512

d5aa25a3862972d29a52d5e5c1bfe46d618f208e9ef20c14a91886efe643229a5189b143b1a261417691df773192789b0cde4b0da52e3205c8b3f39f989706f5
SSDEEP

768:6uPJQyh3ynjNhjQI0DwwL3ahKOfzs4bmuaFiuTv+V1ShkxQA/1H5mXdnhg20a0ka:BiTjQIMwwL3agaKNBU1QkyaCH1juIZo

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dcjnoece.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ccgjopal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idfaefkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikdcmpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oalipoiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akkffkhk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gacjadad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjeiodek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcmmhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdojjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpdgqmnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmbanbmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oalipoiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emjgim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmipdk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hheoid32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcogje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcmlfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmgjia32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfjola32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Goedpofl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plhnda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Diffglam.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckclhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffceip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hipmfjee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mqdcnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eaakpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gaamlecg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdlqqcnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnqfcbnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqojclne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cocjiehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekodjiol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoeieolb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onocomdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbbdjm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjeiodek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Folaiqng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlegnjbm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmiikh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfjka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdjbiheb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpmdfonj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppgegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apmhiq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfeeabda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mchppmij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iliinc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcblpdgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhpiafnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blnoga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cljobphg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eofgpikj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aknbkjfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akdilipp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bahdob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpmggb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdbpgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inkjhi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdenmbkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdmfllhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cogddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnfhfl32.exe

Executes dropped EXE 64 IoCs

pid	Process
3676	Pfaigm32.exe
4660	Qqfmde32.exe
412	Qgqeappe.exe
4120	Qqijje32.exe
2812	Qffbbldm.exe
2484	Ampkof32.exe
4528	Bebblb32.exe
768	Balpgb32.exe
3416	Daqbip32.exe
4188	Ehapfiem.exe
3212	Emaedo32.exe
4088	Ehfjah32.exe
2072	Ekefmc32.exe
4800	Eobocb32.exe
524	Eaakpm32.exe
1908	Ekiohclf.exe
2040	Feocelll.exe
1792	Fkllnbjc.exe
3672	Fnjhjn32.exe
2780	Fhpmgg32.exe
2800	Fedmqk32.exe
4828	Folaiqng.exe
1072	Fhdfbfdh.exe
3336	Fnaokmco.exe
2388	Fgjccb32.exe
4116	Fnckpmql.exe
408	Ghipne32.exe
1652	Gnfhfl32.exe
1784	Goedpofl.exe
2668	Gepmlimi.exe
4816	Ggqida32.exe
2028	Gddinf32.exe
4392	Gojnko32.exe
3020	Gfdfgiid.exe
440	Gkaopp32.exe
4272	Hffcmh32.exe
3052	Hheoid32.exe
4780	Hoogfnnb.exe
1684	Hhgloc32.exe
4724	Hbpphi32.exe
4864	Hhihdcbp.exe
3588	Hnfamjqg.exe
4524	Hdpiid32.exe
3068	Hofmfmhj.exe
4932	Hdbfodfa.exe
2284	Hgabkoee.exe
1628	Inkjhi32.exe
3056	Ihqoeb32.exe
1408	Idgojc32.exe
1944	Inpccihl.exe
2352	Ikcdlmgf.exe
8	Lifjnm32.exe
4136	Leadnm32.exe
4980	Mbjnbqhp.exe
792	Nhpiafnm.exe
4788	Ocopdn32.exe
2696	Ollnhb32.exe
1000	Pfillg32.exe
3264	Ppopjp32.exe
3580	Pcmlfl32.exe
2232	Phjenbhp.exe
3308	Pcpikkge.exe
3892	Plhnda32.exe
568	Qqffjo32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fbpchb32.exe	Flfkkhid.exe
File created	C:\Windows\SysWOW64\Nkbjmj32.dll	Kgflcifg.exe
File created	C:\Windows\SysWOW64\Akqgne32.dll	Aompak32.exe
File created	C:\Windows\SysWOW64\Gjkmhmpl.dll	Dclkee32.exe
File created	C:\Windows\SysWOW64\Gefchq32.dll	Hdhedh32.exe
File opened for modification	C:\Windows\SysWOW64\Kgkfnh32.exe	Kodnmkap.exe
File created	C:\Windows\SysWOW64\Lpfgmnfp.exe	Lljklo32.exe
File created	C:\Windows\SysWOW64\Dhhmleng.dll	Ofmdio32.exe
File created	C:\Windows\SysWOW64\Pneall32.dll	Pdjgha32.exe
File created	C:\Windows\SysWOW64\Hnflfgji.dll	Conanfli.exe
File opened for modification	C:\Windows\SysWOW64\Cnhgjaml.exe	Cgnomg32.exe
File created	C:\Windows\SysWOW64\Dgeenfog.exe	Ddgibkpc.exe
File opened for modification	C:\Windows\SysWOW64\Ghipne32.exe	Fnckpmql.exe
File created	C:\Windows\SysWOW64\Jlolpq32.exe	Ibhkfm32.exe
File opened for modification	C:\Windows\SysWOW64\Lmdnbn32.exe	Ljeafb32.exe
File opened for modification	C:\Windows\SysWOW64\Efmmmn32.exe	Edopabqn.exe
File opened for modification	C:\Windows\SysWOW64\Hfcnpn32.exe	Hlnjbedi.exe
File opened for modification	C:\Windows\SysWOW64\Knenkbio.exe	Kgkfnh32.exe
File opened for modification	C:\Windows\SysWOW64\Oldjcg32.exe	Odmbaj32.exe
File created	C:\Windows\SysWOW64\Ipjoja32.exe	Iipfmggc.exe
File created	C:\Windows\SysWOW64\Ngidlo32.dll	Lnoaaaad.exe
File created	C:\Windows\SysWOW64\Pknlanaa.dll	Ghipne32.exe
File created	C:\Windows\SysWOW64\Dnbokg32.dll	Hdjbiheb.exe
File created	C:\Windows\SysWOW64\Ojdnid32.exe	Oalipoiq.exe
File opened for modification	C:\Windows\SysWOW64\Gkgeoklj.exe	Ghhhcomg.exe
File opened for modification	C:\Windows\SysWOW64\Cjliajmo.exe	Ccbadp32.exe
File created	C:\Windows\SysWOW64\Lljklo32.exe	Kgnbdh32.exe
File created	C:\Windows\SysWOW64\Igafkb32.dll	Pdhkcb32.exe
File created	C:\Windows\SysWOW64\Qgqeappe.exe	Qqfmde32.exe
File created	C:\Windows\SysWOW64\Mjhedo32.dll	Hgabkoee.exe
File created	C:\Windows\SysWOW64\Qbemjj32.dll	Diffglam.exe
File created	C:\Windows\SysWOW64\Nggmhj32.dll	Eangpgcl.exe
File opened for modification	C:\Windows\SysWOW64\Bahkih32.exe	Bllbaa32.exe
File created	C:\Windows\SysWOW64\Qnbidcgp.dll	Bdmmeo32.exe
File opened for modification	C:\Windows\SysWOW64\Meiioonj.exe	Mmbanbmg.exe
File created	C:\Windows\SysWOW64\Digehphc.exe	Ddjmba32.exe
File created	C:\Windows\SysWOW64\Hoaojp32.exe	Hlbcnd32.exe
File created	C:\Windows\SysWOW64\Pijmiq32.dll	Kodnmkap.exe
File created	C:\Windows\SysWOW64\Pdhkcb32.exe	Pdenmbkk.exe
File opened for modification	C:\Windows\SysWOW64\Hhihdcbp.exe	Hbpphi32.exe
File opened for modification	C:\Windows\SysWOW64\Inkjhi32.exe	Hgabkoee.exe
File opened for modification	C:\Windows\SysWOW64\Gdjibj32.exe	Fmpqfq32.exe
File opened for modification	C:\Windows\SysWOW64\Aphnnafb.exe	Aaenbd32.exe
File opened for modification	C:\Windows\SysWOW64\Bajqda32.exe	Bnoddcef.exe
File created	C:\Windows\SysWOW64\Lmhqnncg.dll	Cceddf32.exe
File created	C:\Windows\SysWOW64\Achhaode.dll	Fdffbake.exe
File created	C:\Windows\SysWOW64\Ecpfpo32.dll	Bhkfkmmg.exe
File created	C:\Windows\SysWOW64\Lgnqimah.dll	Oloahhki.exe
File created	C:\Windows\SysWOW64\Eeelnp32.exe	Enkdaepb.exe
File opened for modification	C:\Windows\SysWOW64\Ncnofeof.exe	Nqpcjj32.exe
File created	C:\Windows\SysWOW64\Edjgfcec.exe	Eidbij32.exe
File opened for modification	C:\Windows\SysWOW64\Fkpool32.exe	Fdffbake.exe
File created	C:\Windows\SysWOW64\Hkpqkcpd.exe	Hdehni32.exe
File opened for modification	C:\Windows\SysWOW64\Edhjqc32.exe	Ejpfhnpe.exe
File created	C:\Windows\SysWOW64\Hdjbiheb.exe	Hkbmqb32.exe
File created	C:\Windows\SysWOW64\Dnpdegjp.exe	Dkahilkl.exe
File created	C:\Windows\SysWOW64\Gbnoiqdq.exe	Gppcmeem.exe
File created	C:\Windows\SysWOW64\Ikgbdnie.dll	Ibfnqmpf.exe
File created	C:\Windows\SysWOW64\Pfaigm32.exe	d7e1e4d47a06a5d9a308d6247fe990064d290a508e2e9869a71994fb6a84ad76.exe
File opened for modification	C:\Windows\SysWOW64\Goedpofl.exe	Gnfhfl32.exe
File created	C:\Windows\SysWOW64\Hdbfodfa.exe	Hofmfmhj.exe
File created	C:\Windows\SysWOW64\Dgfnagdi.dll	Nnhmnn32.exe
File opened for modification	C:\Windows\SysWOW64\Mcgiefen.exe	Mfchlbfd.exe
File opened for modification	C:\Windows\SysWOW64\Akkffkhk.exe	Qacameaj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9664	9536	WerFault.exe	529

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohlqcagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okjodami.dll"	Bcghch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkpool32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qabjcina.dll"	Gingkqkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iliinc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncfpbegh.dll"	Inpccihl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cpbbch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icdheded.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Micgbemj.dll"	Ckhecmcf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dodjjimm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjqlnnkp.dll"	Deqcbpld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glfdiedd.dll"	Dgeenfog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hdehni32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkndie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hdehni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbjoeojc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llmhaold.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njjdho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofmfi32.dll"	Ocgbld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhkfkmmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njhgbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Plhnda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmqgpgoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhjnjq32.dll"	Cbbdjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcjmel32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bahkih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hlnjbedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgdidgjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkndie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkdjfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lccahg32.dll"	Jnhidk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hlbcnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njgigo32.dll"	Jlolpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofkgcobj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Coiaiakf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fipkjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbdqegoi.dll"	Oldjcg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kflide32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bocbindj.dll"	Fnckpmql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmdijf32.dll"	Ollnhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enfdlg32.dll"	Aggegh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdbnag32.dll"	Ddcqedkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifolcq32.dll"	Mfnoqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkodcb32.dll"	Mjlhgaqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akdilipp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hhihdcbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njfagf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onlche32.dll"	Nmgjia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akfiji32.dll"	Nopfpgip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmiikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgpcliao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocopdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Digehphc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgeakekd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnpkdp32.dll"	Omgmeigd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmndpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjnppabn.dll"	Hdehni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddipic32.dll"	Hfcnpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imiehfao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahofoogd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmggfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncofplba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnoknihb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 3676	3900	d7e1e4d47a06a5d9a308d6247fe990064d290a508e2e9869a71994fb6a84ad76.exe	83
PID 3900 wrote to memory of 3676	3900	d7e1e4d47a06a5d9a308d6247fe990064d290a508e2e9869a71994fb6a84ad76.exe	83
PID 3900 wrote to memory of 3676	3900	d7e1e4d47a06a5d9a308d6247fe990064d290a508e2e9869a71994fb6a84ad76.exe	83
PID 3676 wrote to memory of 4660	3676	Pfaigm32.exe	84
PID 3676 wrote to memory of 4660	3676	Pfaigm32.exe	84
PID 3676 wrote to memory of 4660	3676	Pfaigm32.exe	84
PID 4660 wrote to memory of 412	4660	Qqfmde32.exe	85
PID 4660 wrote to memory of 412	4660	Qqfmde32.exe	85
PID 4660 wrote to memory of 412	4660	Qqfmde32.exe	85
PID 412 wrote to memory of 4120	412	Qgqeappe.exe	86
PID 412 wrote to memory of 4120	412	Qgqeappe.exe	86
PID 412 wrote to memory of 4120	412	Qgqeappe.exe	86
PID 4120 wrote to memory of 2812	4120	Qqijje32.exe	87
PID 4120 wrote to memory of 2812	4120	Qqijje32.exe	87
PID 4120 wrote to memory of 2812	4120	Qqijje32.exe	87
PID 2812 wrote to memory of 2484	2812	Qffbbldm.exe	89
PID 2812 wrote to memory of 2484	2812	Qffbbldm.exe	89
PID 2812 wrote to memory of 2484	2812	Qffbbldm.exe	89
PID 2484 wrote to memory of 4528	2484	Ampkof32.exe	91
PID 2484 wrote to memory of 4528	2484	Ampkof32.exe	91
PID 2484 wrote to memory of 4528	2484	Ampkof32.exe	91
PID 4528 wrote to memory of 768	4528	Bebblb32.exe	92
PID 4528 wrote to memory of 768	4528	Bebblb32.exe	92
PID 4528 wrote to memory of 768	4528	Bebblb32.exe	92
PID 768 wrote to memory of 3416	768	Balpgb32.exe	93
PID 768 wrote to memory of 3416	768	Balpgb32.exe	93
PID 768 wrote to memory of 3416	768	Balpgb32.exe	93
PID 3416 wrote to memory of 4188	3416	Daqbip32.exe	94
PID 3416 wrote to memory of 4188	3416	Daqbip32.exe	94
PID 3416 wrote to memory of 4188	3416	Daqbip32.exe	94
PID 4188 wrote to memory of 3212	4188	Ehapfiem.exe	96
PID 4188 wrote to memory of 3212	4188	Ehapfiem.exe	96
PID 4188 wrote to memory of 3212	4188	Ehapfiem.exe	96
PID 3212 wrote to memory of 4088	3212	Emaedo32.exe	97
PID 3212 wrote to memory of 4088	3212	Emaedo32.exe	97
PID 3212 wrote to memory of 4088	3212	Emaedo32.exe	97
PID 4088 wrote to memory of 2072	4088	Ehfjah32.exe	98
PID 4088 wrote to memory of 2072	4088	Ehfjah32.exe	98
PID 4088 wrote to memory of 2072	4088	Ehfjah32.exe	98
PID 2072 wrote to memory of 4800	2072	Ekefmc32.exe	99
PID 2072 wrote to memory of 4800	2072	Ekefmc32.exe	99
PID 2072 wrote to memory of 4800	2072	Ekefmc32.exe	99
PID 4800 wrote to memory of 524	4800	Eobocb32.exe	100
PID 4800 wrote to memory of 524	4800	Eobocb32.exe	100
PID 4800 wrote to memory of 524	4800	Eobocb32.exe	100
PID 524 wrote to memory of 1908	524	Eaakpm32.exe	101
PID 524 wrote to memory of 1908	524	Eaakpm32.exe	101
PID 524 wrote to memory of 1908	524	Eaakpm32.exe	101
PID 1908 wrote to memory of 2040	1908	Ekiohclf.exe	102
PID 1908 wrote to memory of 2040	1908	Ekiohclf.exe	102
PID 1908 wrote to memory of 2040	1908	Ekiohclf.exe	102
PID 2040 wrote to memory of 1792	2040	Feocelll.exe	103
PID 2040 wrote to memory of 1792	2040	Feocelll.exe	103
PID 2040 wrote to memory of 1792	2040	Feocelll.exe	103
PID 1792 wrote to memory of 3672	1792	Fkllnbjc.exe	104
PID 1792 wrote to memory of 3672	1792	Fkllnbjc.exe	104
PID 1792 wrote to memory of 3672	1792	Fkllnbjc.exe	104
PID 3672 wrote to memory of 2780	3672	Fnjhjn32.exe	105
PID 3672 wrote to memory of 2780	3672	Fnjhjn32.exe	105
PID 3672 wrote to memory of 2780	3672	Fnjhjn32.exe	105
PID 2780 wrote to memory of 2800	2780	Fhpmgg32.exe	106
PID 2780 wrote to memory of 2800	2780	Fhpmgg32.exe	106
PID 2780 wrote to memory of 2800	2780	Fhpmgg32.exe	106
PID 2800 wrote to memory of 4828	2800	Fedmqk32.exe	107

C:\Users\Admin\AppData\Local\Temp\d7e1e4d47a06a5d9a308d6247fe990064d290a508e2e9869a71994fb6a84ad76.exe
"C:\Users\Admin\AppData\Local\Temp\d7e1e4d47a06a5d9a308d6247fe990064d290a508e2e9869a71994fb6a84ad76.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\SysWOW64\Pfaigm32.exe
  C:\Windows\system32\Pfaigm32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\SysWOW64\Qqfmde32.exe
    C:\Windows\system32\Qqfmde32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Windows\SysWOW64\Qgqeappe.exe
      C:\Windows\system32\Qgqeappe.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:412
    - - C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4120
      - C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:768
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3416
        
        C:\Windows\SysWOW64\Ehapfiem.exe
        
        C:\Windows\system32\Ehapfiem.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Windows\SysWOW64\Emaedo32.exe
        
        C:\Windows\system32\Emaedo32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Windows\SysWOW64\Ehfjah32.exe
        
        C:\Windows\system32\Ehfjah32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\SysWOW64\Ekefmc32.exe
        
        C:\Windows\system32\Ekefmc32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Windows\SysWOW64\Eobocb32.exe
        
        C:\Windows\system32\Eobocb32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:524
        
        C:\Windows\SysWOW64\Ekiohclf.exe
        
        C:\Windows\system32\Ekiohclf.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\SysWOW64\Feocelll.exe
        
        C:\Windows\system32\Feocelll.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2040
        
        C:\Windows\SysWOW64\Fkllnbjc.exe
        
        C:\Windows\system32\Fkllnbjc.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\SysWOW64\Fnjhjn32.exe
        
        C:\Windows\system32\Fnjhjn32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\SysWOW64\Fhpmgg32.exe
        
        C:\Windows\system32\Fhpmgg32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\SysWOW64\Fedmqk32.exe
        
        C:\Windows\system32\Fedmqk32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Windows\SysWOW64\Folaiqng.exe
        
        C:\Windows\system32\Folaiqng.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4828
        
        C:\Windows\SysWOW64\Fhdfbfdh.exe
        
        C:\Windows\system32\Fhdfbfdh.exe
        24⤵
        Executes dropped EXE
        
        PID:1072
        
        C:\Windows\SysWOW64\Fnaokmco.exe
        
        C:\Windows\system32\Fnaokmco.exe
        25⤵
        Executes dropped EXE
        
        PID:3336
        
        C:\Windows\SysWOW64\Fgjccb32.exe
        
        C:\Windows\system32\Fgjccb32.exe
        26⤵
        Executes dropped EXE
        
        PID:2388
        
        C:\Windows\SysWOW64\Fnckpmql.exe
        
        C:\Windows\system32\Fnckpmql.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4116
        
        C:\Windows\SysWOW64\Ghipne32.exe
        
        C:\Windows\system32\Ghipne32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:408
        
        C:\Windows\SysWOW64\Gnfhfl32.exe
        
        C:\Windows\system32\Gnfhfl32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1652
        
        C:\Windows\SysWOW64\Goedpofl.exe
        
        C:\Windows\system32\Goedpofl.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1784
        
        C:\Windows\SysWOW64\Gepmlimi.exe
        
        C:\Windows\system32\Gepmlimi.exe
        31⤵
        Executes dropped EXE
        
        PID:2668
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        32⤵
        Executes dropped EXE
        
        PID:4816
        
        C:\Windows\SysWOW64\Gddinf32.exe
        
        C:\Windows\system32\Gddinf32.exe
        33⤵
        Executes dropped EXE
        
        PID:2028
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        34⤵
        Executes dropped EXE
        
        PID:4392
        
        C:\Windows\SysWOW64\Gfdfgiid.exe
        
        C:\Windows\system32\Gfdfgiid.exe
        35⤵
        Executes dropped EXE
        
        PID:3020
        
        C:\Windows\SysWOW64\Gkaopp32.exe
        
        C:\Windows\system32\Gkaopp32.exe
        36⤵
        Executes dropped EXE
        
        PID:440
        
        C:\Windows\SysWOW64\Hffcmh32.exe
        
        C:\Windows\system32\Hffcmh32.exe
        37⤵
        Executes dropped EXE
        
        PID:4272
        
        C:\Windows\SysWOW64\Hheoid32.exe
        
        C:\Windows\system32\Hheoid32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3052
        
        C:\Windows\SysWOW64\Hoogfnnb.exe
        
        C:\Windows\system32\Hoogfnnb.exe
        39⤵
        Executes dropped EXE
        
        PID:4780
        
        C:\Windows\SysWOW64\Hhgloc32.exe
        
        C:\Windows\system32\Hhgloc32.exe
        40⤵
        Executes dropped EXE
        
        PID:1684
        
        C:\Windows\SysWOW64\Hbpphi32.exe
        
        C:\Windows\system32\Hbpphi32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4724
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4864
        
        C:\Windows\SysWOW64\Hnfamjqg.exe
        
        C:\Windows\system32\Hnfamjqg.exe
        43⤵
        Executes dropped EXE
        
        PID:3588
        
        C:\Windows\SysWOW64\Hdpiid32.exe
        
        C:\Windows\system32\Hdpiid32.exe
        44⤵
        Executes dropped EXE
        
        PID:4524
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3068
        
        C:\Windows\SysWOW64\Hdbfodfa.exe
        
        C:\Windows\system32\Hdbfodfa.exe
        46⤵
        Executes dropped EXE
        
        PID:4932
        
        C:\Windows\SysWOW64\Hgabkoee.exe
        
        C:\Windows\system32\Hgabkoee.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2284
        
        C:\Windows\SysWOW64\Inkjhi32.exe
        
        C:\Windows\system32\Inkjhi32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1628
        
        C:\Windows\SysWOW64\Ihqoeb32.exe
        
        C:\Windows\system32\Ihqoeb32.exe
        49⤵
        Executes dropped EXE
        
        PID:3056
        
        C:\Windows\SysWOW64\Idgojc32.exe
        
        C:\Windows\system32\Idgojc32.exe
        50⤵
        Executes dropped EXE
        
        PID:1408
        
        C:\Windows\SysWOW64\Inpccihl.exe
        
        C:\Windows\system32\Inpccihl.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1944
        
        C:\Windows\SysWOW64\Ikcdlmgf.exe
        
        C:\Windows\system32\Ikcdlmgf.exe
        52⤵
        Executes dropped EXE
        
        PID:2352
        
        C:\Windows\SysWOW64\Lifjnm32.exe
        
        C:\Windows\system32\Lifjnm32.exe
        53⤵
        Executes dropped EXE
        
        PID:8
        
        C:\Windows\SysWOW64\Leadnm32.exe
        
        C:\Windows\system32\Leadnm32.exe
        54⤵
        Executes dropped EXE
        
        PID:4136
        
        C:\Windows\SysWOW64\Mbjnbqhp.exe
        
        C:\Windows\system32\Mbjnbqhp.exe
        55⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\Nhpiafnm.exe
        
        C:\Windows\system32\Nhpiafnm.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:792
        
        C:\Windows\SysWOW64\Ocopdn32.exe
        
        C:\Windows\system32\Ocopdn32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4788
        
        C:\Windows\SysWOW64\Ollnhb32.exe
        
        C:\Windows\system32\Ollnhb32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2696
        
        C:\Windows\SysWOW64\Pfillg32.exe
        
        C:\Windows\system32\Pfillg32.exe
        59⤵
        Executes dropped EXE
        
        PID:1000
        
        C:\Windows\SysWOW64\Ppopjp32.exe
        
        C:\Windows\system32\Ppopjp32.exe
        60⤵
        Executes dropped EXE
        
        PID:3264
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3580
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        62⤵
        Executes dropped EXE
        
        PID:2232
        
        C:\Windows\SysWOW64\Pcpikkge.exe
        
        C:\Windows\system32\Pcpikkge.exe
        63⤵
        Executes dropped EXE
        
        PID:3308
        
        C:\Windows\SysWOW64\Plhnda32.exe
        
        C:\Windows\system32\Plhnda32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3892
        
        C:\Windows\SysWOW64\Qgnbaj32.exe
        
        C:\Windows\system32\Qgnbaj32.exe
        65⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Qqffjo32.exe
        
        C:\Windows\system32\Qqffjo32.exe
        66⤵
        Executes dropped EXE
        
        PID:568
        
        C:\Windows\SysWOW64\Qgpogili.exe
        
        C:\Windows\system32\Qgpogili.exe
        67⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        68⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Afelhf32.exe
        
        C:\Windows\system32\Afelhf32.exe
        69⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\Aompak32.exe
        
        C:\Windows\system32\Aompak32.exe
        70⤵
        Drops file in System32 directory
        
        PID:552
        
        C:\Windows\SysWOW64\Amaqjp32.exe
        
        C:\Windows\system32\Amaqjp32.exe
        71⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        72⤵
        Modifies registry class
        
        PID:952
        
        C:\Windows\SysWOW64\Aihaoqlp.exe
        
        C:\Windows\system32\Aihaoqlp.exe
        73⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Acnemi32.exe
        
        C:\Windows\system32\Acnemi32.exe
        74⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Aflaie32.exe
        
        C:\Windows\system32\Aflaie32.exe
        75⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\Aqaffn32.exe
        
        C:\Windows\system32\Aqaffn32.exe
        76⤵
        
        PID:652
        
        C:\Windows\SysWOW64\Aglnbhal.exe
        
        C:\Windows\system32\Aglnbhal.exe
        77⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\Bgpgng32.exe
        
        C:\Windows\system32\Bgpgng32.exe
        78⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Bmmpfn32.exe
        
        C:\Windows\system32\Bmmpfn32.exe
        79⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\Bcghch32.exe
        
        C:\Windows\system32\Bcghch32.exe
        80⤵
        Modifies registry class
        
        PID:2424
        
        C:\Windows\SysWOW64\Bmomlnjk.exe
        
        C:\Windows\system32\Bmomlnjk.exe
        81⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Bifmqo32.exe
        
        C:\Windows\system32\Bifmqo32.exe
        82⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4064
        
        C:\Windows\SysWOW64\Cpbbch32.exe
        
        C:\Windows\system32\Cpbbch32.exe
        84⤵
        Modifies registry class
        
        PID:3116
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        85⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Ccqkigkp.exe
        
        C:\Windows\system32\Ccqkigkp.exe
        86⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\Cadlbk32.exe
        
        C:\Windows\system32\Cadlbk32.exe
        87⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        88⤵
        Drops file in System32 directory
        
        PID:2300
        
        C:\Windows\SysWOW64\Cjaifp32.exe
        
        C:\Windows\system32\Cjaifp32.exe
        89⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\Dcjnoece.exe
        
        C:\Windows\system32\Dcjnoece.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2136
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4632
        
        C:\Windows\SysWOW64\Dclkee32.exe
        
        C:\Windows\system32\Dclkee32.exe
        92⤵
        Drops file in System32 directory
        
        PID:3312
        
        C:\Windows\SysWOW64\Diicml32.exe
        
        C:\Windows\system32\Diicml32.exe
        93⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1776
        
        C:\Windows\SysWOW64\Djhpgofm.exe
        
        C:\Windows\system32\Djhpgofm.exe
        95⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        96⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        97⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Ddcqedkk.exe
        
        C:\Windows\system32\Ddcqedkk.exe
        98⤵
        Modifies registry class
        
        PID:5144
        
        C:\Windows\SysWOW64\Eagaoh32.exe
        
        C:\Windows\system32\Eagaoh32.exe
        99⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Ejpfhnpe.exe
        
        C:\Windows\system32\Ejpfhnpe.exe
        100⤵
        Drops file in System32 directory
        
        PID:5236
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        101⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        102⤵
        Drops file in System32 directory
        
        PID:5332
        
        C:\Windows\SysWOW64\Edjgfcec.exe
        
        C:\Windows\system32\Edjgfcec.exe
        103⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Efhcbodf.exe
        
        C:\Windows\system32\Efhcbodf.exe
        104⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Eangpgcl.exe
        
        C:\Windows\system32\Eangpgcl.exe
        105⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        106⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        107⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Edopabqn.exe
        
        C:\Windows\system32\Edopabqn.exe
        108⤵
        Drops file in System32 directory
        
        PID:5608
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        109⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        110⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        111⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Fkkeclfh.exe
        
        C:\Windows\system32\Fkkeclfh.exe
        112⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        113⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        114⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        115⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        116⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Fdffbake.exe
        
        C:\Windows\system32\Fdffbake.exe
        117⤵
        Drops file in System32 directory
        
        PID:6024
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        118⤵
        Modifies registry class
        
        PID:6072
        
        C:\Windows\SysWOW64\Fpmggb32.exe
        
        C:\Windows\system32\Fpmggb32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6116
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        120⤵
        Modifies registry class
        
        PID:5152
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        121⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        122⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        123⤵
        Drops file in System32 directory
        
        PID:5368
        
        C:\Windows\SysWOW64\Gkgeoklj.exe
        
        C:\Windows\system32\Gkgeoklj.exe
        124⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4496
        
        C:\Windows\SysWOW64\Gilapgqb.exe
        
        C:\Windows\system32\Gilapgqb.exe
        126⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5644
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        128⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        129⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Ghpocngo.exe
        
        C:\Windows\system32\Ghpocngo.exe
        130⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        131⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Hhbkinel.exe
        
        C:\Windows\system32\Hhbkinel.exe
        132⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Hjhalefe.exe
        
        C:\Windows\system32\Hjhalefe.exe
        133⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Hpbiip32.exe
        
        C:\Windows\system32\Hpbiip32.exe
        134⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Hglaej32.exe
        
        C:\Windows\system32\Hglaej32.exe
        135⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        136⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        137⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Alnmjjdb.exe
        
        C:\Windows\system32\Alnmjjdb.exe
        138⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        139⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        140⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        141⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6004
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        143⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        144⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        145⤵
        Drops file in System32 directory
        
        PID:5364
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        146⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        147⤵
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        148⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5992
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        150⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        151⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        152⤵
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        153⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        154⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        155⤵
        Modifies registry class
        
        PID:5756
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        156⤵
        Drops file in System32 directory
        
        PID:5244
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        157⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        158⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        159⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        160⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        161⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        162⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        163⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        164⤵
        Modifies registry class
        
        PID:6292
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        165⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        166⤵
        Modifies registry class
        
        PID:6376
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        167⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        168⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        169⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        170⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6556
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        171⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        172⤵
        Drops file in System32 directory
        
        PID:6640
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        173⤵
        Drops file in System32 directory
        
        PID:6692
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6732
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        175⤵
        Modifies registry class
        
        PID:6780
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6824
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        177⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        178⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6956
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        180⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        181⤵
        Modifies registry class
        
        PID:7044
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        182⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        183⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        184⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6204
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        186⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6328
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        188⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        189⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        190⤵
        Modifies registry class
        
        PID:6520
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        191⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        192⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        193⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        194⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6944
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        196⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        197⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        198⤵
        Modifies registry class
        
        PID:6164
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        199⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6400
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        201⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        202⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        203⤵
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        204⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        205⤵
        Modifies registry class
        
        PID:6984
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        206⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        208⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        209⤵
        Drops file in System32 directory
        
        PID:4804
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6932
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        211⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        212⤵
        Drops file in System32 directory
        
        PID:6676
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        213⤵
        Modifies registry class
        
        PID:6748
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        214⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        215⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        216⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        217⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        218⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        219⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        220⤵
        
        PID:412
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        221⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        222⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        223⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        224⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        225⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        226⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        227⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        228⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        229⤵
        Drops file in System32 directory
        
        PID:7376
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        230⤵
        Modifies registry class
        
        PID:7420
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7460
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        232⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        233⤵
        Modifies registry class
        
        PID:7556
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        234⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        235⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7684
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        237⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7772
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        239⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        240⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        241⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        242⤵
        Modifies registry class
        
        PID:7960
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        243⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        244⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8076
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        246⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        247⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        248⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        249⤵
        Drops file in System32 directory
        
        PID:7244
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        250⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        251⤵
        Drops file in System32 directory
        
        PID:7360
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        252⤵
        Modifies registry class
        
        PID:7412
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        253⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        254⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        255⤵
        Modifies registry class
        
        PID:7592
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        256⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        257⤵
        Modifies registry class
        
        PID:7764
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3136
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        259⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7968
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        261⤵
        Drops file in System32 directory
        
        PID:8028
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        262⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8184
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        264⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        265⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        266⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        267⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        268⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        269⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        270⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        271⤵
        Drops file in System32 directory
        
        PID:7952
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        272⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        273⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        274⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        275⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3596
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        277⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        278⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        279⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7948
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        281⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        282⤵
        Drops file in System32 directory
        
        PID:8056
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        283⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        284⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        285⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        286⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7748
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        288⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2080
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        289⤵
        Modifies registry class
        
        PID:7988
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        290⤵
        
        PID:764
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        291⤵
        Modifies registry class
        
        PID:4668
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        292⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7272
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        293⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        294⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:408
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        296⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3352
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        298⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        299⤵
        Modifies registry class
        
        PID:2704
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        300⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        301⤵
        Drops file in System32 directory
        
        PID:4648
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        302⤵
        Drops file in System32 directory
        
        PID:2584
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        303⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        304⤵
        Drops file in System32 directory
        
        PID:1364
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        305⤵
        Modifies registry class
        
        PID:7572
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        306⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        307⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        308⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3616
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        310⤵
        Drops file in System32 directory
        
        PID:8152
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2760
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        312⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4380
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        314⤵
        Modifies registry class
        
        PID:4272
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        315⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        316⤵
        
        PID:456
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        317⤵
        Drops file in System32 directory
        
        PID:7584
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        318⤵
        Drops file in System32 directory
        
        PID:6860
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        319⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        320⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        321⤵
        Drops file in System32 directory
        
        PID:2560
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        322⤵
        Drops file in System32 directory
        
        PID:4360
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        323⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        324⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        325⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        326⤵
        Modifies registry class
        
        PID:1692
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        327⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        328⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        329⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        330⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        331⤵
        Modifies registry class
        
        PID:7740
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        332⤵
        Drops file in System32 directory
        
        PID:440
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        333⤵
        Drops file in System32 directory
        
        PID:8176
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        334⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4600
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        336⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        337⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        338⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        339⤵
        Modifies registry class
        
        PID:8312
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        340⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8404
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        342⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        343⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        344⤵
        Modifies registry class
        
        PID:8548
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        345⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        346⤵
        Drops file in System32 directory
        
        PID:8644
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        347⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8744
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        349⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        350⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        351⤵
        Modifies registry class
        
        PID:8888
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        352⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        353⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        354⤵
        Modifies registry class
        
        PID:9032
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9076
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        356⤵
        Drops file in System32 directory
        
        PID:9132
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        357⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        358⤵
        Modifies registry class
        
        PID:4280
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        359⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        360⤵
        Modifies registry class
        
        PID:8320
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8360
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        362⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        363⤵
        Drops file in System32 directory
        
        PID:212
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        364⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        365⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        366⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        367⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        368⤵
        Modifies registry class
        
        PID:8828
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        369⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        370⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        371⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        372⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        373⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4332
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        375⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        376⤵
        Modifies registry class
        
        PID:8324
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        377⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        378⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        379⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        380⤵
        Drops file in System32 directory
        
        PID:8668
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        381⤵
        Modifies registry class
        
        PID:8820
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        382⤵
        Modifies registry class
        
        PID:8900
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8992
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9060
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        385⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        386⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8468
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        388⤵
        Drops file in System32 directory
        
        PID:8576
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        389⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        390⤵
        Drops file in System32 directory
        
        PID:8840
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        391⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        392⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        393⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        394⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        395⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        396⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        397⤵
        Drops file in System32 directory
        
        PID:5056
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9152
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        399⤵
        Drops file in System32 directory
        
        PID:7156
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        400⤵
        
        PID:620
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        401⤵
        Modifies registry class
        
        PID:372
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8772
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        403⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        404⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        405⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3380
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        407⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        408⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2492
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        410⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        411⤵
        Drops file in System32 directory
        
        PID:4540
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        412⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        413⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3940
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        414⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3360
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        415⤵
        Modifies registry class
        
        PID:1380
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        416⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        417⤵
        
        PID:648
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        418⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1844
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        420⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        421⤵
        Drops file in System32 directory
        
        PID:1524
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        422⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        423⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        424⤵
        Drops file in System32 directory
        
        PID:2504
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        425⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        426⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        427⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        428⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3748
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        429⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4536
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        430⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1588
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        431⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        432⤵
        Drops file in System32 directory
        
        PID:1508
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        433⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        434⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4064
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        435⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9300
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        437⤵
        Modifies registry class
        
        PID:9360
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        438⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        439⤵
        Drops file in System32 directory
        
        PID:9452
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        440⤵
        Modifies registry class
        
        PID:9496
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        441⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9536 -s 436
        442⤵
        Program crash
        
        PID:9664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 9536 -ip 9536
1⤵
PID:9580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acnemi32.exe

Filesize
63KB

MD5
d265e039ca7ed37282afcf840b8b5b46

SHA1
dd2f376d1d4d6ff689203611955159072c6a6340

SHA256
e3bc18513ed2b0ce3ffc3db39cb2fe348dfbc890627423a1e0948f68bc3aeed2

SHA512
3920a3d30c7f330d47677e2f534f1b129f30f1f2c822c0728c22570ebabd0c299cd4827c3b3d4cbe5e6c61bc075a5532252fd71909a506c3f8547fa7407f056a

Download Submit
C:\Windows\SysWOW64\Akcjkfij.exe

Filesize
63KB

MD5
b700e20bc2249df1754b1ec7472557e2

SHA1
c236a40bd11a66f274c08bbb30d972aac26e2294

SHA256
2cdad1120326641ff20ea5208423eaab9db3654ac8983fec462f53dbef12384c

SHA512
ef8a179c9185f11ec03114157f91ae74b796a39651da3fb95cd763b7d222fee6f9620d4f4d2910545efc03c47e2028161193bfb03befbbb172d7ff784a8de09c

Download Submit
C:\Windows\SysWOW64\Ampkof32.exe

Filesize
63KB

MD5
5c255590dbb4fbddef60438c4d05001d

SHA1
559b4cd495c1850b7d675c07dc737be0d9d4c486

SHA256
4eafde857997c41f2cbe6e4a6187aa50dadd2420532bb402deb45ea6836d902b

SHA512
29827328012fdaf838454b516deac6e25403df029d28ab3c727945f66b2f8a544bb0d139c947c66a92e82fefb037adff1c591110ddb2eefb182cd3ef136aac45

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
63KB

MD5
db3936e57951c91ba68226d4adf08a46

SHA1
e6299d81b2b2fd1364fe9efc92eebba9a865cbc9

SHA256
f9da00e7db22c934a4ac8f2e371301e57c96d5fb9746ed2b90e8f1d6fa519146

SHA512
f3b1f76537a65ea7fec079be418a898e9c7ca7388786056ae852f627efcfbd4b1e88eddafffc4a01d489874f85cea37d764455bb33bd52c915789e95d796bb15

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
63KB

MD5
150faf0c601c89a0b6bf5cf1d037a40b

SHA1
25a833fe2be7143ccaa540847afeab043d0e02d3

SHA256
86cbf3a2e20a49bc1ec4e0f70bb37c5fcb260ecb2a19a16b1ed7719049ec9d6c

SHA512
c4fe31619d4b8c1d22790e65239521da504084162a1fb75c9e6f4efccf5a70666ec9ed180be7d19af990906816305f3c331f18f2d73371e6a2980eba6ca01c86

Download Submit
C:\Windows\SysWOW64\Bepmoh32.exe

Filesize
63KB

MD5
f56dfa505d86a3aea1e9f8d69431ff66

SHA1
b89af862d77b4617937f17869c47c4a34f8c3ef0

SHA256
3720ba452d15979ce0ba42ebf3e7e2efd0c65144dafb44f9ed1c3f03fb8990c5

SHA512
812b0454a475612e4ee24e772fb513e25d27c6e0b1cea826d89d7095ea25dab924d9f2b8f286225845ce7192c6d1360b302349318b6ff9c2cf5316040a217f13

Download Submit
C:\Windows\SysWOW64\Bjfjka32.exe

Filesize
63KB

MD5
2dc3ddae9657c5f3a72fa7be336ee69d

SHA1
db483ae421a5434855364c120e9b98e913d9d323

SHA256
96c0ddde081062a48086f4148f22fb61796eaa4df338f3dac54d05b786b563e8

SHA512
20a8f2181fbb3115dc5cdf840554b3d0883348b5650777b6de0bd9bb58ead8a0b3cadf463135ef5c18051377aba7adbcb7bc17b8d3fab0da49c225757fb6aade

Download Submit
C:\Windows\SysWOW64\Cceddf32.exe

Filesize
63KB

MD5
57d27c095246e8dd18f2006fc0207ada

SHA1
5f56f1e5e71df4270d12b26945d7740cb8b31baf

SHA256
f94deadc8f83427cee87ff1f9e2fd313fbf5aadb6e26c0712763f1931ea8f68e

SHA512
0c92a611e5c3fb4f72741b413a3f165bf1193cc5f09669e8c36880235d5f645c561885d08d161e80cdc7a91f749555b26d2eb85268dda8a187b3f9c6b109cb3a

Download Submit
C:\Windows\SysWOW64\Cikglnkj.exe

Filesize
63KB

MD5
a32ec8734bf69a1aa6dc4a9e0d4db652

SHA1
df84d2c306657a976442c38fc2f99a0e79e8d754

SHA256
6574094766a82f18ed3bc946637e47ae24bd38d1d6223e9527662af4388761b8

SHA512
9be6e24cceb2e2fd044ab94891b7979a880d8e60782f522f48d208c283e3698aac997730001655e4fa942b66b94c65d780fb2681d677c9ffb2c492ac67d7a79b

Download Submit
C:\Windows\SysWOW64\Cjliajmo.exe

Filesize
63KB

MD5
ba3726397130cd71d028d13c0c7b8e6e

SHA1
722a36bccf3e6fee5dd0361dca08d4038819fb3f

SHA256
2e46e1fd5488db15c925b4a3d08e3a9e19ba738294aced521455d1a5738d74ae

SHA512
36626d187bdd5cd39f4d99e65388bf2ef4d7ea8a85d7674e1a1f9bbb44a2f749b74189f6d950a7577cb191577f6c95be0b180272ee34fa4ad798c1e620733712

Download Submit
C:\Windows\SysWOW64\Cofnik32.exe

Filesize
63KB

MD5
8c8a16deb2823b9cfe04566cfde63d85

SHA1
b4e9d1cee72dff74dbb448cf99fb9cacb84d4759

SHA256
4358e2b9add60c1138001a95de949b5b0ddfd3bd33d61d64988b4bb41bf91574

SHA512
027d198d21f70429f972958081eb78bf1c84f9a0ef14d4bcce0eab0b5aad5d7a599094b603877422c7e18aa703bc6b153566bc4419be8447dc380c34e09ce3ef

Download Submit
C:\Windows\SysWOW64\Daqbip32.exe

Filesize
63KB

MD5
974e38e4a2c2e70afce1ae6c281f0967

SHA1
87985b4b8844d5ca255cee4254215a97c7fa4c58

SHA256
7d678acc4f3fb0c8d4989ec84fc1801182b444713e1c4be481e1de6ed13a8a95

SHA512
d2e04693e3993f8b0504ee8ccddacffcfa0df2ea2fc3389861fa79386c6c1fe9fc41bd39b39fb0e2e096e2a95169b1721625a96d073f5d068a42066e9fac7f62

Download Submit
C:\Windows\SysWOW64\Dcjnoece.exe

Filesize
63KB

MD5
253cd4fd1f0b5131b9ed4fb2d5da4551

SHA1
1dc89be4719b21fd67298af1d19fa56ef86c8a48

SHA256
9508204978c28339153e274f052ef1006369536b1ef1616a880cb377d8cdc3f1

SHA512
7c854a0b27b44fa0801e6ff610412259d1e0a4b93bb42234390a53ec46e6d0b57b4691f6d03f1780737dd0c9796687cb2f98a331dffb379b4126d03bbf7d0d89

Download Submit
C:\Windows\SysWOW64\Digehphc.exe

Filesize
63KB

MD5
e832cf6c5a9eb8b75061fe76c95c0674

SHA1
5828b89c8ff3ef8e4d69039be2f001df54f6a64e

SHA256
98d3e697a64716b5fbcbfdd54ed805ea7dcb72ddc34dee636a8cede440e2b5d9

SHA512
70579c8f0750efe8cceef5e9be5507946877264cbc708070368fc14a4ed1f9625953ee348d4e245d6f8a5a73a900acc9801fada55b19eb90d64ce4054a362c73

Download Submit
C:\Windows\SysWOW64\Diicml32.exe

Filesize
63KB

MD5
fb84a8a1c136056a916d331cb564b93e

SHA1
2db9cd2b4c002ca1967fbbc82d648fc749a9739f

SHA256
29f4cecdfe5d891524fbe7fa7917ba47e12e43feddd1f021282e7fd84a832124

SHA512
e24aa3049cb4fd99f88dd90491825e3013f57ff417932b33c73897651a7d35141246b41e72cd5a2041790be8962f18f57a7b6d7dbe431bb2059d9284432bb179

Download Submit
C:\Windows\SysWOW64\Eaakpm32.exe

Filesize
63KB

MD5
6df279b783036bf09523adc39f2895a1

SHA1
b5715651c7ea21b62c4f9d558a05e0e8071fbd77

SHA256
de63f75abadc775bcb14b5ccf751fc7799a607f1df6b36bf9ea9737941c14948

SHA512
c09ba0064e86241422337ac0ba8ec15837dd069507e848bc943e1d7ac9c7228563791962ad603b9121a5051151620be3482b73c6c74a6e0ea4c723665720050d

Download Submit
C:\Windows\SysWOW64\Ehapfiem.exe

Filesize
63KB

MD5
b6f462fff1aae20747335dd7878faae9

SHA1
d6979eb15ea2326719c6f87efe10934f908dfb5b

SHA256
38a8e447c56c512fa3f8882a9be755ed01fd84b209c8468f105cb8636cd4a58c

SHA512
b4c210264883d3362557341bcc14fb2fadbf35fe114c1d5f96baba16dd88a9ff2d0c40be049519990bd7ec9c35de5811e90b064e94508d4745b30044049ccbbd

Download Submit
C:\Windows\SysWOW64\Ehfjah32.exe

Filesize
63KB

MD5
2767c5e4445c9d0698c2ef6148ba2cfb

SHA1
4e83a3ff57b9384027dc9410bdef5ab729f17bd5

SHA256
38fac5ed83102abb98ec0b0ae8857b5dbd40aa59bd9bff208c8d893525151cc8

SHA512
34b4e939c64c98d589b61d599dd3c4281e6980526331d751984b5deecb4d270ea9ca9c35ee276ac25487dd8f852e81a280204da38898dc426117276d9439578e

Download Submit
C:\Windows\SysWOW64\Ekefmc32.exe

Filesize
63KB

MD5
50844efe552e50c3cec1596e3087287f

SHA1
24db98034a58e12bfae0ad69e5272f99cb35e0a0

SHA256
9704dcc934490a6bd772c50ab3e170c0208fba15ec9a0b021081b8b5902a20af

SHA512
088544dc3ea5b7bbd5a7d07ebe2651b3a7ab331deefde1bc0b87cec3c36dffdbec977e707b180f7fe041c589a2c12c00a27063fe0aa50f60eb42fcc62d03cda4

Download Submit
C:\Windows\SysWOW64\Ekiohclf.exe

Filesize
63KB

MD5
dee8c3c70f47e19386e0475602a1e522

SHA1
d2a3214758cc21f2402221551cfeadb45fd9842e

SHA256
f5af609792c3f9694e6e09fece53a4f23e6c99620866d26dd0397e5cac3cbdfd

SHA512
01881764404936d3d8bb07335b62dc634847a797957549474c3462b324f39dbeb35f3e8c4f7740e0d97fc710a285b5d09dd615d00b02569fe2937167535544fd

Download Submit
C:\Windows\SysWOW64\Emaedo32.exe

Filesize
63KB

MD5
4c8c2475b7855df19dbea14f0c81d19b

SHA1
33e6110504b9bef727c22dbd305bcae643ffdf26

SHA256
c97b9362a6f5af4cf39da438f4cc1e5ed46a74d5ad896bd47eaf75fcf499b748

SHA512
d54a8885ccb7deef548a2db7c84e510c59a34315437bd931017532fda64fbf86551b5680abeab2d24b3e587b8fe29733ada3641d154993734c2a1117bf396165

Download Submit
C:\Windows\SysWOW64\Eobocb32.exe

Filesize
63KB

MD5
9042a6bde129b4eabeb9186a9ce213cf

SHA1
1b70398edd8e691e7e4a5fecb1fa44b1c27d24fd

SHA256
02d0ab4481e6bfef7f7112dcd760b5f1af31b608e6c7b2e1fe9a0f8d0906aae0

SHA512
3d7db83d695f0e619f450e709f991f52c3c6eb13ba12e5dbb09f762e7b1fe8fc6323b93b549293cfc86156c59678af068c2da76ae46877e71b4ad0bcaddb95e5

Download Submit
C:\Windows\SysWOW64\Fedmqk32.exe

Filesize
63KB

MD5
cfcf8e61335a280d6697e52b57276d5d

SHA1
600609f6c091ed7d7f7996d482714cedbf39faa4

SHA256
f99965bd9078b7d1ba536cffd4b20f430de9f6c26b386b158d530c58d590acae

SHA512
40e1c36961530f83eb18a5edd62df6fe46ef8218dd08240577c2095d508999298cadf78400126e434cf8eb974be66a48e9ad0f47d8528a1d30b23fca446efa1e

Download Submit
C:\Windows\SysWOW64\Feocelll.exe

Filesize
63KB

MD5
373d2ed6f734627b2fc02577fb542327

SHA1
22e092fa002ab3ebee36edd7b2d57088a11a0131

SHA256
187574962e28f57357a6038dd0eb3ecfb841ee70198fa17de9df010e5a1f3c11

SHA512
b8c0d37c99ac575651b6a462cfae5bdf0c9828f2fd5c3619369475f3491db065ba509efc41e794a33144ad8baa609f2e364c89c9ffe653a56e9434ce90b96112

Download Submit
C:\Windows\SysWOW64\Fgjccb32.exe

Filesize
63KB

MD5
4c8a7397484fa2dff3b82a6b6f01601c

SHA1
0693297828bd7f721d7a01b30512af73fed3cb1c

SHA256
de19198196ff7b8f7243bfcd40e1af1bbdbe0b769fb441467c8957a6bb49b3bc

SHA512
0d9a063746bf325a633bffbd86766095bf8817cb0fbd57cfabf6ef6fa4f3c9ac6f8ec8bdd6436b1ebfc26974dfa42bb87c341a56b4d156ef84cf4a76ac361143

Download Submit
C:\Windows\SysWOW64\Fhdfbfdh.exe

Filesize
63KB

MD5
71ef69d83aac1b94c6b56554c0df2b2a

SHA1
735664e0c5b906a01a961eaa29d677eaf329a9f6

SHA256
978cefa7696ced1f9d473a6e55e7e8c45275fadb708f8087d1191654d1ceb510

SHA512
9926b285baf107b08f18fa130a3d394883f2cab62eba0ee0a310f7996ebe90272e16e1e856324f3de3ba6d401a7990b987614b1cffa23e3aa674f4994381c2a6

Download Submit
C:\Windows\SysWOW64\Fhpmgg32.exe

Filesize
63KB

MD5
c284c0b6772a4a4809fdfb319c8a4c61

SHA1
169bb5b1badcd873553440902ffb7f7c8b433478

SHA256
98ae47a5232dd4a63b5e6e1c288e546d93b9710309b14d612065c4dfa2d943e3

SHA512
bf44af833068bb736e5a5857ac82481624cb549f545e46437f461ac59e4813b8c435ee2f695820246efc3ac392e965f287a82c4d3a82ba0879a1ab86923bdd54

Download Submit
C:\Windows\SysWOW64\Fkllnbjc.exe

Filesize
63KB

MD5
bd732f4e383c3e980250ee7d9e9800a5

SHA1
cefc840cdbabc51bd57aaa64fa55930ef03f9887

SHA256
520086c78a16582e80bf29283a0e106796571d58b91d52dd94c566329b8e7083

SHA512
c2c67337ad550bd7c194535027885a1dd0df7bcb9b061ea8e47aef9ff097446ede08ac1c304da4b09a9172840d36008dbb5fdace69e856f0d7a5a153b06b5f6d

Download Submit
C:\Windows\SysWOW64\Fnaokmco.exe

Filesize
63KB

MD5
6c33bba52631268c0e95ee2f0c7c97f2

SHA1
d7700cab3df03252cfb19a17985052001b099070

SHA256
7418202ce0be07f5d75ab0d0ff5b46762ed715376a6322a2ba428fbd60db6db9

SHA512
0040b285c5b015ca7eb4daef5986d50e3b3fc6e9bdd10679fd06ddf2513803f91b988f816a67a60100832c8d276af204ef8f38783e3d0775a2d083ca7f14d938

Download Submit
C:\Windows\SysWOW64\Fnckpmql.exe

Filesize
63KB

MD5
e8013f896259d97d3042d3d03fdf71ef

SHA1
1232630226a1531e30a8aa9af91949c07de88da9

SHA256
fc7ad77e61dc248db8eab2e34d6fbb7cd46dd640157154abd5d43cfee0e76fed

SHA512
0210324686905e5ae61c5c013a98e2c5347247396cf812d1cfab5f35dca5faf5fbd47e8cd2e15b2c16ffce4f62f29ed3c8b62fe3b5c8e9954879e6f0e9b8de61

Download Submit
C:\Windows\SysWOW64\Fnjhjn32.exe

Filesize
63KB

MD5
6262b9043923fb68b4728de00d387d85

SHA1
7fb32d1c639d53d33f88b2d6dde591aff53f33ee

SHA256
771026c90b4c5718daaabaf4692cbac200a96650b76c699e80812c0705794410

SHA512
bfc9aa9929998ef98ca28b6812d857b1d8936b5637ee06fff53ef316cdabf176ac251892679e0ae90fb8e9fac32d2638dc3a98a6f6b3e1a8bcbf2218638c2c78

Download Submit
C:\Windows\SysWOW64\Folaiqng.exe

Filesize
63KB

MD5
ac1d682880c1bcc0ffa4043da163b33c

SHA1
f3771ff2f8421609c7292ec6712229ce755aba0d

SHA256
9f338d3751f8297e900f849fd9ea51548656f8fc12f1b2478b326718f959c73a

SHA512
6257acd163cde65cbdc2e12e78ddc993dd8235a171619a38ecf1a707fd9d5699ef919ef85e8e01a6a40051ce6d94ba1127ad3ce7fb77adc7c1fdd82581f32283

Download Submit
C:\Windows\SysWOW64\Gddinf32.exe

Filesize
63KB

MD5
265c31582fdd87b5203f023b47908f7b

SHA1
c2caf8630b10e110d2a34b622ee23711ae43ba6a

SHA256
a74292067d6abe09e4708db176ddccd5686f0a005d8004c241624859ca56b265

SHA512
1f42d74723ed8ac3e6da4006dda1276c539b1992c0aa2689cd84f2723eb14dc4894513433e6820d2a70483bec97a9ace6140afe39a81e51711a5f23ae8bed4ee

Download Submit
C:\Windows\SysWOW64\Gepmlimi.exe

Filesize
63KB

MD5
41c661202f59bbc8ea00cc42dbd5d8e5

SHA1
e41031ccf34211f9c58a7c03eb928834d8a9874f

SHA256
13be7b1f3ac4802ed88440e21128735ea940379c31461737918398a4a2c1d50e

SHA512
5b0b74a8f59bd9f826a224215fda514baf321bf782c8b832e5c3ca7a69918d59a2bb18b53e63326dd94629de49117eb696eff96de7df8ff66bf7762d8ccc1c57

Download Submit
C:\Windows\SysWOW64\Ggqida32.exe

Filesize
63KB

MD5
73c6dad84398874ef1bb0cf183d09197

SHA1
bad040d7e3d6f6d3d07f4b4936f3150165901006

SHA256
7de44ec6790f286bfd4fe5e95d869fadb03eab398b2d28e3fb1d770625a76ea5

SHA512
3418d5959b8d73cec703046cacd81e5acdb748e458121d1d3c7697f7fb6f5b4cedaaf4204057ae75db33a5b3a0efbb6273c8f9be49cb3e89cc40faf37fd112d3

Download Submit
C:\Windows\SysWOW64\Ghipne32.exe

Filesize
63KB

MD5
7238190f01fa37f7961d9ead3a3d11e4

SHA1
d2fb75c9420f38fae3f75165a31744247570c315

SHA256
e2bef370b35936b889c46ff48b94c90ac2d4d71bf7e67034ccda9e26c5826f27

SHA512
85c16f2624ccde98214409ac5b86b1833a602bc19d42940fef0bf76eca65c931113f3eca2f779472b65b40e0b4fd3885b14331d6e3bc5ff54d1debf26a643cc9

Download Submit
C:\Windows\SysWOW64\Glengm32.exe

Filesize
63KB

MD5
d7081181388ffb53380fe87a35edcc9e

SHA1
cc7314c089c7b773dbed1518e635036778ed525d

SHA256
c9e2ba4d7fa3605922cceeb417696934c2e9106f268fdeefc9af92fc7f1c35df

SHA512
34dfc70e52325cbf586950f6b036d9ffd81dda3a49bb31bfbe5245cfb7d64e867c598d0c4e0d6667dc3555d6afca1bb20824bbe790dcd37e5787211730164a8c

Download Submit
C:\Windows\SysWOW64\Gnfhfl32.exe

Filesize
63KB

MD5
3b25a3590bfca73f6ea25ed8cd7a6863

SHA1
f61f93689480131942ae60f0292005d398589a20

SHA256
d7151738e6c8c77d2d6752f182534843a65610e2a72f1fb790aa9235c905d80e

SHA512
e812b4e6704442b16c9532236f18ec424967dd11ba2b064bd0deae6c9a7805ca59beda6ffa607dc3c34e3b296ebefb4e0ecae432f0d2d1f8f2b08e496ed9e20d

Download Submit
C:\Windows\SysWOW64\Goedpofl.exe

Filesize
63KB

MD5
864a5d490a01e8110881741a38efb6bf

SHA1
c43acaf6698cffca83ec2bf9b40a5b5b73ee4374

SHA256
348eba774770fefcddc2e9b0a5a6950dbaa147fb5206c10939e8de870e6ddf4b

SHA512
524954435e2be8bc94b93d60fb61270535f361b3f2dc66f55afa8f78910716bd405736fc597901521352658f8c319e2bb2634ad67ea3b6cbd3d217ed59d09d4e

Download Submit
C:\Windows\SysWOW64\Hcblpdgg.exe

Filesize
63KB

MD5
2ddc6789c4756d767dfc1e39b0923813

SHA1
a5c57749d644b18d4093b78d0e655ff45830e57a

SHA256
c829b45df5e7b85625e94aa26ca4487403ebd4061ff7f443f36b324267f353d4

SHA512
63e79473dff68dd3ede72badb869cd61de1b3d6fe2c84c8f91ad3c0bfdb77bd08178f50b1dc522388cd2a8e829d1455a2a165c04cc99d30972d95ee5fe81b5ef

Download Submit
C:\Windows\SysWOW64\Hhbkinel.exe

Filesize
63KB

MD5
ee186f917c969f8c61cdb77c63723ba5

SHA1
2997990ff5381cddd2cea9f40a5ff754657a2a2b

SHA256
3962d243d46ae075d0a0c3f3e13fbb39e0027ac24e88bc777d452cdb87b92c6b

SHA512
b103f6a9bfbbe3440aa18c826d247933a3b335a6f0d8e9ca1307112d1f6d93403100335f434bac9c14a7bf93b5f31cdca340cec488397e3c0193fbab872a4d5f

Download Submit
C:\Windows\SysWOW64\Hhgloc32.exe

Filesize
63KB

MD5
f835746061cc505e736429c6e840e4ff

SHA1
05d48c007131b1c5f518e9c310de68a161c16d9e

SHA256
82ed3e1fc80344228e2254cf48797d7721c7bcc47cebd121591c391e4d746545

SHA512
2be318a047680692e4966dd938c508ce9da83de58ef3afc8eb365ac0960b483a31b2b36cb1465ea73109c2f89c98ba7259e12e98a8f5dc76880021726f88c52f

Download Submit
C:\Windows\SysWOW64\Hofmfmhj.exe

Filesize
63KB

MD5
62bd7f4e8d1c17821f4cbde15cb81cbd

SHA1
cc1e4f06615246569ff8d7afe8dd923285b99741

SHA256
4206548ed5a794c32c924bcaa5ac419f63afd755c825547982560e4a605e4b4c

SHA512
1b129880ef6be76949290deb14ad511697eee2e0569c9602bee5b8fecaefdc273cba9ff11243e6fc9722b55972ea333e922ac3299ba1853f391787ca4ea63a05

Download Submit
C:\Windows\SysWOW64\Ijegcm32.exe

Filesize
63KB

MD5
5d0d1dbea493cf636af3f7312c3e5dd9

SHA1
5a0f6b971f47a5e8ae087f9850c57a916d17fa1f

SHA256
a0ab496da87d3603d69cca06b2d7fac9d9fb920db21dbc8e4a26ad3e2f14f0e9

SHA512
1ad272db94d1629b75f5bd36ded58309ea2c6c3a96449033f59008c025e59d5431b78edd6463ff79aefc74c960a5240e07cc162e400c9e7c443d1e61ac52122f

Download Submit
C:\Windows\SysWOW64\Inpccihl.exe

Filesize
63KB

MD5
37b9f8cd7dbaaea40d5c6976cce11067

SHA1
ae422d0d9df53867456e46141c4ac8d9b731bebd

SHA256
dbcdc76cd1de420ddbc223ff88daae6de10a990211b51259bc14f2a5eb3840f3

SHA512
bc815095e282d7e5a825920d623cdcd59567660ea93b7baa2cc0fabd0c46aabeec86b219487a597bb8045ca4b4e6c6dcc4466eedbc466af5aae51a0b32634222

Download Submit
C:\Windows\SysWOW64\Jjoiil32.exe

Filesize
63KB

MD5
508e896c5ae64803abaddf44ddd91d88

SHA1
e7755a2cdd0ddd36da609a88856af2406f093e39

SHA256
29bc923c84a27359ce00e24e7d6f09f8ca2cbfeddbfd3866b07e2716237a49a6

SHA512
55de93ae7e6458bbdb60d70da49fd0a33027f912c8555a8907d0887bcd2166cad9a96b92a2b2f1473ef4892c8fc024582a458af5640657b8b7a243cdaaedf25c

Download Submit
C:\Windows\SysWOW64\Nmgjia32.exe

Filesize
63KB

MD5
55cb40a9e73d250b5a2051c3a90ad584

SHA1
d65f7bcb5cb2030d0f333e5237a04515d3868cc0

SHA256
e4db6368505cac523183037274e84325d588d13797d8effa24f78017fe5587c6

SHA512
fa3afa5811003df62b8ade79aae19af35007aaa2d22d592d5198e358d0665a01b3c9d3ab13090e78fe6da3b6ca66f8cab88ab7168b5d5bb91da7071663225f75

Download Submit
C:\Windows\SysWOW64\Pcpikkge.exe

Filesize
63KB

MD5
64e5b20a3a38a8ae4bcf5a8067f45359

SHA1
96830c2ff41250ea8b13b027706f6bc2ed3e41c3

SHA256
00ab7213e90451f8aa91a5e2ea933337ab5889e6119ba603af2c6088d26736f6

SHA512
f2c83bfcc06424d7649d4f832b56f411200053f71a40b13ce69eef3a7f20f493d6f5e514352292fc1eee763fb183b8ba1ac352df47041418f93a0eac2c91c764

Download Submit
C:\Windows\SysWOW64\Pfaigm32.exe

Filesize
63KB

MD5
a8b93dc67ca8dad5b4b26499af18c104

SHA1
f1905b996b9edffdd1d68fe36245c89c5cef93e3

SHA256
cf580d6f6792aef03f7dee31eccb901e6e123166b36f862e423ddf82f419647a

SHA512
85d4629eaa8f1e1bc680dbd523e2e7fb9d4a1b50300ac8b1fabb1f5d7407ff1608541bd3f455d82b17852e4adabb5dae207044608b82f2d2d091689faca90835

Download Submit
C:\Windows\SysWOW64\Qffbbldm.exe

Filesize
63KB

MD5
c4d77941a27cd738acc636d186232ba7

SHA1
e7a98a26911ce305ecc72e5bcb89155f214bca38

SHA256
5ca1819dbc34b8dd56839f44d9c9194402c3b60ed871cc64b86f20b4707f8b72

SHA512
f4117578db626a21bf6d1e2fa8bd63887c80f279aca431832730a88a70ee9434edfeb39f616ff97b90e3f10b8de0e942c9cbb88a6fd7b47e7aa4343eebfa9b5c

Download Submit
C:\Windows\SysWOW64\Qgqeappe.exe

Filesize
63KB

MD5
332e5ff7fae685a2aee41409b0143abe

SHA1
315e7b6f6d16b46e159d3f6d7482bbbc692d7d75

SHA256
43e7739d1b7e14230f8619dddb97c80c6388af51d88a1c510f0b7b773f706b9f

SHA512
ec439c5d5af6e17000ee37ccbb06b45110e5c9009061eb26c8e0be5d904a7a24866cd4d8acbd18ad1d155f744c93311c965de480208dfb53a07aeb7bd7efb478

Download Submit
C:\Windows\SysWOW64\Qqfmde32.exe

Filesize
63KB

MD5
6a979f0186ef56c4b206d031ae5b4526

SHA1
32b6a13ba1d250e06332fc7f044de232e86e5df6

SHA256
aa223c0b1b52090edf1c6a662a7accbeb8b2dfcfdf6e78a03bfb36fcbad25069

SHA512
409b8fe96496c754d80e07dca4073cc55dff9b13d6907f2d862f1c7b4e46854887018c8588bb2c1ed8f405ad714ef666967379867077e810aab167c0c0b741f5

Download Submit
C:\Windows\SysWOW64\Qqijje32.exe

Filesize
63KB

MD5
82a8cedaff777879b322f963a2d1003b

SHA1
1ffb392d3807ce89dcb272d9e194eeb3b7928b49

SHA256
f73d23dd39dfcfb4384dc70326da0ff8f43c95ebc5d745e43ee03a211f891954

SHA512
1a7cdabd8f7942700c7093506e93c6780f1d6f4a28afaf153d22b9f1a00b083c6c5fb0784137f9f838d21f5be96dce765f0390e8ff5981ce7343fe91069cfc4d

Download Submit
memory/8-379-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/408-219-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/412-455-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/412-25-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/440-277-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/524-123-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/768-64-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/792-397-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1000-419-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1072-186-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1408-361-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1628-349-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1652-226-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1684-301-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1784-235-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1792-147-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1908-131-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1944-367-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2028-258-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2040-139-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2072-105-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2232-434-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2284-343-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2352-373-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2388-203-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2484-524-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2484-49-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2668-243-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2696-414-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2780-163-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2800-171-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2812-41-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2812-467-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3020-271-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3052-292-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3056-355-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3068-331-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3212-90-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3264-426-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3336-194-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3416-78-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3580-428-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3588-319-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3672-155-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3676-446-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3676-9-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3900-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3900-5-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3900-72-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4088-98-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4116-211-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4120-462-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4120-33-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4136-385-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4188-82-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4272-283-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4392-265-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4524-325-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4528-537-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4528-57-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4660-16-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4660-447-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4724-307-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4780-295-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4788-403-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4800-115-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4816-250-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4828-179-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4864-313-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4932-337-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4980-391-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads