xmrig | 9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d

Analysis

max time kernel
134s
max time network
12s
platform
windows7_x64
resource
win7v20210410
submitted
15-05-2021 14:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d.exe
Size

1.1MB
MD5

0a44ea401960942fb659e2516a47a230
SHA1

af730afece5517a2e8e27d873d2241814381feb2
SHA256

9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d
SHA512

73a110d75540dd3b33d344e3bcf7633d19bc74f703d709de93a6389fd22ee8429267c175c1adafd9816924b421ed9b3dc1a33d4d4f93887b179f33eec5bea31a

Score

10^/10

xmrig miner persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Executes dropped EXE 64 IoCs

pid	Process
1916	Fqhadkjd.exe
1504	Fppkkgli.exe
1976	Fpbhagjg.exe
1780	Fflpnabc.exe
1712	Gdfjpj32.exe
1704	Ghgokh32.exe
1384	Idpiel32.exe
1220	Jhfhiodn.exe
1488	Jhkadnqi.exe
1696	Kobiklmd.exe
556	Kjjjmdjg.exe
1192	Lipgoaoo.exe
1468	Lcnajn32.exe
1644	Lemnda32.exe
1620	Mhngfl32.exe
1512	Nkloakmk.exe
1408	Ngemkkam.exe
2032	Oojdflfm.exe
1800	Pjaahh32.exe
1708	Qoojpo32.exe
1692	Qigoidkd.exe
1256	Qoagfobq.exe
1676	Aenoneah.exe
1228	Akhgkp32.exe
1004	Abapgjpb.exe
2036	Aeplceoe.exe
1520	Ajmdll32.exe
1992	Aceidacm.exe
1600	Aklafodp.exe
1464	Aaiinfbg.exe
304	Agcakp32.exe
1320	Ampjcghk.exe
1196	Acjbpa32.exe
660	Ajdjlkge.exe
2028	Bancie32.exe
1584	Bbooamdp.exe
2044	Bmdcnf32.exe
1776	Bbalfm32.exe
360	Bmgpcf32.exe
1736	Bebehh32.exe
1344	Bllmebgk.exe
1136	Baiemi32.exe
1528	Bhcnjclo.exe
876	Bomffm32.exe
1592	Bakbbi32.exe
1092	Chekocjm.exe
1796	Cooclm32.exe
1772	Ceikig32.exe
988	Cfjgpood.exe
2020	Cmdpmi32.exe
1156	Cdnhjcnn.exe
2060	Ckhpfn32.exe
2072	Cmglbi32.exe
2084	Cdqdoc32.exe
2096	Ckkmlmch.exe
2108	Cllide32.exe
2120	Cbfaqpac.exe
2132	Cpjbjdpm.exe
2144	Dbhnfo32.exe
2156	Dibfcifn.exe
2168	Dplopc32.exe
2184	Damkglci.exe
2196	Dlcpddco.exe
2208	Dekdmjjo.exe

Loads dropped DLL 64 IoCs

pid	Process
788	9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d.exe
788	9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d.exe
1916	Fqhadkjd.exe
1916	Fqhadkjd.exe
1504	Fppkkgli.exe
1504	Fppkkgli.exe
1976	Fpbhagjg.exe
1976	Fpbhagjg.exe
1780	Fflpnabc.exe
1780	Fflpnabc.exe
1712	Gdfjpj32.exe
1712	Gdfjpj32.exe
1704	Ghgokh32.exe
1704	Ghgokh32.exe
1384	Idpiel32.exe
1384	Idpiel32.exe
1220	Jhfhiodn.exe
1220	Jhfhiodn.exe
1488	Jhkadnqi.exe
1488	Jhkadnqi.exe
1696	Kobiklmd.exe
1696	Kobiklmd.exe
556	Kjjjmdjg.exe
556	Kjjjmdjg.exe
1192	Lipgoaoo.exe
1192	Lipgoaoo.exe
1468	Lcnajn32.exe
1468	Lcnajn32.exe
1644	Lemnda32.exe
1644	Lemnda32.exe
1620	Mhngfl32.exe
1620	Mhngfl32.exe
1512	Nkloakmk.exe
1512	Nkloakmk.exe
1408	Ngemkkam.exe
1408	Ngemkkam.exe
2032	Oojdflfm.exe
2032	Oojdflfm.exe
1800	Pjaahh32.exe
1800	Pjaahh32.exe
1708	Qoojpo32.exe
1708	Qoojpo32.exe
1692	Qigoidkd.exe
1692	Qigoidkd.exe
1256	Qoagfobq.exe
1256	Qoagfobq.exe
1676	Aenoneah.exe
1676	Aenoneah.exe
1228	Akhgkp32.exe
1228	Akhgkp32.exe
1004	Abapgjpb.exe
1004	Abapgjpb.exe
2036	Aeplceoe.exe
2036	Aeplceoe.exe
1520	Ajmdll32.exe
1520	Ajmdll32.exe
1992	Aceidacm.exe
1992	Aceidacm.exe
1600	Aklafodp.exe
1600	Aklafodp.exe
1464	Aaiinfbg.exe
1464	Aaiinfbg.exe
304	Agcakp32.exe
304	Agcakp32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mdihgh32.dll	Akbcdmkj.exe
File opened for modification	C:\Windows\SysWOW64\Lbmgkn32.exe	Lggcne32.exe
File created	C:\Windows\SysWOW64\Jgmked32.exe	Jpcbiklk.exe
File created	C:\Windows\SysWOW64\Lfdqkdih.exe	Ldcdcl32.exe
File created	C:\Windows\SysWOW64\Mgopik32.exe	Lbbgadid.exe
File created	C:\Windows\SysWOW64\Bnclfh32.exe	Bgidinan.exe
File created	C:\Windows\SysWOW64\Ljmfpd32.dll	Bacegc32.exe
File created	C:\Windows\SysWOW64\Cblhpkeb.exe	Cpmlcofo.exe
File created	C:\Windows\SysWOW64\Ggbhia32.exe	Gddlmf32.exe
File opened for modification	C:\Windows\SysWOW64\Heiagijc.exe	Hibabh32.exe
File created	C:\Windows\SysWOW64\Ibfgkaco.dll	Cdqdoc32.exe
File created	C:\Windows\SysWOW64\Oognkinn.dll	Hjknfb32.exe
File opened for modification	C:\Windows\SysWOW64\Jhadcm32.exe	Johpjgab.exe
File created	C:\Windows\SysWOW64\Aopqfbai.dll	Heiagijc.exe
File created	C:\Windows\SysWOW64\Hngpoffi.dll	Akhgkp32.exe
File created	C:\Windows\SysWOW64\Menmhhhh.dll	Gqcmni32.exe
File created	C:\Windows\SysWOW64\Gfhejnph.exe	Gefibf32.exe
File created	C:\Windows\SysWOW64\Kjhpqm32.exe	Kcogdcla.exe
File created	C:\Windows\SysWOW64\Efbfhf32.dll	Ceikig32.exe
File opened for modification	C:\Windows\SysWOW64\Phoano32.exe	Peaebd32.exe
File created	C:\Windows\SysWOW64\Jaakqmqp.exe	Jkgcdb32.exe
File opened for modification	C:\Windows\SysWOW64\Jddahg32.exe	Johhpq32.exe
File created	C:\Windows\SysWOW64\Efpojjpe.dll	Lqnkalbk.exe
File created	C:\Windows\SysWOW64\Aklafodp.exe	Aceidacm.exe
File created	C:\Windows\SysWOW64\Hmaeqn32.dll	Fqlgmjca.exe
File created	C:\Windows\SysWOW64\Jhadcm32.exe	Johpjgab.exe
File created	C:\Windows\SysWOW64\Bgcgbhbk.dll	Lbbgadid.exe
File opened for modification	C:\Windows\SysWOW64\Plhqin32.exe	Penhldqo.exe
File created	C:\Windows\SysWOW64\Amkjnaie.exe	Abeephio.exe
File created	C:\Windows\SysWOW64\Nabaaa32.dll	Ejjbek32.exe
File created	C:\Windows\SysWOW64\Bebehh32.exe	Bmgpcf32.exe
File created	C:\Windows\SysWOW64\Gbmmlpjm.exe	Gpoqpdki.exe
File opened for modification	C:\Windows\SysWOW64\Jgmked32.exe	Jpcbiklk.exe
File created	C:\Windows\SysWOW64\Kfdfpj32.dll	Jjijlq32.exe
File created	C:\Windows\SysWOW64\Niaeha32.exe	Nbgmkggk.exe
File created	C:\Windows\SysWOW64\Igmdnn32.dll	Ohmhilmg.exe
File created	C:\Windows\SysWOW64\Bifoikde.dll	Hpjcchbj.exe
File opened for modification	C:\Windows\SysWOW64\Kdagnlem.exe	Kbpola32.exe
File created	C:\Windows\SysWOW64\Eondpmce.exe	Edipbdco.exe
File created	C:\Windows\SysWOW64\Nochhied.dll	Ckkmlmch.exe
File opened for modification	C:\Windows\SysWOW64\Gfdoaogk.exe	Gcfcedhh.exe
File created	C:\Windows\SysWOW64\Iadodo32.dll	Gelihkiq.exe
File created	C:\Windows\SysWOW64\Cgqeeamh.dll	Pgdnolbh.exe
File created	C:\Windows\SysWOW64\Fppdbi32.dll	Bnclfh32.exe
File created	C:\Windows\SysWOW64\Bcdniobm.exe	Bafbmcci.exe
File created	C:\Windows\SysWOW64\Cbcnqj32.exe	Clifdphn.exe
File opened for modification	C:\Windows\SysWOW64\Iflkdqno.exe	Ieknmh32.exe
File opened for modification	C:\Windows\SysWOW64\Bmdcnf32.exe	Bbooamdp.exe
File created	C:\Windows\SysWOW64\Opdpep32.dll	Hajpnk32.exe
File opened for modification	C:\Windows\SysWOW64\Pcplpiak.exe	Plfdco32.exe
File created	C:\Windows\SysWOW64\Iiamak32.exe	Ifcaep32.exe
File created	C:\Windows\SysWOW64\Jddahg32.exe	Johhpq32.exe
File created	C:\Windows\SysWOW64\Aeplceoe.exe	Abapgjpb.exe
File created	C:\Windows\SysWOW64\Bmgpcf32.exe	Bbalfm32.exe
File created	C:\Windows\SysWOW64\Cbfaqpac.exe	Cllide32.exe
File opened for modification	C:\Windows\SysWOW64\Joklpgop.exe	Jhadcm32.exe
File opened for modification	C:\Windows\SysWOW64\Oiqafd32.exe	Oddinm32.exe
File opened for modification	C:\Windows\SysWOW64\Dihiahmh.exe	Dbnadn32.exe
File created	C:\Windows\SysWOW64\Lmghllem.exe	Ljhlpq32.exe
File created	C:\Windows\SysWOW64\Ffhida32.dll	Lmghllem.exe
File created	C:\Windows\SysWOW64\Bbjmgcml.dll	Ngemkkam.exe
File opened for modification	C:\Windows\SysWOW64\Aeplceoe.exe	Abapgjpb.exe
File created	C:\Windows\SysWOW64\Iekcfjjh.dll	Dkmfqp32.exe
File created	C:\Windows\SysWOW64\Hliphekl.dll	Bfegkj32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4740	4732	WerFault.exe	416

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhcnjclo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oqifal32.dll"	Cbfaqpac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbbhqkhb.dll"	Mnkekelf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eolhjneg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ghgokh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkjikqfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hpjcchbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deapdh32.dll"	Kcogdcla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbaffkao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cddjhbei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nolmlpge.dll"	Dgnfpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gemkpk32.dll"	Fkeacald.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dekdmjjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgnndn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lllehhol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljkieqdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckhpfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpjcchbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoajakch.dll"	Paqpff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkhodj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gflnef32.dll"	Bgidinan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Johhpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acjbpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mhhcojoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iaaoaind.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jaakqmqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kcadicjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agcakp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obfpmkpk.dll"	Bancie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbdqeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghiadh32.dll"	Dppdhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mibnfj32.dll"	Lfdqkdih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhhflned.dll"	Fqidmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pddblihh.dll"	Ilnmhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aeiejobk.dll"	Lllehhol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgaiondl.dll"	Idpiel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bancie32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdnhjcnn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbkdgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fqidmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfmofamg.dll"	Glokdfge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpaknlno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amkjnaie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdihgh32.dll"	Akbcdmkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fninof32.dll"	Kkoida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mccmnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bndmnb32.dll"	Hndnaapa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibbbfbic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjppmpof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpimib32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Joelja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Midoalei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kipegpbg.dll"	Cblhpkeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpngnfmf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Idpiel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mhngfl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Abapgjpb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bebehh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhhonm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fhibmfjn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjfckn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmcbcnlp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bkgmom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ggplcbmc.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe
4740	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4740	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4740	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 1916	788	9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d.exe	25
PID 788 wrote to memory of 1916	788	9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d.exe	25
PID 788 wrote to memory of 1916	788	9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d.exe	25
PID 788 wrote to memory of 1916	788	9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d.exe	25
PID 1916 wrote to memory of 1504	1916	Fqhadkjd.exe	27
PID 1916 wrote to memory of 1504	1916	Fqhadkjd.exe	27
PID 1916 wrote to memory of 1504	1916	Fqhadkjd.exe	27
PID 1916 wrote to memory of 1504	1916	Fqhadkjd.exe	27
PID 1504 wrote to memory of 1976	1504	Fppkkgli.exe	28
PID 1504 wrote to memory of 1976	1504	Fppkkgli.exe	28
PID 1504 wrote to memory of 1976	1504	Fppkkgli.exe	28
PID 1504 wrote to memory of 1976	1504	Fppkkgli.exe	28
PID 1976 wrote to memory of 1780	1976	Fpbhagjg.exe	29
PID 1976 wrote to memory of 1780	1976	Fpbhagjg.exe	29
PID 1976 wrote to memory of 1780	1976	Fpbhagjg.exe	29
PID 1976 wrote to memory of 1780	1976	Fpbhagjg.exe	29
PID 1780 wrote to memory of 1712	1780	Fflpnabc.exe	30
PID 1780 wrote to memory of 1712	1780	Fflpnabc.exe	30
PID 1780 wrote to memory of 1712	1780	Fflpnabc.exe	30
PID 1780 wrote to memory of 1712	1780	Fflpnabc.exe	30
PID 1712 wrote to memory of 1704	1712	Gdfjpj32.exe	31
PID 1712 wrote to memory of 1704	1712	Gdfjpj32.exe	31
PID 1712 wrote to memory of 1704	1712	Gdfjpj32.exe	31
PID 1712 wrote to memory of 1704	1712	Gdfjpj32.exe	31
PID 1704 wrote to memory of 1384	1704	Ghgokh32.exe	32
PID 1704 wrote to memory of 1384	1704	Ghgokh32.exe	32
PID 1704 wrote to memory of 1384	1704	Ghgokh32.exe	32
PID 1704 wrote to memory of 1384	1704	Ghgokh32.exe	32
PID 1384 wrote to memory of 1220	1384	Idpiel32.exe	33
PID 1384 wrote to memory of 1220	1384	Idpiel32.exe	33
PID 1384 wrote to memory of 1220	1384	Idpiel32.exe	33
PID 1384 wrote to memory of 1220	1384	Idpiel32.exe	33
PID 1220 wrote to memory of 1488	1220	Jhfhiodn.exe	34
PID 1220 wrote to memory of 1488	1220	Jhfhiodn.exe	34
PID 1220 wrote to memory of 1488	1220	Jhfhiodn.exe	34
PID 1220 wrote to memory of 1488	1220	Jhfhiodn.exe	34
PID 1488 wrote to memory of 1696	1488	Jhkadnqi.exe	35
PID 1488 wrote to memory of 1696	1488	Jhkadnqi.exe	35
PID 1488 wrote to memory of 1696	1488	Jhkadnqi.exe	35
PID 1488 wrote to memory of 1696	1488	Jhkadnqi.exe	35
PID 1696 wrote to memory of 556	1696	Kobiklmd.exe	37
PID 1696 wrote to memory of 556	1696	Kobiklmd.exe	37
PID 1696 wrote to memory of 556	1696	Kobiklmd.exe	37
PID 1696 wrote to memory of 556	1696	Kobiklmd.exe	37
PID 556 wrote to memory of 1192	556	Kjjjmdjg.exe	38
PID 556 wrote to memory of 1192	556	Kjjjmdjg.exe	38
PID 556 wrote to memory of 1192	556	Kjjjmdjg.exe	38
PID 556 wrote to memory of 1192	556	Kjjjmdjg.exe	38
PID 1192 wrote to memory of 1468	1192	Lipgoaoo.exe	43
PID 1192 wrote to memory of 1468	1192	Lipgoaoo.exe	43
PID 1192 wrote to memory of 1468	1192	Lipgoaoo.exe	43
PID 1192 wrote to memory of 1468	1192	Lipgoaoo.exe	43
PID 1468 wrote to memory of 1644	1468	Lcnajn32.exe	42
PID 1468 wrote to memory of 1644	1468	Lcnajn32.exe	42
PID 1468 wrote to memory of 1644	1468	Lcnajn32.exe	42
PID 1468 wrote to memory of 1644	1468	Lcnajn32.exe	42
PID 1644 wrote to memory of 1620	1644	Lemnda32.exe	41
PID 1644 wrote to memory of 1620	1644	Lemnda32.exe	41
PID 1644 wrote to memory of 1620	1644	Lemnda32.exe	41
PID 1644 wrote to memory of 1620	1644	Lemnda32.exe	41
PID 1620 wrote to memory of 1512	1620	Mhngfl32.exe	44
PID 1620 wrote to memory of 1512	1620	Mhngfl32.exe	44
PID 1620 wrote to memory of 1512	1620	Mhngfl32.exe	44
PID 1620 wrote to memory of 1512	1620	Mhngfl32.exe	44

C:\Users\Admin\AppData\Local\Temp\9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d.exe
"C:\Users\Admin\AppData\Local\Temp\9d044def0f2ecf958fc8fad895547a924058a34f795bff9a3d5f33ddc1e4c65d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\SysWOW64\Fqhadkjd.exe
  C:\Windows\system32\Fqhadkjd.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\Fppkkgli.exe
    C:\Windows\system32\Fppkkgli.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Windows\SysWOW64\Fpbhagjg.exe
      C:\Windows\system32\Fpbhagjg.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1976
    - - C:\Windows\SysWOW64\Fflpnabc.exe
        
        C:\Windows\system32\Fflpnabc.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1780
      - C:\Windows\SysWOW64\Gdfjpj32.exe
        
        C:\Windows\system32\Gdfjpj32.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1712
        
        C:\Windows\SysWOW64\Ghgokh32.exe
        
        C:\Windows\system32\Ghgokh32.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Idpiel32.exe
        
        C:\Windows\system32\Idpiel32.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        C:\Windows\SysWOW64\Jhfhiodn.exe
        
        C:\Windows\system32\Jhfhiodn.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1220
        
        C:\Windows\SysWOW64\Jhkadnqi.exe
        
        C:\Windows\system32\Jhkadnqi.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Windows\SysWOW64\Kobiklmd.exe
        
        C:\Windows\system32\Kobiklmd.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Windows\SysWOW64\Kjjjmdjg.exe
        
        C:\Windows\system32\Kjjjmdjg.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\SysWOW64\Lipgoaoo.exe
        
        C:\Windows\system32\Lipgoaoo.exe
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1192
        
        C:\Windows\SysWOW64\Lcnajn32.exe
        
        C:\Windows\system32\Lcnajn32.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1468

C:\Windows\SysWOW64\Mhngfl32.exe
C:\Windows\system32\Mhngfl32.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\Nkloakmk.exe
  C:\Windows\system32\Nkloakmk.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1512
- - C:\Windows\SysWOW64\Ngemkkam.exe
    C:\Windows\system32\Ngemkkam.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    PID:1408
  - - C:\Windows\SysWOW64\Oojdflfm.exe
      C:\Windows\system32\Oojdflfm.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2032
    - - C:\Windows\SysWOW64\Pjaahh32.exe
        
        C:\Windows\system32\Pjaahh32.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1800
      - C:\Windows\SysWOW64\Qoojpo32.exe
        
        C:\Windows\system32\Qoojpo32.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1708
        
        C:\Windows\SysWOW64\Qigoidkd.exe
        
        C:\Windows\system32\Qigoidkd.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1692
        
        C:\Windows\SysWOW64\Qoagfobq.exe
        
        C:\Windows\system32\Qoagfobq.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1256
        
        C:\Windows\SysWOW64\Aenoneah.exe
        
        C:\Windows\system32\Aenoneah.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1676
        
        C:\Windows\SysWOW64\Akhgkp32.exe
        
        C:\Windows\system32\Akhgkp32.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1228
        
        C:\Windows\SysWOW64\Abapgjpb.exe
        
        C:\Windows\system32\Abapgjpb.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        
        PID:1004
        
        C:\Windows\SysWOW64\Aeplceoe.exe
        
        C:\Windows\system32\Aeplceoe.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2036
        
        C:\Windows\SysWOW64\Ajmdll32.exe
        
        C:\Windows\system32\Ajmdll32.exe
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1520
        
        C:\Windows\SysWOW64\Aceidacm.exe
        
        C:\Windows\system32\Aceidacm.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1992
        
        C:\Windows\SysWOW64\Aklafodp.exe
        
        C:\Windows\system32\Aklafodp.exe
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1600
        
        C:\Windows\SysWOW64\Aaiinfbg.exe
        
        C:\Windows\system32\Aaiinfbg.exe
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1464
        
        C:\Windows\SysWOW64\Agcakp32.exe
        
        C:\Windows\system32\Agcakp32.exe
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:304
        
        C:\Windows\SysWOW64\Ampjcghk.exe
        
        C:\Windows\system32\Ampjcghk.exe
        18⤵
        Executes dropped EXE
        
        PID:1320
        
        C:\Windows\SysWOW64\Acjbpa32.exe
        
        C:\Windows\system32\Acjbpa32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1196
        
        C:\Windows\SysWOW64\Ajdjlkge.exe
        
        C:\Windows\system32\Ajdjlkge.exe
        20⤵
        Executes dropped EXE
        
        PID:660
        
        C:\Windows\SysWOW64\Bancie32.exe
        
        C:\Windows\system32\Bancie32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2028
        
        C:\Windows\SysWOW64\Bbooamdp.exe
        
        C:\Windows\system32\Bbooamdp.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1584
        
        C:\Windows\SysWOW64\Bmdcnf32.exe
        
        C:\Windows\system32\Bmdcnf32.exe
        23⤵
        Executes dropped EXE
        
        PID:2044
        
        C:\Windows\SysWOW64\Bbalfm32.exe
        
        C:\Windows\system32\Bbalfm32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1776
        
        C:\Windows\SysWOW64\Bmgpcf32.exe
        
        C:\Windows\system32\Bmgpcf32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:360
        
        C:\Windows\SysWOW64\Bebehh32.exe
        
        C:\Windows\system32\Bebehh32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1736
        
        C:\Windows\SysWOW64\Bllmebgk.exe
        
        C:\Windows\system32\Bllmebgk.exe
        27⤵
        Executes dropped EXE
        
        PID:1344
        
        C:\Windows\SysWOW64\Baiemi32.exe
        
        C:\Windows\system32\Baiemi32.exe
        28⤵
        Executes dropped EXE
        
        PID:1136
        
        C:\Windows\SysWOW64\Bhcnjclo.exe
        
        C:\Windows\system32\Bhcnjclo.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1528
        
        C:\Windows\SysWOW64\Bomffm32.exe
        
        C:\Windows\system32\Bomffm32.exe
        30⤵
        Executes dropped EXE
        
        PID:876
        
        C:\Windows\SysWOW64\Bakbbi32.exe
        
        C:\Windows\system32\Bakbbi32.exe
        31⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\Chekocjm.exe
        
        C:\Windows\system32\Chekocjm.exe
        32⤵
        Executes dropped EXE
        
        PID:1092
        
        C:\Windows\SysWOW64\Cooclm32.exe
        
        C:\Windows\system32\Cooclm32.exe
        33⤵
        Executes dropped EXE
        
        PID:1796
        
        C:\Windows\SysWOW64\Ceikig32.exe
        
        C:\Windows\system32\Ceikig32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1772
        
        C:\Windows\SysWOW64\Cfjgpood.exe
        
        C:\Windows\system32\Cfjgpood.exe
        35⤵
        Executes dropped EXE
        
        PID:988
        
        C:\Windows\SysWOW64\Cmdpmi32.exe
        
        C:\Windows\system32\Cmdpmi32.exe
        36⤵
        Executes dropped EXE
        
        PID:2020
        
        C:\Windows\SysWOW64\Cdnhjcnn.exe
        
        C:\Windows\system32\Cdnhjcnn.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1156
        
        C:\Windows\SysWOW64\Ckhpfn32.exe
        
        C:\Windows\system32\Ckhpfn32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2060
        
        C:\Windows\SysWOW64\Cmglbi32.exe
        
        C:\Windows\system32\Cmglbi32.exe
        39⤵
        Executes dropped EXE
        
        PID:2072
        
        C:\Windows\SysWOW64\Cdqdoc32.exe
        
        C:\Windows\system32\Cdqdoc32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2084
        
        C:\Windows\SysWOW64\Ckkmlmch.exe
        
        C:\Windows\system32\Ckkmlmch.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2096
        
        C:\Windows\SysWOW64\Cllide32.exe
        
        C:\Windows\system32\Cllide32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2108
        
        C:\Windows\SysWOW64\Cbfaqpac.exe
        
        C:\Windows\system32\Cbfaqpac.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2120
        
        C:\Windows\SysWOW64\Cpjbjdpm.exe
        
        C:\Windows\system32\Cpjbjdpm.exe
        44⤵
        Executes dropped EXE
        
        PID:2132
        
        C:\Windows\SysWOW64\Dbhnfo32.exe
        
        C:\Windows\system32\Dbhnfo32.exe
        45⤵
        Executes dropped EXE
        
        PID:2144
        
        C:\Windows\SysWOW64\Dibfcifn.exe
        
        C:\Windows\system32\Dibfcifn.exe
        46⤵
        Executes dropped EXE
        
        PID:2156
        
        C:\Windows\SysWOW64\Dplopc32.exe
        
        C:\Windows\system32\Dplopc32.exe
        47⤵
        Executes dropped EXE
        
        PID:2168
        
        C:\Windows\SysWOW64\Damkglci.exe
        
        C:\Windows\system32\Damkglci.exe
        48⤵
        Executes dropped EXE
        
        PID:2184
        
        C:\Windows\SysWOW64\Dlcpddco.exe
        
        C:\Windows\system32\Dlcpddco.exe
        49⤵
        Executes dropped EXE
        
        PID:2196
        
        C:\Windows\SysWOW64\Dekdmjjo.exe
        
        C:\Windows\system32\Dekdmjjo.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2208
        
        C:\Windows\SysWOW64\Dleljd32.exe
        
        C:\Windows\system32\Dleljd32.exe
        51⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\Dabebk32.exe
        
        C:\Windows\system32\Dabebk32.exe
        52⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\Dhlmoegp.exe
        
        C:\Windows\system32\Dhlmoegp.exe
        53⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Dkjikqfd.exe
        
        C:\Windows\system32\Dkjikqfd.exe
        54⤵
        Modifies registry class
        
        PID:2244
        
        C:\Windows\SysWOW64\Dadahk32.exe
        
        C:\Windows\system32\Dadahk32.exe
        55⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\Dhnjde32.exe
        
        C:\Windows\system32\Dhnjde32.exe
        56⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\Dkmfqp32.exe
        
        C:\Windows\system32\Dkmfqp32.exe
        57⤵
        Drops file in System32 directory
        
        PID:2268
        
        C:\Windows\SysWOW64\Enkbml32.exe
        
        C:\Windows\system32\Enkbml32.exe
        58⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\Edejifja.exe
        
        C:\Windows\system32\Edejifja.exe
        59⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Egcfeaje.exe
        
        C:\Windows\system32\Egcfeaje.exe
        60⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\Ejbcamii.exe
        
        C:\Windows\system32\Ejbcamii.exe
        61⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Elponhhm.exe
        
        C:\Windows\system32\Elponhhm.exe
        62⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\Ecjgkboi.exe
        
        C:\Windows\system32\Ecjgkboi.exe
        63⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\Ejdpgl32.exe
        
        C:\Windows\system32\Ejdpgl32.exe
        64⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Elclch32.exe
        
        C:\Windows\system32\Elclch32.exe
        65⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Ecmdpbmg.exe
        
        C:\Windows\system32\Ecmdpbmg.exe
        66⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\Efkplmlk.exe
        
        C:\Windows\system32\Efkplmlk.exe
        67⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\Elgeogbe.exe
        
        C:\Windows\system32\Elgeogbe.exe
        68⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\Eofakbah.exe
        
        C:\Windows\system32\Eofakbah.exe
        69⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\Ffpjgm32.exe
        
        C:\Windows\system32\Ffpjgm32.exe
        70⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\Fhnfch32.exe
        
        C:\Windows\system32\Fhnfch32.exe
        71⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\Fohnpbof.exe
        
        C:\Windows\system32\Fohnpbof.exe
        72⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\Ffbfml32.exe
        
        C:\Windows\system32\Ffbfml32.exe
        73⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\Fgccdd32.exe
        
        C:\Windows\system32\Fgccdd32.exe
        74⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\Fojkfb32.exe
        
        C:\Windows\system32\Fojkfb32.exe
        75⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\Fqlgmjca.exe
        
        C:\Windows\system32\Fqlgmjca.exe
        76⤵
        Drops file in System32 directory
        
        PID:2420
        
        C:\Windows\SysWOW64\Fgfpjd32.exe
        
        C:\Windows\system32\Fgfpjd32.exe
        77⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Fjdlfp32.exe
        
        C:\Windows\system32\Fjdlfp32.exe
        78⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\Fbkdgm32.exe
        
        C:\Windows\system32\Fbkdgm32.exe
        79⤵
        Modifies registry class
        
        PID:2444
        
        C:\Windows\SysWOW64\Fdjpch32.exe
        
        C:\Windows\system32\Fdjpch32.exe
        80⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\Fghlpdhk.exe
        
        C:\Windows\system32\Fghlpdhk.exe
        81⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\Fnbdln32.exe
        
        C:\Windows\system32\Fnbdln32.exe
        82⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\Fcomde32.exe
        
        C:\Windows\system32\Fcomde32.exe
        83⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\Fjieaoel.exe
        
        C:\Windows\system32\Fjieaoel.exe
        84⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\Gqcmni32.exe
        
        C:\Windows\system32\Gqcmni32.exe
        85⤵
        Drops file in System32 directory
        
        PID:2492
        
        C:\Windows\SysWOW64\Ggmfkcdf.exe
        
        C:\Windows\system32\Ggmfkcdf.exe
        86⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\Gmincj32.exe
        
        C:\Windows\system32\Gmincj32.exe
        87⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\Gbfgka32.exe
        
        C:\Windows\system32\Gbfgka32.exe
        88⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\Gjnoln32.exe
        
        C:\Windows\system32\Gjnoln32.exe
        89⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\Glokdfge.exe
        
        C:\Windows\system32\Glokdfge.exe
        90⤵
        Modifies registry class
        
        PID:2532
        
        C:\Windows\SysWOW64\Gcfcedhh.exe
        
        C:\Windows\system32\Gcfcedhh.exe
        91⤵
        Drops file in System32 directory
        
        PID:2540
        
        C:\Windows\SysWOW64\Gfdoaogk.exe
        
        C:\Windows\system32\Gfdoaogk.exe
        92⤵
        
        PID:2548
        
        C:\Windows\SysWOW64\Gmngninh.exe
        
        C:\Windows\system32\Gmngninh.exe
        93⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\Gpmdjeml.exe
        
        C:\Windows\system32\Gpmdjeml.exe
        94⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\Gfflgo32.exe
        
        C:\Windows\system32\Gfflgo32.exe
        95⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Giehcj32.exe
        
        C:\Windows\system32\Giehcj32.exe
        96⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\Gpoqpdki.exe
        
        C:\Windows\system32\Gpoqpdki.exe
        97⤵
        Drops file in System32 directory
        
        PID:2588
        
        C:\Windows\SysWOW64\Gbmmlpjm.exe
        
        C:\Windows\system32\Gbmmlpjm.exe
        98⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\Gelihkiq.exe
        
        C:\Windows\system32\Gelihkiq.exe
        99⤵
        Drops file in System32 directory
        
        PID:2604
        
        C:\Windows\SysWOW64\Hhjedgid.exe
        
        C:\Windows\system32\Hhjedgid.exe
        100⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\Hndnaapa.exe
        
        C:\Windows\system32\Hndnaapa.exe
        101⤵
        Modifies registry class
        
        PID:2620
        
        C:\Windows\SysWOW64\Henfnk32.exe
        
        C:\Windows\system32\Henfnk32.exe
        102⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\Hhmbjf32.exe
        
        C:\Windows\system32\Hhmbjf32.exe
        103⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\Hjknfb32.exe
        
        C:\Windows\system32\Hjknfb32.exe
        104⤵
        Drops file in System32 directory
        
        PID:2644
        
        C:\Windows\SysWOW64\Hmijbm32.exe
        
        C:\Windows\system32\Hmijbm32.exe
        105⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\Hdcboglf.exe
        
        C:\Windows\system32\Hdcboglf.exe
        106⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\Hfaokcki.exe
        
        C:\Windows\system32\Hfaokcki.exe
        107⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\Hmlggmcf.exe
        
        C:\Windows\system32\Hmlggmcf.exe
        108⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\Hpjcchbj.exe
        
        C:\Windows\system32\Hpjcchbj.exe
        109⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2684
        
        C:\Windows\SysWOW64\Hjphaaap.exe
        
        C:\Windows\system32\Hjphaaap.exe
        110⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\Hajpnk32.exe
        
        C:\Windows\system32\Hajpnk32.exe
        111⤵
        Drops file in System32 directory
        
        PID:2700
        
        C:\Windows\SysWOW64\Hdhljg32.exe
        
        C:\Windows\system32\Hdhljg32.exe
        112⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\Hbklecok.exe
        
        C:\Windows\system32\Hbklecok.exe
        113⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\Hiedbn32.exe
        
        C:\Windows\system32\Hiedbn32.exe
        114⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\Idjioffn.exe
        
        C:\Windows\system32\Idjioffn.exe
        115⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\Ielego32.exe
        
        C:\Windows\system32\Ielego32.exe
        116⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\Iodjpdbm.exe
        
        C:\Windows\system32\Iodjpdbm.exe
        117⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\Ienbmo32.exe
        
        C:\Windows\system32\Ienbmo32.exe
        118⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\Ihlnij32.exe
        
        C:\Windows\system32\Ihlnij32.exe
        119⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\Ibbbfbic.exe
        
        C:\Windows\system32\Ibbbfbic.exe
        120⤵
        Modifies registry class
        
        PID:2772
        
        C:\Windows\SysWOW64\Iepobnhg.exe
        
        C:\Windows\system32\Iepobnhg.exe
        121⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\Iljgoh32.exe
        
        C:\Windows\system32\Iljgoh32.exe
        122⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\Ioickc32.exe
        
        C:\Windows\system32\Ioickc32.exe
        123⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\Janehn32.exe
        
        C:\Windows\system32\Janehn32.exe
        124⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\Jdmbdi32.exe
        
        C:\Windows\system32\Jdmbdi32.exe
        125⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\Jjijlq32.exe
        
        C:\Windows\system32\Jjijlq32.exe
        126⤵
        Drops file in System32 directory
        
        PID:2820
        
        C:\Windows\SysWOW64\Jpcbiklk.exe
        
        C:\Windows\system32\Jpcbiklk.exe
        127⤵
        Drops file in System32 directory
        
        PID:2828
        
        C:\Windows\SysWOW64\Jgmked32.exe
        
        C:\Windows\system32\Jgmked32.exe
        128⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\Jngcbokd.exe
        
        C:\Windows\system32\Jngcbokd.exe
        129⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\Johpjgab.exe
        
        C:\Windows\system32\Johpjgab.exe
        130⤵
        Drops file in System32 directory
        
        PID:2852
        
        C:\Windows\SysWOW64\Jhadcm32.exe
        
        C:\Windows\system32\Jhadcm32.exe
        131⤵
        Drops file in System32 directory
        
        PID:2860
        
        C:\Windows\SysWOW64\Joklpgop.exe
        
        C:\Windows\system32\Joklpgop.exe
        132⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\Kjppmpof.exe
        
        C:\Windows\system32\Kjppmpof.exe
        133⤵
        Modifies registry class
        
        PID:2876
        
        C:\Windows\SysWOW64\Komiefmm.exe
        
        C:\Windows\system32\Komiefmm.exe
        134⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\Khemnlcn.exe
        
        C:\Windows\system32\Khemnlcn.exe
        135⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\Kdlncm32.exe
        
        C:\Windows\system32\Kdlncm32.exe
        136⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\Kkffpgqo.exe
        
        C:\Windows\system32\Kkffpgqo.exe
        137⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\Kbpola32.exe
        
        C:\Windows\system32\Kbpola32.exe
        138⤵
        Drops file in System32 directory
        
        PID:2916
        
        C:\Windows\SysWOW64\Kdagnlem.exe
        
        C:\Windows\system32\Kdagnlem.exe
        139⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Kkkpkf32.exe
        
        C:\Windows\system32\Kkkpkf32.exe
        140⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\Knilga32.exe
        
        C:\Windows\system32\Knilga32.exe
        141⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\Ldcdcl32.exe
        
        C:\Windows\system32\Ldcdcl32.exe
        142⤵
        Drops file in System32 directory
        
        PID:2948
        
        C:\Windows\SysWOW64\Lfdqkdih.exe
        
        C:\Windows\system32\Lfdqkdih.exe
        143⤵
        Modifies registry class
        
        PID:2956
        
        C:\Windows\SysWOW64\Lqjehmin.exe
        
        C:\Windows\system32\Lqjehmin.exe
        144⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\Lfgmqdgf.exe
        
        C:\Windows\system32\Lfgmqdgf.exe
        145⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\Lmaenn32.exe
        
        C:\Windows\system32\Lmaenn32.exe
        146⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Lfijfc32.exe
        
        C:\Windows\system32\Lfijfc32.exe
        147⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\Lmcbcnlp.exe
        
        C:\Windows\system32\Lmcbcnlp.exe
        148⤵
        Modifies registry class
        
        PID:2996
        
        C:\Windows\SysWOW64\Loaooilc.exe
        
        C:\Windows\system32\Loaooilc.exe
        149⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Lflglc32.exe
        
        C:\Windows\system32\Lflglc32.exe
        150⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\Lijcho32.exe
        
        C:\Windows\system32\Lijcho32.exe
        151⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\Lkhodj32.exe
        
        C:\Windows\system32\Lkhodj32.exe
        152⤵
        Modifies registry class
        
        PID:3028
        
        C:\Windows\SysWOW64\Lbbgadid.exe
        
        C:\Windows\system32\Lbbgadid.exe
        153⤵
        Drops file in System32 directory
        
        PID:3036
        
        C:\Windows\SysWOW64\Mgopik32.exe
        
        C:\Windows\system32\Mgopik32.exe
        154⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\Mbedfd32.exe
        
        C:\Windows\system32\Mbedfd32.exe
        155⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\Miolcnno.exe
        
        C:\Windows\system32\Miolcnno.exe
        156⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\Mlmioimb.exe
        
        C:\Windows\system32\Mlmioimb.exe
        157⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\Mnkekelf.exe
        
        C:\Windows\system32\Mnkekelf.exe
        158⤵
        Modifies registry class
        
        PID:2068
        
        C:\Windows\SysWOW64\Meemho32.exe
        
        C:\Windows\system32\Meemho32.exe
        159⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\Mjbepfbj.exe
        
        C:\Windows\system32\Mjbepfbj.exe
        160⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\Mnnaad32.exe
        
        C:\Windows\system32\Mnnaad32.exe
        161⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\Mckjik32.exe
        
        C:\Windows\system32\Mckjik32.exe
        162⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Mnpnfd32.exe
        
        C:\Windows\system32\Mnpnfd32.exe
        163⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\Mpaknlno.exe
        
        C:\Windows\system32\Mpaknlno.exe
        164⤵
        Modifies registry class
        
        PID:2216
        
        C:\Windows\SysWOW64\Mhhcojoa.exe
        
        C:\Windows\system32\Mhhcojoa.exe
        165⤵
        Modifies registry class
        
        PID:1840
        
        C:\Windows\SysWOW64\Mijogbdp.exe
        
        C:\Windows\system32\Mijogbdp.exe
        166⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\Npdgcl32.exe
        
        C:\Windows\system32\Npdgcl32.exe
        167⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Nfnpqfci.exe
        
        C:\Windows\system32\Nfnpqfci.exe
        168⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Nmhhmp32.exe
        
        C:\Windows\system32\Nmhhmp32.exe
        169⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Nbdqeg32.exe
        
        C:\Windows\system32\Nbdqeg32.exe
        170⤵
        Modifies registry class
        
        PID:3104
        
        C:\Windows\SysWOW64\Nioiba32.exe
        
        C:\Windows\system32\Nioiba32.exe
        171⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Nphaokhg.exe
        
        C:\Windows\system32\Nphaokhg.exe
        172⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\Nbgmkggk.exe
        
        C:\Windows\system32\Nbgmkggk.exe
        173⤵
        Drops file in System32 directory
        
        PID:3128
        
        C:\Windows\SysWOW64\Niaeha32.exe
        
        C:\Windows\system32\Niaeha32.exe
        174⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\Nonnph32.exe
        
        C:\Windows\system32\Nonnph32.exe
        175⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Nicbmq32.exe
        
        C:\Windows\system32\Nicbmq32.exe
        176⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\Nlanillh.exe
        
        C:\Windows\system32\Nlanillh.exe
        177⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Nblfff32.exe
        
        C:\Windows\system32\Nblfff32.exe
        178⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Nhhonm32.exe
        
        C:\Windows\system32\Nhhonm32.exe
        179⤵
        Modifies registry class
        
        PID:3176
        
        C:\Windows\SysWOW64\Oobgkgii.exe
        
        C:\Windows\system32\Oobgkgii.exe
        180⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Odopcnga.exe
        
        C:\Windows\system32\Odopcnga.exe
        181⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\Ognloifd.exe
        
        C:\Windows\system32\Ognloifd.exe
        182⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Omgdlcna.exe
        
        C:\Windows\system32\Omgdlcna.exe
        183⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\Ohmhilmg.exe
        
        C:\Windows\system32\Ohmhilmg.exe
        184⤵
        Drops file in System32 directory
        
        PID:3216
        
        C:\Windows\SysWOW64\Omjaacko.exe
        
        C:\Windows\system32\Omjaacko.exe
        185⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\Oddinm32.exe
        
        C:\Windows\system32\Oddinm32.exe
        186⤵
        Drops file in System32 directory
        
        PID:3244
        
        C:\Windows\SysWOW64\Oiqafd32.exe
        
        C:\Windows\system32\Oiqafd32.exe
        187⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\Oloncppg.exe
        
        C:\Windows\system32\Oloncppg.exe
        188⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\Ocifpj32.exe
        
        C:\Windows\system32\Ocifpj32.exe
        189⤵
        
        PID:3268
        
        C:\Windows\SysWOW64\Olakhond.exe
        
        C:\Windows\system32\Olakhond.exe
        190⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\Oopgdkmh.exe
        
        C:\Windows\system32\Oopgdkmh.exe
        191⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\Piekacmn.exe
        
        C:\Windows\system32\Piekacmn.exe
        192⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\Ppocnndj.exe
        
        C:\Windows\system32\Ppocnndj.exe
        193⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\Paqpff32.exe
        
        C:\Windows\system32\Paqpff32.exe
        194⤵
        Modifies registry class
        
        PID:3308
        
        C:\Windows\SysWOW64\Pihhgc32.exe
        
        C:\Windows\system32\Pihhgc32.exe
        195⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\Plfdco32.exe
        
        C:\Windows\system32\Plfdco32.exe
        196⤵
        Drops file in System32 directory
        
        PID:3324
        
        C:\Windows\SysWOW64\Pcplpiak.exe
        
        C:\Windows\system32\Pcplpiak.exe
        197⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\Penhldqo.exe
        
        C:\Windows\system32\Penhldqo.exe
        198⤵
        Drops file in System32 directory
        
        PID:3340
        
        C:\Windows\SysWOW64\Plhqin32.exe
        
        C:\Windows\system32\Plhqin32.exe
        199⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\Pnjmqf32.exe
        
        C:\Windows\system32\Pnjmqf32.exe
        200⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\Peaebd32.exe
        
        C:\Windows\system32\Peaebd32.exe
        201⤵
        Drops file in System32 directory
        
        PID:3364
        
        C:\Windows\SysWOW64\Phoano32.exe
        
        C:\Windows\system32\Phoano32.exe
        202⤵
        
        PID:3372
        
        C:\Windows\SysWOW64\Pknnjk32.exe
        
        C:\Windows\system32\Pknnjk32.exe
        203⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\Pdfbcpcd.exe
        
        C:\Windows\system32\Pdfbcpcd.exe
        204⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\Pgdnolbh.exe
        
        C:\Windows\system32\Pgdnolbh.exe
        205⤵
        Drops file in System32 directory
        
        PID:3396
        
        C:\Windows\SysWOW64\Qnnglf32.exe
        
        C:\Windows\system32\Qnnglf32.exe
        206⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\Qckodmhl.exe
        
        C:\Windows\system32\Qckodmhl.exe
        207⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Qjegqg32.exe
        
        C:\Windows\system32\Qjegqg32.exe
        208⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Qmccmb32.exe
        
        C:\Windows\system32\Qmccmb32.exe
        209⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\Qcnlilfj.exe
        
        C:\Windows\system32\Qcnlilfj.exe
        210⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Qgihjk32.exe
        
        C:\Windows\system32\Qgihjk32.exe
        211⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\Ancpgefp.exe
        
        C:\Windows\system32\Ancpgefp.exe
        212⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\Aqalcqec.exe
        
        C:\Windows\system32\Aqalcqec.exe
        213⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Aimagc32.exe
        
        C:\Windows\system32\Aimagc32.exe
        214⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Aqdihp32.exe
        
        C:\Windows\system32\Aqdihp32.exe
        215⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\Abeephio.exe
        
        C:\Windows\system32\Abeephio.exe
        216⤵
        Drops file in System32 directory
        
        PID:3484
        
        C:\Windows\SysWOW64\Amkjnaie.exe
        
        C:\Windows\system32\Amkjnaie.exe
        217⤵
        Modifies registry class
        
        PID:3492
        
        C:\Windows\SysWOW64\Aoifjmhh.exe
        
        C:\Windows\system32\Aoifjmhh.exe
        218⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\Afcnfgoe.exe
        
        C:\Windows\system32\Afcnfgoe.exe
        219⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Aiajbbni.exe
        
        C:\Windows\system32\Aiajbbni.exe
        220⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Aokbol32.exe
        
        C:\Windows\system32\Aokbol32.exe
        221⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Abjokh32.exe
        
        C:\Windows\system32\Abjokh32.exe
        222⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\Aehkgc32.exe
        
        C:\Windows\system32\Aehkgc32.exe
        223⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\Akbcdmkj.exe
        
        C:\Windows\system32\Akbcdmkj.exe
        224⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3548
        
        C:\Windows\SysWOW64\Anqppijn.exe
        
        C:\Windows\system32\Anqppijn.exe
        225⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\Bejhmcbk.exe
        
        C:\Windows\system32\Bejhmcbk.exe
        226⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Bgidinan.exe
        
        C:\Windows\system32\Bgidinan.exe
        227⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3572
        
        C:\Windows\SysWOW64\Bnclfh32.exe
        
        C:\Windows\system32\Bnclfh32.exe
        228⤵
        Drops file in System32 directory
        
        PID:3580
        
        C:\Windows\SysWOW64\Bemdbbph.exe
        
        C:\Windows\system32\Bemdbbph.exe
        229⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\Bkgmom32.exe
        
        C:\Windows\system32\Bkgmom32.exe
        230⤵
        Modifies registry class
        
        PID:3596
        
        C:\Windows\SysWOW64\Bneikh32.exe
        
        C:\Windows\system32\Bneikh32.exe
        231⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Bacegc32.exe
        
        C:\Windows\system32\Bacegc32.exe
        232⤵
        Drops file in System32 directory
        
        PID:3612
        
        C:\Windows\SysWOW64\Bgnndn32.exe
        
        C:\Windows\system32\Bgnndn32.exe
        233⤵
        Modifies registry class
        
        PID:3620
        
        C:\Windows\SysWOW64\Bjljpi32.exe
        
        C:\Windows\system32\Bjljpi32.exe
        234⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\Bafbmcci.exe
        
        C:\Windows\system32\Bafbmcci.exe
        235⤵
        Drops file in System32 directory
        
        PID:3636
        
        C:\Windows\SysWOW64\Bcdniobm.exe
        
        C:\Windows\system32\Bcdniobm.exe
        236⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\Biagaead.exe
        
        C:\Windows\system32\Biagaead.exe
        237⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Bpkonp32.exe
        
        C:\Windows\system32\Bpkonp32.exe
        238⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\Bfegkj32.exe
        
        C:\Windows\system32\Bfegkj32.exe
        239⤵
        Drops file in System32 directory
        
        PID:3668
        
        C:\Windows\SysWOW64\Biccge32.exe
        
        C:\Windows\system32\Biccge32.exe
        240⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\Cpmlcofo.exe
        
        C:\Windows\system32\Cpmlcofo.exe
        241⤵
        Drops file in System32 directory
        
        PID:3684
        
        C:\Windows\SysWOW64\Cblhpkeb.exe
        
        C:\Windows\system32\Cblhpkeb.exe
        242⤵
        Modifies registry class
        
        PID:3692
        
        C:\Windows\SysWOW64\Cejdlfdf.exe
        
        C:\Windows\system32\Cejdlfdf.exe
        243⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Cldlip32.exe
        
        C:\Windows\system32\Cldlip32.exe
        244⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\Cnbiel32.exe
        
        C:\Windows\system32\Cnbiel32.exe
        245⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Cfjqfi32.exe
        
        C:\Windows\system32\Cfjqfi32.exe
        246⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\Chkmna32.exe
        
        C:\Windows\system32\Chkmna32.exe
        247⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\Cpbeoo32.exe
        
        C:\Windows\system32\Cpbeoo32.exe
        248⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Cbqakj32.exe
        
        C:\Windows\system32\Cbqakj32.exe
        249⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Cijihdij.exe
        
        C:\Windows\system32\Cijihdij.exe
        250⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\Clifdphn.exe
        
        C:\Windows\system32\Clifdphn.exe
        251⤵
        Drops file in System32 directory
        
        PID:3764
        
        C:\Windows\SysWOW64\Cbcnqj32.exe
        
        C:\Windows\system32\Cbcnqj32.exe
        252⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Cddjhbei.exe
        
        C:\Windows\system32\Cddjhbei.exe
        253⤵
        Modifies registry class
        
        PID:3780
        
        C:\Windows\SysWOW64\Clkbio32.exe
        
        C:\Windows\system32\Clkbio32.exe
        254⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\Cmloagli.exe
        
        C:\Windows\system32\Cmloagli.exe
        255⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\Cecgbelk.exe
        
        C:\Windows\system32\Cecgbelk.exe
        256⤵
        
        PID:3804
        
        C:\Windows\SysWOW64\Dfecjm32.exe
        
        C:\Windows\system32\Dfecjm32.exe
        257⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Dmolfgjf.exe
        
        C:\Windows\system32\Dmolfgjf.exe
        258⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\Dpmhbbij.exe
        
        C:\Windows\system32\Dpmhbbij.exe
        259⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Dhdpdpil.exe
        
        C:\Windows\system32\Dhdpdpil.exe
        260⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\Dkclpk32.exe
        
        C:\Windows\system32\Dkclpk32.exe
        261⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Dppdhb32.exe
        
        C:\Windows\system32\Dppdhb32.exe
        262⤵
        Modifies registry class
        
        PID:3852
        
        C:\Windows\SysWOW64\Dbnadn32.exe
        
        C:\Windows\system32\Dbnadn32.exe
        263⤵
        Drops file in System32 directory
        
        PID:3860
        
        C:\Windows\SysWOW64\Dihiahmh.exe
        
        C:\Windows\system32\Dihiahmh.exe
        264⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\Dlfemcll.exe
        
        C:\Windows\system32\Dlfemcll.exe
        265⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\Deojfi32.exe
        
        C:\Windows\system32\Deojfi32.exe
        266⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\Dpdncabb.exe
        
        C:\Windows\system32\Dpdncabb.exe
        267⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\Dgnfpl32.exe
        
        C:\Windows\system32\Dgnfpl32.exe
        268⤵
        Modifies registry class
        
        PID:3900
        
        C:\Windows\SysWOW64\Dpfkiaqp.exe
        
        C:\Windows\system32\Dpfkiaqp.exe
        269⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Eahgqi32.exe
        
        C:\Windows\system32\Eahgqi32.exe
        270⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\Ehbpmcnk.exe
        
        C:\Windows\system32\Ehbpmcnk.exe
        271⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Eolhjneg.exe
        
        C:\Windows\system32\Eolhjneg.exe
        272⤵
        Modifies registry class
        
        PID:3932
        
        C:\Windows\SysWOW64\Edipbdco.exe
        
        C:\Windows\system32\Edipbdco.exe
        273⤵
        Drops file in System32 directory
        
        PID:3940
        
        C:\Windows\SysWOW64\Eondpmce.exe
        
        C:\Windows\system32\Eondpmce.exe
        274⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Eehmlg32.exe
        
        C:\Windows\system32\Eehmlg32.exe
        275⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\Egiidpqp.exe
        
        C:\Windows\system32\Egiidpqp.exe
        276⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Eaomah32.exe
        
        C:\Windows\system32\Eaomah32.exe
        277⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Ehienbhb.exe
        
        C:\Windows\system32\Ehienbhb.exe
        278⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\Ejjbek32.exe
        
        C:\Windows\system32\Ejjbek32.exe
        279⤵
        Drops file in System32 directory
        
        PID:3988
        
        C:\Windows\SysWOW64\Eaajgh32.exe
        
        C:\Windows\system32\Eaajgh32.exe
        280⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\Egnboo32.exe
        
        C:\Windows\system32\Egnboo32.exe
        281⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\Fcecdp32.exe
        
        C:\Windows\system32\Fcecdp32.exe
        282⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Fjokqjjk.exe
        
        C:\Windows\system32\Fjokqjjk.exe
        283⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Fqidmd32.exe
        
        C:\Windows\system32\Fqidmd32.exe
        284⤵
        Modifies registry class
        
        PID:4028
        
        C:\Windows\SysWOW64\Fgbljnhe.exe
        
        C:\Windows\system32\Fgbljnhe.exe
        285⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\Fqkqcdoe.exe
        
        C:\Windows\system32\Fqkqcdoe.exe
        286⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Fblmkl32.exe
        
        C:\Windows\system32\Fblmkl32.exe
        287⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\Fhfegflq.exe
        
        C:\Windows\system32\Fhfegflq.exe
        288⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\Fkeacald.exe
        
        C:\Windows\system32\Fkeacald.exe
        289⤵
        Modifies registry class
        
        PID:4068
        
        C:\Windows\SysWOW64\Fbojpl32.exe
        
        C:\Windows\system32\Fbojpl32.exe
        290⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\Fhibmfjn.exe
        
        C:\Windows\system32\Fhibmfjn.exe
        291⤵
        Modifies registry class
        
        PID:4084
        
        C:\Windows\SysWOW64\Fkgniaia.exe
        
        C:\Windows\system32\Fkgniaia.exe
        292⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\Fbaffkao.exe
        
        C:\Windows\system32\Fbaffkao.exe
        293⤵
        Modifies registry class
        
        PID:1996
        
        C:\Windows\SysWOW64\Ghkobe32.exe
        
        C:\Windows\system32\Ghkobe32.exe
        294⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\Gkikoa32.exe
        
        C:\Windows\system32\Gkikoa32.exe
        295⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\Gnhgkl32.exe
        
        C:\Windows\system32\Gnhgkl32.exe
        296⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Gqfcgh32.exe
        
        C:\Windows\system32\Gqfcgh32.exe
        297⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\Ggplcbmc.exe
        
        C:\Windows\system32\Ggplcbmc.exe
        298⤵
        Modifies registry class
        
        PID:4124
        
        C:\Windows\SysWOW64\Gnjdpl32.exe
        
        C:\Windows\system32\Gnjdpl32.exe
        299⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\Gddlmf32.exe
        
        C:\Windows\system32\Gddlmf32.exe
        300⤵
        Drops file in System32 directory
        
        PID:4140
        
        C:\Windows\SysWOW64\Ggbhia32.exe
        
        C:\Windows\system32\Ggbhia32.exe
        301⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\Gmoqah32.exe
        
        C:\Windows\system32\Gmoqah32.exe
        302⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\Gefibf32.exe
        
        C:\Windows\system32\Gefibf32.exe
        303⤵
        Drops file in System32 directory
        
        PID:4164
        
        C:\Windows\SysWOW64\Gfhejnph.exe
        
        C:\Windows\system32\Gfhejnph.exe
        304⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\Hipdmhga.exe
        
        C:\Windows\system32\Hipdmhga.exe
        305⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\Hpimib32.exe
        
        C:\Windows\system32\Hpimib32.exe
        306⤵
        Modifies registry class
        
        PID:4188
        
        C:\Windows\SysWOW64\Hbhien32.exe
        
        C:\Windows\system32\Hbhien32.exe
        307⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\Hibabh32.exe
        
        C:\Windows\system32\Hibabh32.exe
        308⤵
        Drops file in System32 directory
        
        PID:4204
        
        C:\Windows\SysWOW64\Heiagijc.exe
        
        C:\Windows\system32\Heiagijc.exe
        309⤵
        Drops file in System32 directory
        
        PID:4212
        
        C:\Windows\SysWOW64\Inafpn32.exe
        
        C:\Windows\system32\Inafpn32.exe
        310⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\Ieknmh32.exe
        
        C:\Windows\system32\Ieknmh32.exe
        311⤵
        Drops file in System32 directory
        
        PID:4228
        
        C:\Windows\SysWOW64\Iflkdqno.exe
        
        C:\Windows\system32\Iflkdqno.exe
        312⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Iaaoaind.exe
        
        C:\Windows\system32\Iaaoaind.exe
        313⤵
        Modifies registry class
        
        PID:4244
        
        C:\Windows\SysWOW64\Ihlgnc32.exe
        
        C:\Windows\system32\Ihlgnc32.exe
        314⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\Ijjcjo32.exe
        
        C:\Windows\system32\Ijjcjo32.exe
        315⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\Imhpfj32.exe
        
        C:\Windows\system32\Imhpfj32.exe
        316⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\Idbhcdke.exe
        
        C:\Windows\system32\Idbhcdke.exe
        317⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\Iioqkk32.exe
        
        C:\Windows\system32\Iioqkk32.exe
        318⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\Ilnmhg32.exe
        
        C:\Windows\system32\Ilnmhg32.exe
        319⤵
        Modifies registry class
        
        PID:4292
        
        C:\Windows\SysWOW64\Ifcaep32.exe
        
        C:\Windows\system32\Ifcaep32.exe
        320⤵
        Drops file in System32 directory
        
        PID:4300
        
        C:\Windows\SysWOW64\Iiamak32.exe
        
        C:\Windows\system32\Iiamak32.exe
        321⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Jpleneog.exe
        
        C:\Windows\system32\Jpleneog.exe
        322⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Jbjajqnk.exe
        
        C:\Windows\system32\Jbjajqnk.exe
        323⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Jidjfkeh.exe
        
        C:\Windows\system32\Jidjfkeh.exe
        324⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Jpnbce32.exe
        
        C:\Windows\system32\Jpnbce32.exe
        325⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Jekkll32.exe
        
        C:\Windows\system32\Jekkll32.exe
        326⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Jkgcdb32.exe
        
        C:\Windows\system32\Jkgcdb32.exe
        327⤵
        Drops file in System32 directory
        
        PID:4356
        
        C:\Windows\SysWOW64\Jaakqmqp.exe
        
        C:\Windows\system32\Jaakqmqp.exe
        328⤵
        Modifies registry class
        
        PID:4364
        
        C:\Windows\SysWOW64\Jhkcmghm.exe
        
        C:\Windows\system32\Jhkcmghm.exe
        329⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\Joelja32.exe
        
        C:\Windows\system32\Joelja32.exe
        330⤵
        Modifies registry class
        
        PID:4380
        
        C:\Windows\SysWOW64\Jepdgkgf.exe
        
        C:\Windows\system32\Jepdgkgf.exe
        331⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Jhnpcffj.exe
        
        C:\Windows\system32\Jhnpcffj.exe
        332⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Johhpq32.exe
        
        C:\Windows\system32\Johhpq32.exe
        333⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4404
        
        C:\Windows\SysWOW64\Jddahg32.exe
        
        C:\Windows\system32\Jddahg32.exe
        334⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Kkoida32.exe
        
        C:\Windows\system32\Kkoida32.exe
        335⤵
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\Knmeqm32.exe
        
        C:\Windows\system32\Knmeqm32.exe
        336⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Kdgnmgjl.exe
        
        C:\Windows\system32\Kdgnmgjl.exe
        337⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Kgejibip.exe
        
        C:\Windows\system32\Kgejibip.exe
        338⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Klbbaigg.exe
        
        C:\Windows\system32\Klbbaigg.exe
        339⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Kclknc32.exe
        
        C:\Windows\system32\Kclknc32.exe
        340⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Kjfckn32.exe
        
        C:\Windows\system32\Kjfckn32.exe
        341⤵
        Modifies registry class
        
        PID:4468
        
        C:\Windows\SysWOW64\Kppkhhmm.exe
        
        C:\Windows\system32\Kppkhhmm.exe
        342⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Kcogdcla.exe
        
        C:\Windows\system32\Kcogdcla.exe
        343⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4484
        
        C:\Windows\SysWOW64\Kjhpqm32.exe
        
        C:\Windows\system32\Kjhpqm32.exe
        344⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Klglmi32.exe
        
        C:\Windows\system32\Klglmi32.exe
        345⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Kcadicjn.exe
        
        C:\Windows\system32\Kcadicjn.exe
        346⤵
        Modifies registry class
        
        PID:4508
        
        C:\Windows\SysWOW64\Kjklfm32.exe
        
        C:\Windows\system32\Kjklfm32.exe
        347⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Kkline32.exe
        
        C:\Windows\system32\Kkline32.exe
        348⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Kccaob32.exe
        
        C:\Windows\system32\Kccaob32.exe
        349⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Lllehhol.exe
        
        C:\Windows\system32\Lllehhol.exe
        350⤵
        Modifies registry class
        
        PID:4540
        
        C:\Windows\SysWOW64\Lolnjc32.exe
        
        C:\Windows\system32\Lolnjc32.exe
        351⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Lqnkalbk.exe
        
        C:\Windows\system32\Lqnkalbk.exe
        352⤵
        Drops file in System32 directory
        
        PID:4556
        
        C:\Windows\SysWOW64\Lggcne32.exe
        
        C:\Windows\system32\Lggcne32.exe
        353⤵
        Drops file in System32 directory
        
        PID:4564
        
        C:\Windows\SysWOW64\Lbmgkn32.exe
        
        C:\Windows\system32\Lbmgkn32.exe
        354⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\Ldkcgj32.exe
        
        C:\Windows\system32\Ldkcgj32.exe
        355⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\Ljhlpq32.exe
        
        C:\Windows\system32\Ljhlpq32.exe
        356⤵
        Drops file in System32 directory
        
        PID:4588
        
        C:\Windows\SysWOW64\Lmghllem.exe
        
        C:\Windows\system32\Lmghllem.exe
        357⤵
        Drops file in System32 directory
        
        PID:4596
        
        C:\Windows\SysWOW64\Lgllieec.exe
        
        C:\Windows\system32\Lgllieec.exe
        358⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\Ljkieqdf.exe
        
        C:\Windows\system32\Ljkieqdf.exe
        359⤵
        Modifies registry class
        
        PID:4612
        
        C:\Windows\SysWOW64\Mqdabj32.exe
        
        C:\Windows\system32\Mqdabj32.exe
        360⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Mccmnf32.exe
        
        C:\Windows\system32\Mccmnf32.exe
        361⤵
        Modifies registry class
        
        PID:4628
        
        C:\Windows\SysWOW64\Mjmekpbd.exe
        
        C:\Windows\system32\Mjmekpbd.exe
        362⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Mipefm32.exe
        
        C:\Windows\system32\Mipefm32.exe
        363⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\Mcejceid.exe
        
        C:\Windows\system32\Mcejceid.exe
        364⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Mjobpp32.exe
        
        C:\Windows\system32\Mjobpp32.exe
        365⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Mkqohhfp.exe
        
        C:\Windows\system32\Mkqohhfp.exe
        366⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Mbjgeb32.exe
        
        C:\Windows\system32\Mbjgeb32.exe
        367⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Midoalei.exe
        
        C:\Windows\system32\Midoalei.exe
        368⤵
        Modifies registry class
        
        PID:4684
        
        C:\Windows\SysWOW64\Mmpkbk32.exe
        
        C:\Windows\system32\Mmpkbk32.exe
        369⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\Mpngnfmf.exe
        
        C:\Windows\system32\Mpngnfmf.exe
        370⤵
        Modifies registry class
        
        PID:4700
        
        C:\Windows\SysWOW64\Mbmcjalj.exe
        
        C:\Windows\system32\Mbmcjalj.exe
        371⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Miglgl32.exe
        
        C:\Windows\system32\Miglgl32.exe
        372⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\Mboppajg.exe
        
        C:\Windows\system32\Mboppajg.exe
        373⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Niihml32.exe
        
        C:\Windows\system32\Niihml32.exe
        374⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 140
        375⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:4740

C:\Windows\SysWOW64\Lemnda32.exe
C:\Windows\system32\Lemnda32.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4740-187-0x0000000000220000-0x0000000000280000-memory.dmp

Filesize
384KB

Download