3e744f57f9434dc63d51394510b9c3150c7eb7f8bb5117b1d9fcddc661b79965

Analysis

max time kernel
166s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2024, 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e69f49fe5a56918207f4a3894a45ed07.exe
Size

314KB
MD5

e69f49fe5a56918207f4a3894a45ed07
SHA1

277a061a971d779ddc588756d6be00e7bc60a47c
SHA256

3e744f57f9434dc63d51394510b9c3150c7eb7f8bb5117b1d9fcddc661b79965
SHA512

5cb35fa47e8f03f2dae75d352fd15f8e8174dbca60f91e9bff414123376c8a4e89dcdc50a43126e5dc3d2fba25c6b7d99b06ab215ea75ba395313485d5ffe14d
SSDEEP

6144:d9Mp1/Psj6MB8MhjwszeXmr8SeNpgdyuH1lFDjC:dup1O6Najb87gP3C

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpmmhpgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcalae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emllbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggnlhgkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbgqdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbkmngfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahacndjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcnnllcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgaelcgm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejdhcjpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fchdnkpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Keifdpif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fplimi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Impldi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Booaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chfepa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khiopp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfddci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akbjidbf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aljmal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afcffb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fobomglo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laiiie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkjfakng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jloibkhh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dflflg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edmjpoli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Madjbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Epaemojk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjjcmbci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nefmgogl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegnol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Epoplk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkoinlbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	e69f49fe5a56918207f4a3894a45ed07.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhehkepj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlnnfghd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kaehepeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bogkgmho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfgboc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofdqcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbgndoho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocmchdmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pplhab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjgncihp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bonhqnpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mofmhhcl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obikgppg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgnlmdcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmbjcb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbceoped.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cflkihbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjcdih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpmqoqbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhemfbnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bccfleqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mledgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdmoafdb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfonnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfddci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkaljpmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oboicmhj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhnhkpgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofdqcc32.exe

Executes dropped EXE 64 IoCs

pid	Process
4804	Iajdgcab.exe
3376	Keifdpif.exe
768	Lpgmhg32.exe
1756	Mcaipa32.exe
216	Mpeiie32.exe
1064	Nmcpoedn.exe
4060	Nmjfodne.exe
2272	Pplhhm32.exe
760	Abmjqe32.exe
1984	Bmladm32.exe
1116	Cdmoafdb.exe
4732	Ddcebe32.exe
2152	Dcphdqmj.exe
3120	Edoencdm.exe
1656	Eqmlccdi.exe
3560	Fkjfakng.exe
3356	Gcnnllcg.exe
4416	Gndbie32.exe
2496	Gdnjfojj.exe
2236	Hgeihiac.exe
1884	Ielfgmnj.exe
4180	Jejbhk32.exe
3368	Jjnaaa32.exe
2872	Khabke32.exe
3840	Kaaldjil.exe
2884	Ofdqcc32.exe
1244	Pbgqdb32.exe
4328	Qppkhfec.exe
4736	Bpbpecen.exe
1716	Dfonnk32.exe
1356	Dpjompqc.exe
4668	Epaemojk.exe
3108	Eippgckc.exe
4460	Fjjcmbci.exe
1692	Gphddlfp.exe
4808	Gfemmb32.exe
2952	Gdfmkjlg.exe
1848	Gglpgd32.exe
3556	Hgnlmdcp.exe
4300	Hjabdo32.exe
4024	Iqbpahpc.exe
1888	Igneda32.exe
1836	Jegohe32.exe
404	Jmdqbg32.exe
3584	Jndmlj32.exe
3336	Kfanflne.exe
1280	Kagbdenk.exe
4908	Kfdklllb.exe
220	Kffhakjp.exe
772	Ldoafodd.exe
4812	Lacbpccn.exe
4820	Lmjcdd32.exe
4932	Lfddci32.exe
436	Ldhdlnli.exe
2856	Loniiflo.exe
4844	Mejnlpai.exe
4224	Mmebpbod.exe
4312	Mhkgnkoj.exe
3156	Nahdapae.exe
3400	Nefmgogl.exe
2044	Ndkjik32.exe
3524	Naokbokn.exe
2484	Philfgdh.exe
3816	Pnhacn32.exe

Loads dropped DLL 1 IoCs

pid	Process
5064	Bchogd32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jabglkpp.dll	Mjggka32.exe
File created	C:\Windows\SysWOW64\Dfonnk32.exe	Bpbpecen.exe
File opened for modification	C:\Windows\SysWOW64\Nefmgogl.exe	Nahdapae.exe
File opened for modification	C:\Windows\SysWOW64\Lpmmhpgp.exe	Ikifhm32.exe
File created	C:\Windows\SysWOW64\Pgpobmca.exe	Pjlnhi32.exe
File created	C:\Windows\SysWOW64\Jcdafg32.exe	Jkgpleaf.exe
File created	C:\Windows\SysWOW64\Kaadhg32.dll	Pmoijcje.exe
File created	C:\Windows\SysWOW64\Ijkloi32.exe	Indkih32.exe
File created	C:\Windows\SysWOW64\Dhdaao32.exe	Dkqahk32.exe
File opened for modification	C:\Windows\SysWOW64\Ankdbf32.exe	Pbkagfba.exe
File created	C:\Windows\SysWOW64\Cbmjen32.dll	Gdeqaa32.exe
File opened for modification	C:\Windows\SysWOW64\Okjnhpee.exe	Oboicmhj.exe
File opened for modification	C:\Windows\SysWOW64\Noaoagca.exe	Midfiq32.exe
File created	C:\Windows\SysWOW64\Knlfkb32.dll	Doeghk32.exe
File opened for modification	C:\Windows\SysWOW64\Doojni32.exe	Dhdaao32.exe
File created	C:\Windows\SysWOW64\Clddbd32.dll	Bkkhlhlj.exe
File opened for modification	C:\Windows\SysWOW64\Edoencdm.exe	Dcphdqmj.exe
File created	C:\Windows\SysWOW64\Kncfkjpc.dll	Mibpng32.exe
File created	C:\Windows\SysWOW64\Elahnadm.dll	Nlljglpc.exe
File created	C:\Windows\SysWOW64\Qomghp32.exe	Pgaelcgm.exe
File opened for modification	C:\Windows\SysWOW64\Jijhom32.exe	Iciflfcd.exe
File opened for modification	C:\Windows\SysWOW64\Npabeq32.exe	Mgimmkgp.exe
File created	C:\Windows\SysWOW64\Jjjfeo32.dll	Ddcebe32.exe
File created	C:\Windows\SysWOW64\Odooqo32.exe	Ojdnbj32.exe
File created	C:\Windows\SysWOW64\Deokhc32.exe	Dfmjjl32.exe
File opened for modification	C:\Windows\SysWOW64\Kjhlipla.exe	Kjepcqnd.exe
File created	C:\Windows\SysWOW64\Pmoijcje.exe	Odooqo32.exe
File opened for modification	C:\Windows\SysWOW64\Lgmbmn32.exe	Llhnpe32.exe
File created	C:\Windows\SysWOW64\Oimlagii.dll	Pdhklgnf.exe
File created	C:\Windows\SysWOW64\Mmnklgqn.dll	Emdaee32.exe
File created	C:\Windows\SysWOW64\Ojcidelf.exe	Nphhfp32.exe
File created	C:\Windows\SysWOW64\Glgoje32.dll	Aedfdjdl.exe
File created	C:\Windows\SysWOW64\Njbgfp32.exe	Nciojeem.exe
File opened for modification	C:\Windows\SysWOW64\Hjabdo32.exe	Hgnlmdcp.exe
File created	C:\Windows\SysWOW64\Jkgmmjgh.dll	Iaahjmkn.exe
File opened for modification	C:\Windows\SysWOW64\Ckdkbfco.exe	Cdjbel32.exe
File opened for modification	C:\Windows\SysWOW64\Pehghhgc.exe	Pbiklmhp.exe
File opened for modification	C:\Windows\SysWOW64\Bkcjjhgp.exe	Bhbahm32.exe
File opened for modification	C:\Windows\SysWOW64\Aihfjd32.exe	Appaangd.exe
File created	C:\Windows\SysWOW64\Eekanh32.exe	Cbgbpp32.exe
File created	C:\Windows\SysWOW64\Ldcofihm.dll	Cmnncb32.exe
File opened for modification	C:\Windows\SysWOW64\Mcaipa32.exe	Lpgmhg32.exe
File opened for modification	C:\Windows\SysWOW64\Pcaoahio.exe	Pdlbpldg.exe
File opened for modification	C:\Windows\SysWOW64\Ikifhm32.exe	Impldi32.exe
File created	C:\Windows\SysWOW64\Bagphg32.dll	Mnojcb32.exe
File created	C:\Windows\SysWOW64\Ininloda.exe	Ihlechfj.exe
File opened for modification	C:\Windows\SysWOW64\Kibmqond.exe	Jhndepbi.exe
File created	C:\Windows\SysWOW64\Fmklob32.dll	Aapnfe32.exe
File created	C:\Windows\SysWOW64\Ejdhcjpl.exe	Bkbcpb32.exe
File created	C:\Windows\SysWOW64\Gmdknbko.dll	Dlegokbe.exe
File created	C:\Windows\SysWOW64\Lejngd32.exe	Kbneij32.exe
File created	C:\Windows\SysWOW64\Kjpaec32.dll	Kjhlipla.exe
File created	C:\Windows\SysWOW64\Eiidnkam.dll	Iajdgcab.exe
File created	C:\Windows\SysWOW64\Odnjbcmc.dll	Iqbpahpc.exe
File created	C:\Windows\SysWOW64\Okeifa32.dll	Opcqgh32.exe
File created	C:\Windows\SysWOW64\Kbjkbj32.dll	Iggakn32.exe
File created	C:\Windows\SysWOW64\Kedlbf32.exe	Kojdflkl.exe
File opened for modification	C:\Windows\SysWOW64\Cmnncb32.exe	Ckpagg32.exe
File created	C:\Windows\SysWOW64\Cpacjm32.exe	Ckdkbfco.exe
File opened for modification	C:\Windows\SysWOW64\Keifdpif.exe	Iajdgcab.exe
File opened for modification	C:\Windows\SysWOW64\Lckglc32.exe	Kkkldg32.exe
File created	C:\Windows\SysWOW64\Coegih32.exe	Ciioaa32.exe
File opened for modification	C:\Windows\SysWOW64\Ckphamkp.exe	Cdfpdc32.exe
File created	C:\Windows\SysWOW64\Gdgiknio.dll	Pgihppgo.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocdnedkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iicboncn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edflfp32.dll"	Nohdaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcgjjgkh.dll"	Hddejjdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kqpoja32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Doeghk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fkempa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Okkidceh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oldnoemd.dll"	Hnddqp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Difici32.dll"	Qdflaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjhlipla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgimjd32.dll"	Fkjfakng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apdicjnk.dll"	Mjaodkmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahmikfcb.dll"	Qipqibmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dobnpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnbmaehm.dll"	Aappdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihnbih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oilmckml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggajho32.dll"	Pgaelcgm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ejaecdnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjnlgckh.dll"	Lgmnqmam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Liikiccg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmcpoedn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Naokbokn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdkgn32.dll"	Icooig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkllgnco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ppopcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbqiak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akbjidbf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajnkmjqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qocfjlan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oimlagii.dll"	Pdhklgnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djklgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcggga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjcmognb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kaehepeg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aoifoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jefbcdik.dll"	Ahnghafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Abmjqe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Opnglhnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlelbe32.dll"	Dmmblkpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oenldl32.dll"	Ajfhhp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lejngd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nciojeem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmjcdd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjlnhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfbjkc32.dll"	Lhbafo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgmhmggq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Headnoed.dll"	Qomghp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qlajkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cajcffka.dll"	Njdlfbgm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pbgqdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eodclj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jofaqlji.dll"	Bchogd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nllekk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Opcqgh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mbgejcpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aljmal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekeacmel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfacai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bccfleqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lhbafo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbgqdb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oblhlpne.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 4804	2452	e69f49fe5a56918207f4a3894a45ed07.exe	91
PID 2452 wrote to memory of 4804	2452	e69f49fe5a56918207f4a3894a45ed07.exe	91
PID 2452 wrote to memory of 4804	2452	e69f49fe5a56918207f4a3894a45ed07.exe	91
PID 4804 wrote to memory of 3376	4804	Iajdgcab.exe	92
PID 4804 wrote to memory of 3376	4804	Iajdgcab.exe	92
PID 4804 wrote to memory of 3376	4804	Iajdgcab.exe	92
PID 3376 wrote to memory of 768	3376	Keifdpif.exe	93
PID 3376 wrote to memory of 768	3376	Keifdpif.exe	93
PID 3376 wrote to memory of 768	3376	Keifdpif.exe	93
PID 768 wrote to memory of 1756	768	Lpgmhg32.exe	94
PID 768 wrote to memory of 1756	768	Lpgmhg32.exe	94
PID 768 wrote to memory of 1756	768	Lpgmhg32.exe	94
PID 1756 wrote to memory of 216	1756	Mcaipa32.exe	95
PID 1756 wrote to memory of 216	1756	Mcaipa32.exe	95
PID 1756 wrote to memory of 216	1756	Mcaipa32.exe	95
PID 216 wrote to memory of 1064	216	Mpeiie32.exe	96
PID 216 wrote to memory of 1064	216	Mpeiie32.exe	96
PID 216 wrote to memory of 1064	216	Mpeiie32.exe	96
PID 1064 wrote to memory of 4060	1064	Nmcpoedn.exe	97
PID 1064 wrote to memory of 4060	1064	Nmcpoedn.exe	97
PID 1064 wrote to memory of 4060	1064	Nmcpoedn.exe	97
PID 4060 wrote to memory of 2272	4060	Nmjfodne.exe	98
PID 4060 wrote to memory of 2272	4060	Nmjfodne.exe	98
PID 4060 wrote to memory of 2272	4060	Nmjfodne.exe	98
PID 2272 wrote to memory of 760	2272	Pplhhm32.exe	99
PID 2272 wrote to memory of 760	2272	Pplhhm32.exe	99
PID 2272 wrote to memory of 760	2272	Pplhhm32.exe	99
PID 760 wrote to memory of 1984	760	Abmjqe32.exe	100
PID 760 wrote to memory of 1984	760	Abmjqe32.exe	100
PID 760 wrote to memory of 1984	760	Abmjqe32.exe	100
PID 1984 wrote to memory of 1116	1984	Bmladm32.exe	101
PID 1984 wrote to memory of 1116	1984	Bmladm32.exe	101
PID 1984 wrote to memory of 1116	1984	Bmladm32.exe	101
PID 1116 wrote to memory of 4732	1116	Cdmoafdb.exe	102
PID 1116 wrote to memory of 4732	1116	Cdmoafdb.exe	102
PID 1116 wrote to memory of 4732	1116	Cdmoafdb.exe	102
PID 4732 wrote to memory of 2152	4732	Ddcebe32.exe	103
PID 4732 wrote to memory of 2152	4732	Ddcebe32.exe	103
PID 4732 wrote to memory of 2152	4732	Ddcebe32.exe	103
PID 2152 wrote to memory of 3120	2152	Dcphdqmj.exe	104
PID 2152 wrote to memory of 3120	2152	Dcphdqmj.exe	104
PID 2152 wrote to memory of 3120	2152	Dcphdqmj.exe	104
PID 3120 wrote to memory of 1656	3120	Edoencdm.exe	105
PID 3120 wrote to memory of 1656	3120	Edoencdm.exe	105
PID 3120 wrote to memory of 1656	3120	Edoencdm.exe	105
PID 1656 wrote to memory of 3560	1656	Eqmlccdi.exe	106
PID 1656 wrote to memory of 3560	1656	Eqmlccdi.exe	106
PID 1656 wrote to memory of 3560	1656	Eqmlccdi.exe	106
PID 3560 wrote to memory of 3356	3560	Fkjfakng.exe	107
PID 3560 wrote to memory of 3356	3560	Fkjfakng.exe	107
PID 3560 wrote to memory of 3356	3560	Fkjfakng.exe	107
PID 3356 wrote to memory of 4416	3356	Gcnnllcg.exe	108
PID 3356 wrote to memory of 4416	3356	Gcnnllcg.exe	108
PID 3356 wrote to memory of 4416	3356	Gcnnllcg.exe	108
PID 4416 wrote to memory of 2496	4416	Gndbie32.exe	110
PID 4416 wrote to memory of 2496	4416	Gndbie32.exe	110
PID 4416 wrote to memory of 2496	4416	Gndbie32.exe	110
PID 2496 wrote to memory of 2236	2496	Gdnjfojj.exe	111
PID 2496 wrote to memory of 2236	2496	Gdnjfojj.exe	111
PID 2496 wrote to memory of 2236	2496	Gdnjfojj.exe	111
PID 2236 wrote to memory of 1884	2236	Hgeihiac.exe	112
PID 2236 wrote to memory of 1884	2236	Hgeihiac.exe	112
PID 2236 wrote to memory of 1884	2236	Hgeihiac.exe	112
PID 1884 wrote to memory of 4180	1884	Ielfgmnj.exe	113

C:\Users\Admin\AppData\Local\Temp\e69f49fe5a56918207f4a3894a45ed07.exe
"C:\Users\Admin\AppData\Local\Temp\e69f49fe5a56918207f4a3894a45ed07.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\Iajdgcab.exe
  C:\Windows\system32\Iajdgcab.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\SysWOW64\Keifdpif.exe
    C:\Windows\system32\Keifdpif.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\SysWOW64\Lpgmhg32.exe
      C:\Windows\system32\Lpgmhg32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:768
    - - C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1756
      - C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:216
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1064
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\SysWOW64\Bmladm32.exe
        
        C:\Windows\system32\Bmladm32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1116
        
        C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\SysWOW64\Dcphdqmj.exe
        
        C:\Windows\system32\Dcphdqmj.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\SysWOW64\Edoencdm.exe
        
        C:\Windows\system32\Edoencdm.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Windows\SysWOW64\Eqmlccdi.exe
        
        C:\Windows\system32\Eqmlccdi.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\SysWOW64\Fkjfakng.exe
        
        C:\Windows\system32\Fkjfakng.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Windows\SysWOW64\Gcnnllcg.exe
        
        C:\Windows\system32\Gcnnllcg.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Windows\SysWOW64\Gndbie32.exe
        
        C:\Windows\system32\Gndbie32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\SysWOW64\Gdnjfojj.exe
        
        C:\Windows\system32\Gdnjfojj.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Windows\SysWOW64\Hgeihiac.exe
        
        C:\Windows\system32\Hgeihiac.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\SysWOW64\Ielfgmnj.exe
        
        C:\Windows\system32\Ielfgmnj.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1884
        
        C:\Windows\SysWOW64\Jejbhk32.exe
        
        C:\Windows\system32\Jejbhk32.exe
        23⤵
        Executes dropped EXE
        
        PID:4180
        
        C:\Windows\SysWOW64\Jjnaaa32.exe
        
        C:\Windows\system32\Jjnaaa32.exe
        24⤵
        Executes dropped EXE
        
        PID:3368
        
        C:\Windows\SysWOW64\Khabke32.exe
        
        C:\Windows\system32\Khabke32.exe
        25⤵
        Executes dropped EXE
        
        PID:2872
        
        C:\Windows\SysWOW64\Kaaldjil.exe
        
        C:\Windows\system32\Kaaldjil.exe
        26⤵
        Executes dropped EXE
        
        PID:3840
        
        C:\Windows\SysWOW64\Ofdqcc32.exe
        
        C:\Windows\system32\Ofdqcc32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2884
        
        C:\Windows\SysWOW64\Pbgqdb32.exe
        
        C:\Windows\system32\Pbgqdb32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1244
        
        C:\Windows\SysWOW64\Qppkhfec.exe
        
        C:\Windows\system32\Qppkhfec.exe
        29⤵
        Executes dropped EXE
        
        PID:4328
        
        C:\Windows\SysWOW64\Bpbpecen.exe
        
        C:\Windows\system32\Bpbpecen.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4736
        
        C:\Windows\SysWOW64\Dfonnk32.exe
        
        C:\Windows\system32\Dfonnk32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1716
        
        C:\Windows\SysWOW64\Dpjompqc.exe
        
        C:\Windows\system32\Dpjompqc.exe
        32⤵
        Executes dropped EXE
        
        PID:1356
        
        C:\Windows\SysWOW64\Epaemojk.exe
        
        C:\Windows\system32\Epaemojk.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4668
        
        C:\Windows\SysWOW64\Eippgckc.exe
        
        C:\Windows\system32\Eippgckc.exe
        34⤵
        Executes dropped EXE
        
        PID:3108
        
        C:\Windows\SysWOW64\Fjjcmbci.exe
        
        C:\Windows\system32\Fjjcmbci.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4460
        
        C:\Windows\SysWOW64\Gphddlfp.exe
        
        C:\Windows\system32\Gphddlfp.exe
        36⤵
        Executes dropped EXE
        
        PID:1692
        
        C:\Windows\SysWOW64\Gfemmb32.exe
        
        C:\Windows\system32\Gfemmb32.exe
        37⤵
        Executes dropped EXE
        
        PID:4808
        
        C:\Windows\SysWOW64\Gdfmkjlg.exe
        
        C:\Windows\system32\Gdfmkjlg.exe
        38⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Windows\SysWOW64\Gglpgd32.exe
        
        C:\Windows\system32\Gglpgd32.exe
        39⤵
        Executes dropped EXE
        
        PID:1848
        
        C:\Windows\SysWOW64\Hgnlmdcp.exe
        
        C:\Windows\system32\Hgnlmdcp.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3556
        
        C:\Windows\SysWOW64\Hjabdo32.exe
        
        C:\Windows\system32\Hjabdo32.exe
        41⤵
        Executes dropped EXE
        
        PID:4300
        
        C:\Windows\SysWOW64\Iqbpahpc.exe
        
        C:\Windows\system32\Iqbpahpc.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4024
        
        C:\Windows\SysWOW64\Igneda32.exe
        
        C:\Windows\system32\Igneda32.exe
        43⤵
        Executes dropped EXE
        
        PID:1888
        
        C:\Windows\SysWOW64\Jegohe32.exe
        
        C:\Windows\system32\Jegohe32.exe
        44⤵
        Executes dropped EXE
        
        PID:1836
        
        C:\Windows\SysWOW64\Jmdqbg32.exe
        
        C:\Windows\system32\Jmdqbg32.exe
        45⤵
        Executes dropped EXE
        
        PID:404
        
        C:\Windows\SysWOW64\Jndmlj32.exe
        
        C:\Windows\system32\Jndmlj32.exe
        46⤵
        Executes dropped EXE
        
        PID:3584
        
        C:\Windows\SysWOW64\Kfanflne.exe
        
        C:\Windows\system32\Kfanflne.exe
        47⤵
        Executes dropped EXE
        
        PID:3336
        
        C:\Windows\SysWOW64\Kagbdenk.exe
        
        C:\Windows\system32\Kagbdenk.exe
        48⤵
        Executes dropped EXE
        
        PID:1280
        
        C:\Windows\SysWOW64\Kfdklllb.exe
        
        C:\Windows\system32\Kfdklllb.exe
        49⤵
        Executes dropped EXE
        
        PID:4908
        
        C:\Windows\SysWOW64\Kffhakjp.exe
        
        C:\Windows\system32\Kffhakjp.exe
        50⤵
        Executes dropped EXE
        
        PID:220
        
        C:\Windows\SysWOW64\Ldoafodd.exe
        
        C:\Windows\system32\Ldoafodd.exe
        51⤵
        Executes dropped EXE
        
        PID:772
        
        C:\Windows\SysWOW64\Lacbpccn.exe
        
        C:\Windows\system32\Lacbpccn.exe
        52⤵
        Executes dropped EXE
        
        PID:4812
        
        C:\Windows\SysWOW64\Lmjcdd32.exe
        
        C:\Windows\system32\Lmjcdd32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4820
        
        C:\Windows\SysWOW64\Lfddci32.exe
        
        C:\Windows\system32\Lfddci32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4932
        
        C:\Windows\SysWOW64\Ldhdlnli.exe
        
        C:\Windows\system32\Ldhdlnli.exe
        55⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Loniiflo.exe
        
        C:\Windows\system32\Loniiflo.exe
        56⤵
        Executes dropped EXE
        
        PID:2856
        
        C:\Windows\SysWOW64\Mejnlpai.exe
        
        C:\Windows\system32\Mejnlpai.exe
        57⤵
        Executes dropped EXE
        
        PID:4844
        
        C:\Windows\SysWOW64\Mmebpbod.exe
        
        C:\Windows\system32\Mmebpbod.exe
        58⤵
        Executes dropped EXE
        
        PID:4224
        
        C:\Windows\SysWOW64\Mhkgnkoj.exe
        
        C:\Windows\system32\Mhkgnkoj.exe
        59⤵
        Executes dropped EXE
        
        PID:4312
        
        C:\Windows\SysWOW64\Nahdapae.exe
        
        C:\Windows\system32\Nahdapae.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3156
        
        C:\Windows\SysWOW64\Nefmgogl.exe
        
        C:\Windows\system32\Nefmgogl.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3400
        
        C:\Windows\SysWOW64\Ndkjik32.exe
        
        C:\Windows\system32\Ndkjik32.exe
        62⤵
        Executes dropped EXE
        
        PID:2044
        
        C:\Windows\SysWOW64\Naokbokn.exe
        
        C:\Windows\system32\Naokbokn.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3524
        
        C:\Windows\SysWOW64\Philfgdh.exe
        
        C:\Windows\system32\Philfgdh.exe
        64⤵
        Executes dropped EXE
        
        PID:2484
        
        C:\Windows\SysWOW64\Pnhacn32.exe
        
        C:\Windows\system32\Pnhacn32.exe
        65⤵
        Executes dropped EXE
        
        PID:3816
        
        C:\Windows\SysWOW64\Pgaelcgm.exe
        
        C:\Windows\system32\Pgaelcgm.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4928
        
        C:\Windows\SysWOW64\Qomghp32.exe
        
        C:\Windows\system32\Qomghp32.exe
        67⤵
        Modifies registry class
        
        PID:3564
        
        C:\Windows\SysWOW64\Bijncb32.exe
        
        C:\Windows\system32\Bijncb32.exe
        68⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Cbnbhfde.exe
        
        C:\Windows\system32\Cbnbhfde.exe
        69⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Hhehkepj.exe
        
        C:\Windows\system32\Hhehkepj.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5080
        
        C:\Windows\SysWOW64\Icklhnop.exe
        
        C:\Windows\system32\Icklhnop.exe
        71⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\Iqombb32.exe
        
        C:\Windows\system32\Iqombb32.exe
        72⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Iodjcnca.exe
        
        C:\Windows\system32\Iodjcnca.exe
        73⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Igkadlcd.exe
        
        C:\Windows\system32\Igkadlcd.exe
        74⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\Icbbimih.exe
        
        C:\Windows\system32\Icbbimih.exe
        75⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\Jgedjjki.exe
        
        C:\Windows\system32\Jgedjjki.exe
        76⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\Jmamba32.exe
        
        C:\Windows\system32\Jmamba32.exe
        77⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\Kgcqlh32.exe
        
        C:\Windows\system32\Kgcqlh32.exe
        78⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\Laiafl32.exe
        
        C:\Windows\system32\Laiafl32.exe
        79⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\Mfhgcbfo.exe
        
        C:\Windows\system32\Mfhgcbfo.exe
        80⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\Mmghklif.exe
        
        C:\Windows\system32\Mmghklif.exe
        81⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Nmpkakak.exe
        
        C:\Windows\system32\Nmpkakak.exe
        82⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Ngipjp32.exe
        
        C:\Windows\system32\Ngipjp32.exe
        83⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Pjlnhi32.exe
        
        C:\Windows\system32\Pjlnhi32.exe
        84⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Pgpobmca.exe
        
        C:\Windows\system32\Pgpobmca.exe
        85⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Pafcofcg.exe
        
        C:\Windows\system32\Pafcofcg.exe
        86⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Qdflaa32.exe
        
        C:\Windows\system32\Qdflaa32.exe
        87⤵
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Qjcdih32.exe
        
        C:\Windows\system32\Qjcdih32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5544
        
        C:\Windows\SysWOW64\Adnbapjp.exe
        
        C:\Windows\system32\Adnbapjp.exe
        89⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Bhbahm32.exe
        
        C:\Windows\system32\Bhbahm32.exe
        90⤵
        Drops file in System32 directory
        
        PID:5640
        
        C:\Windows\SysWOW64\Bkcjjhgp.exe
        
        C:\Windows\system32\Bkcjjhgp.exe
        91⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Bqpbboeg.exe
        
        C:\Windows\system32\Bqpbboeg.exe
        92⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Bqbohocd.exe
        
        C:\Windows\system32\Bqbohocd.exe
        93⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Cegnol32.exe
        
        C:\Windows\system32\Cegnol32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5820
        
        C:\Windows\SysWOW64\Djklgb32.exe
        
        C:\Windows\system32\Djklgb32.exe
        95⤵
        Modifies registry class
        
        PID:5860
        
        C:\Windows\SysWOW64\Dilmeida.exe
        
        C:\Windows\system32\Dilmeida.exe
        96⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Dbgndoho.exe
        
        C:\Windows\system32\Dbgndoho.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5960
        
        C:\Windows\SysWOW64\Fhkecb32.exe
        
        C:\Windows\system32\Fhkecb32.exe
        98⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Fbqiak32.exe
        
        C:\Windows\system32\Fbqiak32.exe
        99⤵
        Modifies registry class
        
        PID:6048
        
        C:\Windows\SysWOW64\Gkcdfl32.exe
        
        C:\Windows\system32\Gkcdfl32.exe
        100⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Icmbcg32.exe
        
        C:\Windows\system32\Icmbcg32.exe
        101⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Icooig32.exe
        
        C:\Windows\system32\Icooig32.exe
        102⤵
        Modifies registry class
        
        PID:5144
        
        C:\Windows\SysWOW64\Jbghpc32.exe
        
        C:\Windows\system32\Jbghpc32.exe
        103⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\Jloibkhh.exe
        
        C:\Windows\system32\Jloibkhh.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:768
        
        C:\Windows\SysWOW64\Jfgnka32.exe
        
        C:\Windows\system32\Jfgnka32.exe
        105⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\Kfndlphp.exe
        
        C:\Windows\system32\Kfndlphp.exe
        106⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Kkkldg32.exe
        
        C:\Windows\system32\Kkkldg32.exe
        107⤵
        Drops file in System32 directory
        
        PID:216
        
        C:\Windows\SysWOW64\Lckglc32.exe
        
        C:\Windows\system32\Lckglc32.exe
        108⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Lihpdj32.exe
        
        C:\Windows\system32\Lihpdj32.exe
        109⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Lobhqdec.exe
        
        C:\Windows\system32\Lobhqdec.exe
        110⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Lcpqgbkj.exe
        
        C:\Windows\system32\Lcpqgbkj.exe
        111⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Lmheph32.exe
        
        C:\Windows\system32\Lmheph32.exe
        112⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Lfqjhmhk.exe
        
        C:\Windows\system32\Lfqjhmhk.exe
        113⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Lcdjba32.exe
        
        C:\Windows\system32\Lcdjba32.exe
        114⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\Lmmokgne.exe
        
        C:\Windows\system32\Lmmokgne.exe
        115⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Mcggga32.exe
        
        C:\Windows\system32\Mcggga32.exe
        116⤵
        Modifies registry class
        
        PID:5748
        
        C:\Windows\SysWOW64\Mjaodkmo.exe
        
        C:\Windows\system32\Mjaodkmo.exe
        117⤵
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Mmdekf32.exe
        
        C:\Windows\system32\Mmdekf32.exe
        118⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Mflidl32.exe
        
        C:\Windows\system32\Mflidl32.exe
        119⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\Ncbfcp32.exe
        
        C:\Windows\system32\Ncbfcp32.exe
        120⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Nmkkle32.exe
        
        C:\Windows\system32\Nmkkle32.exe
        121⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\Nbhcdl32.exe
        
        C:\Windows\system32\Nbhcdl32.exe
        122⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Ndgpnogo.exe
        
        C:\Windows\system32\Ndgpnogo.exe
        123⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\Nmpdgdmp.exe
        
        C:\Windows\system32\Nmpdgdmp.exe
        124⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\Nfhipj32.exe
        
        C:\Windows\system32\Nfhipj32.exe
        125⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Nboiekjd.exe
        
        C:\Windows\system32\Nboiekjd.exe
        126⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Njfafhjf.exe
        
        C:\Windows\system32\Njfafhjf.exe
        127⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Olgnnqpe.exe
        
        C:\Windows\system32\Olgnnqpe.exe
        128⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Olqqdo32.exe
        
        C:\Windows\system32\Olqqdo32.exe
        129⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Pmbjcb32.exe
        
        C:\Windows\system32\Pmbjcb32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5336
        
        C:\Windows\SysWOW64\Pdlbpldg.exe
        
        C:\Windows\system32\Pdlbpldg.exe
        131⤵
        Drops file in System32 directory
        
        PID:1728
        
        C:\Windows\SysWOW64\Pcaoahio.exe
        
        C:\Windows\system32\Pcaoahio.exe
        132⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\Qipqibmf.exe
        
        C:\Windows\system32\Qipqibmf.exe
        133⤵
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Qlomemlj.exe
        
        C:\Windows\system32\Qlomemlj.exe
        134⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Qlajkm32.exe
        
        C:\Windows\system32\Qlajkm32.exe
        135⤵
        Modifies registry class
        
        PID:2008
        
        C:\Windows\SysWOW64\Akbjidbf.exe
        
        C:\Windows\system32\Akbjidbf.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4216
        
        C:\Windows\SysWOW64\Apobakpn.exe
        
        C:\Windows\system32\Apobakpn.exe
        137⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Aljmal32.exe
        
        C:\Windows\system32\Aljmal32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6084
        
        C:\Windows\SysWOW64\Akkmocjl.exe
        
        C:\Windows\system32\Akkmocjl.exe
        139⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Bkbcpb32.exe
        
        C:\Windows\system32\Bkbcpb32.exe
        140⤵
        Drops file in System32 directory
        
        PID:5700
        
        C:\Windows\SysWOW64\Ejdhcjpl.exe
        
        C:\Windows\system32\Ejdhcjpl.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5040
        
        C:\Windows\SysWOW64\Emdaee32.exe
        
        C:\Windows\system32\Emdaee32.exe
        142⤵
        Drops file in System32 directory
        
        PID:5316
        
        C:\Windows\SysWOW64\Ekeacmel.exe
        
        C:\Windows\system32\Ekeacmel.exe
        143⤵
        Modifies registry class
        
        PID:4516
        
        C:\Windows\SysWOW64\Eabjkdcc.exe
        
        C:\Windows\system32\Eabjkdcc.exe
        144⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Fnkdpgnh.exe
        
        C:\Windows\system32\Fnkdpgnh.exe
        145⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Gjkgkg32.exe
        
        C:\Windows\system32\Gjkgkg32.exe
        146⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Hmecba32.exe
        
        C:\Windows\system32\Hmecba32.exe
        147⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Hlfcqh32.exe
        
        C:\Windows\system32\Hlfcqh32.exe
        148⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\Haclio32.exe
        
        C:\Windows\system32\Haclio32.exe
        149⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Hklpaeno.exe
        
        C:\Windows\system32\Hklpaeno.exe
        150⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Hddejjdo.exe
        
        C:\Windows\system32\Hddejjdo.exe
        151⤵
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Hmlicp32.exe
        
        C:\Windows\system32\Hmlicp32.exe
        152⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Hlmiagbo.exe
        
        C:\Windows\system32\Hlmiagbo.exe
        153⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Iefnjm32.exe
        
        C:\Windows\system32\Iefnjm32.exe
        154⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\Iaahjmkn.exe
        
        C:\Windows\system32\Iaahjmkn.exe
        155⤵
        Drops file in System32 directory
        
        PID:964
        
        C:\Windows\SysWOW64\Ihkpgg32.exe
        
        C:\Windows\system32\Ihkpgg32.exe
        156⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Jeanfkob.exe
        
        C:\Windows\system32\Jeanfkob.exe
        157⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Jahnkl32.exe
        
        C:\Windows\system32\Jahnkl32.exe
        158⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Jefgak32.exe
        
        C:\Windows\system32\Jefgak32.exe
        159⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Jnalem32.exe
        
        C:\Windows\system32\Jnalem32.exe
        160⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Kkaljpmd.exe
        
        C:\Windows\system32\Kkaljpmd.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5940
        
        C:\Windows\SysWOW64\Kbkdgj32.exe
        
        C:\Windows\system32\Kbkdgj32.exe
        162⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\Ldnjndpo.exe
        
        C:\Windows\system32\Ldnjndpo.exe
        163⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\Lnfngj32.exe
        
        C:\Windows\system32\Lnfngj32.exe
        164⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Lmhnea32.exe
        
        C:\Windows\system32\Lmhnea32.exe
        165⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Mbkmngfn.exe
        
        C:\Windows\system32\Mbkmngfn.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5224
        
        C:\Windows\SysWOW64\Acaanp32.exe
        
        C:\Windows\system32\Acaanp32.exe
        167⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Amibqhed.exe
        
        C:\Windows\system32\Amibqhed.exe
        168⤵
        
        PID:432
        
        C:\Windows\SysWOW64\Cpmqoqbp.exe
        
        C:\Windows\system32\Cpmqoqbp.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4112
        
        C:\Windows\SysWOW64\Cggikk32.exe
        
        C:\Windows\system32\Cggikk32.exe
        170⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Djeegf32.exe
        
        C:\Windows\system32\Djeegf32.exe
        171⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\Dobnpm32.exe
        
        C:\Windows\system32\Dobnpm32.exe
        172⤵
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Dflflg32.exe
        
        C:\Windows\system32\Dflflg32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4588
        
        C:\Windows\SysWOW64\Dfclmfhl.exe
        
        C:\Windows\system32\Dfclmfhl.exe
        174⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\Dokqfl32.exe
        
        C:\Windows\system32\Dokqfl32.exe
        175⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Ejaecdnc.exe
        
        C:\Windows\system32\Ejaecdnc.exe
        176⤵
        Modifies registry class
        
        PID:2952
        
        C:\Windows\SysWOW64\Eonmkkmj.exe
        
        C:\Windows\system32\Eonmkkmj.exe
        177⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\Efgehe32.exe
        
        C:\Windows\system32\Efgehe32.exe
        178⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Eobffk32.exe
        
        C:\Windows\system32\Eobffk32.exe
        179⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Eodclj32.exe
        
        C:\Windows\system32\Eodclj32.exe
        180⤵
        Modifies registry class
        
        PID:4304
        
        C:\Windows\SysWOW64\Fmmmqnaf.exe
        
        C:\Windows\system32\Fmmmqnaf.exe
        181⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Fplimi32.exe
        
        C:\Windows\system32\Fplimi32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5124
        
        C:\Windows\SysWOW64\Ffhnocfd.exe
        
        C:\Windows\system32\Ffhnocfd.exe
        183⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Fggkifmg.exe
        
        C:\Windows\system32\Fggkifmg.exe
        184⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\Fpbpmhjb.exe
        
        C:\Windows\system32\Fpbpmhjb.exe
        185⤵
        
        PID:392
        
        C:\Windows\SysWOW64\Gndpkp32.exe
        
        C:\Windows\system32\Gndpkp32.exe
        186⤵
        
        PID:112
        
        C:\Windows\SysWOW64\Impldi32.exe
        
        C:\Windows\system32\Impldi32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5904
        
        C:\Windows\SysWOW64\Ikifhm32.exe
        
        C:\Windows\system32\Ikifhm32.exe
        188⤵
        Drops file in System32 directory
        
        PID:5180
        
        C:\Windows\SysWOW64\Lpmmhpgp.exe
        
        C:\Windows\system32\Lpmmhpgp.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1760
        
        C:\Windows\SysWOW64\Mbfmha32.exe
        
        C:\Windows\system32\Mbfmha32.exe
        190⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Mdgejmdi.exe
        
        C:\Windows\system32\Mdgejmdi.exe
        191⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Mnojcb32.exe
        
        C:\Windows\system32\Mnojcb32.exe
        192⤵
        Drops file in System32 directory
        
        PID:4508
        
        C:\Windows\SysWOW64\Moofmeal.exe
        
        C:\Windows\system32\Moofmeal.exe
        193⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Mqpcdn32.exe
        
        C:\Windows\system32\Mqpcdn32.exe
        194⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\Mkegbfgp.exe
        
        C:\Windows\system32\Mkegbfgp.exe
        195⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\Mdnlkl32.exe
        
        C:\Windows\system32\Mdnlkl32.exe
        196⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\Mglhgg32.exe
        
        C:\Windows\system32\Mglhgg32.exe
        197⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Nildajdg.exe
        
        C:\Windows\system32\Nildajdg.exe
        198⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Nnimia32.exe
        
        C:\Windows\system32\Nnimia32.exe
        199⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Ninafj32.exe
        
        C:\Windows\system32\Ninafj32.exe
        200⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Nohicdia.exe
        
        C:\Windows\system32\Nohicdia.exe
        201⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\Nqifkl32.exe
        
        C:\Windows\system32\Nqifkl32.exe
        202⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\Oaeegjeb.exe
        
        C:\Windows\system32\Oaeegjeb.exe
        203⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\Okkidceh.exe
        
        C:\Windows\system32\Okkidceh.exe
        204⤵
        Modifies registry class
        
        PID:624
        
        C:\Windows\SysWOW64\Pgdgodhj.exe
        
        C:\Windows\system32\Pgdgodhj.exe
        205⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\Pbiklmhp.exe
        
        C:\Windows\system32\Pbiklmhp.exe
        206⤵
        Drops file in System32 directory
        
        PID:4788
        
        C:\Windows\SysWOW64\Pehghhgc.exe
        
        C:\Windows\system32\Pehghhgc.exe
        207⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Plapdb32.exe
        
        C:\Windows\system32\Plapdb32.exe
        208⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\Aonhblad.exe
        
        C:\Windows\system32\Aonhblad.exe
        209⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\Aiclodaj.exe
        
        C:\Windows\system32\Aiclodaj.exe
        210⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Albikp32.exe
        
        C:\Windows\system32\Albikp32.exe
        211⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Aified32.exe
        
        C:\Windows\system32\Aified32.exe
        212⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\Appaangd.exe
        
        C:\Windows\system32\Appaangd.exe
        213⤵
        Drops file in System32 directory
        
        PID:4928
        
        C:\Windows\SysWOW64\Aihfjd32.exe
        
        C:\Windows\system32\Aihfjd32.exe
        214⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\Aoenbkll.exe
        
        C:\Windows\system32\Aoenbkll.exe
        215⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Booaii32.exe
        
        C:\Windows\system32\Booaii32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1680
        
        C:\Windows\SysWOW64\Ciioaa32.exe
        
        C:\Windows\system32\Ciioaa32.exe
        217⤵
        Drops file in System32 directory
        
        PID:5256
        
        C:\Windows\SysWOW64\Coegih32.exe
        
        C:\Windows\system32\Coegih32.exe
        218⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Chnlbndj.exe
        
        C:\Windows\system32\Chnlbndj.exe
        219⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Dcjfpfnh.exe
        
        C:\Windows\system32\Dcjfpfnh.exe
        220⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\Dpnfjjla.exe
        
        C:\Windows\system32\Dpnfjjla.exe
        221⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Dcmcfeke.exe
        
        C:\Windows\system32\Dcmcfeke.exe
        222⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Dlegokbe.exe
        
        C:\Windows\system32\Dlegokbe.exe
        223⤵
        Drops file in System32 directory
        
        PID:5560
        
        C:\Windows\SysWOW64\Denlgq32.exe
        
        C:\Windows\system32\Denlgq32.exe
        224⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\Dcalae32.exe
        
        C:\Windows\system32\Dcalae32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5732
        
        C:\Windows\SysWOW64\Hifmhf32.exe
        
        C:\Windows\system32\Hifmhf32.exe
        226⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Hapancai.exe
        
        C:\Windows\system32\Hapancai.exe
        227⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Hjhfgi32.exe
        
        C:\Windows\system32\Hjhfgi32.exe
        228⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Hbcklkee.exe
        
        C:\Windows\system32\Hbcklkee.exe
        229⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Hfacai32.exe
        
        C:\Windows\system32\Hfacai32.exe
        230⤵
        Modifies registry class
        
        PID:6060
        
        C:\Windows\SysWOW64\Iafgob32.exe
        
        C:\Windows\system32\Iafgob32.exe
        231⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\Iiblcdil.exe
        
        C:\Windows\system32\Iiblcdil.exe
        232⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Iiffoc32.exe
        
        C:\Windows\system32\Iiffoc32.exe
        233⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Idnfal32.exe
        
        C:\Windows\system32\Idnfal32.exe
        234⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Jbccbi32.exe
        
        C:\Windows\system32\Jbccbi32.exe
        235⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Jaddpppa.exe
        
        C:\Windows\system32\Jaddpppa.exe
        236⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Jfalhgni.exe
        
        C:\Windows\system32\Jfalhgni.exe
        237⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\Majoikof.exe
        
        C:\Windows\system32\Majoikof.exe
        238⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Nqdeefpi.exe
        
        C:\Windows\system32\Nqdeefpi.exe
        239⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\Pbkagfba.exe
        
        C:\Windows\system32\Pbkagfba.exe
        240⤵
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\Ankdbf32.exe
        
        C:\Windows\system32\Ankdbf32.exe
        241⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Coijja32.exe
        
        C:\Windows\system32\Coijja32.exe
        242⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Cbgbpp32.exe
        
        C:\Windows\system32\Cbgbpp32.exe
        243⤵
        Drops file in System32 directory
        
        PID:5972
        
        C:\Windows\SysWOW64\Eekanh32.exe
        
        C:\Windows\system32\Eekanh32.exe
        244⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Eocegn32.exe
        
        C:\Windows\system32\Eocegn32.exe
        245⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\Eaabci32.exe
        
        C:\Windows\system32\Eaabci32.exe
        246⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Flgfqb32.exe
        
        C:\Windows\system32\Flgfqb32.exe
        247⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\Ffpjihee.exe
        
        C:\Windows\system32\Ffpjihee.exe
        248⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Fcckcl32.exe
        
        C:\Windows\system32\Fcckcl32.exe
        249⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Fkopgn32.exe
        
        C:\Windows\system32\Fkopgn32.exe
        250⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Fdgdpdgj.exe
        
        C:\Windows\system32\Fdgdpdgj.exe
        251⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Fchdnkpi.exe
        
        C:\Windows\system32\Fchdnkpi.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5076
        
        C:\Windows\SysWOW64\Fhemfbnq.exe
        
        C:\Windows\system32\Fhemfbnq.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5572
        
        C:\Windows\SysWOW64\Fckacknf.exe
        
        C:\Windows\system32\Fckacknf.exe
        254⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Gdcdlb32.exe
        
        C:\Windows\system32\Gdcdlb32.exe
        255⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Gcddjiel.exe
        
        C:\Windows\system32\Gcddjiel.exe
        256⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\Gdeqaa32.exe
        
        C:\Windows\system32\Gdeqaa32.exe
        257⤵
        Drops file in System32 directory
        
        PID:944
        
        C:\Windows\SysWOW64\Gkoinlbg.exe
        
        C:\Windows\system32\Gkoinlbg.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5840
        
        C:\Windows\SysWOW64\Hbiakf32.exe
        
        C:\Windows\system32\Hbiakf32.exe
        259⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\Hkdbik32.exe
        
        C:\Windows\system32\Hkdbik32.exe
        260⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Hodgei32.exe
        
        C:\Windows\system32\Hodgei32.exe
        261⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Hkkhjj32.exe
        
        C:\Windows\system32\Hkkhjj32.exe
        262⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Ibeqgdpf.exe
        
        C:\Windows\system32\Ibeqgdpf.exe
        263⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\Ibijbc32.exe
        
        C:\Windows\system32\Ibijbc32.exe
        264⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Iicboncn.exe
        
        C:\Windows\system32\Iicboncn.exe
        265⤵
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Iciflfcd.exe
        
        C:\Windows\system32\Iciflfcd.exe
        266⤵
        Drops file in System32 directory
        
        PID:5952
        
        C:\Windows\SysWOW64\Jijhom32.exe
        
        C:\Windows\system32\Jijhom32.exe
        267⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\Jfoihalp.exe
        
        C:\Windows\system32\Jfoihalp.exe
        268⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Jlnnfghd.exe
        
        C:\Windows\system32\Jlnnfghd.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1656
        
        C:\Windows\SysWOW64\Jbgfca32.exe
        
        C:\Windows\system32\Jbgfca32.exe
        270⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Jmpgfjmd.exe
        
        C:\Windows\system32\Jmpgfjmd.exe
        271⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Kifhkkci.exe
        
        C:\Windows\system32\Kifhkkci.exe
        272⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\Kbceoped.exe
        
        C:\Windows\system32\Kbceoped.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3140
        
        C:\Windows\SysWOW64\Kmijliej.exe
        
        C:\Windows\system32\Kmijliej.exe
        274⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\Kedoqkbe.exe
        
        C:\Windows\system32\Kedoqkbe.exe
        275⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\Ldeonbkd.exe
        
        C:\Windows\system32\Ldeonbkd.exe
        276⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\Lmppmh32.exe
        
        C:\Windows\system32\Lmppmh32.exe
        277⤵
        
        PID:620
        
        C:\Windows\SysWOW64\Lgmnqmam.exe
        
        C:\Windows\system32\Lgmnqmam.exe
        278⤵
        Modifies registry class
        
        PID:2004
        
        C:\Windows\SysWOW64\Mpebjb32.exe
        
        C:\Windows\system32\Mpebjb32.exe
        279⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Mpjleadh.exe
        
        C:\Windows\system32\Mpjleadh.exe
        280⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Mibpng32.exe
        
        C:\Windows\system32\Mibpng32.exe
        281⤵
        Drops file in System32 directory
        
        PID:760
        
        C:\Windows\SysWOW64\Mgimmkgp.exe
        
        C:\Windows\system32\Mgimmkgp.exe
        282⤵
        Drops file in System32 directory
        
        PID:5628
        
        C:\Windows\SysWOW64\Npabeq32.exe
        
        C:\Windows\system32\Npabeq32.exe
        283⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Nebdighb.exe
        
        C:\Windows\system32\Nebdighb.exe
        284⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\Nphhfp32.exe
        
        C:\Windows\system32\Nphhfp32.exe
        285⤵
        Drops file in System32 directory
        
        PID:5296
        
        C:\Windows\SysWOW64\Ojcidelf.exe
        
        C:\Windows\system32\Ojcidelf.exe
        286⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Onhhkb32.exe
        
        C:\Windows\system32\Onhhkb32.exe
        287⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Pqmjhm32.exe
        
        C:\Windows\system32\Pqmjhm32.exe
        288⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Pggbdgmm.exe
        
        C:\Windows\system32\Pggbdgmm.exe
        289⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Pdkcnklf.exe
        
        C:\Windows\system32\Pdkcnklf.exe
        290⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Pjhlfb32.exe
        
        C:\Windows\system32\Pjhlfb32.exe
        291⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\Afcffb32.exe
        
        C:\Windows\system32\Afcffb32.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2140
        
        C:\Windows\SysWOW64\Aedfdjdl.exe
        
        C:\Windows\system32\Aedfdjdl.exe
        293⤵
        Drops file in System32 directory
        
        PID:848
        
        C:\Windows\SysWOW64\Ajfhhp32.exe
        
        C:\Windows\system32\Ajfhhp32.exe
        294⤵
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Aappdj32.exe
        
        C:\Windows\system32\Aappdj32.exe
        295⤵
        Modifies registry class
        
        PID:2184
        
        C:\Windows\SysWOW64\Bccfleqi.exe
        
        C:\Windows\system32\Bccfleqi.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6008
        
        C:\Windows\SysWOW64\Bnhjinpo.exe
        
        C:\Windows\system32\Bnhjinpo.exe
        297⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\Bchogd32.exe
        
        C:\Windows\system32\Bchogd32.exe
        298⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:5064
        
        C:\Windows\SysWOW64\Bjagcndq.exe
        
        C:\Windows\system32\Bjagcndq.exe
        299⤵
        
        PID:884
        
        C:\Windows\SysWOW64\Dfmjjl32.exe
        
        C:\Windows\system32\Dfmjjl32.exe
        300⤵
        Drops file in System32 directory
        
        PID:4112
        
        C:\Windows\SysWOW64\Deokhc32.exe
        
        C:\Windows\system32\Deokhc32.exe
        301⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Ehocjo32.exe
        
        C:\Windows\system32\Ehocjo32.exe
        302⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Emllbe32.exe
        
        C:\Windows\system32\Emllbe32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6248
        
        C:\Windows\SysWOW64\Eopbghnb.exe
        
        C:\Windows\system32\Eopbghnb.exe
        304⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Edmjpoli.exe
        
        C:\Windows\system32\Edmjpoli.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6324
        
        C:\Windows\SysWOW64\Fobomglo.exe
        
        C:\Windows\system32\Fobomglo.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6368
        
        C:\Windows\SysWOW64\Faakickc.exe
        
        C:\Windows\system32\Faakickc.exe
        307⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Fachob32.exe
        
        C:\Windows\system32\Fachob32.exe
        308⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Foghhg32.exe
        
        C:\Windows\system32\Foghhg32.exe
        309⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Feapdaof.exe
        
        C:\Windows\system32\Feapdaof.exe
        310⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Fgbmliee.exe
        
        C:\Windows\system32\Fgbmliee.exe
        311⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Fojenfeg.exe
        
        C:\Windows\system32\Fojenfeg.exe
        312⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Fnoboc32.exe
        
        C:\Windows\system32\Fnoboc32.exe
        313⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Fhdfll32.exe
        
        C:\Windows\system32\Fhdfll32.exe
        314⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Gkeonggf.exe
        
        C:\Windows\system32\Gkeonggf.exe
        315⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Gaogja32.exe
        
        C:\Windows\system32\Gaogja32.exe
        316⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Ggnlhgkg.exe
        
        C:\Windows\system32\Ggnlhgkg.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6848
        
        C:\Windows\SysWOW64\Gfomfo32.exe
        
        C:\Windows\system32\Gfomfo32.exe
        318⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Ghpehjph.exe
        
        C:\Windows\system32\Ghpehjph.exe
        319⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Hojndd32.exe
        
        C:\Windows\system32\Hojndd32.exe
        320⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Hdlphjaf.exe
        
        C:\Windows\system32\Hdlphjaf.exe
        321⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Hnddqp32.exe
        
        C:\Windows\system32\Hnddqp32.exe
        322⤵
        Modifies registry class
        
        PID:7084
        
        C:\Windows\SysWOW64\Hgliie32.exe
        
        C:\Windows\system32\Hgliie32.exe
        323⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Hocqkc32.exe
        
        C:\Windows\system32\Hocqkc32.exe
        324⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Ihlechfj.exe
        
        C:\Windows\system32\Ihlechfj.exe
        325⤵
        Drops file in System32 directory
        
        PID:6212
        
        C:\Windows\SysWOW64\Ininloda.exe
        
        C:\Windows\system32\Ininloda.exe
        326⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Ihnbih32.exe
        
        C:\Windows\system32\Ihnbih32.exe
        327⤵
        Modifies registry class
        
        PID:6224
        
        C:\Windows\SysWOW64\Ikmnec32.exe
        
        C:\Windows\system32\Ikmnec32.exe
        328⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Joamlacj.exe
        
        C:\Windows\system32\Joamlacj.exe
        329⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Jphcmp32.exe
        
        C:\Windows\system32\Jphcmp32.exe
        330⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\Kbneij32.exe
        
        C:\Windows\system32\Kbneij32.exe
        331⤵
        Drops file in System32 directory
        
        PID:772
        
        C:\Windows\SysWOW64\Lejngd32.exe
        
        C:\Windows\system32\Lejngd32.exe
        332⤵
        Modifies registry class
        
        PID:6580
        
        C:\Windows\SysWOW64\Midfiq32.exe
        
        C:\Windows\system32\Midfiq32.exe
        333⤵
        Drops file in System32 directory
        
        PID:6620
        
        C:\Windows\SysWOW64\Noaoagca.exe
        
        C:\Windows\system32\Noaoagca.exe
        334⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Nhicjm32.exe
        
        C:\Windows\system32\Nhicjm32.exe
        335⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Nemcca32.exe
        
        C:\Windows\system32\Nemcca32.exe
        336⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\Noehlgol.exe
        
        C:\Windows\system32\Noehlgol.exe
        337⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\Neppiagi.exe
        
        C:\Windows\system32\Neppiagi.exe
        338⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Nohdaf32.exe
        
        C:\Windows\system32\Nohdaf32.exe
        339⤵
        Modifies registry class
        
        PID:6904
        
        C:\Windows\SysWOW64\Nllekk32.exe
        
        C:\Windows\system32\Nllekk32.exe
        340⤵
        Modifies registry class
        
        PID:1420
        
        C:\Windows\SysWOW64\Nipedokm.exe
        
        C:\Windows\system32\Nipedokm.exe
        341⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Oomnmfid.exe
        
        C:\Windows\system32\Oomnmfid.exe
        342⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Olqofjhn.exe
        
        C:\Windows\system32\Olqofjhn.exe
        343⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Oeicopoo.exe
        
        C:\Windows\system32\Oeicopoo.exe
        344⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Opnglhnd.exe
        
        C:\Windows\system32\Opnglhnd.exe
        345⤵
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Ocmchdmh.exe
        
        C:\Windows\system32\Ocmchdmh.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:512
        
        C:\Windows\SysWOW64\Opcqgh32.exe
        
        C:\Windows\system32\Opcqgh32.exe
        347⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3420
        
        C:\Windows\SysWOW64\Pfdbknda.exe
        
        C:\Windows\system32\Pfdbknda.exe
        348⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Phcogice.exe
        
        C:\Windows\system32\Phcogice.exe
        349⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\Pomgcc32.exe
        
        C:\Windows\system32\Pomgcc32.exe
        350⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Pfgopnbo.exe
        
        C:\Windows\system32\Pfgopnbo.exe
        351⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Phekliab.exe
        
        C:\Windows\system32\Phekliab.exe
        352⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Pgfljqia.exe
        
        C:\Windows\system32\Pgfljqia.exe
        353⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Ppopcf32.exe
        
        C:\Windows\system32\Ppopcf32.exe
        354⤵
        Modifies registry class
        
        PID:4596
        
        C:\Windows\SysWOW64\Pgihppgo.exe
        
        C:\Windows\system32\Pgihppgo.exe
        355⤵
        Drops file in System32 directory
        
        PID:1312
        
        C:\Windows\SysWOW64\Qhjegh32.exe
        
        C:\Windows\system32\Qhjegh32.exe
        356⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Qfneamlf.exe
        
        C:\Windows\system32\Qfneamlf.exe
        357⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Qfpbfljd.exe
        
        C:\Windows\system32\Qfpbfljd.exe
        358⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Aoifoa32.exe
        
        C:\Windows\system32\Aoifoa32.exe
        359⤵
        Modifies registry class
        
        PID:2712
        
        C:\Windows\SysWOW64\Ajnkmjqj.exe
        
        C:\Windows\system32\Ajnkmjqj.exe
        360⤵
        Modifies registry class
        
        PID:6868
        
        C:\Windows\SysWOW64\Agdhln32.exe
        
        C:\Windows\system32\Agdhln32.exe
        361⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Amaqde32.exe
        
        C:\Windows\system32\Amaqde32.exe
        362⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Aggean32.exe
        
        C:\Windows\system32\Aggean32.exe
        363⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Aihaifam.exe
        
        C:\Windows\system32\Aihaifam.exe
        364⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Bjgncihp.exe
        
        C:\Windows\system32\Bjgncihp.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4476
        
        C:\Windows\SysWOW64\Bgknlmgi.exe
        
        C:\Windows\system32\Bgknlmgi.exe
        366⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Bidqddgp.exe
        
        C:\Windows\system32\Bidqddgp.exe
        367⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\Cjcmognb.exe
        
        C:\Windows\system32\Cjcmognb.exe
        368⤵
        Modifies registry class
        
        PID:2952
        
        C:\Windows\SysWOW64\Cflkihbd.exe
        
        C:\Windows\system32\Cflkihbd.exe
        369⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6428
        
        C:\Windows\SysWOW64\Cpeobn32.exe
        
        C:\Windows\system32\Cpeobn32.exe
        370⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\Cjjcof32.exe
        
        C:\Windows\system32\Cjjcof32.exe
        371⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Cadllq32.exe
        
        C:\Windows\system32\Cadllq32.exe
        372⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Cjmpeffh.exe
        
        C:\Windows\system32\Cjmpeffh.exe
        373⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Cmklaaek.exe
        
        C:\Windows\system32\Cmklaaek.exe
        374⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Dibmfb32.exe
        
        C:\Windows\system32\Dibmfb32.exe
        375⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Dcgackke.exe
        
        C:\Windows\system32\Dcgackke.exe
        376⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Djaipe32.exe
        
        C:\Windows\system32\Djaipe32.exe
        377⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Eipigqop.exe
        
        C:\Windows\system32\Eipigqop.exe
        378⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\Ejabgcdp.exe
        
        C:\Windows\system32\Ejabgcdp.exe
        379⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Eangimij.exe
        
        C:\Windows\system32\Eangimij.exe
        380⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Fkflbb32.exe
        
        C:\Windows\system32\Fkflbb32.exe
        381⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Filicodb.exe
        
        C:\Windows\system32\Filicodb.exe
        382⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\Fgbfbc32.exe
        
        C:\Windows\system32\Fgbfbc32.exe
        383⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Fagjolao.exe
        
        C:\Windows\system32\Fagjolao.exe
        384⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Ghhhmebd.exe
        
        C:\Windows\system32\Ghhhmebd.exe
        385⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Gaqmej32.exe
        
        C:\Windows\system32\Gaqmej32.exe
        386⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\Ggnenagl.exe
        
        C:\Windows\system32\Ggnenagl.exe
        387⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Gacjkjgb.exe
        
        C:\Windows\system32\Gacjkjgb.exe
        388⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\Gkkndp32.exe
        
        C:\Windows\system32\Gkkndp32.exe
        389⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Hdhlhd32.exe
        
        C:\Windows\system32\Hdhlhd32.exe
        390⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\Hgieipmo.exe
        
        C:\Windows\system32\Hgieipmo.exe
        391⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\Hjhaeklb.exe
        
        C:\Windows\system32\Hjhaeklb.exe
        392⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Hdmecdlh.exe
        
        C:\Windows\system32\Hdmecdlh.exe
        393⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\Iaaflh32.exe
        
        C:\Windows\system32\Iaaflh32.exe
        394⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Iggakn32.exe
        
        C:\Windows\system32\Iggakn32.exe
        395⤵
        Drops file in System32 directory
        
        PID:5560
        
        C:\Windows\SysWOW64\Jhndepbi.exe
        
        C:\Windows\system32\Jhndepbi.exe
        396⤵
        Drops file in System32 directory
        
        PID:6964
        
        C:\Windows\SysWOW64\Kibmqond.exe
        
        C:\Windows\system32\Kibmqond.exe
        397⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Kqpoja32.exe
        
        C:\Windows\system32\Kqpoja32.exe
        398⤵
        Modifies registry class
        
        PID:1412
        
        C:\Windows\SysWOW64\Kaehepeg.exe
        
        C:\Windows\system32\Kaehepeg.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4640
        
        C:\Windows\SysWOW64\Ljmmnf32.exe
        
        C:\Windows\system32\Ljmmnf32.exe
        400⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Mlhidg32.exe
        
        C:\Windows\system32\Mlhidg32.exe
        401⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Magnbnea.exe
        
        C:\Windows\system32\Magnbnea.exe
        402⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Mjpbkc32.exe
        
        C:\Windows\system32\Mjpbkc32.exe
        403⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\Nhfpjghi.exe
        
        C:\Windows\system32\Nhfpjghi.exe
        404⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Njdlfbgm.exe
        
        C:\Windows\system32\Njdlfbgm.exe
        405⤵
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Nifldj32.exe
        
        C:\Windows\system32\Nifldj32.exe
        406⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Nobdlqnc.exe
        
        C:\Windows\system32\Nobdlqnc.exe
        407⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\Noeaaqlq.exe
        
        C:\Windows\system32\Noeaaqlq.exe
        408⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Oldagc32.exe
        
        C:\Windows\system32\Oldagc32.exe
        409⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Oboicmhj.exe
        
        C:\Windows\system32\Oboicmhj.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5580
        
        C:\Windows\SysWOW64\Okjnhpee.exe
        
        C:\Windows\system32\Okjnhpee.exe
        411⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Piknfgmd.exe
        
        C:\Windows\system32\Piknfgmd.exe
        412⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Qocfjlan.exe
        
        C:\Windows\system32\Qocfjlan.exe
        413⤵
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Qemoff32.exe
        
        C:\Windows\system32\Qemoff32.exe
        414⤵
        
        PID:812
        
        C:\Windows\SysWOW64\Qoecol32.exe
        
        C:\Windows\system32\Qoecol32.exe
        415⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\Ahnghafl.exe
        
        C:\Windows\system32\Ahnghafl.exe
        416⤵
        Modifies registry class
        
        PID:6536
        
        C:\Windows\SysWOW64\Acheqi32.exe
        
        C:\Windows\system32\Acheqi32.exe
        417⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Ckaffjbg.exe
        
        C:\Windows\system32\Ckaffjbg.exe
        418⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\Dmmblkpm.exe
        
        C:\Windows\system32\Dmmblkpm.exe
        419⤵
        Modifies registry class
        
        PID:1684
        
        C:\Windows\SysWOW64\Ggmock32.exe
        
        C:\Windows\system32\Ggmock32.exe
        420⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Hkpqdifa.exe
        
        C:\Windows\system32\Hkpqdifa.exe
        421⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\Hdmohnhl.exe
        
        C:\Windows\system32\Hdmohnhl.exe
        422⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Ikfgeh32.exe
        
        C:\Windows\system32\Ikfgeh32.exe
        423⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Ilhcmpeg.exe
        
        C:\Windows\system32\Ilhcmpeg.exe
        424⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\Idoknmfj.exe
        
        C:\Windows\system32\Idoknmfj.exe
        425⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Ikickgnf.exe
        
        C:\Windows\system32\Ikickgnf.exe
        426⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\Jkbfafel.exe
        
        C:\Windows\system32\Jkbfafel.exe
        427⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\Jncobabm.exe
        
        C:\Windows\system32\Jncobabm.exe
        428⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Jkgpleaf.exe
        
        C:\Windows\system32\Jkgpleaf.exe
        429⤵
        Drops file in System32 directory
        
        PID:4352
        
        C:\Windows\SysWOW64\Jcdafg32.exe
        
        C:\Windows\system32\Jcdafg32.exe
        430⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\Kckgff32.exe
        
        C:\Windows\system32\Kckgff32.exe
        431⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Kjepcqnd.exe
        
        C:\Windows\system32\Kjepcqnd.exe
        432⤵
        Drops file in System32 directory
        
        PID:4032
        
        C:\Windows\SysWOW64\Kjhlipla.exe
        
        C:\Windows\system32\Kjhlipla.exe
        433⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Kqbdej32.exe
        
        C:\Windows\system32\Kqbdej32.exe
        434⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\Kjjinp32.exe
        
        C:\Windows\system32\Kjjinp32.exe
        435⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Kmhejk32.exe
        
        C:\Windows\system32\Kmhejk32.exe
        436⤵
        
        PID:944
        
        C:\Windows\SysWOW64\Lgnihd32.exe
        
        C:\Windows\system32\Lgnihd32.exe
        437⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Lmkbpk32.exe
        
        C:\Windows\system32\Lmkbpk32.exe
        438⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Madjbg32.exe
        
        C:\Windows\system32\Madjbg32.exe
        439⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4828
        
        C:\Windows\SysWOW64\Nlfnkoia.exe
        
        C:\Windows\system32\Nlfnkoia.exe
        440⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\Njkklk32.exe
        
        C:\Windows\system32\Njkklk32.exe
        441⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Ojdnbj32.exe
        
        C:\Windows\system32\Ojdnbj32.exe
        442⤵
        Drops file in System32 directory
        
        PID:5384
        
        C:\Windows\SysWOW64\Odooqo32.exe
        
        C:\Windows\system32\Odooqo32.exe
        443⤵
        Drops file in System32 directory
        
        PID:912
        
        C:\Windows\SysWOW64\Pmoijcje.exe
        
        C:\Windows\system32\Pmoijcje.exe
        444⤵
        Drops file in System32 directory
        
        PID:2912
        
        C:\Windows\SysWOW64\Phfjmlhh.exe
        
        C:\Windows\system32\Phfjmlhh.exe
        445⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Qhigbl32.exe
        
        C:\Windows\system32\Qhigbl32.exe
        446⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\Qkgcog32.exe
        
        C:\Windows\system32\Qkgcog32.exe
        447⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\Aklmjfad.exe
        
        C:\Windows\system32\Aklmjfad.exe
        448⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Bhipiihc.exe
        
        C:\Windows\system32\Bhipiihc.exe
        449⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\Colklb32.exe
        
        C:\Windows\system32\Colklb32.exe
        450⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Ddgpfgil.exe
        
        C:\Windows\system32\Ddgpfgil.exe
        451⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\Deliaf32.exe
        
        C:\Windows\system32\Deliaf32.exe
        452⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Dndnjllg.exe
        
        C:\Windows\system32\Dndnjllg.exe
        453⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Emenhcdf.exe
        
        C:\Windows\system32\Emenhcdf.exe
        454⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Gldgflba.exe
        
        C:\Windows\system32\Gldgflba.exe
        455⤵
        
        PID:620
        
        C:\Windows\SysWOW64\Headjael.exe
        
        C:\Windows\system32\Headjael.exe
        456⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Hoaocf32.exe
        
        C:\Windows\system32\Hoaocf32.exe
        457⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Jmbhhkoa.exe
        
        C:\Windows\system32\Jmbhhkoa.exe
        458⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Komhfa32.exe
        
        C:\Windows\system32\Komhfa32.exe
        459⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Kflink32.exe
        
        C:\Windows\system32\Kflink32.exe
        460⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\Llhnpe32.exe
        
        C:\Windows\system32\Llhnpe32.exe
        461⤵
        Drops file in System32 directory
        
        PID:4976
        
        C:\Windows\SysWOW64\Lgmbmn32.exe
        
        C:\Windows\system32\Lgmbmn32.exe
        462⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Ncgiolkk.exe
        
        C:\Windows\system32\Ncgiolkk.exe
        463⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Ompfnoci.exe
        
        C:\Windows\system32\Ompfnoci.exe
        464⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Ojcghc32.exe
        
        C:\Windows\system32\Ojcghc32.exe
        465⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\Onapnbhi.exe
        
        C:\Windows\system32\Onapnbhi.exe
        466⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\Pmgmonma.exe
        
        C:\Windows\system32\Pmgmonma.exe
        467⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\Ppgeqijb.exe
        
        C:\Windows\system32\Ppgeqijb.exe
        468⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\Pdhklgnf.exe
        
        C:\Windows\system32\Pdhklgnf.exe
        469⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:212
        
        C:\Windows\SysWOW64\Pnmojp32.exe
        
        C:\Windows\system32\Pnmojp32.exe
        470⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Qfhdnb32.exe
        
        C:\Windows\system32\Qfhdnb32.exe
        471⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Ameipl32.exe
        
        C:\Windows\system32\Ameipl32.exe
        472⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Apeabg32.exe
        
        C:\Windows\system32\Apeabg32.exe
        473⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Akkfop32.exe
        
        C:\Windows\system32\Akkfop32.exe
        474⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Amibklml.exe
        
        C:\Windows\system32\Amibklml.exe
        475⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Adcjhf32.exe
        
        C:\Windows\system32\Adcjhf32.exe
        476⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Aagkaj32.exe
        
        C:\Windows\system32\Aagkaj32.exe
        477⤵
        
        PID:5576

C:\Windows\SysWOW64\Ahacndjo.exe
C:\Windows\system32\Ahacndjo.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7100
- C:\Windows\SysWOW64\Aajggjap.exe
  C:\Windows\system32\Aajggjap.exe
  2⤵
  PID:5812
- - C:\Windows\SysWOW64\Ahdpdd32.exe
    C:\Windows\system32\Ahdpdd32.exe
    3⤵
    PID:6944
  - - C:\Windows\SysWOW64\Bonhqnpi.exe
      C:\Windows\system32\Bonhqnpi.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:7124
    - - C:\Windows\SysWOW64\Bpodhf32.exe
        
        C:\Windows\system32\Bpodhf32.exe
        5⤵
        
        PID:4924
      - C:\Windows\SysWOW64\Bgimepmd.exe
        
        C:\Windows\system32\Bgimepmd.exe
        6⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Banabi32.exe
        
        C:\Windows\system32\Banabi32.exe
        7⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Bhhiocdg.exe
        
        C:\Windows\system32\Bhhiocdg.exe
        8⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Baanhi32.exe
        
        C:\Windows\system32\Baanhi32.exe
        9⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\Bhkfdcbd.exe
        
        C:\Windows\system32\Bhkfdcbd.exe
        10⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Bacjmh32.exe
        
        C:\Windows\system32\Bacjmh32.exe
        11⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\Bogkgmho.exe
        
        C:\Windows\system32\Bogkgmho.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6604
        
        C:\Windows\SysWOW64\Bphgoe32.exe
        
        C:\Windows\system32\Bphgoe32.exe
        13⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Cknlln32.exe
        
        C:\Windows\system32\Cknlln32.exe
        14⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Cnlhhi32.exe
        
        C:\Windows\system32\Cnlhhi32.exe
        15⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Cdfpdc32.exe
        
        C:\Windows\system32\Cdfpdc32.exe
        16⤵
        Drops file in System32 directory
        
        PID:2856
        
        C:\Windows\SysWOW64\Ckphamkp.exe
        
        C:\Windows\system32\Ckphamkp.exe
        17⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Cdhmjc32.exe
        
        C:\Windows\system32\Cdhmjc32.exe
        18⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Conagl32.exe
        
        C:\Windows\system32\Conagl32.exe
        19⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Chfepa32.exe
        
        C:\Windows\system32\Chfepa32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5916
        
        C:\Windows\SysWOW64\Coqnmkpd.exe
        
        C:\Windows\system32\Coqnmkpd.exe
        21⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Cdmfebnk.exe
        
        C:\Windows\system32\Cdmfebnk.exe
        22⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\Cocjbkna.exe
        
        C:\Windows\system32\Cocjbkna.exe
        23⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Cdpckbli.exe
        
        C:\Windows\system32\Cdpckbli.exe
        24⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Doeghk32.exe
        
        C:\Windows\system32\Doeghk32.exe
        25⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6424
        
        C:\Windows\SysWOW64\Dogdnj32.exe
        
        C:\Windows\system32\Dogdnj32.exe
        26⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Dddlfa32.exe
        
        C:\Windows\system32\Dddlfa32.exe
        27⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Dkndbkop.exe
        
        C:\Windows\system32\Dkndbkop.exe
        28⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Dahmoefm.exe
        
        C:\Windows\system32\Dahmoefm.exe
        29⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Dkqahk32.exe
        
        C:\Windows\system32\Dkqahk32.exe
        30⤵
        Drops file in System32 directory
        
        PID:6412
        
        C:\Windows\SysWOW64\Dhdaao32.exe
        
        C:\Windows\system32\Dhdaao32.exe
        31⤵
        Drops file in System32 directory
        
        PID:6720
        
        C:\Windows\SysWOW64\Doojni32.exe
        
        C:\Windows\system32\Doojni32.exe
        32⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Egjobl32.exe
        
        C:\Windows\system32\Egjobl32.exe
        33⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Hiofeigg.exe
        
        C:\Windows\system32\Hiofeigg.exe
        34⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Kojdflkl.exe
        
        C:\Windows\system32\Kojdflkl.exe
        35⤵
        Drops file in System32 directory
        
        PID:2664
        
        C:\Windows\SysWOW64\Kedlbf32.exe
        
        C:\Windows\system32\Kedlbf32.exe
        36⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\Kakmhg32.exe
        
        C:\Windows\system32\Kakmhg32.exe
        37⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Khdedapj.exe
        
        C:\Windows\system32\Khdedapj.exe
        38⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Koonak32.exe
        
        C:\Windows\system32\Koonak32.exe
        39⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Kidbnd32.exe
        
        C:\Windows\system32\Kidbnd32.exe
        40⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\Koajfk32.exe
        
        C:\Windows\system32\Koajfk32.exe
        41⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Khiopp32.exe
        
        C:\Windows\system32\Khiopp32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6684
        
        C:\Windows\SysWOW64\Locgljca.exe
        
        C:\Windows\system32\Locgljca.exe
        43⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\Liikiccg.exe
        
        C:\Windows\system32\Liikiccg.exe
        44⤵
        Modifies registry class
        
        PID:4592
        
        C:\Windows\SysWOW64\Lcapbi32.exe
        
        C:\Windows\system32\Lcapbi32.exe
        45⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Lhnhkpgo.exe
        
        C:\Windows\system32\Lhnhkpgo.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4476
        
        C:\Windows\SysWOW64\Lohqgj32.exe
        
        C:\Windows\system32\Lohqgj32.exe
        47⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Lebiddfi.exe
        
        C:\Windows\system32\Lebiddfi.exe
        48⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Laiiie32.exe
        
        C:\Windows\system32\Laiiie32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5764
        
        C:\Windows\SysWOW64\Lhbafo32.exe
        
        C:\Windows\system32\Lhbafo32.exe
        50⤵
        Modifies registry class
        
        PID:4908
        
        C:\Windows\SysWOW64\Lomjbikf.exe
        
        C:\Windows\system32\Lomjbikf.exe
        51⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Lfgboc32.exe
        
        C:\Windows\system32\Lfgboc32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2964
        
        C:\Windows\SysWOW64\Moofhiid.exe
        
        C:\Windows\system32\Moofhiid.exe
        53⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Mlcgam32.exe
        
        C:\Windows\system32\Mlcgam32.exe
        54⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\Mbppjd32.exe
        
        C:\Windows\system32\Mbppjd32.exe
        55⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\Mjggka32.exe
        
        C:\Windows\system32\Mjggka32.exe
        56⤵
        Drops file in System32 directory
        
        PID:6864
        
        C:\Windows\SysWOW64\Mledgm32.exe
        
        C:\Windows\system32\Mledgm32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6680
        
        C:\Windows\SysWOW64\Mhldlnko.exe
        
        C:\Windows\system32\Mhldlnko.exe
        58⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Mofmhhcl.exe
        
        C:\Windows\system32\Mofmhhcl.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3096
        
        C:\Windows\SysWOW64\Mbdiecbp.exe
        
        C:\Windows\system32\Mbdiecbp.exe
        60⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Mljmblae.exe
        
        C:\Windows\system32\Mljmblae.exe
        61⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Mbgejcpm.exe
        
        C:\Windows\system32\Mbgejcpm.exe
        62⤵
        Modifies registry class
        
        PID:2320
        
        C:\Windows\SysWOW64\Nlljglpc.exe
        
        C:\Windows\system32\Nlljglpc.exe
        63⤵
        Drops file in System32 directory
        
        PID:3156
        
        C:\Windows\SysWOW64\Nokfcg32.exe
        
        C:\Windows\system32\Nokfcg32.exe
        64⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\Nfenpafc.exe
        
        C:\Windows\system32\Nfenpafc.exe
        65⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Nciojeem.exe
        
        C:\Windows\system32\Nciojeem.exe
        66⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:408
        
        C:\Windows\SysWOW64\Njbgfp32.exe
        
        C:\Windows\system32\Njbgfp32.exe
        67⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Nbnlkbje.exe
        
        C:\Windows\system32\Nbnlkbje.exe
        68⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\Nqolii32.exe
        
        C:\Windows\system32\Nqolii32.exe
        69⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Njgqaohd.exe
        
        C:\Windows\system32\Njgqaohd.exe
        70⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Nqaini32.exe
        
        C:\Windows\system32\Nqaini32.exe
        71⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\Oilmckml.exe
        
        C:\Windows\system32\Oilmckml.exe
        72⤵
        Modifies registry class
        
        PID:6936
        
        C:\Windows\SysWOW64\Oofepe32.exe
        
        C:\Windows\system32\Oofepe32.exe
        73⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Ofqnlplf.exe
        
        C:\Windows\system32\Ofqnlplf.exe
        74⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Ocdnedkp.exe
        
        C:\Windows\system32\Ocdnedkp.exe
        75⤵
        Modifies registry class
        
        PID:4236
        
        C:\Windows\SysWOW64\Ojnfbnbl.exe
        
        C:\Windows\system32\Ojnfbnbl.exe
        76⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\Obikgppg.exe
        
        C:\Windows\system32\Obikgppg.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4288
        
        C:\Windows\SysWOW64\Oqkkdh32.exe
        
        C:\Windows\system32\Oqkkdh32.exe
        78⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\Oblhlpne.exe
        
        C:\Windows\system32\Oblhlpne.exe
        79⤵
        Modifies registry class
        
        PID:3420
        
        C:\Windows\SysWOW64\Omalii32.exe
        
        C:\Windows\system32\Omalii32.exe
        80⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\Obnebp32.exe
        
        C:\Windows\system32\Obnebp32.exe
        81⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\Pihmojco.exe
        
        C:\Windows\system32\Pihmojco.exe
        82⤵
        
        PID:808
        
        C:\Windows\SysWOW64\Pqoepgca.exe
        
        C:\Windows\system32\Pqoepgca.exe
        83⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\Pflmhnbi.exe
        
        C:\Windows\system32\Pflmhnbi.exe
        84⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Pcpnab32.exe
        
        C:\Windows\system32\Pcpnab32.exe
        85⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Pjjfnlho.exe
        
        C:\Windows\system32\Pjjfnlho.exe
        86⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\Pbekboej.exe
        
        C:\Windows\system32\Pbekboej.exe
        87⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\Pmkopgep.exe
        
        C:\Windows\system32\Pmkopgep.exe
        88⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\Pjopil32.exe
        
        C:\Windows\system32\Pjopil32.exe
        89⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\Pplhab32.exe
        
        C:\Windows\system32\Pplhab32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6888
        
        C:\Windows\SysWOW64\Qidljhia.exe
        
        C:\Windows\system32\Qidljhia.exe
        91⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Qpnegbpo.exe
        
        C:\Windows\system32\Qpnegbpo.exe
        92⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\Qifiph32.exe
        
        C:\Windows\system32\Qifiph32.exe
        93⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Qppambnl.exe
        
        C:\Windows\system32\Qppambnl.exe
        94⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Aapnfe32.exe
        
        C:\Windows\system32\Aapnfe32.exe
        95⤵
        Drops file in System32 directory
        
        PID:1884
        
        C:\Windows\SysWOW64\Afmfolcf.exe
        
        C:\Windows\system32\Afmfolcf.exe
        96⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\Adepco32.exe
        
        C:\Windows\system32\Adepco32.exe
        97⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Bbacekmj.exe
        
        C:\Windows\system32\Bbacekmj.exe
        98⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\Bkkhlhlj.exe
        
        C:\Windows\system32\Bkkhlhlj.exe
        99⤵
        Drops file in System32 directory
        
        PID:5324
        
        C:\Windows\SysWOW64\Cgaiqian.exe
        
        C:\Windows\system32\Cgaiqian.exe
        100⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Cipemdqa.exe
        
        C:\Windows\system32\Cipemdqa.exe
        101⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Ckpagg32.exe
        
        C:\Windows\system32\Ckpagg32.exe
        102⤵
        Drops file in System32 directory
        
        PID:2256
        
        C:\Windows\SysWOW64\Cmnncb32.exe
        
        C:\Windows\system32\Cmnncb32.exe
        103⤵
        Drops file in System32 directory
        
        PID:5500
        
        C:\Windows\SysWOW64\Cckfkiep.exe
        
        C:\Windows\system32\Cckfkiep.exe
        104⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Cmpjhbee.exe
        
        C:\Windows\system32\Cmpjhbee.exe
        105⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Cdjbel32.exe
        
        C:\Windows\system32\Cdjbel32.exe
        106⤵
        Drops file in System32 directory
        
        PID:1992
        
        C:\Windows\SysWOW64\Ckdkbfco.exe
        
        C:\Windows\system32\Ckdkbfco.exe
        107⤵
        Drops file in System32 directory
        
        PID:7060
        
        C:\Windows\SysWOW64\Cpacjm32.exe
        
        C:\Windows\system32\Cpacjm32.exe
        108⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\Ckfggf32.exe
        
        C:\Windows\system32\Ckfggf32.exe
        109⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Ddolpkhm.exe
        
        C:\Windows\system32\Ddolpkhm.exe
        110⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Dgmhmggq.exe
        
        C:\Windows\system32\Dgmhmggq.exe
        111⤵
        Modifies registry class
        
        PID:2568
        
        C:\Windows\SysWOW64\Ddaifk32.exe
        
        C:\Windows\system32\Ddaifk32.exe
        112⤵
        
        PID:812
        
        C:\Windows\SysWOW64\Epoplk32.exe
        
        C:\Windows\system32\Epoplk32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1748
        
        C:\Windows\SysWOW64\Fkempa32.exe
        
        C:\Windows\system32\Fkempa32.exe
        114⤵
        Modifies registry class
        
        PID:6932
        
        C:\Windows\SysWOW64\Hkllgnco.exe
        
        C:\Windows\system32\Hkllgnco.exe
        115⤵
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Indkih32.exe
        
        C:\Windows\system32\Indkih32.exe
        116⤵
        Drops file in System32 directory
        
        PID:3508
        
        C:\Windows\SysWOW64\Ijkloi32.exe
        
        C:\Windows\system32\Ijkloi32.exe
        117⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Iccpgofm.exe
        
        C:\Windows\system32\Iccpgofm.exe
        118⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Jjbbohid.exe
        
        C:\Windows\system32\Jjbbohid.exe
        119⤵
        
        PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abmjqe32.exe

Filesize
192KB

MD5
a78847efb9729f0cfa5e6b9183bd9572

SHA1
a1ebbb7fdd314ed6014bd3218333329af9ed15d7

SHA256
58826783ede849c2285dcedda05c237ad429869c0f30b91cff8a42c3c6269200

SHA512
0f732e3313a975165a0f733c49a7b5f3fc1e77e2d5818a64ba91e76e0c3f9ba192773fa631c1160bd222e6051f0ae9f4a4c6984a529d4056ae04ea27c4a1e812

Download Submit
C:\Windows\SysWOW64\Abmjqe32.exe

Filesize
314KB

MD5
babdbd6662cf1df270f9b0a1e50be1a5

SHA1
9b418721242e66f43a1e635922f17c4792ea1266

SHA256
417af3221852cb789be44ae147394aa4f07f9a221b3863ca92832295f5939754

SHA512
d5973b06ef0ca617e78c68ce861d1261609f431f0e56761868e499a8ae60184a698c6a739f9d47592917591118b05794e3d2d78839c4f2578d34709293e292ef

Download Submit
C:\Windows\SysWOW64\Ajnkmjqj.exe

Filesize
314KB

MD5
9d7408a097da7502d3608c7c8e70ca98

SHA1
88403dd5a3e6d28e9b0812900911ac79fb7d7864

SHA256
ce0b1f06cca3c917dfd2468803ba65e713291aa0fbcfcfe21897c22fedf8128a

SHA512
197924f021dc02c847852ebdfb7a179108cb50a0c87ec850154713945b66b30b64e144657f733db2ed2c4aeac15e4346f9b58c6d585d903a0b7c05de6321711d

Download Submit
C:\Windows\SysWOW64\Bmladm32.exe

Filesize
314KB

MD5
07a62dba7e67519e34f652bd8cede11f

SHA1
3e0fd7b14b741c18b62bed29b02f2fd5cc041e2f

SHA256
dbe240e4c0a1553bfb83385ef2c6c41923b1f0033cad89330446a5377be2a192

SHA512
9c2a64c15de5b7b16cb470a0e7c8c9385a29db7f086136f577b860a0a11c7407a4a17cd7ece91f389e82e82176fd88bc0791229c990bcc1537e629767c660366

Download Submit
C:\Windows\SysWOW64\Bpbpecen.exe

Filesize
314KB

MD5
32892072485f4df73849187aa4e02e47

SHA1
887f85122ec54c0ca8feae7c9c3b78c168833cbf

SHA256
872b52c361e8b67333111dcd1eea6c615cd2be3e2a59d9e11b0e7f8babfcb690

SHA512
d70bc594bd8b6543af2c359df7eebde3d89420d268e2a4f09bcdb7d682d5ebb52c40a16a08ce50063728044356f85fb4703e7c072618e073bd09e3b221a16cb6

Download Submit
C:\Windows\SysWOW64\Cbnbhfde.exe

Filesize
256KB

MD5
232062024ee66039cf50d94bf11da018

SHA1
d390246dc98e9f888f01018125116a4560540746

SHA256
895a06d45518def06b7d133dc6be7d1ff7bda646e2ca67975db15765b70aaead

SHA512
416075a210640a08f8c38285d4ec136e82c308321790ccd5c8f04d6f0fc8f80b80ea21e1f3852a29c7b204f22be717b1076a92e4182bea124e159020c8a5a8fe

Download Submit
C:\Windows\SysWOW64\Cdmoafdb.exe

Filesize
314KB

MD5
270615cf5bdd121af7eef09d14ab2d7c

SHA1
095dcf60149a77d8698098bf5e302ee14d1ab272

SHA256
7631b5d140aea1550f5030af3837d667e6069ea6ef03b8797dae8cb095bf4834

SHA512
b934230de9e769a352d76b30fce192d143e3b4e8d8ca12de7b43ec3898d33c910c2dd125f47edb1feef827c9c80f4bd2b0eef02daa24d2ed306c060c7c643eda

Download Submit
C:\Windows\SysWOW64\Ckphamkp.exe

Filesize
314KB

MD5
135c7dce86bde7dffa7b90b1ea218ddd

SHA1
81cc39424318477c142e09d100fea11f49c5ffcf

SHA256
eda0e86b0aaec7604a29e35a995d4452f5dbb4de263b5b5e4ab4dcb9d6913db1

SHA512
26dc544aa901843535d64af4f3e4d06cc44284a92205d88e8cd51a4af1857e88bf9c7ca5110a68f962c1e12f26bd003734ed07aa08b93982d34195c4257c4a98

Download Submit
C:\Windows\SysWOW64\Dcphdqmj.exe

Filesize
314KB

MD5
4c9b329762f9fbd97e0a77e2a216da79

SHA1
3af7eab03bf65e99c242545c4918a9551204ef7c

SHA256
1341605a9621e50a6590e088731dcbbf6ab7dd0aa516bf60b4dfece2f06947cf

SHA512
2e819551a29f1f81f2c6cb2027eaab942bbb9dc5cb6a3f366edfc8ffd06618fc34dc1bf47ae9834dc703607b44ca5f2f44707cc34e4c76d66c18aa5e6b2246ca

Download Submit
C:\Windows\SysWOW64\Ddcebe32.exe

Filesize
314KB

MD5
0c6f65b902e15f5ee320643be6d5a403

SHA1
5a78381e497e11553f248a1668e720cdf8acb563

SHA256
5750ee7c594902d91ffe7fbd200da54120b7b09662a4ffede0ef1decfce92da0

SHA512
e819d74a52286bde8e7ba73e7dcfdbfd38b374bb6cdbcd3da72b1d497ba98de43a7a5e923b763cf29eda76dbf89b9d9638f2f43f0b734532c886910d712d5747

Download Submit
C:\Windows\SysWOW64\Dfonnk32.exe

Filesize
314KB

MD5
ab8ad5718f61096da5de3e944dabc32c

SHA1
19d1d02af8d5f63f4e4e5d38ffffcfc0a4256933

SHA256
4fa08271abad4fb2e249a97aeeb26c907175f2e78f7e355ec963e5b6c337df44

SHA512
9eaec1919fee1ee767dc72a9e2f426a26577cdb61f65cfa5b11bc1ee210d29826cbe6d05e02b6948afb7209ec069b16b182c2fdda91956909f841750f045e137

Download Submit
C:\Windows\SysWOW64\Dpjompqc.exe

Filesize
314KB

MD5
f4d1453c99584c7464e2a9e7509d504d

SHA1
f86711f0c5c46d35314beb0f6ffdd27f7d4087af

SHA256
b12d2b4af8d663e5060377beac49b24e49f2fcdd4ecfee685ee127640aec7913

SHA512
f6a5a754f260458cced76aa8f37f1d9f467f8adc434a47fafd31fab94b8545f99494d2a7ffd5f2efd8ac9d84bd780c8ab192fc17617553e701a9a910a41b5b05

Download Submit
C:\Windows\SysWOW64\Edoencdm.exe

Filesize
314KB

MD5
4b03866d55ec1db4ce0f4b7e8e2cc3cf

SHA1
c03b5b75766bdf2b420b9ddffaf35fb750f7eb9c

SHA256
2ced80757cf8ea41d0faef7dbd0c79d66119bae745c3edeb837fbea45cdfab93

SHA512
e6cfff6b69ee9b4339e80ba454882df236421dc9b4d6ddc8e6a9db6360b7eba8a528f973bdc2da4664f29d1ba3120efbeb7f6bb6f091cf4bf6e168feea586bc3

Download Submit
C:\Windows\SysWOW64\Epaemojk.exe

Filesize
314KB

MD5
086c0fbab65bb2f2131fa4f3e425fa45

SHA1
507b876d620797fe567701b57aa35b78d3c4394f

SHA256
243d0ce9f53833d2dfdaac737c3ccecedccc67cb557cfe48bcbd8494de620a62

SHA512
87f8dfca6081bffd54de0de5b2fb7594e4f874d9912746a3b865d1083b9723b6eae7a33861d9e30fd8a83891c948182bfa100e06a13ef2e486b783e5ed74ee74

Download Submit
C:\Windows\SysWOW64\Eqmlccdi.exe

Filesize
314KB

MD5
7743e801662bd8bc34a34ea87e749551

SHA1
87c0625457599654d87257bfe55d5f5f17807aa6

SHA256
87ee329da694586facdb2f32ebd83a3efbb2ed1391deb7c6f10c618d36d56b5a

SHA512
e6c848f8fc3284639f86110ce465f4119ae8666175e46731862469e65f79fc6a1f77ac6216272a3f11e0c93ebd73d3c5ae071fdb1432a794df376f3315b3f815

Download Submit
C:\Windows\SysWOW64\Fagjolao.exe

Filesize
314KB

MD5
a36a364565bef7d69038460b947af2bd

SHA1
5bffd8df284584d07dc4e659f49ee575dd57f83b

SHA256
b3994649e24a73d640cc1646c3181951368145fa06dd7e754337d0f3e23e1383

SHA512
ade0a0a546adcd28bed1c0848ed18691ece7f1bbdb24151947d8a7c9d5e740b71c6db314783de5edf4e97e6591188835fe0c1593f2b7d6fc01739120226b09b2

Download Submit
C:\Windows\SysWOW64\Fkjfakng.exe

Filesize
314KB

MD5
785f159624f495348aa404f7d8175cdc

SHA1
ff746c9b9efc424dce4b8a5d5a1142f21eaa2557

SHA256
31551089ab55298a8a4b4a859dd56c65c9f703959d76bc191131492dfe65504b

SHA512
c3b74ff2e770f96c3cc97f58e836b38aa3d2093d1156219d2ed05f0698ff054e1c9071930bb54c682122e881c0bd4be0aa85049284e2fc33dfebc0e3164e083d

Download Submit
C:\Windows\SysWOW64\Fkopgn32.exe

Filesize
314KB

MD5
a2f3aae712ee40516b5d2630fba5e6d8

SHA1
3f1a6d1eda489f9fea71b9a2a097058099cefcdf

SHA256
81c18a73c771da152f2017dc8f36e22ca8d8132932700e6817662b20ab90a813

SHA512
fa4fd5608a9b7a3d42f165f70995c1461d4fac997d3f5c693c1bf58fcce69c21cf60ed0d8063e743399ec9621509dd9e618dfe46daeb32599551c3a7a6040b60

Download Submit
C:\Windows\SysWOW64\Gcnnllcg.exe

Filesize
314KB

MD5
64c69acbff7591aa89f19a38ca430f03

SHA1
eebbd83414e95741a8e5f9aa6e6f3ead901d6358

SHA256
55a82a3cff42e848473bf244bfcae428c4a2d93d6602989b62d44911e265ef54

SHA512
a4d6e6da6a3757a6b139f06e8aa2e95283c2033f2738eefc7a072539a59cf9b407f6cab579f1c0157b4531d7948e45841c6740fefaacc4853782d1654c876513

Download Submit
C:\Windows\SysWOW64\Gdnjfojj.exe

Filesize
314KB

MD5
6f916a32044ffbd4cecf44d98672d499

SHA1
2c770ab0c1b4ecd74317e174eac401056f052d45

SHA256
22a14018766b698dcfdf599595c4d37bd151ab82da988c8933a46afef3e219b1

SHA512
2e825ab9cc7f6634034ae55f71327567b0337535464f19b990d9c961001bd68a11f15fef84d4a7cef2034673a2aacea8565719cb3fe715046bcf99027c0258d3

Download Submit
C:\Windows\SysWOW64\Gndbie32.exe

Filesize
314KB

MD5
befbe57bc876decddeb3252e14b71717

SHA1
2406381d001df81a0e7bab43dc689f45977f1154

SHA256
6931a30bb67ef561e4a02d21552179be1703ec90c96d6e0afd7aeb33e19d1b66

SHA512
03f202cd0faaa1556f0f4367e0c6cf70835ef387f2d805e34ba38f209b41ce4db6f5fdeaf24ef07a9c83ee6ee17fb5196b5f8e657481cc810567be7e634df0e7

Download Submit
C:\Windows\SysWOW64\Hfacai32.exe

Filesize
314KB

MD5
822c0f2d369168b6496d84c345d0c1b1

SHA1
ad53fe03ff93f40b9c81ba7bce3ee9d6688573bd

SHA256
87fbc9a63102f7d7cb8037da657856ee0d36f2bb6f058342b6e1ba57113c8c6c

SHA512
5e14597df786396fe7befb3a0c67818f97fbd47bdc02b0b92e40bccbd849eb40360dec1815f1303eababacd8af9f9036bbf23295f328b232769bd5ed2e4aeb33

Download Submit
C:\Windows\SysWOW64\Hgeihiac.exe

Filesize
314KB

MD5
088951b775ac011078bf58c32eae7a5f

SHA1
74a9a85e73ca02bb70d22d393d55687dbc96faad

SHA256
d0f9d38fbe6fca1ea60f50c4e912210400acfc9c5f00c2b3bc55cfd16c859351

SHA512
ca5d00c11157b7cd172214240d79522ecf3ef3757a530df5777ec3c16eff62409b5a392d082eb38bd6ed0bf60995b835cb025254fb5e90d068aafc5559ff5ff6

Download Submit
C:\Windows\SysWOW64\Iajdgcab.exe

Filesize
314KB

MD5
c6d7e970658ee7fd66f997e82e118a13

SHA1
44ff276a41c5edcfe758339b8e22b80eae872e3a

SHA256
fcd8445a8dc02772e902afdf1efb10a385a0864dbd1a4254b6750f9becfbde30

SHA512
e2b2eef2db20bf7b1af2efc623b6b6954e53bfab9150fed3a17523d71319068077d76c58181d23d89d4dff54b2ff10b5ad37bc75bc68230e4def4c7319ca4c9f

Download Submit
C:\Windows\SysWOW64\Ielfgmnj.exe

Filesize
314KB

MD5
1d05043f640445640c02b4a233bd54ee

SHA1
5b2128625c306d55f5d0c6f1a7e6eb5a3a28f6fa

SHA256
c4ed07f65accadd4b53f5e2ab3435e44c2cad0f8f1f3a485884d01c40531e167

SHA512
68386325be6803c5ffe396392a91d0473a7c97ad93cc48d0db802ac36da37344218e255000fbbc78699455df6e509f28983b1463d83eb3ad87fe42702253b3b6

Download Submit
C:\Windows\SysWOW64\Iiffoc32.exe

Filesize
314KB

MD5
360fa6dc0f8f6599dae4a1d3ef5af627

SHA1
d4c3330bcd6e1c6caae745d9e89e6778efe5f23b

SHA256
fa351ec7c34034631e9eb89d81f6ae5ed38fce6a47f3a85f72cecf3eb92f60cc

SHA512
d5edc91d4e9cfda92715fc2c73b2dd58fded5d5120ac0134baff5116ebde1f869e6facc109a646839eaf16e5599b88b48065959eccddba0f016722d3762950e3

Download Submit
C:\Windows\SysWOW64\Jejbhk32.exe

Filesize
314KB

MD5
05702bdae9198246131d2b36505187b5

SHA1
76d6fb1f7e644a02aaf11c50badfa89a15173ed4

SHA256
f25b928f8ddaeb9ef05ae1c98f4e50700f5b739816d3a4ef928c482b9ce0b57f

SHA512
fb8de639d593fb775d3e57b5247dfade400dc79b7525c9b47d262ba9801ee844ce5889df0df6bd4f455e0ed5a3485427ef038d93d414ecf3d464ea823f3c78f5

Download Submit
C:\Windows\SysWOW64\Jjnaaa32.exe

Filesize
314KB

MD5
b49be958b28432a98a0e72ee9480e2e0

SHA1
463c4750a5abc4af6ad85f8f4679833b0b0cca61

SHA256
50f874a1fc1708c783cd4c165ea291b439f1b1319852fc2d101ebe532bc1d524

SHA512
8aaa2eb28088983f08bfc9d3d3c4fc5e5ec8e10b58e384253c7e3ec2f7ff44c83a8f876b95ecabac427aed711b129deec2dcfd40173ef592a54413cb202fc443

Download Submit
C:\Windows\SysWOW64\Jkgpleaf.exe

Filesize
314KB

MD5
b3727895bac0c22af91b9b98ac1ef454

SHA1
ea4b38c77c7a7b32dda2e622703ea3845cdc7b4e

SHA256
a8cfe5ef4cb518de817328907f2dce0f34fc1b1c1429dda34274132b6637166c

SHA512
a5388368771fc6e29f4cdaa281de82fd3017d003547813974e0d30bb6715fab78e817cb3246bd94fec405b5382c1a0f02e61fe0000802a575c305255e4b24eb9

Download Submit
C:\Windows\SysWOW64\Jndmlj32.exe

Filesize
314KB

MD5
d11ba4ed7fa2951ed89e76d76761e1a8

SHA1
9007d0e2cfb9202e9f71aacd9e706bd7436e8cce

SHA256
4daf0cbb78c91475e0ec6e9bf2b4ffe83fbb3ff8d77c6b092a79ae873545f1f0

SHA512
8e3dc271aca7db42af361284e472922833303af8c3484bd562a058a8d64e0c400656b57a9e87c6171f757d0f1182979de2888123200474f777377606160da742

Download Submit
C:\Windows\SysWOW64\Kaaldjil.exe

Filesize
314KB

MD5
bc7fb8a30ef36674638e8e1f90ca9c04

SHA1
70c38bd9ffe202356782c5d45c142922faf5b757

SHA256
39e508b5efc5a547ae0d65dfc7a9432e7debf5c0621312e2cb6f0182bc4fca50

SHA512
d9ea5200e3c6f1650561bc21c9a60eed5aefd07e41e9a5e2998ae02e6dde03764d064fd72076eb652b5e52b1d8583564db5ad7af38df56c2aa15244379128668

Download Submit
C:\Windows\SysWOW64\Keifdpif.exe

Filesize
314KB

MD5
9f0cb93ef1a4a75bd908d7a20866bb40

SHA1
04934a11e8be4853c4683040f9f10d8dd695d91e

SHA256
8240f868ef4a5162822dbbf444c4055e748f1886d6292b2a30caad0904a2779c

SHA512
842789b511089e116e92f7de89298d2b4b8ea34f4b1fe98042ab3cfee527ee310ea11a3b352d9b4631ea03e68053e38bc7faa3a64f1d1fb6fab9ad4fd1251410

Download Submit
C:\Windows\SysWOW64\Kfdklllb.exe

Filesize
314KB

MD5
d5ae46fc0672173d7d12b11c232f9fc4

SHA1
3e61e1833004eca67bc2adcee7d3628dadd00a92

SHA256
918fc3e0b79caf2ede02b0740c70ee00572a8dc42506d46ddb65097f08d5a5ec

SHA512
432ab309a2f046d6b0fa20259bf7865a72757521151d4716bbc5a6c07c56f9b44fac717e3537015f23dfbe58bb26c3097c688389e7bbf9cfce42d28c2dfdf44d

Download Submit
C:\Windows\SysWOW64\Kgcqlh32.exe

Filesize
314KB

MD5
f028446a1117672e83a2be54872b43ce

SHA1
df335f49ef1c4d761848e445e04f18ffaf4d690c

SHA256
f5323642b01883e05519a6f89c3523e0ea4a10f87b1786ce871f3e7b7ba26d3d

SHA512
77c6e89d2c1b157107b76386fc4adb835fd796a07f8ef71ab9279f167670d0062f56121e7d2a3bb434e46f2c5fc5fa7cb5da36ace2e38a32b52736f29b124b97

Download Submit
C:\Windows\SysWOW64\Khabke32.exe

Filesize
314KB

MD5
29e6ea67a6d6c2fb5f768ba7cdb25148

SHA1
ff558fea03d9d4a5959762c0ca57970ac1d6d413

SHA256
91feddae14a0e92c06bff2933b2e3f0067b6d5472de3a5a22ba009965ea065fd

SHA512
6f1043b2162300b5a2445ea2d6a3f07303e2983b327db4b830b582916ef58b86d902673d6cccb1c97eebe2241c24582708118c7fe5e6482160d9ac5d390508d1

Download Submit
C:\Windows\SysWOW64\Lpgmhg32.exe

Filesize
314KB

MD5
f86a886b50d841baebc1f75e59e97a02

SHA1
cab49dc0a314f2352d184034e92e1a7144f020e5

SHA256
3ab3a44c2dd116d48ebbe303b6e227d3453d48e024e8a84bfa85d8f7f7b43064

SHA512
6c78ed190d40268fc7719ba71937d0543aaa3d81b473588403ec58891803746957169fa26fe9c0a0ab08f11882976d65371d269d24e3e00f583f8958e639f563

Download Submit
C:\Windows\SysWOW64\Mcaipa32.exe

Filesize
314KB

MD5
fb824454d54d836613cd6e917d080d11

SHA1
99bdbc120a56986da6cae5fd4529c1bccf2e0e47

SHA256
6d9ae6d026cdfde8a03130ad554edbac5fdbc49446876189c79bc0f9dc3e6dc3

SHA512
837e668425312d7c0fccae27b54630dcb12577dd3fb5e7d0ad3ec74c0164e6c5a2f25bab2fa015ba46437f42009ebf2dd44b14c7eb44a67dc81b75df60c45dff

Download Submit
C:\Windows\SysWOW64\Mejnlpai.exe

Filesize
314KB

MD5
06d8eb8e088ccddcded7bc991fa4d0a4

SHA1
7d76fca8b430b28d0a90c61615247c1074d33785

SHA256
42fc93152037c2db35294e08b95b412a02ed83c0f5e586119da77f8e759c215f

SHA512
f27ea7e19f8bd5fb12e4dd66b2d8cadefb4557971d292a7a031b37706c8c9ef7017e3e528fdfbd19a441e521ce6cf3c7f5f077a498e3624a8009b9df121ce8cb

Download Submit
C:\Windows\SysWOW64\Mflidl32.exe

Filesize
314KB

MD5
8b62cc2ee3bbf767b291441df7deaea2

SHA1
3228efe24baffbf572afec78de05ba088dbaef29

SHA256
76f997c78aff0940ee2ccfcd23beb5bf994c653683eaf1b3d85579a95baa3873

SHA512
5ac7388f5b1f2626a4223bb9ea152a1422544a35cd5b40d4dbd0fbfed9585d1f10fb8e2a3f80938700563f16f8b6cff87798cfbf40acce0e9401ccb38fff8ef6

Download Submit
C:\Windows\SysWOW64\Mlhidg32.exe

Filesize
314KB

MD5
7a0cd40e646bfafdee1fd6b063d1adef

SHA1
3ae9350ead240617d2a814d73978c773da8dc5ff

SHA256
55ab56b95550dd244f602a5c855704e3ca8606ba4d38e33567fa24b6590617f7

SHA512
28644000f4acc15ab73182c456548438027b1a4eac1080a2031328a524436c520418aecc68a0e4108cf2dba2b5be00b610d86581f281dcb4ce2bb93b3b7f4299

Download Submit
C:\Windows\SysWOW64\Mpeiie32.exe

Filesize
314KB

MD5
18cd38f53c7686c17abe12199f989fdf

SHA1
510469cfc63b0ef49815b1337f723af20ed8e642

SHA256
a9e42001c006b9a383d1992a21d752122e07082373ff382eee34e3e6a3f86d91

SHA512
53878114fb1ee85faf8eedc11a791de8fa858ec6e95547a7e3fd6b9c249f1795d7b3619130bf9ca0d2dfaa779b387c48641c451c6a5dfbe95cb47f31fd497e03

Download Submit
C:\Windows\SysWOW64\Ndkjik32.exe

Filesize
314KB

MD5
6e7c91513ad3dcf936caad7f9a3e81c4

SHA1
15754b36cdbc2a6b977329e662106e409f28bec4

SHA256
234a0e1ee319154cb6105ddcba4c9ae39e5420cfa98b7dbc8eeb08a07d3e83d8

SHA512
e2018c9ef3537e9d480964797a7aac896cdf998f531f99e507687f35ab272d18d299c481022701ae51e51e9cd91ad502f49937ef5fbe3b68412a3348cb67ce4c

Download Submit
C:\Windows\SysWOW64\Ngipjp32.exe

Filesize
314KB

MD5
50a660c734a4573e0e7d36aefb5a2ffc

SHA1
1d7230fe8c6f5de1d02097e0366f796748a88c12

SHA256
e774e1a4d35cd52b584b332352c6b8d458e5e23a7a189c671f837ef5e274dd2c

SHA512
b2d22876eb6a723896e39b7fa44d95f5d0ffde65d8e7a3130bdef9b54c2f5fcb3c1297d2fa37139fec7b4a69d0823b65790a5ee043d451d51c93a2b83f7e83c5

Download Submit
C:\Windows\SysWOW64\Nmcpoedn.exe

Filesize
314KB

MD5
24f9a8ac6865f31cbf939f6e16d009b6

SHA1
0ee984caedebeff96254e43e616ba3265a82e3e8

SHA256
c8601faf1adff1e8834ea72e641fc170d6f4521dc149025290bd1f8adcf6b9ca

SHA512
e8aa75ebcd2520fb6d16373e36f2d7f0f722376fcfd39ba3135c2f7f601ab56fb7bc7fba23726b7f38769b3243b995d568ba39a9a50bad23083c13627f4e05d1

Download Submit
C:\Windows\SysWOW64\Nmjfodne.exe

Filesize
256KB

MD5
b1f25328397402d7e8089976501cc0bf

SHA1
a730b94e1a5c58abb342e90887144b9d977d957e

SHA256
f28aab82ff4cc35ecefad650aefc84875889496d547969a94679fbb5539ada0d

SHA512
e0d78ebc481b529456d569e22b403bdf356e149acee2ae9556add65b64f9b4ec16b0ef7bdc7aa0ca587c8ec7526165faa606289184bd5cc96b053837f751d3c7

Download Submit
C:\Windows\SysWOW64\Nmjfodne.exe

Filesize
314KB

MD5
56d1ea37cce8c1838143715d6d4cd04b

SHA1
64608b9495fa2a90f5811394bf01e90773e207ce

SHA256
9869fc706689362a2221e85bd4b06c7faae22d50b66e8bea5fa1299a8eafd99e

SHA512
48a6b31f42658ac48dabb04b98296e14d4044950bf47f2cb72da5cded2070e231d75f1c5632f8069c27b1d5657cc2b359f16c84dd977ca663bbdaefd9894c4ff

Download Submit
C:\Windows\SysWOW64\Ofdqcc32.exe

Filesize
314KB

MD5
23a5b12d7b61d95bc735e277fc32cf33

SHA1
1cb375653ef092409a6c28aaa23e33b310ff661f

SHA256
0ea20526ddcef2e02544931e9423a00be2e3ea68c731d48d88fa35e19be090b0

SHA512
23144aef37d1cd770896d054a37b798d22edb6bc9e5e89fff6366872e0927471f85b834ddfcfdfbcd94f4196e5ca8eb5d5633e376e99c3bfef77a9515f8bfc0e

Download Submit
C:\Windows\SysWOW64\Pbgqdb32.exe

Filesize
314KB

MD5
805ec655e81f80786e0493e7a67d300c

SHA1
5bcafb955f6437474ef1a95953d60def681db4ad

SHA256
a3cef74e0303c7413d57c5f1f1e257eb5452e4cc9ac2b51625a9a8fceab052fa

SHA512
b3badc71acfdab34bde1b5faaca5a72dab3b070ebec31f0c1eadfa1ece37e17668dca84388d49af7ab576c721667e7abf500cf58f8a72e2656c39a0b9f9aef02

Download Submit
C:\Windows\SysWOW64\Pplhhm32.exe

Filesize
314KB

MD5
ebf8a371decedc3ca7ad24801dbf0479

SHA1
20658173702ddbe773db24715da879223aa34772

SHA256
3b72e455b75ede21f989da06c56a2209024048f7865912538a906c68d98a9841

SHA512
511b4986992ae4c57eee351bea782178b78eff405b11034df79bca3a8d99b0cc9a7bd4962710883247ad1344565bac826ca491b07a82c8fdea74d86f88c011fd

Download Submit
C:\Windows\SysWOW64\Qidljhia.exe

Filesize
314KB

MD5
1b7b9042536ccd4df5a51a69ed94c506

SHA1
8295163468f4cc7e64a9fa15bcdc44551f3cc026

SHA256
6dec5bbee6e4d36d87cfc20af7ad65fae32bf3ba374778b04e4d2a6a614ff831

SHA512
f8e5551f1e119144ce48087ef13e2bceb8a7d02605d5a974d57817460be78bd887766ebc8b82271faf6683335efe10f77e0a8c95840a0a5fb158684919ae448d

Download Submit
C:\Windows\SysWOW64\Qppkhfec.exe

Filesize
314KB

MD5
147d96ba0ed302dc654e60a701f13cdf

SHA1
e1ac585160e615f5dc03ac0f946fba26c6147057

SHA256
f0174627fe748390ee1b8b7f68eaf195c717204236d54e31a53ab5608349b8e8

SHA512
33449c8551cf7bb72f2097a0da5d3a60b76f56b822922875233d6d1818fa379316a634c3ae01f67d70cebe8361607806649d2d621d7c4e01b4ffac1aa97c517d

Download Submit
memory/216-40-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/220-360-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/404-330-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/436-390-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/760-72-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/768-25-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/772-366-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1064-48-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1116-89-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1244-217-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1280-348-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1356-249-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1656-122-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1692-276-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1716-241-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1756-32-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1836-324-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1848-294-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1884-170-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1888-318-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1984-82-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2044-432-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2152-105-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2236-162-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2272-64-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2452-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2452-81-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2452-1-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2496-153-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2856-396-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2872-194-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2884-214-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2952-288-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3108-264-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3120-113-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3156-420-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3336-342-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3356-137-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3368-190-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3376-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3400-426-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3556-300-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3560-129-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3584-336-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3840-202-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4024-315-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4060-56-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4180-177-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4224-408-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4300-306-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4312-414-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4328-226-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4416-150-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4460-270-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4668-257-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4732-98-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4736-239-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4804-9-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4808-282-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4812-372-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4820-378-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4844-406-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4908-354-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4932-384-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads