02ff9f02ef10b2a4e2f36414bf1a804cb257078366c854103ea54d322ba9c397

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 17:11 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02ff9f02ef10b2a4e2f36414bf1a804cb257078366c854103ea54d322ba9c397.exe
Size

227KB
MD5

dfaa5b6067a2b0393eba4972bb341009
SHA1

93a551ae898fbe9f8deba501137af48898caf5a8
SHA256

02ff9f02ef10b2a4e2f36414bf1a804cb257078366c854103ea54d322ba9c397
SHA512

a250bf18772bc51b70d8912a6cf643474e73d654eb7238be309a9ca68aa87372373395a014d73666c97da77cb485c1a1b7a914f07c7f6ba72acb11e62565a71b
SSDEEP

3072:EI+4VYSPjG9xT80nPhcEaeyqpwoTRBmDRGGurhUXvBj2QE2HegPelTeIdI7jFHu:EInV3K9xYILYm7U5j2QE2+g24Id2jFHu

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngndaccj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdnjgmle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qgnbaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Giqkkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iefgbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kfnfjehl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aopemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bkoigdom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kkgiimng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bgbdcgld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfendmoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bbnkonbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omgcpokp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fligqhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjmjdm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fddqghpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jeqbpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ahchda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgaokl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlnjbedi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnangaoa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehljfnpn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlkipgpe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jngbjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Apmhiq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbdbjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lqojclne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	02ff9f02ef10b2a4e2f36414bf1a804cb257078366c854103ea54d322ba9c397.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bggnof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hgiepjga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmofagfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ccgjopal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amqhbe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbgmcnhf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfningai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ibicnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmniml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmcdffmq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojnblg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Afkknogn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fimhjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gpkchqdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iefgbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mfchlbfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aggegh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Giqkkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Icknfcol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iikmbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppgegd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eoaihhlp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehimanbq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lckiihok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eocenh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhihdcbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhnbpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Innfnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Poaqemao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jjgchm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lenicahg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iipfmggc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bhkfkmmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ikokan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jkmgblok.exe

Executes dropped EXE 64 IoCs

pid	Process
1700	Eoaihhlp.exe
2880	Ehimanbq.exe
1612	Eocenh32.exe
904	Eabbjc32.exe
2448	Ehljfnpn.exe
1856	Ekjfcipa.exe
4000	Eadopc32.exe
832	Fljcmlfd.exe
4320	Febgea32.exe
4812	Ffddka32.exe
2468	Flnlhk32.exe
3284	Ffgqqaip.exe
4228	Fooeif32.exe
4636	Fdnjgmle.exe
4720	Gcojed32.exe
1120	Glhonj32.exe
2036	Gbdgfa32.exe
2732	Gmlhii32.exe
2404	Gcfqfc32.exe
2136	Gblngpbd.exe
3132	Hiefcj32.exe
2456	Hmcojh32.exe
3464	Hbpgbo32.exe
4708	Hbbdholl.exe
2740	Himldi32.exe
3076	Hkkhqd32.exe
2340	Hfqlnm32.exe
4852	Hmjdjgjo.exe
2216	Hbgmcnhf.exe
3764	Ikpaldog.exe
3368	Iicbehnq.exe
3892	Iblfnn32.exe
4800	Iejcji32.exe
3324	Ickchq32.exe
2832	Imfdff32.exe
2864	Lgmngglp.exe
3640	Mcmabg32.exe
4996	Ncbknfed.exe
752	Njqmepik.exe
4772	Npjebj32.exe
3124	Nfgmjqop.exe
3488	Nfjjppmm.exe
2376	Oponmilc.exe
4820	Oflgep32.exe
5020	Opakbi32.exe
1712	Ofnckp32.exe
552	Ocbddc32.exe
1884	Ocdqjceo.exe
320	Olmeci32.exe
4272	Ocgmpccl.exe
1256	Ojaelm32.exe
5048	Pcijeb32.exe
1872	Pnonbk32.exe
2460	Pdifoehl.exe
1284	Pmfhig32.exe
4556	Pjjhbl32.exe
3156	Pqdqof32.exe
3524	Qddfkd32.exe
1716	Ajanck32.exe
2380	Aqkgpedc.exe
2252	Ageolo32.exe
3916	Anogiicl.exe
492	Aclpap32.exe
3636	Amddjegd.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kibohd32.dll	Oghghb32.exe
File created	C:\Windows\SysWOW64\Ppahmb32.exe	Pmblagmf.exe
File created	C:\Windows\SysWOW64\Qacameaj.exe	Qjiipk32.exe
File created	C:\Windows\SysWOW64\Dgnkfj32.dll	Higjaoci.exe
File opened for modification	C:\Windows\SysWOW64\Inqbclob.exe	Ikbfgppo.exe
File created	C:\Windows\SysWOW64\Flafeh32.dll	Jpaleglc.exe
File created	C:\Windows\SysWOW64\Hoeieolb.exe	Hlglidlo.exe
File created	C:\Windows\SysWOW64\Dikihe32.exe	Dbndfl32.exe
File opened for modification	C:\Windows\SysWOW64\Iibccgep.exe	Iefgbh32.exe
File created	C:\Windows\SysWOW64\Mlmgnn32.dll	Bfbaonae.exe
File created	C:\Windows\SysWOW64\Njjdho32.exe	Nqbpojnp.exe
File created	C:\Windows\SysWOW64\Fipbdikp.exe	Fphnlcdo.exe
File created	C:\Windows\SysWOW64\Ebjkfjbc.dll	Onpjichj.exe
File created	C:\Windows\SysWOW64\Npgmpf32.exe	Nnfpinmi.exe
File opened for modification	C:\Windows\SysWOW64\Hbpgbo32.exe	Hmcojh32.exe
File opened for modification	C:\Windows\SysWOW64\Ollnhb32.exe	Ojnblg32.exe
File opened for modification	C:\Windows\SysWOW64\Higjaoci.exe	Hginecde.exe
File created	C:\Windows\SysWOW64\Hgfnoiid.dll	Jddnfd32.exe
File created	C:\Windows\SysWOW64\Phdpmbnc.dll	Kdigadjo.exe
File created	C:\Windows\SysWOW64\Bdabnm32.dll	Oeheqm32.exe
File opened for modification	C:\Windows\SysWOW64\Ljhnlb32.exe	Lgibpf32.exe
File opened for modification	C:\Windows\SysWOW64\Paeelgnj.exe	Pjkmomfn.exe
File created	C:\Windows\SysWOW64\Ekjfcipa.exe	Ehljfnpn.exe
File created	C:\Windows\SysWOW64\Oadacmff.dll	Oflgep32.exe
File created	C:\Windows\SysWOW64\Oghppm32.exe	Ngomin32.exe
File created	C:\Windows\SysWOW64\Igegpo32.dll	Aanbhp32.exe
File opened for modification	C:\Windows\SysWOW64\Pjjhbl32.exe	Pmfhig32.exe
File created	C:\Windows\SysWOW64\Qgnbaj32.exe	Pqcjepfo.exe
File created	C:\Windows\SysWOW64\Kjffdalb.exe	Kdinljnk.exe
File opened for modification	C:\Windows\SysWOW64\Bpkdjofm.exe	Bknlbhhe.exe
File created	C:\Windows\SysWOW64\Ldklgegb.dll	Fbelcblk.exe
File created	C:\Windows\SysWOW64\Ocgbld32.exe	Oaifpi32.exe
File created	C:\Windows\SysWOW64\Gbdgfa32.exe	Glhonj32.exe
File created	C:\Windows\SysWOW64\Kkbljp32.dll	Pnonbk32.exe
File opened for modification	C:\Windows\SysWOW64\Jbiejoaj.exe	Jjamia32.exe
File created	C:\Windows\SysWOW64\Bfgjjm32.exe	Bcinna32.exe
File created	C:\Windows\SysWOW64\Iqipio32.exe	Injcmc32.exe
File created	C:\Windows\SysWOW64\Lgdidgjg.exe	Lomqcjie.exe
File created	C:\Windows\SysWOW64\Jdodkebj.exe	Jlhljhbg.exe
File opened for modification	C:\Windows\SysWOW64\Dmohno32.exe	Dkokcl32.exe
File opened for modification	C:\Windows\SysWOW64\Iipfmggc.exe	Igajal32.exe
File opened for modification	C:\Windows\SysWOW64\Jgmjmjnb.exe	Jpcapp32.exe
File opened for modification	C:\Windows\SysWOW64\Njqmepik.exe	Ncbknfed.exe
File opened for modification	C:\Windows\SysWOW64\Pjmjdm32.exe	Phonha32.exe
File opened for modification	C:\Windows\SysWOW64\Gcojed32.exe	Fdnjgmle.exe
File created	C:\Windows\SysWOW64\Ejlgio32.dll	Lcggio32.exe
File created	C:\Windows\SysWOW64\Facdchai.dll	Hglaej32.exe
File opened for modification	C:\Windows\SysWOW64\Kjffdalb.exe	Kdinljnk.exe
File created	C:\Windows\SysWOW64\Ipgbdbqb.exe	Iikmbh32.exe
File created	C:\Windows\SysWOW64\Bhpofl32.exe	Bphgeo32.exe
File created	C:\Windows\SysWOW64\Ccchof32.exe	Cpglnhad.exe
File created	C:\Windows\SysWOW64\Chkobkod.exe	Cocjiehd.exe
File opened for modification	C:\Windows\SysWOW64\Omgmeigd.exe	Ofmdio32.exe
File created	C:\Windows\SysWOW64\Mkjbip32.dll	Idieem32.exe
File opened for modification	C:\Windows\SysWOW64\Mcpcdg32.exe	Mqafhl32.exe
File created	C:\Windows\SysWOW64\Mchqfb32.dll	Lgmngglp.exe
File opened for modification	C:\Windows\SysWOW64\Hhnbpb32.exe	Hfpecg32.exe
File created	C:\Windows\SysWOW64\Dokmlmhl.dll	Hpofii32.exe
File opened for modification	C:\Windows\SysWOW64\Jlolpq32.exe	Jphkkpbp.exe
File created	C:\Windows\SysWOW64\Jkmmde32.dll	Bknlbhhe.exe
File opened for modification	C:\Windows\SysWOW64\Bifmqo32.exe	Bgeaifia.exe
File created	C:\Windows\SysWOW64\Hpomcp32.exe	Hnaqgd32.exe
File created	C:\Windows\SysWOW64\Gfibje32.dll	Flqdlnde.exe
File created	C:\Windows\SysWOW64\Cbdjeg32.exe	Clgbmp32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10500	6320	WerFault.exe	677

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlklhm32.dll"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fpmggb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Acmobchj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kmdlffhj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgflfoob.dll"	Gpkchqdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgnnnnod.dll"	Jglklggl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdbeojmh.dll"	Mfchlbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lehagi32.dll"	Fpjjac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjjcdn32.dll"	Fpodlbng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ghhhcomg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fligqhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldamee32.dll"	Ocgmpccl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mjcngpjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aknbkjfh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cdmfllhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Amaqjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jbiejoaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gejlkojm.dll"	Blhpqhlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebcneqod.dll"	Enbjad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mqimikfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Coegoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnpofk32.dll"	Dhphmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ickchq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfpbkoql.dll"	Olmeci32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Phhhhc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jgogbgei.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Djcoai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Knooej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cinbbnpa.dll"	Jdnoplhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fbjmhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fligqhga.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aagkhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Amqhbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nekiiopm.dll"	Cpglnhad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inogde32.dll"	Cceddf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oaifpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gmlhii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Haafcb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dpphjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcdcmh32.dll"	Glcaambb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gbmingjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hmbfbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhbebj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hofmfmhj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Phincl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jdfjld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Clgbmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kaafjamj.dll"	Emhldnkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejljgqdp.dll"	Jdfjld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhhqlkph.dll"	Jgeghp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jgmjmjnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aoioli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Apodoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dckhejil.dll"	Ihphkl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bhamkipi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghoqak32.dll"	Omgcpokp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keiifian.dll"	Qfkqjmdg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qlmgopjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gigmlgok.dll"	Ikndgg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fpkibf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jghpbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjjkaabc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ekjfcipa.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 1700	5032	02ff9f02ef10b2a4e2f36414bf1a804cb257078366c854103ea54d322ba9c397.exe	87
PID 5032 wrote to memory of 1700	5032	02ff9f02ef10b2a4e2f36414bf1a804cb257078366c854103ea54d322ba9c397.exe	87
PID 5032 wrote to memory of 1700	5032	02ff9f02ef10b2a4e2f36414bf1a804cb257078366c854103ea54d322ba9c397.exe	87
PID 1700 wrote to memory of 2880	1700	Eoaihhlp.exe	88
PID 1700 wrote to memory of 2880	1700	Eoaihhlp.exe	88
PID 1700 wrote to memory of 2880	1700	Eoaihhlp.exe	88
PID 2880 wrote to memory of 1612	2880	Ehimanbq.exe	89
PID 2880 wrote to memory of 1612	2880	Ehimanbq.exe	89
PID 2880 wrote to memory of 1612	2880	Ehimanbq.exe	89
PID 1612 wrote to memory of 904	1612	Eocenh32.exe	90
PID 1612 wrote to memory of 904	1612	Eocenh32.exe	90
PID 1612 wrote to memory of 904	1612	Eocenh32.exe	90
PID 904 wrote to memory of 2448	904	Eabbjc32.exe	91
PID 904 wrote to memory of 2448	904	Eabbjc32.exe	91
PID 904 wrote to memory of 2448	904	Eabbjc32.exe	91
PID 2448 wrote to memory of 1856	2448	Ehljfnpn.exe	92
PID 2448 wrote to memory of 1856	2448	Ehljfnpn.exe	92
PID 2448 wrote to memory of 1856	2448	Ehljfnpn.exe	92
PID 1856 wrote to memory of 4000	1856	Ekjfcipa.exe	93
PID 1856 wrote to memory of 4000	1856	Ekjfcipa.exe	93
PID 1856 wrote to memory of 4000	1856	Ekjfcipa.exe	93
PID 4000 wrote to memory of 832	4000	Eadopc32.exe	94
PID 4000 wrote to memory of 832	4000	Eadopc32.exe	94
PID 4000 wrote to memory of 832	4000	Eadopc32.exe	94
PID 832 wrote to memory of 4320	832	Fljcmlfd.exe	95
PID 832 wrote to memory of 4320	832	Fljcmlfd.exe	95
PID 832 wrote to memory of 4320	832	Fljcmlfd.exe	95
PID 4320 wrote to memory of 4812	4320	Febgea32.exe	96
PID 4320 wrote to memory of 4812	4320	Febgea32.exe	96
PID 4320 wrote to memory of 4812	4320	Febgea32.exe	96
PID 4812 wrote to memory of 2468	4812	Ffddka32.exe	97
PID 4812 wrote to memory of 2468	4812	Ffddka32.exe	97
PID 4812 wrote to memory of 2468	4812	Ffddka32.exe	97
PID 2468 wrote to memory of 3284	2468	Flnlhk32.exe	98
PID 2468 wrote to memory of 3284	2468	Flnlhk32.exe	98
PID 2468 wrote to memory of 3284	2468	Flnlhk32.exe	98
PID 3284 wrote to memory of 4228	3284	Ffgqqaip.exe	99
PID 3284 wrote to memory of 4228	3284	Ffgqqaip.exe	99
PID 3284 wrote to memory of 4228	3284	Ffgqqaip.exe	99
PID 4228 wrote to memory of 4636	4228	Fooeif32.exe	100
PID 4228 wrote to memory of 4636	4228	Fooeif32.exe	100
PID 4228 wrote to memory of 4636	4228	Fooeif32.exe	100
PID 4636 wrote to memory of 4720	4636	Fdnjgmle.exe	101
PID 4636 wrote to memory of 4720	4636	Fdnjgmle.exe	101
PID 4636 wrote to memory of 4720	4636	Fdnjgmle.exe	101
PID 4720 wrote to memory of 1120	4720	Gcojed32.exe	102
PID 4720 wrote to memory of 1120	4720	Gcojed32.exe	102
PID 4720 wrote to memory of 1120	4720	Gcojed32.exe	102
PID 1120 wrote to memory of 2036	1120	Glhonj32.exe	103
PID 1120 wrote to memory of 2036	1120	Glhonj32.exe	103
PID 1120 wrote to memory of 2036	1120	Glhonj32.exe	103
PID 2036 wrote to memory of 2732	2036	Gbdgfa32.exe	105
PID 2036 wrote to memory of 2732	2036	Gbdgfa32.exe	105
PID 2036 wrote to memory of 2732	2036	Gbdgfa32.exe	105
PID 2732 wrote to memory of 2404	2732	Gmlhii32.exe	106
PID 2732 wrote to memory of 2404	2732	Gmlhii32.exe	106
PID 2732 wrote to memory of 2404	2732	Gmlhii32.exe	106
PID 2404 wrote to memory of 2136	2404	Gcfqfc32.exe	107
PID 2404 wrote to memory of 2136	2404	Gcfqfc32.exe	107
PID 2404 wrote to memory of 2136	2404	Gcfqfc32.exe	107
PID 2136 wrote to memory of 3132	2136	Gblngpbd.exe	108
PID 2136 wrote to memory of 3132	2136	Gblngpbd.exe	108
PID 2136 wrote to memory of 3132	2136	Gblngpbd.exe	108
PID 3132 wrote to memory of 2456	3132	Hiefcj32.exe	109

C:\Users\Admin\AppData\Local\Temp\02ff9f02ef10b2a4e2f36414bf1a804cb257078366c854103ea54d322ba9c397.exe
"C:\Users\Admin\AppData\Local\Temp\02ff9f02ef10b2a4e2f36414bf1a804cb257078366c854103ea54d322ba9c397.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\Eoaihhlp.exe
  C:\Windows\system32\Eoaihhlp.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\Ehimanbq.exe
    C:\Windows\system32\Ehimanbq.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Windows\SysWOW64\Eocenh32.exe
      C:\Windows\system32\Eocenh32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1612
    - - C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:904
      - C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2448
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:832
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1120
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2456
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        24⤵
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        25⤵
        Executes dropped EXE
        
        PID:4708
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        26⤵
        Executes dropped EXE
        
        PID:2740
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        27⤵
        Executes dropped EXE
        
        PID:3076
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        28⤵
        Executes dropped EXE
        
        PID:2340
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        29⤵
        Executes dropped EXE
        
        PID:4852
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2216
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        31⤵
        Executes dropped EXE
        
        PID:3764
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        32⤵
        Executes dropped EXE
        
        PID:3368
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        33⤵
        Executes dropped EXE
        
        PID:3892
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        34⤵
        Executes dropped EXE
        
        PID:4800
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3324
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        36⤵
        Executes dropped EXE
        
        PID:2832
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2864
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        38⤵
        Executes dropped EXE
        
        PID:3640
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4996
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        40⤵
        Executes dropped EXE
        
        PID:752
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        41⤵
        Executes dropped EXE
        
        PID:4772
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        42⤵
        Executes dropped EXE
        
        PID:3124
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        43⤵
        Executes dropped EXE
        
        PID:3488
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        44⤵
        Executes dropped EXE
        
        PID:2376
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4820
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        46⤵
        Executes dropped EXE
        
        PID:5020
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        47⤵
        Executes dropped EXE
        
        PID:1712
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        48⤵
        Executes dropped EXE
        
        PID:552
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        49⤵
        Executes dropped EXE
        
        PID:1884
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:320
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4272
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        52⤵
        Executes dropped EXE
        
        PID:1256
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        53⤵
        Executes dropped EXE
        
        PID:5048
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1872
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        55⤵
        Executes dropped EXE
        
        PID:2460
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1284
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4556
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        58⤵
        Executes dropped EXE
        
        PID:3156
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        59⤵
        Executes dropped EXE
        
        PID:3524
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        60⤵
        Executes dropped EXE
        
        PID:1716
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2380
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        62⤵
        Executes dropped EXE
        
        PID:2252
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        63⤵
        Executes dropped EXE
        
        PID:3916
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        64⤵
        Executes dropped EXE
        
        PID:492
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3636
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        66⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        67⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        68⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\Emhldnkj.exe
        
        C:\Windows\system32\Emhldnkj.exe
        69⤵
        Modifies registry class
        
        PID:2576
        
        C:\Windows\SysWOW64\Fhmpagkp.exe
        
        C:\Windows\system32\Fhmpagkp.exe
        70⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\Fnjhjn32.exe
        
        C:\Windows\system32\Fnjhjn32.exe
        71⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Fddqghpd.exe
        
        C:\Windows\system32\Fddqghpd.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4716
        
        C:\Windows\SysWOW64\Fgbmccpg.exe
        
        C:\Windows\system32\Fgbmccpg.exe
        73⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\Gnkaalkd.exe
        
        C:\Windows\system32\Gnkaalkd.exe
        74⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\Gddinf32.exe
        
        C:\Windows\system32\Gddinf32.exe
        75⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Gkobjpin.exe
        
        C:\Windows\system32\Gkobjpin.exe
        76⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Gnmnfkia.exe
        
        C:\Windows\system32\Gnmnfkia.exe
        77⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\Goljqnpd.exe
        
        C:\Windows\system32\Goljqnpd.exe
        78⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\Hdicienl.exe
        
        C:\Windows\system32\Hdicienl.exe
        79⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\Hghoeqmp.exe
        
        C:\Windows\system32\Hghoeqmp.exe
        80⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\Hkckeo32.exe
        
        C:\Windows\system32\Hkckeo32.exe
        81⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\Hbmcbime.exe
        
        C:\Windows\system32\Hbmcbime.exe
        82⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Hhgloc32.exe
        
        C:\Windows\system32\Hhgloc32.exe
        83⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5224
        
        C:\Windows\SysWOW64\Hfningai.exe
        
        C:\Windows\system32\Hfningai.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5264
        
        C:\Windows\SysWOW64\Hhlejcpm.exe
        
        C:\Windows\system32\Hhlejcpm.exe
        86⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        87⤵
        Modifies registry class
        
        PID:5348
        
        C:\Windows\SysWOW64\Hfpecg32.exe
        
        C:\Windows\system32\Hfpecg32.exe
        88⤵
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Hhnbpb32.exe
        
        C:\Windows\system32\Hhnbpb32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5436
        
        C:\Windows\SysWOW64\Ibffhhek.exe
        
        C:\Windows\system32\Ibffhhek.exe
        90⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Igcoqocb.exe
        
        C:\Windows\system32\Igcoqocb.exe
        91⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Ikokan32.exe
        
        C:\Windows\system32\Ikokan32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5560
        
        C:\Windows\SysWOW64\Ibicnh32.exe
        
        C:\Windows\system32\Ibicnh32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5604
        
        C:\Windows\SysWOW64\Idgojc32.exe
        
        C:\Windows\system32\Idgojc32.exe
        94⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Inpccihl.exe
        
        C:\Windows\system32\Inpccihl.exe
        95⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Ikcdlmgf.exe
        
        C:\Windows\system32\Ikcdlmgf.exe
        96⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Ifihif32.exe
        
        C:\Windows\system32\Ifihif32.exe
        97⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Ikfabm32.exe
        
        C:\Windows\system32\Ikfabm32.exe
        98⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Ifleoe32.exe
        
        C:\Windows\system32\Ifleoe32.exe
        99⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Igmagnkg.exe
        
        C:\Windows\system32\Igmagnkg.exe
        100⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Jbbfdfkn.exe
        
        C:\Windows\system32\Jbbfdfkn.exe
        101⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5988
        
        C:\Windows\SysWOW64\Jgonlm32.exe
        
        C:\Windows\system32\Jgonlm32.exe
        103⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Jbdbjf32.exe
        
        C:\Windows\system32\Jbdbjf32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6076
        
        C:\Windows\SysWOW64\Jkmgblok.exe
        
        C:\Windows\system32\Jkmgblok.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6120
        
        C:\Windows\SysWOW64\Jbgoof32.exe
        
        C:\Windows\system32\Jbgoof32.exe
        106⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Jgdhgmep.exe
        
        C:\Windows\system32\Jgdhgmep.exe
        107⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Jnnpdg32.exe
        
        C:\Windows\system32\Jnnpdg32.exe
        108⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Jehhaaci.exe
        
        C:\Windows\system32\Jehhaaci.exe
        109⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        110⤵
        Drops file in System32 directory
        
        PID:5432
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        111⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        112⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        113⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Ogmijllo.exe
        
        C:\Windows\system32\Ogmijllo.exe
        114⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Oljaccjf.exe
        
        C:\Windows\system32\Oljaccjf.exe
        115⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        116⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Ojnblg32.exe
        
        C:\Windows\system32\Ojnblg32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Ollnhb32.exe
        
        C:\Windows\system32\Ollnhb32.exe
        118⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        119⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Phcomcng.exe
        
        C:\Windows\system32\Phcomcng.exe
        120⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Pgflqkdd.exe
        
        C:\Windows\system32\Pgflqkdd.exe
        121⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Phhhhc32.exe
        
        C:\Windows\system32\Phhhhc32.exe
        122⤵
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1772
        
        C:\Windows\SysWOW64\Pgihfj32.exe
        
        C:\Windows\system32\Pgihfj32.exe
        124⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        125⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\Ppamophb.exe
        
        C:\Windows\system32\Ppamophb.exe
        126⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Pqcjepfo.exe
        
        C:\Windows\system32\Pqcjepfo.exe
        127⤵
        Drops file in System32 directory
        
        PID:5460
        
        C:\Windows\SysWOW64\Qgnbaj32.exe
        
        C:\Windows\system32\Qgnbaj32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5552
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        129⤵
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        130⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Ahchda32.exe
        
        C:\Windows\system32\Ahchda32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5864
        
        C:\Windows\SysWOW64\Acilajpk.exe
        
        C:\Windows\system32\Acilajpk.exe
        132⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Ajcdnd32.exe
        
        C:\Windows\system32\Ajcdnd32.exe
        133⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Amaqjp32.exe
        
        C:\Windows\system32\Amaqjp32.exe
        134⤵
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Aopmfk32.exe
        
        C:\Windows\system32\Aopmfk32.exe
        135⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4900
        
        C:\Windows\SysWOW64\Aihaoqlp.exe
        
        C:\Windows\system32\Aihaoqlp.exe
        137⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Aobilkcl.exe
        
        C:\Windows\system32\Aobilkcl.exe
        138⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Aflaie32.exe
        
        C:\Windows\system32\Aflaie32.exe
        139⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Ajjjocap.exe
        
        C:\Windows\system32\Ajjjocap.exe
        140⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Bfqkddfd.exe
        
        C:\Windows\system32\Bfqkddfd.exe
        141⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Bmkcqn32.exe
        
        C:\Windows\system32\Bmkcqn32.exe
        142⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Bgbdcgld.exe
        
        C:\Windows\system32\Bgbdcgld.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2000
        
        C:\Windows\SysWOW64\Bmomlnjk.exe
        
        C:\Windows\system32\Bmomlnjk.exe
        144⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Bgeaifia.exe
        
        C:\Windows\system32\Bgeaifia.exe
        145⤵
        Drops file in System32 directory
        
        PID:4392
        
        C:\Windows\SysWOW64\Bifmqo32.exe
        
        C:\Windows\system32\Bifmqo32.exe
        146⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Bppfmigl.exe
        
        C:\Windows\system32\Bppfmigl.exe
        147⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3140
        
        C:\Windows\SysWOW64\Cqpbglno.exe
        
        C:\Windows\system32\Cqpbglno.exe
        149⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Cgjjdf32.exe
        
        C:\Windows\system32\Cgjjdf32.exe
        150⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Cjhfpa32.exe
        
        C:\Windows\system32\Cjhfpa32.exe
        151⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        152⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Ccqkigkp.exe
        
        C:\Windows\system32\Ccqkigkp.exe
        153⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        154⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Cpglnhad.exe
        
        C:\Windows\system32\Cpglnhad.exe
        155⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1804
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        156⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Cfadkb32.exe
        
        C:\Windows\system32\Cfadkb32.exe
        157⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        158⤵
        Modifies registry class
        
        PID:6248
        
        C:\Windows\SysWOW64\Cfcqpa32.exe
        
        C:\Windows\system32\Cfcqpa32.exe
        159⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Cmniml32.exe
        
        C:\Windows\system32\Cmniml32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6344
        
        C:\Windows\SysWOW64\Fpeafcfa.exe
        
        C:\Windows\system32\Fpeafcfa.exe
        161⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Fkkeclfh.exe
        
        C:\Windows\system32\Fkkeclfh.exe
        162⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Fphnlcdo.exe
        
        C:\Windows\system32\Fphnlcdo.exe
        163⤵
        Drops file in System32 directory
        
        PID:6476
        
        C:\Windows\SysWOW64\Fipbdikp.exe
        
        C:\Windows\system32\Fipbdikp.exe
        164⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Fpjjac32.exe
        
        C:\Windows\system32\Fpjjac32.exe
        165⤵
        Modifies registry class
        
        PID:6604
        
        C:\Windows\SysWOW64\Fibojhim.exe
        
        C:\Windows\system32\Fibojhim.exe
        166⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Fpmggb32.exe
        
        C:\Windows\system32\Fpmggb32.exe
        167⤵
        Modifies registry class
        
        PID:6684
        
        C:\Windows\SysWOW64\Fpodlbng.exe
        
        C:\Windows\system32\Fpodlbng.exe
        168⤵
        Modifies registry class
        
        PID:6724
        
        C:\Windows\SysWOW64\Fhflnpoi.exe
        
        C:\Windows\system32\Fhflnpoi.exe
        169⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6816
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        171⤵
        Modifies registry class
        
        PID:6856
        
        C:\Windows\SysWOW64\Gmeakf32.exe
        
        C:\Windows\system32\Gmeakf32.exe
        172⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Ghkeio32.exe
        
        C:\Windows\system32\Ghkeio32.exe
        173⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        174⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Gdafnpqh.exe
        
        C:\Windows\system32\Gdafnpqh.exe
        175⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Gklnjj32.exe
        
        C:\Windows\system32\Gklnjj32.exe
        176⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        177⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        178⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6164
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6240
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        181⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        182⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        183⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Hnaqgd32.exe
        
        C:\Windows\system32\Hnaqgd32.exe
        184⤵
        Drops file in System32 directory
        
        PID:6560
        
        C:\Windows\SysWOW64\Hpomcp32.exe
        
        C:\Windows\system32\Hpomcp32.exe
        185⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Hgiepjga.exe
        
        C:\Windows\system32\Hgiepjga.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6764
        
        C:\Windows\SysWOW64\Hjhalefe.exe
        
        C:\Windows\system32\Hjhalefe.exe
        187⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Haoimcgg.exe
        
        C:\Windows\system32\Haoimcgg.exe
        188⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Hglaej32.exe
        
        C:\Windows\system32\Hglaej32.exe
        189⤵
        Drops file in System32 directory
        
        PID:7024
        
        C:\Windows\SysWOW64\Hjjnae32.exe
        
        C:\Windows\system32\Hjjnae32.exe
        190⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        191⤵
        Modifies registry class
        
        PID:5492
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        192⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Hkjjlhle.exe
        
        C:\Windows\system32\Hkjjlhle.exe
        193⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        194⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        195⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Idbodn32.exe
        
        C:\Windows\system32\Idbodn32.exe
        196⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        197⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Injcmc32.exe
        
        C:\Windows\system32\Injcmc32.exe
        198⤵
        Drops file in System32 directory
        
        PID:6232
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        199⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Ihphkl32.exe
        
        C:\Windows\system32\Ihphkl32.exe
        200⤵
        Modifies registry class
        
        PID:6620
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        201⤵
        Modifies registry class
        
        PID:6996
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        202⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        203⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        204⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        205⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        206⤵
        Drops file in System32 directory
        
        PID:7172
        
        C:\Windows\SysWOW64\Iggaah32.exe
        
        C:\Windows\system32\Iggaah32.exe
        207⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        208⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        209⤵
        Modifies registry class
        
        PID:7300
        
        C:\Windows\SysWOW64\Jglklggl.exe
        
        C:\Windows\system32\Jglklggl.exe
        210⤵
        Modifies registry class
        
        PID:7340
        
        C:\Windows\SysWOW64\Jdpkflfe.exe
        
        C:\Windows\system32\Jdpkflfe.exe
        211⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Jgogbgei.exe
        
        C:\Windows\system32\Jgogbgei.exe
        212⤵
        Modifies registry class
        
        PID:7428
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        213⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        214⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        215⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Jjamia32.exe
        
        C:\Windows\system32\Jjamia32.exe
        216⤵
        Drops file in System32 directory
        
        PID:7604
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        217⤵
        Modifies registry class
        
        PID:7648
        
        C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        218⤵
        Drops file in System32 directory
        
        PID:7692
        
        C:\Windows\SysWOW64\Kjffdalb.exe
        
        C:\Windows\system32\Kjffdalb.exe
        219⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Kbmoen32.exe
        
        C:\Windows\system32\Kbmoen32.exe
        220⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        221⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        222⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        223⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        224⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        225⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Pchlpfjb.exe
        
        C:\Windows\system32\Pchlpfjb.exe
        226⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        227⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        228⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        229⤵
        Modifies registry class
        
        PID:7204
        
        C:\Windows\SysWOW64\Pemomqcn.exe
        
        C:\Windows\system32\Pemomqcn.exe
        230⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        231⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        232⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        233⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        234⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Ahqddk32.exe
        
        C:\Windows\system32\Ahqddk32.exe
        235⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        236⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Akamff32.exe
        
        C:\Windows\system32\Akamff32.exe
        237⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        238⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        239⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        240⤵
        Drops file in System32 directory
        
        PID:7996
        
        C:\Windows\SysWOW64\Alcfei32.exe
        
        C:\Windows\system32\Alcfei32.exe
        241⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        242⤵
        Modifies registry class
        
        PID:8148
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7200
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        244⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        245⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        246⤵
        Modifies registry class
        
        PID:7624
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        247⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        248⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        249⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        250⤵
        Drops file in System32 directory
        
        PID:8128
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        251⤵
        Modifies registry class
        
        PID:7212
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7424
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        253⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7756
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8012
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        256⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        257⤵
        Drops file in System32 directory
        
        PID:3584
        
        C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        258⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7328
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        260⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        261⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        262⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        263⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        264⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8256
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        266⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        267⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        268⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        269⤵
        Modifies registry class
        
        PID:8416
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        270⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        271⤵
        Modifies registry class
        
        PID:8520
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        272⤵
        Drops file in System32 directory
        
        PID:8564
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        273⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        274⤵
        Drops file in System32 directory
        
        PID:8656
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        275⤵
        Modifies registry class
        
        PID:8696
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        276⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        277⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        278⤵
        Modifies registry class
        
        PID:8816
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        279⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        280⤵
        Modifies registry class
        
        PID:8912
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        281⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        282⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        283⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        284⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        285⤵
        Drops file in System32 directory
        
        PID:9128
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        286⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        287⤵
        Drops file in System32 directory
        
        PID:8196
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        288⤵
        Drops file in System32 directory
        
        PID:8264
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        289⤵
        Modifies registry class
        
        PID:8316
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        290⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        291⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        292⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        293⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        294⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3936
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        296⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8644
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        298⤵
        Drops file in System32 directory
        
        PID:8676
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        299⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        300⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        301⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2552
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        303⤵
        Drops file in System32 directory
        
        PID:8984
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        304⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        305⤵
        Drops file in System32 directory
        
        PID:9024
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        306⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        307⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9212
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        309⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        310⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        311⤵
        Drops file in System32 directory
        
        PID:8432
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        312⤵
        
        PID:232
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        313⤵
        Modifies registry class
        
        PID:2456
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        314⤵
        Modifies registry class
        
        PID:1420
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        315⤵
        Modifies registry class
        
        PID:8576
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        316⤵
        Drops file in System32 directory
        
        PID:2340
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        317⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        318⤵
        Modifies registry class
        
        PID:4000
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        319⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        320⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2468
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        322⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        323⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        324⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        325⤵
        Drops file in System32 directory
        
        PID:9108
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        326⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        327⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        328⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        329⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        330⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1244
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        332⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        333⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        334⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        335⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        336⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5084
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        338⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        339⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        340⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        341⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        342⤵
        
        PID:652
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        343⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        344⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        345⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        346⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        347⤵
        Drops file in System32 directory
        
        PID:8996
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        348⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        349⤵
        Drops file in System32 directory
        
        PID:4612
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        350⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        351⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        352⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        353⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        354⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        355⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3620
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        357⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        358⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        359⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        360⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        361⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        362⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        363⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8244
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        364⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        365⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        366⤵
        Drops file in System32 directory
        
        PID:1012
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        367⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        368⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        369⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        370⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        371⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        372⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        373⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        374⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        375⤵
        
        PID:8
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        376⤵
        
        PID:684
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        377⤵
        Modifies registry class
        
        PID:4604
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        378⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:904
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:60
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        381⤵
        Drops file in System32 directory
        
        PID:9204
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        382⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        383⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        384⤵
        Modifies registry class
        
        PID:2864
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        385⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        386⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        387⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        388⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        389⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        390⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        391⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        392⤵
        
        PID:552
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        393⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        394⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3412
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        396⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        397⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        398⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        399⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        400⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        401⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        402⤵
        
        PID:316
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        403⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        404⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        405⤵
        Drops file in System32 directory
        
        PID:4568
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        406⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        407⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5236
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        409⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        410⤵
        Drops file in System32 directory
        
        PID:5404
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        411⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5488
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        412⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        413⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5308
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        415⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        416⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        417⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        418⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        419⤵
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        420⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        421⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        422⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        423⤵
        Drops file in System32 directory
        
        PID:6004
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        424⤵
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5560
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        426⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        427⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        428⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        429⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        430⤵
        Drops file in System32 directory
        
        PID:5648
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        431⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        432⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        433⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        434⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        435⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        436⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        437⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        438⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9480
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        439⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        440⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        441⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        442⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        443⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        444⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        445⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        446⤵
        Drops file in System32 directory
        
        PID:9816
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        447⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        448⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        449⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        450⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9980
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        451⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        452⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10072
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10120
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        454⤵
        Drops file in System32 directory
        
        PID:10164
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        455⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        456⤵
        Drops file in System32 directory
        
        PID:6076
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        457⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        458⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        459⤵
        Modifies registry class
        
        PID:9388
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        460⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        461⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        462⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9616
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        463⤵
        Modifies registry class
        
        PID:9696
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        464⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        465⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        466⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        467⤵
        Modifies registry class
        
        PID:3672
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        468⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        469⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        470⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        471⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        472⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        473⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        474⤵
        Drops file in System32 directory
        
        PID:9556
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        475⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        476⤵
        Drops file in System32 directory
        
        PID:9844
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        477⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        478⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9968
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        479⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        480⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        481⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        482⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9428
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        483⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        484⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        485⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        486⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        487⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        488⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        489⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        490⤵
        Drops file in System32 directory
        
        PID:10016
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        491⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        492⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        493⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        494⤵
        Drops file in System32 directory
        
        PID:10144
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        495⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        496⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        497⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        498⤵
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        499⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        500⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5464
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        501⤵
        Drops file in System32 directory
        
        PID:5972
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        502⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10276
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        503⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        504⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        505⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        506⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        507⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        508⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        509⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        510⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        511⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        512⤵
        Drops file in System32 directory
        
        PID:10704
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        513⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        514⤵
        Modifies registry class
        
        PID:10788
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        515⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        516⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        517⤵
        Drops file in System32 directory
        
        PID:10916
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        518⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        519⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        520⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        521⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        522⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        523⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        524⤵
        Modifies registry class
        
        PID:11204
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        525⤵
        Modifies registry class
        
        PID:11248
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        526⤵
        Modifies registry class
        
        PID:5276
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        527⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        528⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        529⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        530⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        531⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10460
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        532⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        533⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        534⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10624
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        535⤵
        Modifies registry class
        
        PID:10684
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        536⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        537⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10832
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        538⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        539⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        540⤵
        
        PID:440
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        541⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        542⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        543⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11068
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        544⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        545⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        546⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        547⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        548⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        549⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        550⤵
        Drops file in System32 directory
        
        PID:10412
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        551⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        552⤵
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        553⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        554⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        555⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        556⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        557⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        558⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        559⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        560⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        561⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        562⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        563⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        564⤵
        Modifies registry class
        
        PID:1276
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        565⤵
        Drops file in System32 directory
        
        PID:10312
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        566⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        567⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        568⤵
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        569⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        570⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        571⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        572⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        573⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        574⤵
        Modifies registry class
        
        PID:10992
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        575⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        576⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        577⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        578⤵
        Modifies registry class
        
        PID:11228
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        579⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6320 -s 420
        580⤵
        Program crash
        
        PID:10500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6320 -ip 6320
1⤵
PID:10448

Network

DNS

13.86.106.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.86.106.20.in-addr.arpa

IN PTR

Response
DNS

47.179.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

47.179.17.96.in-addr.arpa

IN PTR

Response

47.179.17.96.in-addr.arpa

IN PTR

a96-17-179-47deploystaticakamaitechnologiescom
DNS

73.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.159.190.20.in-addr.arpa

IN PTR

Response
DNS

57.169.31.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

57.169.31.20.in-addr.arpa

IN PTR

Response
DNS

57.169.31.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

57.169.31.20.in-addr.arpa

IN PTR
DNS

58.55.71.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

58.55.71.13.in-addr.arpa

IN PTR

Response
DNS

241.154.82.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.154.82.20.in-addr.arpa

IN PTR

Response
DNS

103.169.127.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

103.169.127.40.in-addr.arpa

IN PTR

Response
DNS

198.187.3.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

198.187.3.20.in-addr.arpa

IN PTR

Response
DNS

241.150.49.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.150.49.20.in-addr.arpa

IN PTR

Response
DNS

41.110.16.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

41.110.16.96.in-addr.arpa

IN PTR

Response

41.110.16.96.in-addr.arpa

IN PTR

a96-16-110-41deploystaticakamaitechnologiescom
DNS

232.135.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

232.135.221.88.in-addr.arpa

IN PTR

Response

232.135.221.88.in-addr.arpa

IN PTR

a88-221-135-232deploystaticakamaitechnologiescom
DNS

61.179.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

61.179.17.96.in-addr.arpa

IN PTR

Response

61.179.17.96.in-addr.arpa

IN PTR

a96-17-179-61deploystaticakamaitechnologiescom
DNS

11.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

11.227.111.52.in-addr.arpa

IN PTR

Response
DNS

100.5.17.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

100.5.17.2.in-addr.arpa

IN PTR

Response

100.5.17.2.in-addr.arpa

IN PTR

a2-17-5-100deploystaticakamaitechnologiescom
DNS

119.110.54.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

119.110.54.20.in-addr.arpa

IN PTR

Response
DNS

18.134.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.134.221.88.in-addr.arpa

IN PTR

Response

18.134.221.88.in-addr.arpa

IN PTR

a88-221-134-18deploystaticakamaitechnologiescom
DNS

46.179.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

46.179.17.96.in-addr.arpa

IN PTR

Response

46.179.17.96.in-addr.arpa

IN PTR

a96-17-179-46deploystaticakamaitechnologiescom
DNS

83.179.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

83.179.17.96.in-addr.arpa

IN PTR

Response

83.179.17.96.in-addr.arpa

IN PTR

a96-17-179-83deploystaticakamaitechnologiescom
DNS

26.35.223.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.35.223.20.in-addr.arpa

IN PTR

Response
DNS

26.35.223.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.35.223.20.in-addr.arpa

IN PTR

Response
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

dual-a-0001.a-msedge.net

dual-a-0001.a-msedge.net

IN A

204.79.197.200

dual-a-0001.a-msedge.net

IN A

13.107.21.200
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

dual-a-0001.a-msedge.net

dual-a-0001.a-msedge.net

IN A

204.79.197.200

dual-a-0001.a-msedge.net

IN A

13.107.21.200
GET

https://tse1.mm.bing.net/th?id=OADD2.10239340418557_1YV8GA2L9NL51T4LE&pid=21.2&w=1080&h=1920&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239340418557_1YV8GA2L9NL51T4LE&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 409885
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DD0DF72CCF13405F9A69F23B9D61CC8A Ref B: LON04EDGE0806 Ref C: 2024-03-06T17:13:45Z
date: Wed, 06 Mar 2024 17:13:44 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317300915_11PL293NENO2DA53I&pid=21.2&w=1920&h=1080&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317300915_11PL293NENO2DA53I&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 288710
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 02DBF0C916BF4E3F8258F263A1499744 Ref B: LON04EDGE0806 Ref C: 2024-03-06T17:13:45Z
date: Wed, 06 Mar 2024 17:13:44 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317300899_126S6R30RKFOCBYCC&pid=21.2&w=1920&h=1080&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317300899_126S6R30RKFOCBYCC&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 412437
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3E85F6C95D5448EAA4E5D247CF3FB2D4 Ref B: LON04EDGE0806 Ref C: 2024-03-06T17:13:45Z
date: Wed, 06 Mar 2024 17:13:44 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239340418558_1RIRIQOUBMYAABIAT&pid=21.2&w=1920&h=1080&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239340418558_1RIRIQOUBMYAABIAT&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 441094
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 37E51E5CE22446E1B3C2E67B28B5ADD9 Ref B: LON04EDGE0806 Ref C: 2024-03-06T17:13:45Z
date: Wed, 06 Mar 2024 17:13:44 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301348_1IGED3LPK164UYK70&pid=21.2&w=1080&h=1920&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317301348_1IGED3LPK164UYK70&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 333147
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AE071A34C3894E4E8C0B9DA15468A2C0 Ref B: LON04EDGE0806 Ref C: 2024-03-06T17:13:45Z
date: Wed, 06 Mar 2024 17:13:44 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301332_1PDCNQMZKAUMCHNBI&pid=21.2&w=1080&h=1920&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317301332_1PDCNQMZKAUMCHNBI&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 427108
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4846875894AA49D5832D9618C6398AC1 Ref B: LON04EDGE0806 Ref C: 2024-03-06T17:13:45Z
date: Wed, 06 Mar 2024 17:13:44 GMT
DNS

200.197.79.204.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.197.79.204.in-addr.arpa

IN PTR

Response

200.197.79.204.in-addr.arpa

IN PTR

a-0001a-msedgenet
DNS

217.135.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

217.135.221.88.in-addr.arpa

IN PTR

Response

217.135.221.88.in-addr.arpa

IN PTR

a88-221-135-217deploystaticakamaitechnologiescom
DNS

68.179.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

68.179.17.96.in-addr.arpa

IN PTR

Response

68.179.17.96.in-addr.arpa

IN PTR

a96-17-179-68deploystaticakamaitechnologiescom
DNS

68.179.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

68.179.17.96.in-addr.arpa

IN PTR

Response

68.179.17.96.in-addr.arpa

IN PTR

a96-17-179-68deploystaticakamaitechnologiescom
DNS

169.117.168.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

169.117.168.52.in-addr.arpa

IN PTR

Response

204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.1kB
16
14
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.1kB
16
14
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.1kB
16
14
204.79.197.200:443

https://tse1.mm.bing.net/th?id=OADD2.10239317301332_1PDCNQMZKAUMCHNBI&pid=21.2&w=1080&h=1920&c=4

tls, http2

87.9kB
2.4MB
1764
1755

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239340418557_1YV8GA2L9NL51T4LE&pid=21.2&w=1080&h=1920&c=4

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317300915_11PL293NENO2DA53I&pid=21.2&w=1920&h=1080&c=4

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317300899_126S6R30RKFOCBYCC&pid=21.2&w=1920&h=1080&c=4

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239340418558_1RIRIQOUBMYAABIAT&pid=21.2&w=1920&h=1080&c=4

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301348_1IGED3LPK164UYK70&pid=21.2&w=1080&h=1920&c=4

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301332_1PDCNQMZKAUMCHNBI&pid=21.2&w=1080&h=1920&c=4

HTTP Response

200
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.1kB
16
14

8.8.8.8:53

13.86.106.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

13.86.106.20.in-addr.arpa
8.8.8.8:53

47.179.17.96.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

47.179.17.96.in-addr.arpa
8.8.8.8:53

73.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

73.159.190.20.in-addr.arpa
8.8.8.8:53

57.169.31.20.in-addr.arpa

dns

142 B
157 B
2
1

DNS Request

57.169.31.20.in-addr.arpa

DNS Request

57.169.31.20.in-addr.arpa
8.8.8.8:53

58.55.71.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

58.55.71.13.in-addr.arpa
8.8.8.8:53

241.154.82.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

241.154.82.20.in-addr.arpa
8.8.8.8:53

103.169.127.40.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

103.169.127.40.in-addr.arpa
8.8.8.8:53

198.187.3.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

198.187.3.20.in-addr.arpa
8.8.8.8:53

241.150.49.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

241.150.49.20.in-addr.arpa
8.8.8.8:53

41.110.16.96.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

41.110.16.96.in-addr.arpa
8.8.8.8:53

232.135.221.88.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

232.135.221.88.in-addr.arpa
8.8.8.8:53

61.179.17.96.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

61.179.17.96.in-addr.arpa
8.8.8.8:53

11.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

11.227.111.52.in-addr.arpa
8.8.8.8:53

100.5.17.2.in-addr.arpa

dns

69 B
131 B
1
1

DNS Request

100.5.17.2.in-addr.arpa
8.8.8.8:53

119.110.54.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

119.110.54.20.in-addr.arpa
8.8.8.8:53

18.134.221.88.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

18.134.221.88.in-addr.arpa
8.8.8.8:53

46.179.17.96.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

46.179.17.96.in-addr.arpa
8.8.8.8:53

83.179.17.96.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

83.179.17.96.in-addr.arpa
8.8.8.8:53

26.35.223.20.in-addr.arpa

dns

142 B
314 B
2
2

DNS Request

26.35.223.20.in-addr.arpa

DNS Request

26.35.223.20.in-addr.arpa
8.8.8.8:53

tse1.mm.bing.net

dns

124 B
346 B
2
2

DNS Request

tse1.mm.bing.net

DNS Request

tse1.mm.bing.net

DNS Response

204.79.197.200

13.107.21.200

DNS Response

204.79.197.200

13.107.21.200
8.8.8.8:53

200.197.79.204.in-addr.arpa

dns

73 B
106 B
1
1

DNS Request

200.197.79.204.in-addr.arpa
8.8.8.8:53

217.135.221.88.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

217.135.221.88.in-addr.arpa
8.8.8.8:53

68.179.17.96.in-addr.arpa

dns

142 B
270 B
2
2

DNS Request

68.179.17.96.in-addr.arpa

DNS Request

68.179.17.96.in-addr.arpa
8.8.8.8:53

169.117.168.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

169.117.168.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ajjjocap.exe

Filesize
227KB

MD5
3b29c7cfdda7f7a24f8a4b81d2ccafab

SHA1
9e748018d14c05643b50746650c5aa6f4f2f3da6

SHA256
fe4cf1c557861fe8905fb1035b00c0a3c6fbd84fc3bde95b656288afa844d8d8

SHA512
95cc452f24573ae6a8f849bb25ae89112a3d9f841b438766662fd4951f41ed961a7f241d930f9d3417baba145741d38ae13d60fdd9ec24d59009ad5ae065db60

Download Submit
C:\Windows\SysWOW64\Ccbadp32.exe

Filesize
227KB

MD5
b15a09498674a0ad2ffd063f97261f1b

SHA1
255ad3dd55e4519c126d86f65263defa9d340866

SHA256
7fb6e2d2a9f3f9d5fe90e4221d946d878e295c8913b6c7e1f05d24f46ea3a1a3

SHA512
9d8b1950f538868e80099c9f1034dbd0fde66afb1a54b5d50c8350fea8c099885b455103e88364677efd760ef48146590a8eed351020f72f79846ee202568835

Download Submit
C:\Windows\SysWOW64\Cceddf32.exe

Filesize
227KB

MD5
56ceddcd2b6fa6e8d8e4ccbdfc085619

SHA1
32e7d3d6311f0ce01220b2ad89654fa581169451

SHA256
dae4655ec99bf8fd214c2f6f30aacb88d0c7427ffcff82c98d1eb197fd0d3355

SHA512
0bff592684f6958d8b8f40447998ad6649f7a5e714402000a8cdc94c83912d888db2f4220080d8263c3b0f6b48c50fa62ea87ae3fd1aa85423af6179e027bbcf

Download Submit
C:\Windows\SysWOW64\Cleegp32.exe

Filesize
64KB

MD5
5000080b9707f9aa943f4591a33dc6e0

SHA1
735598ff0954d15e97dab68b5e2fcb2a8cd1c470

SHA256
2f79bce857f9f4744047cf4235efc132243abda441b2efd551b566e8ee79f2fd

SHA512
27a4b90d0be6ff712a99a4ca433be5a229a6ffdf4f4db5cae9133639fa66b51cc8eb9e60b88ea697ad9969eb899666a783bd2122ee38a726debfc413cd32d05a

Download Submit
C:\Windows\SysWOW64\Cobkhb32.exe

Filesize
227KB

MD5
008a4d3507cf89c2676f6f28b3d60e36

SHA1
2dc1632c5a37fb4013949e3a60e164217d936a16

SHA256
0af501d703630770b75a61bffcec56afbdb6929ce8657fc19a737eccef2aaf19

SHA512
e02f8d52a94c0c9c099b323ef2250d2f637f21821b7446f4de2fb6ecfd71104ed475cfeb347cf6c8ba98042617ff98581fe0a4e5cdbc85ca39ff5e91e605d9f9

Download Submit
C:\Windows\SysWOW64\Dbkqfe32.exe

Filesize
227KB

MD5
cb98cd4fda3953c48c79c902a89f30d7

SHA1
9ba9a36c69faa1772a43a11549502ab6fff8474f

SHA256
e44a6c12ff8a149ec07ea577f7d5449b230014af781abdf34726f3684f3585b9

SHA512
e2a15b83a28d368c0fb2ca5b30dac9a3598e3a9c2edb245a7eea2e17ec10634638f5399c405d5d7b1dcb4bf0bb3346db68c931c86f10a17b4243176521eeb195

Download Submit
C:\Windows\SysWOW64\Dikihe32.exe

Filesize
227KB

MD5
a2fc70786ac98b1e92e557330049baf1

SHA1
885344b06d87c984947c0e09ff36a8943d6711e0

SHA256
e73e3d08712f9f33860bfdb5ecb5b0edae24ba3bb6082b1b5bcc23f1ead235c7

SHA512
e0ff724953c94c4fc8eb646ec850cb37b9e2a6d3726abb6d8194c15f66dfd2d911b99879e4cba6a01030d23f76a2d2e143d2fab5c5478419be7e261624deed37

Download Submit
C:\Windows\SysWOW64\Dkokcl32.exe

Filesize
227KB

MD5
8794ab0522a0a6befeabc245fe5346c7

SHA1
87356db16bff5c2c722b04c3e97fbd49642b7018

SHA256
be908e515082b5491d6137c1f5c30793fc3047f353ceaf3da0b1c0ce171c7521

SHA512
689c3922659967988d107c1ca6cee3399481563a5eb9596f3f47ba4ffa5ba23d7b34557abba119300e2b34a99e621a48966b8b9e1089f47bd7f6979663024e66

Download Submit
C:\Windows\SysWOW64\Eabbjc32.exe

Filesize
227KB

MD5
da8bd358c557cc82399cad0a11d19a0c

SHA1
dfcb4b9c14b4773f92b415f6524fde0bcd9b54c5

SHA256
7d449b602c687d4cfdec0e022cea97d32c58d58ceea75f9473745669a54f48f3

SHA512
d9e2d12ebbf5658057ecc7c1d9a6d91560d29c4a961a22ccb5e524bbf39d6b3ffb3a326972b2c4aff4c1c774f12f8bbf7db8adb023069439cc2dea2a00ac0dc0

Download Submit
C:\Windows\SysWOW64\Eadopc32.exe

Filesize
227KB

MD5
a3caf916e41fa41fa82a42d8cdee58b3

SHA1
2f72f677a4cd61658a693ff29e0ef94701f653de

SHA256
104d81ab24c993c337b9288390ee32d35e7ddb0034be424238ad9942600b0bf7

SHA512
98057ceb99ca1fbcaeabb01275d5f6272250d93bb348d4f8430bbd71becabdca350e84a427219fbde2b91ac968715bc5772d0b9658eb7923fbb6d3f638a4f4f8

Download Submit
C:\Windows\SysWOW64\Eejeiocj.exe

Filesize
227KB

MD5
e0bdc44d1de3828c30f24666a3547074

SHA1
a29c41ad6ffc79205838fbcdd23f88c6186f6e20

SHA256
5b6acfdcaa98a897db405bdf7c3df210aa0b41851e0fb3af886cde762dd10e90

SHA512
1a64c80ba23d1f749673f2a2e16642b42114f53c65fcb27bd9ae9b817814a254a8fcfd12b7fa7e55927b56a5cfbcf00f33c953bf61a55191a61c439f6d013c87

Download Submit
C:\Windows\SysWOW64\Ehimanbq.exe

Filesize
227KB

MD5
4e8890ecc33bffb36c9a9064128753a5

SHA1
5d2861f4ebdf9749cd399a32c898520351775ffa

SHA256
c0ba19c9b59f47bae479d611081e90f2f50c5ed31e1092572a84b5ad63cafdd0

SHA512
544bbd5211dd8d1630ea352eca370cbb6fe9464ca3cf2f3e5e1074e6682589a9450d2bf2ecc55cadb67d9d0dfc1c33601639b46d6a496af953bb68c752b2ec3b

Download Submit
C:\Windows\SysWOW64\Ehljfnpn.exe

Filesize
227KB

MD5
7ed7a8b82362eaaea80c54c460499cc5

SHA1
645102f5ead5ceb2e47b1964411b2bb1fe14e373

SHA256
17231b9785cb90e5b14cff7ed0de602504bec91ce608a41743a9b42807a48aaf

SHA512
1930f7969f7f37cfb4946ef25dac5893e19f5069f2b8eb77de6fb0f01e83b738475473f67b331f031349bbb908de26d6a9084ad8af1274e8b92a6927794af875

Download Submit
C:\Windows\SysWOW64\Ekjfcipa.exe

Filesize
227KB

MD5
98c5520aa6b97c35654d39fc5cd97796

SHA1
14fa724b68d60ddfee96f7025a5aa74ae0035543

SHA256
d5c9676e9b1d366421e93c242e91af41c1729098f096b7c69a85e3673de1f27b

SHA512
1d3e565440cead4a13c683f50ab218cc5242a0b8a3570e1349cacb7aed3a22ca43b2be199e1a825a5b4034e76749e8a8d65c64c4e7e4da35e4d761b7a5ac7b16

Download Submit
C:\Windows\SysWOW64\Eoaihhlp.exe

Filesize
227KB

MD5
66e255179fc921c9a61a3c0e86662ab1

SHA1
9c81bab9cc2c9219deaa824d58f59dcdf3d5d900

SHA256
3820a59ab3f39af03731104c93662998c07c6ea9a5a134cfc10037e72f1694b8

SHA512
2073353b1678f08086eef05e5892c4248a2b545a1bd2cbea3f5c39fdd694bf9c60fc7ee6fbd22075fd5efe096cfbad766d48267523528a838ec1328fa3c0d3f8

Download Submit
C:\Windows\SysWOW64\Eocenh32.exe

Filesize
227KB

MD5
303c713b2770bb5120ff2b1ae3d91b5c

SHA1
c8521fcbf0afece71c0b50d16e2d5e4b61c4554a

SHA256
f70ac98045bd4880006c4f963b9d35c87df5fbef116aafdd50e7d1b80cb7b9e5

SHA512
05982b03f240c3e2a692d57eaa8e2561f937fbfac2a638492ee7c0222a10d33e044c57527ab133e1663e08cc3d4d710fe409238b241a0d5bb1352e3e4320bd44

Download Submit
C:\Windows\SysWOW64\Fddqghpd.exe

Filesize
227KB

MD5
175846a0ec5ed88db1d773511b2c9a55

SHA1
0914068b21e14d95d38552c5f0cc28a994f30375

SHA256
392d6f2dfb91ee76541258393f9ce9fec79fcfb5b118395f0f8b46e3adb7fe5f

SHA512
3aeb2da6b4c12fc43f61d80b744ae99a4aa95c97d32acf87c0a1a062ea313ca0245e75bf44640ef45044c8e119a8c26d2f69efc8e3da269c363247e8f9672320

Download Submit
C:\Windows\SysWOW64\Fdnjgmle.exe

Filesize
227KB

MD5
c7b710f0770205aefcb3ed370b5a4f0f

SHA1
e7a069e35830c7e1f4fafe969218d2c0208e9e50

SHA256
90453e48e688434e481b6e391fb185c1f31566a5be1f4f439b6af31cc829f1a2

SHA512
00821cfe1036cdda396307e8d3b0cbcc7cbf0a2ffccc56b9d9d85f20b984f27518745cc49e8c84297d3ae53b4fb5d0f8ea0e5b84cfb61c3a7224d3a5e3020a88

Download Submit
C:\Windows\SysWOW64\Febgea32.exe

Filesize
227KB

MD5
079f43777c1a6104a73513b332668712

SHA1
0158f9f7327002ebac2d1e70423690b82208ddf9

SHA256
4ec79d5d09a7ee299b5194e12033c5189d43e3a1cb0a760089ca00fce5317afc

SHA512
c7f62f5e4013e69743efdd2952242eb07966dc6a295b9149c5b316b908b9abb8d60600034779bdc62c2579a9782da8e8acd3a871722c725e5cba04480c29ac16

Download Submit
C:\Windows\SysWOW64\Ffddka32.exe

Filesize
227KB

MD5
ab6fd5787666d744041977b3e1161447

SHA1
12e35f9a9a6f9e066b30d0cfc3e1f08894e2790b

SHA256
dc74aa73bad7653f0009e3d915c5469508095eb692a647745ec58cadd0af7702

SHA512
d0c32488e9cac929d1bb6d7e5ea5dc37b8cf184d2fefce941a739225b62c49bb248b99a21c0b62081ae7eeddad6500931813b76522686887232192c6be4c52cb

Download Submit
C:\Windows\SysWOW64\Ffgqqaip.exe

Filesize
227KB

MD5
5607e05153c6888f0a94a656461290c0

SHA1
55a674de1e8e2c1c653e217f3f4a05e2068a7925

SHA256
7a70354a65240b6e5519a0f67f7503cb6d2e0742dd11d97f6cd004f207f11754

SHA512
d13c106eaea21ad3d9a9bad2540d58e3af36f8328fc52325f321bd561b21b0e0e0460128ea721e878178454047fa181f43ca91695e61f0d04ec815acb99c58be

Download Submit
C:\Windows\SysWOW64\Fljcmlfd.exe

Filesize
227KB

MD5
3b0fb2b9a19a7a692abc072167df5e63

SHA1
326d172e256a8f82e1669533011af8e46729513e

SHA256
2a23104f844a4398b14b7900791ac927fb97cc7c83c16361cfbe2551e61bd122

SHA512
b34cfe12204bc4540e5e9d412f43943cfbdf40b957b6969bf63c9ca6156852e8c6af07841e0012755a11a7356557541c7bf042bc21b58723b82136925ccce2f8

Download Submit
C:\Windows\SysWOW64\Flnlhk32.exe

Filesize
227KB

MD5
76c0c41f2838156e23dc13c456b50307

SHA1
7e92497e97f40b177b0a9d2c26576c86fd6efd66

SHA256
562c72ea38fbf0b8db8674bc808692f23ef6c777db7fdb4b06aec890f448953e

SHA512
e48a542a2fc484eeb49c91cc8bfe87ce19e9f127a8b66032242274dcc372d86bd8144aae14dbc7f598d848009fe302c63c12d7be4dd6f931b470de447aee165e

Download Submit
C:\Windows\SysWOW64\Fmcjpl32.exe

Filesize
227KB

MD5
62d667623764fc81e1a4b28128b80441

SHA1
dc2830699c798302ab3b049e2e7f6278b6546320

SHA256
c2d44e8aa131e264a870afb970a7639424bd70ab631725c43d21182a97e0011c

SHA512
8b770304bef7476640a1791dfb8101a69a283764a502da2c8b6d9a1e6967451e6d9562212375ef2feea473ddd50a9cc9c1d0860ff0ef50ca194c8682b3d1b030

Download Submit
C:\Windows\SysWOW64\Fooeif32.exe

Filesize
227KB

MD5
3fac46b2643aa6c47d001c1fa566cb13

SHA1
381d7c92ee53a6412ff5c5065fe61e75a05ae2ad

SHA256
ed6f8dc56242c5a4d354a0ccdc96021889a978ca813d427b377ed0daff9cdaf9

SHA512
3b5d0cd23b0b7b7f104c217aacd938478a5246209b9dfc2b22541861526513269a7b12e692bb17b6a467fc33192977e4a78b9c3b4c6b719f2ba3e79fdba761dd

Download Submit
C:\Windows\SysWOW64\Gbdgfa32.exe

Filesize
227KB

MD5
02017e2e08b68b981d0f5f6c008d927a

SHA1
8104e0f17e608c7480c9891e1552eb9e9046b829

SHA256
56f9e99fb4b340b63b1ce45dc232504eaa663d2f1255301830463563d6c80c6e

SHA512
5c463056acbc123ad9f77d59b2b72533a15eb1cb30372cd6e8a9b39bfc2346ed4af1e7c71f4d013f437e5d232f4d1256a0c6108b5be52b42caf576a329084daa

Download Submit
C:\Windows\SysWOW64\Gblngpbd.exe

Filesize
227KB

MD5
ac63216c21d3c38e2841ae8687c15e4c

SHA1
a68298bfc86fc6fcf0861b3e9d727c32e9b4ae6b

SHA256
ab004e1511f9a558595efbb5a158f57c698c172b7ce4a78f4c3d3c786006a2b3

SHA512
0803e26041cf6e70abee83df9b8fd14440b9e1b6c670a25285acb0504201f94b697f3f1aafdf127b21431de94456d747d33d813baa8dbea3f39d0331a029278e

Download Submit
C:\Windows\SysWOW64\Gcfqfc32.exe

Filesize
227KB

MD5
6af07803cd0c2f184aa5f77f2696374d

SHA1
d848db615237320c54cd24c0882bb0ceea2139df

SHA256
aa9f523168373c8780e7fa68b4b460b0021c07b9d69812f4a190f90d7cad5d6f

SHA512
1a4e01e405009ddfc3ac9ac04ff69d6df622bcdcc3af537b3b1118f0370be03bb58be87179ca54f368a9156ba4b8ab422f0ec50e1e46ea1132587210682de76b

Download Submit
C:\Windows\SysWOW64\Gcojed32.exe

Filesize
227KB

MD5
ccdae306298f1b14d31d195b695fc245

SHA1
81bce796353ea5088080a5d19da24595592a4b98

SHA256
d0fac7105ed883c39087caac6537a2d8c1446414188daaacb534aa40c5f14da0

SHA512
91e80f24826eae294d7abc117290dc0f63e9fdce55936799588b2dbaecac287be8da1e8d532a17c3672b593fb6e2b6950b350dc43e65698837882f69dd404645

Download Submit
C:\Windows\SysWOW64\Ghhhcomg.exe

Filesize
227KB

MD5
344c36b24cc3cc98e5a0baa9f78014fb

SHA1
3422e1ac3b2e13d2141e608b1a6bc696ae54e7c3

SHA256
4c4abdc930b1bc76850cc5cf2647ce2b872ba1cce89fd1466b01716b0028b99f

SHA512
6afb3284e61572a4ebc5bdca7b22503e0549c91530631d01aaa4aa3a2e91b9e2f97aeb994b6a83b537a9e3510e67d647cc59798615df8a46437e768298297cd9

Download Submit
C:\Windows\SysWOW64\Gjdaodja.exe

Filesize
227KB

MD5
dee8f49978ff45b5c4735dc173c38f25

SHA1
ee1fd5ede9099133ee5d4ee78362369b68c119f8

SHA256
a2b6499e2655b19eb802e3cac6b88e35d7440f49711f46c7d54fbb2019fea6fa

SHA512
4ac28ac254ad672be13ec5d574079e7e4c1acb36639b94c7be86b766c42cf7a0c0a34598d275efd7f8a82bf58ed1c0c6467899ba6f6d4afa8e739d7d353ee740

Download Submit
C:\Windows\SysWOW64\Glhonj32.exe

Filesize
64KB

MD5
e46632157936b1912f97bd3ea446b022

SHA1
5e879fecfef9408ca6095fd2b64661af095c66a5

SHA256
7ecc992b4cc3a52c40ca96794e1dcad9c03dccc54faf566e27f7d1c47bd1ec9a

SHA512
808cb0833ca5369ca344964af43690e2f45436d64fde11200e1379bcd767768febfaecd4894fdf53c7fd7f8d764a2661080ccb7f28812cf783958cb27981171c

Download Submit
C:\Windows\SysWOW64\Glhonj32.exe

Filesize
227KB

MD5
7fbd59ee27cc025aea91b4cfed61e781

SHA1
9bcd2688a39c48c50d2a70024b9c273d0781a11b

SHA256
e486ea9acd76abeab870dec079291610bd06d5f6b0254ca92b398f5aae9bc765

SHA512
7a0ba2f2459a8541a9fe0cf878ff24877256d9c3fb30117ea1d252e8c6938a3945bd98a2eefe990030a550c5e05e3a0aa100a1069b53a8ab278863830abd6b49

Download Submit
C:\Windows\SysWOW64\Gmlhii32.exe

Filesize
227KB

MD5
1e37459e7bb64161dd94b3f28ba3532e

SHA1
59f47c7fa28cddb15f147a7db30aa2df9cc5a964

SHA256
829c24381227e14bd43dc747f49788c0309a50564cab256bf1732e57905dfddb

SHA512
0b9dbe9069105ca5ae75509c8b4f15132d3d653e1a491b40ef67f978d5e6d98657b638adb7a8f85a3703970a3b350ef00360a9c0af132d793eab8c554a6f0fa7

Download Submit
C:\Windows\SysWOW64\Goljqnpd.exe

Filesize
227KB

MD5
d7a2e8c5de2ca5c4736a8392f42ef3fc

SHA1
7d31d9763df4b97fbe9c2a47e044a9bc1fdf14bd

SHA256
9e349ab3baca331b83a7d8617fe7a4c710740e8abbc429054675e9dbe33f3c66

SHA512
fb29c5d6df80f8c0e69365c7603dbac2b46bec716d23ccff748bafc8bdb0248a9bde26991a393e06f25f4472ee2fe1127c16114902a9215799b225ccc61825d1

Download Submit
C:\Windows\SysWOW64\Hbbdholl.exe

Filesize
227KB

MD5
88e7e8082223bb672ebe4b2f3ba3669f

SHA1
1ad738d0a981ca2d5537a1543a86be88a272fb32

SHA256
c5d84bb421b09f384f43141aea8dfae1e697ff8471d340d5c2f72e16ab463a43

SHA512
29e789e43782c5439167d278c25af24fdd5fa3196fe2a4e038685b5b09d62fa7cf5a33775d818d556f352e65e6de1c9d4f05bd26c1b0396d6014227f14762eb2

Download Submit
C:\Windows\SysWOW64\Hbgmcnhf.exe

Filesize
227KB

MD5
718aa03ab57f1cc7950287e7c9717c25

SHA1
fea8629451326779ac4cb8b00b9f6e2248aa9900

SHA256
1188eef997292c3eb10fb6763f55de642ed95dd1473f4fbe1b425dce561fce71

SHA512
80998d6d67a98984685e391ae34218f3b2b44475961231a9dadf8b3f9e7d1fbd9f8ced5527240df9d9fee9feac6df63e6973a931663effcb3c4b61e5a6c831e6

Download Submit
C:\Windows\SysWOW64\Hbpgbo32.exe

Filesize
227KB

MD5
3887c7faf27dc904f5d74e21fb0c4e13

SHA1
b99555cd86f440317a654c0ecf775bfefb565d63

SHA256
84b911b14cbd5d9ae7f517dcbdcbe2d6a33ff2fcf98599cdaf123cbea12679aa

SHA512
7ac79f06e11fa9d9da0939b03dc9af3e35aa6aaa54dd87eb8f96f54f554d222d2d41782eab8c23d3ab9ab347308175b83b37780fc119fc958b4e11b316d67a9a

Download Submit
C:\Windows\SysWOW64\Hfqlnm32.exe

Filesize
227KB

MD5
c22252ba2e07b90a1f839b945272eb13

SHA1
fdcff05f81fb6355d08b1af1c68bc2584497de49

SHA256
5779b04f40eccc3cb0e7df58f9a58c8cde0f025a42ddd6c1c7b8dbd333c2b339

SHA512
56b73e6c62b2a936c02964424207cac7582e9653c3e0da61b09e3e357441abee01aaec2576601e01bdf8b15e9b057c312bbe4c09806294576a25e28da7e877c8

Download Submit
C:\Windows\SysWOW64\Hiefcj32.exe

Filesize
227KB

MD5
aff566b66a395c22088b9498b19f261a

SHA1
6767310e8666754d0acd8e69fa27dfdedf549075

SHA256
6a5e49cb5599391cc1f0e1cc357caa0237beb89c610e69d970bc302c1c93d5fc

SHA512
3ec6451dc00f81ec1d85237ed65b71842b0710a43721629771609401992533c55c815fc77d7067f70b44ea09371a56a51b6e51147dfb21407aa35e91ed811643

Download Submit
C:\Windows\SysWOW64\Himldi32.exe

Filesize
227KB

MD5
f27d9044d519590f18e8e7198db5e064

SHA1
0d4479a88fa4c7ab1e25e60cfc8bc88c10380b77

SHA256
cc9b8cd27660ef27c17dae8766c47209eb6bfe279d8ad565d448d73f027f7ab0

SHA512
5190e0479dc4cb1f898733d558ddd818e27baae51728d66759beaf62585ab7c8f6212453f09deb3e31b532daf9fd6cadec163c8e8df266205828b634d15e0998

Download Submit
C:\Windows\SysWOW64\Hkkhqd32.exe

Filesize
227KB

MD5
1dfe053343f1d71478b2614d6a4c53a0

SHA1
eeac67fa93baccffec3c712bc3fc6627450cb059

SHA256
b3dd85efc4c134d24dff971139ccc96ba2028d08f6ef310fbec8acc980caf9c0

SHA512
5d48899568d590c7c6aecfcba2e3298e596f394754dc94e8f7935b0e55ede30a7de35172754b8a4fff8e865908cd007bfee2b2fa57af8729ddef080dfb8d8e9e

Download Submit
C:\Windows\SysWOW64\Hmcojh32.exe

Filesize
227KB

MD5
f3231eff1043901bcf25337eb8aa63ce

SHA1
8239d63688d5770cb14af7cbddeeb542af3d1e06

SHA256
042579bd88d6a4dad5e55c83dec63627dc13c3a4535c88771a752527846423d2

SHA512
174f19f76eac357cdcecc97bc285e94dd5c672a332491ec0e5706e64953000cf85bd73d5f66eec963ff58e34802b4bf4e2ad0307b466b3b2b8c0326e18260e54

Download Submit
C:\Windows\SysWOW64\Hmjdjgjo.exe

Filesize
227KB

MD5
6bb3e7461c032bd910afcb6bc36bace7

SHA1
1a1710a7c89cf593c385014d441f8b5bb60b79a7

SHA256
3a376cafc1a613c4edd8f67a6c5344a92860d84ab24f48a1eb781ecb05c84d13

SHA512
e830bf8fc7f315f297d03ae2142d7dfd8c350cc49dd47eca87f4cb7c4b7d992d3ce5b30291f116ec4487c2e6cfc3103f837f01a4da47fee171ff9b1d8603a03b

Download Submit
C:\Windows\SysWOW64\Iblfnn32.exe

Filesize
227KB

MD5
786a6370d52fe63cf4cdc5d2a767a285

SHA1
79490ddfb9bc2fc044d5b280ba6cffec77445922

SHA256
37deb43617071d697e89dfd3232bd854abec5f7ae3331a1f3f14739b3c9b7503

SHA512
985d0e541f2a46a40ae900407a34777f3254c4e12904600dbd0c932a0f40c5ae98f859a1e4390fac9b1b6aaf4cc03b9d5a4488b7926d2540ad82b73f1369983a

Download Submit
C:\Windows\SysWOW64\Iggaah32.exe

Filesize
227KB

MD5
a5968fb8c7690556e190c29db69db5fc

SHA1
fdd73b2b3774f3d81928012af4bb32e51be8f0f4

SHA256
4f5bba98009f964324dc9f0201b55c95a91a1ba42c590f96cdc04d0847d02fdc

SHA512
8db0d7d084a8772df8b279f61f022b0c908c4eb0862a5f93c981bbc72a310d99fc759f7990a93ae873bf271502907d684743a2ba383347d4c10f134d145e1c6d

Download Submit
C:\Windows\SysWOW64\Iicbehnq.exe

Filesize
227KB

MD5
75fd6231db26c35637dc648340f7a2f3

SHA1
2ec5f2c9cca2b477f75547ebb69022c23bb561bc

SHA256
d54fe834793e4d03678dba03f42f60d62ec82a2e60554476a2f67d0eb64b1cda

SHA512
00f9a1d7dfebbd8561b94b394a57bbd7dbd9d583b5f4bbdb278b40eff377a20724dc5852a3c402c373d0502d7de1d5f9a1bbc9686a940fb144d2cf187776562f

Download Submit
C:\Windows\SysWOW64\Ikfabm32.exe

Filesize
227KB

MD5
067b8b37afcfe5c55db469f344208e1f

SHA1
858b7022a6d94da7fe24618e767b94f4f6ed6187

SHA256
594be11f830892f939787e1c82c68a80870509409bea41b7344b27389c7ae8dc

SHA512
a149acec6e73bcae24a8dcec37eab3f4a92fbc24db176a3aea9dc5fb3a30c5440066d2ea4ec07751b68d1d5b6140ed5659f556ffc63b580d47af9a37febcfe1c

Download Submit
C:\Windows\SysWOW64\Ikpaldog.exe

Filesize
227KB

MD5
373a80abd2679119a70ef5c4072bc9aa

SHA1
da033d0007fdca6a4ac62962ac84b31a60464010

SHA256
d6289d9aa370a98afaf62769d0fe3d0223d1f64b3ce88e7668c40551be710c9e

SHA512
77b9898eaab4dcf2ca8a5b136d08cda3044ced7b9521595fc12907165b4b6fbc5075f019b8e0c78a0a101a58e17a14b8628269a66c6672e9948c4f17477afc97

Download Submit
C:\Windows\SysWOW64\Jdbhkk32.exe

Filesize
227KB

MD5
edbbe1a973f473f106678bef91e6fd3a

SHA1
7d38966ba2b81fa4e095436c374bf14b871acb7e

SHA256
b9827ed8f66e0ff6c8f515ca1b16bc35acd1cd9237bea7bc6bc664f4c91895ba

SHA512
1b2d791eed598d1d35e16f5055ae24cb88908f536685f3d6108cf73b0f23c903fc66a0454fd8c99c39e34083ca96237169f12a91371c7eb768378eb3234766ec

Download Submit
C:\Windows\SysWOW64\Jdfjld32.exe

Filesize
227KB

MD5
007f401b660536293b2bde5824421d78

SHA1
98f1815ddd40d3608200785a89ce7ac17b1f8244

SHA256
3e6cb532474e5e50fd604755e7a21f4a3b747c1f905299878241c29b5a5e3b1f

SHA512
2592de31d7169f1d91c18927ccde2b5e0f88be1ae981d52cb42519dbd96eb647315cd862ad13ee7c000cddbedfa3c3625f95c9818141616efcf1585dd36a2adf

Download Submit
C:\Windows\SysWOW64\Jgmjmjnb.exe

Filesize
227KB

MD5
ae7c25054134adc828cd6e56118185df

SHA1
67c107ebdd11f4314168f7da9f0a86331cada4f0

SHA256
92c7653e03f53af120887372d46965f4ed23b7395d0b64c2a22f51df0a186d41

SHA512
8f82b2134629f9ff893d32c545e2a344583c2ed86df30e3c6a0116d3f0bf95b58f2729ba064ea980744faa330b9aefa93a8db7f0bed7b50a4e070687f382efe3

Download Submit
C:\Windows\SysWOW64\Kelkaj32.exe

Filesize
192KB

MD5
62526bfe230a513ac903c9df22bb1167

SHA1
3b29f84b817651556a8da9981b56e98f084feefb

SHA256
aca7f5aee3e869b016a8165d9e4f55a92b60f08eb829f1e29d4d7bfb6381c3ab

SHA512
629deab375ab11f79415e4b454b0da96a4b0abc58c5a7c986be565aabced1980f063193cd9b5a2db9e47951258d02e57ed4b2666ba104797a9262c6384b92554

Download Submit
C:\Windows\SysWOW64\Lcggio32.exe

Filesize
227KB

MD5
aab1e3131baf822ad6a1022d0bc9286a

SHA1
cf5bfbbe33ab9ce4ce11bbd2b6e17d68f67d7796

SHA256
17fc01509f9a760eb76e834b394d1831b2942a35ae364c255ebc84562560ab96

SHA512
16c3f31eaaf04b4437717cf59f46ea0358c9341b53a0a122a9a8c31b1b12e05ec6530344f00cad69aa22dc358a1bf109135d940d701b57e26c7896ea75b78faa

Download Submit
C:\Windows\SysWOW64\Lfjehk32.dll

Filesize
7KB

MD5
8b5717007906db6123dbb8598690416a

SHA1
d1bc25bb898b268ef5b37aa1816b1224dea71394

SHA256
a783342fe8416cd67665ef987800a64ccd898b1a00761c4f5489374bace11b7c

SHA512
b1bf2af1cc6dfe523b71a1985c38e3b3997d2b78ea2b905392518cef69347d3e25682f3ccbd49c658c7d2d7de95726cf1c694b2a6e034b0989609c88e46a26f9

Download Submit
C:\Windows\SysWOW64\Lgmngglp.exe

Filesize
227KB

MD5
8c065714d45561ab4341e07f955ae99f

SHA1
9153c6730dcbedb81c19c4fb12d03df290dce79a

SHA256
403a551443a3db1a44cd571e989a9daaeaacde8cf0f0c67f9e5a368e4750db03

SHA512
dca3c723c8c2ea448029abcbd9b7e754c7bc0318c6ab54081bbd0b70f05d697d4c1c5fece5345f73bf171fb5734d7ced4f1717ae58045f4dc24de879bd02bf8b

Download Submit
C:\Windows\SysWOW64\Lnjgfb32.exe

Filesize
227KB

MD5
5dbcd0cade50098bd2e8106293b46cee

SHA1
a69cef9d42463674ab06ee2254c1806eac4db9d4

SHA256
406d0e8304eaacd54c93769d0b9b56fe452931f4244bc0b5429b8e5abd516ada

SHA512
0297a7ef86292b8d8934a0783b35eadcc419f0f9f9277230448ef2424d4e30109a4eeb916cd5589ce721ed84b008ebb04adda8078b7a5e18800544808a861f5e

Download Submit
C:\Windows\SysWOW64\Mfqlfb32.exe

Filesize
227KB

MD5
c873b577fa618c23d222d2ae84cd4bea

SHA1
c8c70fcd73a5f0513e1c898dca496e50b46fd87d

SHA256
ef73d6586da22f010be0c289cf0261f5639f9afb7135e1d757a211f43cb02cd8

SHA512
c3a37b9e411e27ab37d8eb8212349a35532a11e7fa4a78f76ae146b7eccb5c4ba3866000f390d465eb2a613d2dd73bc0180a36b3fae1c0f9261e2f8a3b1c69d5

Download Submit
C:\Windows\SysWOW64\Ncbknfed.exe

Filesize
227KB

MD5
143426080f05956008231ceb0dc17f3f

SHA1
da9fdceccfd899b6697d7e789ea1512e47c98bf3

SHA256
1220ece76573e1916fd553be7c53e3e1fd99ffc1f3ba737aec934cfcbd9a16d6

SHA512
50ee110fe7b7b5b26d210fefa827d82d79d1b6465aa743462a2064b0e44e3cc6841ecf6aac15c866b59717020101f1e42e88e0fff460227640a488678acfc0ea

Download Submit
C:\Windows\SysWOW64\Nflkbanj.exe

Filesize
227KB

MD5
f580e4073bc13bfd3561d967bbe167c8

SHA1
7162f4aca253267bddc43c9c63068fe9feaae045

SHA256
227935480dcda7a69c48885c41c337a0017b8b9cc53433e712181c86605f835f

SHA512
f6ad63d9a41fb5bd84b2e8bfa73063b75a7696172ba16d8017a298760f70ee41cdbf59569d38499ccf3c081e42e17aa5486fd3d02901203b92e8df94daf21eb0

Download Submit
C:\Windows\SysWOW64\Ocbddc32.exe

Filesize
227KB

MD5
000b696fb56e0810230fb9bebdd3d66f

SHA1
d234bfc1affc95695bb0b64754dd5a0da4e7b395

SHA256
22f6efcf81e6ce79fa6e4c36847a9942fdb65c0d48e20ac046f29b72baeaeee6

SHA512
57d90b62cda3de85e6c9efbdfe709227e48140a1b5aaa41e87bdcf37651121be941b46ee33a40442c653cb85858865abf614673403dd5d5b2cf956f4eaf5f84b

Download Submit
C:\Windows\SysWOW64\Ogmijllo.exe

Filesize
227KB

MD5
89186ba7589d379e0263418b84298f58

SHA1
3f2b9ccb5a03c273d9fb74d9cee70d8488142f08

SHA256
a2911b5e7a1e307953b95be475c98bc5890696374db92ea0069b563a189fe42b

SHA512
1a735abe424f606614c7e169a0d11ed566e2e1e24133a73075f650dbdf693d59100c248617d3b984094e2046356e207b922f91e904c3aebede56b138efeaa4cd

Download Submit
C:\Windows\SysWOW64\Pdifoehl.exe

Filesize
227KB

MD5
5e7357a34405803388042d7577cc4e3f

SHA1
8c9b8305a1d062f6bc825a8e02721c4c7874fa30

SHA256
3fcb26ec2860e3261a4ca0a00ebe83f6fbcdd87c84fcde30f8c582c859aeebe9

SHA512
816f6aff5f994093cdaf80d995058fbd90052f981c58fdbb8d88ae8c6d64415807eaace7b06233d0b6c6ee1ff0e915b5cbfaf1066d93cd59bdf7420026dc35b7

Download Submit
C:\Windows\SysWOW64\Phcomcng.exe

Filesize
227KB

MD5
b47e998ba01591911c52104e90f79502

SHA1
6eaeed8d5009e46502b525cb018cce0ed6a569f7

SHA256
1c63251ef9a4873c108770c3ef9c9037267d5ed5256a35d8d853306b07c20b5f

SHA512
78c5d16d57c00c5b534d601ea48fb75eb5e1f4e06440b883ddf9a8c097bfbd550c6643baf3993d63391a60896bca0791a8733861c4715a7bc4912d9ac413a287

Download Submit
C:\Windows\SysWOW64\Pidabppl.exe

Filesize
227KB

MD5
110ee03d7af344bf9ca879fcd32b4a51

SHA1
021f6485a10057d103a5906e0be966a5e7aff6fd

SHA256
183b35b54c47a373aae848d32385fad0150726207e6d0f719dff350ba4929f5d

SHA512
ce4271346ed5e4c311796a9101d901d691dc81795142332bcf5cb6da5aa80d17e1d8ba6c647b5d7fb837f5130abb5144b76a148192b39c194dc4814fdb4f2e0a

Download Submit
C:\Windows\SysWOW64\Ppamophb.exe

Filesize
128KB

MD5
80dd360875d3d378279a5a3380951c5f

SHA1
70997b3b23b898fd374d837ecd3abccebb2b00ea

SHA256
6f6dc9ae1cf0e62255213e21feea7e1d3714a0f0149465d48a1eca50eac5ca93

SHA512
36b0e704deba025f80b6d5262e6087cebfdab3bf9cd0176e6c61bf5618d9c72a4647e49a3ccbc7d742d4ba7559eb339ac30a50821f6254a362c4385d5374055b

Download Submit
memory/552-362-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/752-311-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/832-71-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/904-67-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1120-147-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1612-28-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1612-144-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1700-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1700-121-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1712-355-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1856-54-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2036-138-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2036-215-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2136-169-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2216-244-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2340-235-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2376-335-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-248-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2404-156-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2448-53-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2456-187-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2468-185-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2468-88-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2732-152-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2740-298-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2740-208-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2832-348-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2832-284-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2864-296-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2880-124-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2880-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3076-227-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3124-323-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3132-173-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3132-277-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3284-100-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3324-341-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3324-278-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3368-269-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3464-189-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3464-290-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3488-329-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3640-361-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3640-299-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3764-253-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3892-274-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4000-66-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4228-104-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4228-197-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4320-163-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4320-72-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4636-118-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4708-199-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4708-291-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4720-130-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4772-319-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4800-276-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4812-84-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4820-346-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4852-238-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4996-309-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5020-349-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5032-112-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5032-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.