3f94a978cac5cb55f97aa968893a9d1d720fa9042937b25266106980d2ad2a21

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f94a978cac5cb55f97aa968893a9d1d720fa9042937b25266106980d2ad2a21.exe
Size

245KB
MD5

cc7ce4403d50190d7500c2f93df4d591
SHA1

783282ae92fd50065aeaefcdfe4ef5c4ff2e3743
SHA256

3f94a978cac5cb55f97aa968893a9d1d720fa9042937b25266106980d2ad2a21
SHA512

d1d32677e53c8b4c187ebcf543025085fd48eed05ac0093e25156ae38df5ae7babab3dee7d8383b30af90339a29b2d204316721a305b436fc72c61bc23ed394e
SSDEEP

1536:v5bKWjE/x//gBsX3bneLC0sgi5X/4cXeXvubKrFEwMEwKhbArEwKhQL4cXeXvubW:R+XYsnbnIEgi5Xwago+bAr+Qka

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jidbflcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckedalaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqfdnhfk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jidbflcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjghpn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hckjacjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocpgod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpdelajl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkceffcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chghdqbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldoaklml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnlhfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikpaldog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfcfml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chdkoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fllpbldb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkkhqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgopffec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qbgqio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbgipldd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dceohhja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbdgfa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jimekgff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kiidgeki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Megdccmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aclpap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abpcon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhdbhcck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddmhja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gofkje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbpgbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndokbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acjjfggb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibqpimpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Leihbeib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgmngglp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cogmkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofqpqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjpaooda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jeklag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojjffddl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcdmga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmiciaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbfkbhpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boepel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdfbibnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckcgkldl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipdqba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbdolh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oboaabga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aniajnnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cddecc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkhbdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paegjl32.exe

Executes dropped EXE 64 IoCs

pid	Process
2428	Jfffjqdf.exe
4416	Jidbflcj.exe
2072	Jaljgidl.exe
4884	Jbmfoa32.exe
2240	Jfhbppbc.exe
1084	Jmbklj32.exe
3068	Jpaghf32.exe
4060	Jbocea32.exe
2036	Jkfkfohj.exe
4876	Kaqcbi32.exe
3168	Kdopod32.exe
4536	Kmgdgjek.exe
1516	Kpepcedo.exe
1544	Kmjqmi32.exe
4556	Kphmie32.exe
3112	Kipabjil.exe
3788	Kagichjo.exe
1564	Kgdbkohf.exe
4804	Kpmfddnf.exe
4220	Kckbqpnj.exe
5012	Liekmj32.exe
4920	Lgikfn32.exe
3952	Lmccchkn.exe
4836	Ldmlpbbj.exe
4404	Lijdhiaa.exe
3672	Ldohebqh.exe
424	Lilanioo.exe
720	Lpfijcfl.exe
1160	Lcdegnep.exe
768	Lnjjdgee.exe
1064	Lphfpbdi.exe
428	Lknjmkdo.exe
5076	Mpkbebbf.exe
2580	Mciobn32.exe
3872	Mkpgck32.exe
2524	Majopeii.exe
1360	Mkbchk32.exe
4312	Mjhqjg32.exe
4720	Mpaifalo.exe
1972	Mjjmog32.exe
2740	Mpdelajl.exe
432	Mgnnhk32.exe
1780	Ndbnboqb.exe
4316	Njogjfoj.exe
4036	Nqiogp32.exe
2160	Ngcgcjnc.exe
4924	Nbhkac32.exe
3620	Ndghmo32.exe
3200	Nkqpjidj.exe
1144	Nbkhfc32.exe
4472	Nqmhbpba.exe
2244	Nggqoj32.exe
3480	Njfmke32.exe
2512	Nqpego32.exe
1952	Okeieh32.exe
2224	Oboaabga.exe
1668	Ogljjiei.exe
3032	Ojjffddl.exe
4292	Oqdoboli.exe
2732	Occkojkm.exe
1148	Odbgim32.exe
5008	Onklabip.exe
2976	Oqihnn32.exe
4708	Ocgdji32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Lcdegnep.exe	Lpfijcfl.exe
File created	C:\Windows\SysWOW64\Mhkngh32.dll	Klqcioba.exe
File created	C:\Windows\SysWOW64\Idodkeom.dll	Mlhbal32.exe
File created	C:\Windows\SysWOW64\Mfilim32.dll	Pfjcgn32.exe
File created	C:\Windows\SysWOW64\Ampkof32.exe	Ajanck32.exe
File opened for modification	C:\Windows\SysWOW64\Bfdodjhm.exe	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Dhmgki32.exe	Deokon32.exe
File created	C:\Windows\SysWOW64\Ahhblemi.exe	Aejfpjne.exe
File created	C:\Windows\SysWOW64\Dhnnep32.exe	Deoaid32.exe
File created	C:\Windows\SysWOW64\Ehimanbq.exe	Eekaebcm.exe
File created	C:\Windows\SysWOW64\Hhhbcf32.dll	Fbpnkama.exe
File opened for modification	C:\Windows\SysWOW64\Ncfdie32.exe	Nphhmj32.exe
File created	C:\Windows\SysWOW64\Jeiooj32.dll	Jaljgidl.exe
File created	C:\Windows\SysWOW64\Bjbndobo.exe	Bhdbhcck.exe
File created	C:\Windows\SysWOW64\Eeanii32.dll	Jcbihpel.exe
File opened for modification	C:\Windows\SysWOW64\Belebq32.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Ceckcp32.exe	Cjmgfgdf.exe
File opened for modification	C:\Windows\SysWOW64\Njogjfoj.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Aklmno32.dll	Abpcon32.exe
File created	C:\Windows\SysWOW64\Eocqqdjh.dll	Dboigi32.exe
File opened for modification	C:\Windows\SysWOW64\Hofdacke.exe	Hkkhqd32.exe
File created	C:\Windows\SysWOW64\Kjqkei32.dll	Icifbang.exe
File created	C:\Windows\SysWOW64\Pflplnlg.exe	Pcncpbmd.exe
File created	C:\Windows\SysWOW64\Bahmfj32.exe	Aniajnnn.exe
File created	C:\Windows\SysWOW64\Bdhfhe32.exe	Bajjli32.exe
File opened for modification	C:\Windows\SysWOW64\Lpebpm32.exe	Lljfpnjg.exe
File created	C:\Windows\SysWOW64\Pfaigm32.exe	Pgnilpah.exe
File opened for modification	C:\Windows\SysWOW64\Qeemej32.exe	Qbgqio32.exe
File created	C:\Windows\SysWOW64\Bhdbhcck.exe	Bdhfhe32.exe
File opened for modification	C:\Windows\SysWOW64\Fljcmlfd.exe	Eepjpb32.exe
File opened for modification	C:\Windows\SysWOW64\Gofkje32.exe	Gkkojgao.exe
File created	C:\Windows\SysWOW64\Jbeidl32.exe	Jcbihpel.exe
File created	C:\Windows\SysWOW64\Ldjhpl32.exe	Lmppcbjd.exe
File created	C:\Windows\SysWOW64\Gcgnkd32.dll	Nnneknob.exe
File created	C:\Windows\SysWOW64\Amjknl32.dll	Daekdooc.exe
File created	C:\Windows\SysWOW64\Gpnkgo32.dll	Mkbchk32.exe
File opened for modification	C:\Windows\SysWOW64\Pgopffec.exe	Paegjl32.exe
File created	C:\Windows\SysWOW64\Dahode32.exe	Dceohhja.exe
File created	C:\Windows\SysWOW64\Ocgdji32.exe	Oqihnn32.exe
File created	C:\Windows\SysWOW64\Nljofl32.exe	Nepgjaeg.exe
File opened for modification	C:\Windows\SysWOW64\Ajanck32.exe	Qffbbldm.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Ddjejl32.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Hnicfelf.dll	Qecppkdm.exe
File opened for modification	C:\Windows\SysWOW64\Abkjdnoa.exe	Anpncp32.exe
File created	C:\Windows\SysWOW64\Njkdbljm.dll	Ecmeig32.exe
File created	C:\Windows\SysWOW64\Gmoeoidl.exe	Gdhmnlcj.exe
File created	C:\Windows\SysWOW64\Kpihae32.dll	Gmoeoidl.exe
File created	C:\Windows\SysWOW64\Hfgefhai.dll	Hobkfd32.exe
File opened for modification	C:\Windows\SysWOW64\Chagok32.exe	Cdfkolkf.exe
File created	C:\Windows\SysWOW64\Bejogg32.exe	Bjdkjo32.exe
File created	C:\Windows\SysWOW64\Fhcpgmjf.exe	Ffddka32.exe
File opened for modification	C:\Windows\SysWOW64\Mlcifmbl.exe	Meiaib32.exe
File created	C:\Windows\SysWOW64\Hmmblqfc.dll	Pdmpje32.exe
File created	C:\Windows\SysWOW64\Ndhkdnkh.dll	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Maickled.dll	Chokikeb.exe
File created	C:\Windows\SysWOW64\Ndbnboqb.exe	Mgnnhk32.exe
File opened for modification	C:\Windows\SysWOW64\Iemppiab.exe	Ibnccmbo.exe
File opened for modification	C:\Windows\SysWOW64\Kdeoemeg.exe	Klngdpdd.exe
File opened for modification	C:\Windows\SysWOW64\Pcbmka32.exe	Pdpmpdbd.exe
File created	C:\Windows\SysWOW64\Qdldlm32.dll	Pnfkma32.exe
File created	C:\Windows\SysWOW64\Mcgdgamg.dll	Cefoce32.exe
File created	C:\Windows\SysWOW64\Gogiek32.dll	Ehgqln32.exe
File created	C:\Windows\SysWOW64\Bcjlcn32.exe	Balpgb32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12200	12040	WerFault.exe	588

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cefoce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogqnnn32.dll"	Dhkapp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ickchq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocgmpccl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pggbkagp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmidog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbcaee32.dll"	Ceoibflm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibcmom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdgljmcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lphoelqn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ognpebpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qceiaa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddpeoafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijcoimpn.dll"	Gbdgfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfbploob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gcfqfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdopod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmfldb32.dll"	Cdfbibnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nckndeni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkobg32.dll"	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoglcqao.dll"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbnpqk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eolpmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eepjpb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghlcnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnbnoffm.dll"	Jfhlejnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcmabg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Miifeq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahhblemi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbddcoei.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chdkoa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipdqba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nniadn32.dll"	Mbfkbhpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngbpidjh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogljjiei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcdgbkil.dll"	Lenamdem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgefeajb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcmdhh32.dll"	Fafkecel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qegnoi32.dll"	Hfcicmqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knfoif32.dll"	Oflgep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohjdgn32.dll"	Ofnckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfddbh32.dll"	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogljjiei.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojjffddl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgopffec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qghlmgij.dll"	Gdeqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpoefk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbmfoa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cogmkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekcpbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ilghlc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kipkhdeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndokbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nckndeni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qdldlm32.dll"	Pnfkma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkaejf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkblkg32.dll"	Ibqpimpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Leihbeib.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 2428	4740	3f94a978cac5cb55f97aa968893a9d1d720fa9042937b25266106980d2ad2a21.exe	91
PID 4740 wrote to memory of 2428	4740	3f94a978cac5cb55f97aa968893a9d1d720fa9042937b25266106980d2ad2a21.exe	91
PID 4740 wrote to memory of 2428	4740	3f94a978cac5cb55f97aa968893a9d1d720fa9042937b25266106980d2ad2a21.exe	91
PID 2428 wrote to memory of 4416	2428	Jfffjqdf.exe	92
PID 2428 wrote to memory of 4416	2428	Jfffjqdf.exe	92
PID 2428 wrote to memory of 4416	2428	Jfffjqdf.exe	92
PID 4416 wrote to memory of 2072	4416	Jidbflcj.exe	93
PID 4416 wrote to memory of 2072	4416	Jidbflcj.exe	93
PID 4416 wrote to memory of 2072	4416	Jidbflcj.exe	93
PID 2072 wrote to memory of 4884	2072	Jaljgidl.exe	94
PID 2072 wrote to memory of 4884	2072	Jaljgidl.exe	94
PID 2072 wrote to memory of 4884	2072	Jaljgidl.exe	94
PID 4884 wrote to memory of 2240	4884	Jbmfoa32.exe	95
PID 4884 wrote to memory of 2240	4884	Jbmfoa32.exe	95
PID 4884 wrote to memory of 2240	4884	Jbmfoa32.exe	95
PID 2240 wrote to memory of 1084	2240	Jfhbppbc.exe	96
PID 2240 wrote to memory of 1084	2240	Jfhbppbc.exe	96
PID 2240 wrote to memory of 1084	2240	Jfhbppbc.exe	96
PID 1084 wrote to memory of 3068	1084	Jmbklj32.exe	97
PID 1084 wrote to memory of 3068	1084	Jmbklj32.exe	97
PID 1084 wrote to memory of 3068	1084	Jmbklj32.exe	97
PID 3068 wrote to memory of 4060	3068	Jpaghf32.exe	98
PID 3068 wrote to memory of 4060	3068	Jpaghf32.exe	98
PID 3068 wrote to memory of 4060	3068	Jpaghf32.exe	98
PID 4060 wrote to memory of 2036	4060	Jbocea32.exe	99
PID 4060 wrote to memory of 2036	4060	Jbocea32.exe	99
PID 4060 wrote to memory of 2036	4060	Jbocea32.exe	99
PID 2036 wrote to memory of 4876	2036	Jkfkfohj.exe	100
PID 2036 wrote to memory of 4876	2036	Jkfkfohj.exe	100
PID 2036 wrote to memory of 4876	2036	Jkfkfohj.exe	100
PID 4876 wrote to memory of 3168	4876	Kaqcbi32.exe	101
PID 4876 wrote to memory of 3168	4876	Kaqcbi32.exe	101
PID 4876 wrote to memory of 3168	4876	Kaqcbi32.exe	101
PID 3168 wrote to memory of 4536	3168	Kdopod32.exe	102
PID 3168 wrote to memory of 4536	3168	Kdopod32.exe	102
PID 3168 wrote to memory of 4536	3168	Kdopod32.exe	102
PID 4536 wrote to memory of 1516	4536	Kmgdgjek.exe	103
PID 4536 wrote to memory of 1516	4536	Kmgdgjek.exe	103
PID 4536 wrote to memory of 1516	4536	Kmgdgjek.exe	103
PID 1516 wrote to memory of 1544	1516	Kpepcedo.exe	104
PID 1516 wrote to memory of 1544	1516	Kpepcedo.exe	104
PID 1516 wrote to memory of 1544	1516	Kpepcedo.exe	104
PID 1544 wrote to memory of 4556	1544	Kmjqmi32.exe	105
PID 1544 wrote to memory of 4556	1544	Kmjqmi32.exe	105
PID 1544 wrote to memory of 4556	1544	Kmjqmi32.exe	105
PID 4556 wrote to memory of 3112	4556	Kphmie32.exe	106
PID 4556 wrote to memory of 3112	4556	Kphmie32.exe	106
PID 4556 wrote to memory of 3112	4556	Kphmie32.exe	106
PID 3112 wrote to memory of 3788	3112	Kipabjil.exe	107
PID 3112 wrote to memory of 3788	3112	Kipabjil.exe	107
PID 3112 wrote to memory of 3788	3112	Kipabjil.exe	107
PID 3788 wrote to memory of 1564	3788	Kagichjo.exe	109
PID 3788 wrote to memory of 1564	3788	Kagichjo.exe	109
PID 3788 wrote to memory of 1564	3788	Kagichjo.exe	109
PID 1564 wrote to memory of 4804	1564	Kgdbkohf.exe	111
PID 1564 wrote to memory of 4804	1564	Kgdbkohf.exe	111
PID 1564 wrote to memory of 4804	1564	Kgdbkohf.exe	111
PID 4804 wrote to memory of 4220	4804	Kpmfddnf.exe	112
PID 4804 wrote to memory of 4220	4804	Kpmfddnf.exe	112
PID 4804 wrote to memory of 4220	4804	Kpmfddnf.exe	112
PID 4220 wrote to memory of 5012	4220	Kckbqpnj.exe	113
PID 4220 wrote to memory of 5012	4220	Kckbqpnj.exe	113
PID 4220 wrote to memory of 5012	4220	Kckbqpnj.exe	113
PID 5012 wrote to memory of 4920	5012	Liekmj32.exe	114

C:\Users\Admin\AppData\Local\Temp\3f94a978cac5cb55f97aa968893a9d1d720fa9042937b25266106980d2ad2a21.exe
"C:\Users\Admin\AppData\Local\Temp\3f94a978cac5cb55f97aa968893a9d1d720fa9042937b25266106980d2ad2a21.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\Jfffjqdf.exe
  C:\Windows\system32\Jfffjqdf.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\Jidbflcj.exe
    C:\Windows\system32\Jidbflcj.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Windows\SysWOW64\Jaljgidl.exe
      C:\Windows\system32\Jaljgidl.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2072
    - - C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4884
      - C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3068
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3112
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1564
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4220
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        23⤵
        Executes dropped EXE
        
        PID:4920
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        24⤵
        Executes dropped EXE
        
        PID:3952
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        25⤵
        Executes dropped EXE
        
        PID:4836
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        26⤵
        Executes dropped EXE
        
        PID:4404
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        27⤵
        Executes dropped EXE
        
        PID:3672
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        28⤵
        Executes dropped EXE
        
        PID:424
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:720
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        30⤵
        Executes dropped EXE
        
        PID:1160
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        31⤵
        Executes dropped EXE
        
        PID:768
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        32⤵
        Executes dropped EXE
        
        PID:1064
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:428
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5076
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        35⤵
        Executes dropped EXE
        
        PID:2580
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        36⤵
        Executes dropped EXE
        
        PID:3872
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        37⤵
        Executes dropped EXE
        
        PID:2524
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1360
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        39⤵
        Executes dropped EXE
        
        PID:4312
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        40⤵
        Executes dropped EXE
        
        PID:4720
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        41⤵
        Executes dropped EXE
        
        PID:1972
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2740
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:432
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1780
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        45⤵
        Executes dropped EXE
        
        PID:4316
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4036
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        47⤵
        Executes dropped EXE
        
        PID:2160
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        48⤵
        Executes dropped EXE
        
        PID:4924
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        49⤵
        Executes dropped EXE
        
        PID:3620
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        50⤵
        Executes dropped EXE
        
        PID:3200
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        51⤵
        Executes dropped EXE
        
        PID:1144
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        52⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        53⤵
        Executes dropped EXE
        
        PID:2244
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        54⤵
        Executes dropped EXE
        
        PID:3480
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        55⤵
        Executes dropped EXE
        
        PID:2512
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        56⤵
        Executes dropped EXE
        
        PID:1952
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2224
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1668
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3032
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        60⤵
        Executes dropped EXE
        
        PID:4292
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        61⤵
        Executes dropped EXE
        
        PID:2732
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        62⤵
        Executes dropped EXE
        
        PID:1148
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        63⤵
        Executes dropped EXE
        
        PID:5008
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2976
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        65⤵
        Executes dropped EXE
        
        PID:4708
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        66⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        67⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        68⤵
        
        PID:3496
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        69⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        70⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        71⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3144
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        73⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        74⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        75⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        76⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        77⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        78⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        79⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4756
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3836
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1396
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        82⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        83⤵
        Modifies registry class
        
        PID:4488
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        84⤵
        Drops file in System32 directory
        
        PID:3216
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        85⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        86⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5212
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        88⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        89⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5328
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        91⤵
        Drops file in System32 directory
        
        PID:5372
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        92⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        93⤵
        Drops file in System32 directory
        
        PID:5456
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        94⤵
        Modifies registry class
        
        PID:5492
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        95⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        96⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        97⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        98⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        99⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        101⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        102⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        103⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        104⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        105⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5976
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        107⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        108⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        109⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6132
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5164
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        112⤵
        Drops file in System32 directory
        
        PID:5208
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        113⤵
        Drops file in System32 directory
        
        PID:5300
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5368
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        115⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        116⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        117⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        118⤵
        Drops file in System32 directory
        
        PID:5636
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        119⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        120⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5844
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        122⤵
        Modifies registry class
        
        PID:5916
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        123⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        124⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        125⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5180
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        127⤵
        Modifies registry class
        
        PID:5284
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        128⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        130⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5688
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        132⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        133⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        135⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        136⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        137⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        138⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5452
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5596
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5760
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        141⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4972
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5360
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        144⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:392
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        146⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        147⤵
        Drops file in System32 directory
        
        PID:5584
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        148⤵
        Modifies registry class
        
        PID:6000
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        149⤵
        Modifies registry class
        
        PID:1980
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        150⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        151⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        152⤵
        Drops file in System32 directory
        
        PID:6196
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        153⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        154⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        155⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        156⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        157⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        158⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        159⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6532
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        161⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        162⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        163⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        164⤵
        Modifies registry class
        
        PID:6684
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        165⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        166⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        167⤵
        Modifies registry class
        
        PID:6796
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        168⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        169⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        170⤵
        Drops file in System32 directory
        
        PID:6908
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        171⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        172⤵
        Drops file in System32 directory
        
        PID:6988
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        173⤵
        Drops file in System32 directory
        
        PID:7028
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        174⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        175⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        176⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        177⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        178⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        179⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6616
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        180⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        181⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        182⤵
        Modifies registry class
        
        PID:6820
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        183⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6948
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        185⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        186⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        187⤵
        Drops file in System32 directory
        
        PID:7156
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        188⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        189⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        190⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        191⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        192⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        193⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        194⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        195⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        196⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        197⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        198⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        199⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        200⤵
        Drops file in System32 directory
        
        PID:6384
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        201⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        202⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6788
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        204⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        205⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        206⤵
        Modifies registry class
        
        PID:6328
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        207⤵
        Drops file in System32 directory
        
        PID:6484
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6944
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        210⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        211⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        212⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        213⤵
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        214⤵
        Modifies registry class
        
        PID:7188
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        215⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        216⤵
        Modifies registry class
        
        PID:7264
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        217⤵
        Drops file in System32 directory
        
        PID:7300
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        218⤵
        Drops file in System32 directory
        
        PID:7336
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        219⤵
        Modifies registry class
        
        PID:7372
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        220⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        221⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        222⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        223⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7580
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        225⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        226⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        227⤵
        Drops file in System32 directory
        
        PID:7696
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7736
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        229⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        230⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        231⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        232⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7928
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        234⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        235⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        236⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8084
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        238⤵
        Modifies registry class
        
        PID:8124
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        239⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7176
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        241⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        242⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        243⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        244⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        245⤵
        Drops file in System32 directory
        
        PID:7508
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        246⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        247⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        248⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        249⤵
        Modifies registry class
        
        PID:7800
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        250⤵
        Drops file in System32 directory
        
        PID:7840
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        251⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        252⤵
        Modifies registry class
        
        PID:7984
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        253⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8108
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        255⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        256⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7368
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        258⤵
        Modifies registry class
        
        PID:7492
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        259⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7732
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        261⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        262⤵
        Drops file in System32 directory
        
        PID:7956
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        263⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        264⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        265⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        266⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        267⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        268⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        269⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        270⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        271⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        272⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        273⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        274⤵
        Modifies registry class
        
        PID:7688
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8220
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        276⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        277⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        278⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8392
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        280⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        281⤵
        Modifies registry class
        
        PID:8472
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        282⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        283⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        284⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        285⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        286⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        287⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        288⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        289⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        290⤵
        Modifies registry class
        
        PID:8884
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        291⤵
        Drops file in System32 directory
        
        PID:8928
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        292⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        293⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        294⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        295⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        296⤵
        Drops file in System32 directory
        
        PID:9152
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        297⤵
        Modifies registry class
        
        PID:9192
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        298⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8236
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        300⤵
        Drops file in System32 directory
        
        PID:8296
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        301⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        302⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        303⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        304⤵
        Modifies registry class
        
        PID:8584
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        305⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8740
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8836
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        308⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        309⤵
        Drops file in System32 directory
        
        PID:8976
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        310⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9088
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        312⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        313⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8312
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        315⤵
        Modifies registry class
        
        PID:8416
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8500
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        317⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        318⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        319⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        320⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        321⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8276
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        323⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        324⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        325⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        326⤵
        Drops file in System32 directory
        
        PID:7892
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        327⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        328⤵
        Modifies registry class
        
        PID:8292
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        329⤵
        Modifies registry class
        
        PID:9220
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        330⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        331⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        332⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        333⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        334⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        335⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        336⤵
        Modifies registry class
        
        PID:9536
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        337⤵
        Drops file in System32 directory
        
        PID:9580
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9616
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        339⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        340⤵
        Drops file in System32 directory
        
        PID:9700
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        341⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        342⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        343⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        344⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        345⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        346⤵
        Drops file in System32 directory
        
        PID:9944
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        347⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        348⤵
        Modifies registry class
        
        PID:10016
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        349⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10092
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        351⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        352⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        353⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        354⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        355⤵
        Drops file in System32 directory
        
        PID:9320
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        356⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        357⤵
        Modifies registry class
        
        PID:9456
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        358⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        359⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        360⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        361⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        362⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        363⤵
        Modifies registry class
        
        PID:9880
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        364⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        365⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        366⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10184
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        368⤵
        Modifies registry class
        
        PID:9276
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        369⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        370⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        371⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        372⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        373⤵
        Modifies registry class
        
        PID:9892
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9996
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        375⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9312
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        377⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        378⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        379⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        380⤵
        Modifies registry class
        
        PID:10088
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        381⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        382⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        383⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        384⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        385⤵
        Modifies registry class
        
        PID:9732
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        386⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        387⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        388⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        389⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        390⤵
        Modifies registry class
        
        PID:10332
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        391⤵
        Drops file in System32 directory
        
        PID:10368
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        392⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        393⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        394⤵
        Drops file in System32 directory
        
        PID:10520
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        395⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        396⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        397⤵
        Drops file in System32 directory
        
        PID:10644
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        398⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        399⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        400⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        401⤵
        Modifies registry class
        
        PID:10796
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        402⤵
        Drops file in System32 directory
        
        PID:10836
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        403⤵
        Modifies registry class
        
        PID:10872
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        404⤵
        Drops file in System32 directory
        
        PID:10908
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        405⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        406⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        407⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        408⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        409⤵
        Modifies registry class
        
        PID:11108
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11148
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        411⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        412⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        413⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        414⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        415⤵
        Drops file in System32 directory
        
        PID:10380
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        416⤵
        Drops file in System32 directory
        
        PID:10448
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        417⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        418⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        419⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        420⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        421⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10868
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        423⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        424⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        425⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        426⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        427⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        428⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        429⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        430⤵
        Modifies registry class
        
        PID:10452
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        431⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        432⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        433⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        434⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        435⤵
        Modifies registry class
        
        PID:3320
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        436⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        437⤵
        Drops file in System32 directory
        
        PID:11092
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        438⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        439⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        440⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        441⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10860
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        442⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        443⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        444⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11172
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        445⤵
        Drops file in System32 directory
        
        PID:10356
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        446⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        447⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        448⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        449⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        450⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        451⤵
        Drops file in System32 directory
        
        PID:4752
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        452⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        453⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11280
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        454⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        455⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        456⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11396
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        457⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11432
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        458⤵
        
        PID:11472
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        459⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        460⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        461⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        462⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11624
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        463⤵
        Drops file in System32 directory
        
        PID:11660
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        464⤵
        Modifies registry class
        
        PID:11696
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        465⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11732
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        466⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        467⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        468⤵
        Drops file in System32 directory
        
        PID:11852
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        469⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        470⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        471⤵
        Drops file in System32 directory
        
        PID:11972
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        472⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        473⤵
        Modifies registry class
        
        PID:12052
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        474⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        475⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        476⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        477⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        478⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        479⤵
        
        PID:12284
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        480⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        481⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        482⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        483⤵
        
        PID:11508
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        484⤵
        Drops file in System32 directory
        
        PID:11584
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        485⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11644
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        486⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        487⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        488⤵
        Drops file in System32 directory
        
        PID:11848
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        489⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        490⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        491⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12040 -s 396
        492⤵
        Program crash
        
        PID:12200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 12040 -ip 12040
1⤵
PID:12160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ahoimd32.exe

Filesize
245KB

MD5
ae88465ac61666c823bfa52f2c992e61

SHA1
6d11da4341ec74541b4680a82d3d78f0f303960b

SHA256
99d8434a0e8c71a2fbb9f5bdb4059238a142bcb986f2ae3cb1376e3c7315735e

SHA512
0b7a4aae912e6083ced1ea3be6a67c3356f880fa144060d946496724bd225c5d4e938296969959c2e6b4f8a45b3b5e9a33d06bc4bf8bf6b6968932e47afb6bda

Download Submit
C:\Windows\SysWOW64\Cabfga32.exe

Filesize
245KB

MD5
c9cc3009903a78f1a27f96a3ca771c79

SHA1
2e13cc291088da3837ad86b41510534b74b405a1

SHA256
c55f5de80d1f477d750d086c0f5db4c7b5c3412a7c54dbd66cf02a8d4d654389

SHA512
99522320a7d60c2d13f9207d70a454593c0cedaf44e0472e4fa2bea8f24d9935df5cc767c7005fdbf9141c8335ee638e0884e17da74d8e7bc455f78b68dd61ef

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
245KB

MD5
9f7ffcbceb03cdf4f91fbb957424f368

SHA1
12b6e552366d9d7ddc98aeb156888ed43bb7726d

SHA256
c00a08b16f278f0145bd4fbf15de3d09bb7dfaaab906af24dc2c54bdfde13222

SHA512
e6029e6702bb3859226955adac61fc433da0b8170c97cf9efee3905442ccb7b81700cebc121f5bcd9129af29c438d08b3425c2fad5141d2340d3801db9669cf9

Download Submit
C:\Windows\SysWOW64\Dkoggkjo.exe

Filesize
245KB

MD5
5ccc4e9124ab14114d35b3e3473eca95

SHA1
b5cfaa2f0008e0f834f17ef29de4cd7d84efcffb

SHA256
4c339f389a0c3ae51cffa9dc7f19e148345baadc9541f39d0e8ceb1d908f3d0d

SHA512
fc4408ec05315dff34b4d650e28307b014119a0e5bb3f4feac407e60d0099461e59fe0ba844a57e93f0b33db16a145a88e2ff54aff2807382845812db0a14f2a

Download Submit
C:\Windows\SysWOW64\Eepjpb32.exe

Filesize
245KB

MD5
7b474fb6e266d9853640c4a06ae58960

SHA1
80f6331f5f6e95495fe4f4faa2ba514d7f71301f

SHA256
dd703300838cbdd4bf845aae13bed3cd78286943394fa5ddca97f2be601e20b4

SHA512
a75fcc29dcb103aab0a1bab6d241a05b55d12a2efd01a4c126763522fd23aa58cd272ce081ca86eb06cb1ef1d8a828abe0dabf559e3790ff8a652891d0f792f4

Download Submit
C:\Windows\SysWOW64\Flceckoj.exe

Filesize
245KB

MD5
83e43f6813cefa1752a0456759bbb4ae

SHA1
83eec29514998266dff228b57eaa20f7ab40082c

SHA256
e2998f62f43c368f62da2f2df9e9380cba5db45be6309039b0f176363bf4c909

SHA512
8d98dc0bf949dc0fb562fcdf762c2b490db5940460e4ccd13789d1e108e4f02d1a3b4415f3df0a621e40b7375482a15692654b0cc8ad433d674316b56530f333

Download Submit
C:\Windows\SysWOW64\Gblngpbd.exe

Filesize
245KB

MD5
4c2ae7f455b745ae45bc86b8b3af9a78

SHA1
cf80df26661a8164348397eca65a882e642349b5

SHA256
c28d163c06d96086952b5189b80c1be1017ea1466e3239f908ded4791de9aace

SHA512
d6a93568a37f86f0a0bf346b4adf24e94ed307b91a5cd9f0ae50878f6b881f364d110811ab23862acb4616eb75c65a78640fa8243918b97527694ef91172524c

Download Submit
C:\Windows\SysWOW64\Hckjacjg.exe

Filesize
245KB

MD5
a0467fab437bd17cc92663db66ab7091

SHA1
66f836ded7c14ff0b611b65dc01c425774f53f02

SHA256
425f088d263749c052fc889416a2401265f17b7bf19fff0618aa4639eab04382

SHA512
aca0ff9867feef095b45cbbed8e3983fb76f3900f90b7cdebe12222b0253631a9ff48ad1ded9f19958da751b8c947efd5de17c4234c9ad9d57b83a1948977ce5

Download Submit
C:\Windows\SysWOW64\Jaljgidl.exe

Filesize
245KB

MD5
71bda078ec0f0e8d76a80f775b207620

SHA1
7f7bf74c56d4ce5bafe9694047d9af1f678d91e3

SHA256
0d41f8cde44394736003f28d0285d9a5a1b5726f9fc51dc813ab491c091e674c

SHA512
c0eb3e7c0a8c07cab94ba5194e1d95305b0619d58f682492cc5225c3663ae9927264c1a4fb6cd5dc8534363b17ffdf53aa79d0e10b2b2003f6b7510b8b9c07bf

Download Submit
C:\Windows\SysWOW64\Jbmfoa32.exe

Filesize
245KB

MD5
f2ccf662461415131b815959a1538334

SHA1
1c62bec3cca34062b969df825c3947f78a37cdad

SHA256
690b6bfb1ba6f33a6def1e3ce8c769101db254135d3e9e4caa957ae4b2ad01f4

SHA512
94a3b8731fb5a13a649f36f5c1c8a584988c28b5a49d055351022f0dd2f6027a971b6963563d5b6a31d92401e7af9744f2ea19df578cd6ab6e22744bf921b1ab

Download Submit
C:\Windows\SysWOW64\Jbocea32.exe

Filesize
245KB

MD5
0835e6a4afb90aa792650a8da085c971

SHA1
66c1c3f1a59103c7eabff897a2f08ed1c0a77370

SHA256
e30bb32b941b9a0f0b6cf896b0bac6cdd3536d52a3a9d9f567f1b7554c941d34

SHA512
814c02a81199aaf908714db13b372d3bafa6e307216d02d7d261755a394a8ea9373e33933af51e865329ea67788b41b40d3ea846416315f004c045a754381e11

Download Submit
C:\Windows\SysWOW64\Jfffjqdf.exe

Filesize
245KB

MD5
1b68e400281d81f7c4036b400d567d08

SHA1
2bdf5c3a4cd3d636e4274ce4401ae3748a844f07

SHA256
fe35106017ac2b6aae40111bd19b07d019824244b4e23279d0e6601466fd6a21

SHA512
330c31da674f7e3a2b0fbaef595529ddaacd615ec552faebb1d4ec1dcaa832f796de3264e787c2d494d0ecd72544460cc5fa1aaa03667523552c2b3e06f95760

Download Submit
C:\Windows\SysWOW64\Jfhbppbc.exe

Filesize
245KB

MD5
65e2dd54ad2a02ef9c29c37a9c5fb92e

SHA1
2fec9ab07d65e79645d17e559e3c2081663fe63f

SHA256
969b3690c41519f0fadd0a851faf9873a688cc34f0f86cfa6192f841e441e589

SHA512
c9e626901eb5759cd48393ff0f29eaf17baa79b6aeb3701e8aba20e80c889a948576195f24d8da52d9ac8e55cdcc8070c6689919102ed028896ee9f84ac29bf5

Download Submit
C:\Windows\SysWOW64\Jidbflcj.exe

Filesize
245KB

MD5
4d28a5051e78b3d9f07a52186e4901f5

SHA1
84fa247c65356f7e5b6e7f9db097e747a77b4ac0

SHA256
33b01b821ed5c7a25bf2d147cd697eeaf7b981f51c5e22095585fad5d3ffde1f

SHA512
1fbe80cc0a9846e3c27333ac66ac2e44ae713718c50b9b30096514a6829aed129ed856cfd56f5b70c0e4e359f1a302e53428f390bb8be4b02ad695ffd261a4fb

Download Submit
C:\Windows\SysWOW64\Jkfkfohj.exe

Filesize
245KB

MD5
44276e6d5fdbd75e7d927d49bdfea3f4

SHA1
4d5aaa5a6775f0e144b4a636cf19956340c3cbe7

SHA256
aca8b91c28d448acc1d2439b161abdfa70bf4c1d022dc8c29a8cb1cc8305e8cd

SHA512
eabe9887005cbd22ee8c89e4b63a17b15447eeb1ab3e37137e4cd6dc7956503de8b06ba525e8c858b20f73247b023aad65c8bb15584e095ddfefe54af4a8ff9b

Download Submit
C:\Windows\SysWOW64\Jmbklj32.exe

Filesize
245KB

MD5
7858190d855a612784ff5be717440351

SHA1
3dd7da57ada362d5815bb553b7d9c61fffe866d9

SHA256
030f0d47242cb4167b06629ba2f94c3cf1f8f6f4d82c34ac2112c3c8403822a2

SHA512
f07a3187bd4135c2365590ca0d7f4602e63d1377d99e1c4583a5b94572c79683a1b5763fa94c5b3b4b199b5fba4c9b99e8c095c95a76024c6d57270295ae00a6

Download Submit
C:\Windows\SysWOW64\Jpaghf32.exe

Filesize
245KB

MD5
d041734a12e3d4e4333f940912cd5b15

SHA1
7c351634dbaa35a538574924199e4c837e87d9b2

SHA256
7add1598300d3c6fd4c29dc4bb6f6b8b6389d88bf8b18cbf2e85c935f8022d2b

SHA512
506abf8da92c6ef9292ca72cea53e22d336f451a7034203467102b98272d026d8bd4c974b556d43f920b6a733043cbefcd299d11a24c091c19d58ee66a7cbaf4

Download Submit
C:\Windows\SysWOW64\Kagichjo.exe

Filesize
245KB

MD5
01f6068466979bdce4ef0e4109bd6a61

SHA1
321c770ae4aab6ff1d17cd6a19ea95820f087bb8

SHA256
dd5c5d06e2099321e4e770190bf2c39239cf3eeb321cbb252044da17ab55849c

SHA512
da99301a4019c4727fd4cf8fa28eda4276dc6b452fd774fc773c237547f77f9d28b7af16457e838bad98fc02371b8ec68b949d7e804d593b550c30721c9348c4

Download Submit
C:\Windows\SysWOW64\Kaqcbi32.exe

Filesize
245KB

MD5
1399b899a22ddf64e0a16a2a797ea0d6

SHA1
742a1ad2fbea668d02bf1f92b6c7a76821faaf43

SHA256
5113fdf4c08574bfb2f5da1e97191bcbfe26c9f087fce63162242f8167c5b741

SHA512
56594bafc91b58fd83d904fca1f5689d776b9d1a7b71b2e8ef622792abf2b47f63d4301a6bf8fac245fec6086c32f39a0e4ec66b22907ae0070b6ef2f7edf1f0

Download Submit
C:\Windows\SysWOW64\Kckbqpnj.exe

Filesize
245KB

MD5
a1218f593e3f9fa5d7316064ff409295

SHA1
c247edc00759e4a065de6be4d1065cb17a5f704f

SHA256
019351c0f4b9a053ca9a0371afa3dc91ab496837fe73b7ae4338b967ce347410

SHA512
ca9c797aab9988b60b8e5843585f0d6c68724aafa9bd1c92228e85edbbbd6b075e792b8e3afee17c867e1641d34f3dd57beac1d6cdf92ad0072002cf63d8390b

Download Submit
C:\Windows\SysWOW64\Kdopod32.exe

Filesize
245KB

MD5
4052de989aace2821a9d994774fa1a04

SHA1
ddf193b2b436543c4a72e499b5f55c882010fdc9

SHA256
366fc11457a1bd30dbf4209ebf22f8315ea40c0ab2b541de33b37747ca315bf2

SHA512
1a7bb194a89a034a855bf9e0e9260e4984bb564f1110a53107b5c6738cc6e267eadaa26247339172f3c82613dad31e2e08f7c6f0c9f0b53d072b3d39c13e0e0a

Download Submit
C:\Windows\SysWOW64\Kgdbkohf.exe

Filesize
245KB

MD5
141e0a9a076fd68e8496f789d6e2596b

SHA1
bbe7ba10e12bc2af5d16c0ecdb476e116ed09985

SHA256
ad86f6aafd2529f88610795a293677fc65da26ddb86b7d6dcbf4d89de2604cdc

SHA512
e3f84289ea17e4a3fedd232435da19ea763bb4d361f6b379714b6ab14247aa0e980ae5d4a9d7409043ad244e7587485c86367f757589a5f4152be803ba726b2b

Download Submit
C:\Windows\SysWOW64\Kipabjil.exe

Filesize
245KB

MD5
f940f7dc24cf9877e335a2c09e0233fa

SHA1
066035f5ef5717e0ac3e9b10d83bb3f4ec06615f

SHA256
12a31a6875664fc1cb8686f34192ce88f4120fadfc82a78b04e5de9adeb72d62

SHA512
8912790fd133428a1dc7729edafb125ab4ae616de0e473d8055d4eb4cc2b555c2ccbbab2cfd1436835eb1e0a61078f4321bda435ec2ea957468badff2d681d7a

Download Submit
C:\Windows\SysWOW64\Kmgdgjek.exe

Filesize
245KB

MD5
70faa7691554221d02d8bc1728417602

SHA1
751a9e56ff6e4127db01567c111ac11e2a67c27d

SHA256
fc9bee6dac59149f31bbe924e4c307fae605e611c505aca6355f2e3e7495846b

SHA512
c6968b4b6788076aa4cdde090a70026b9ea22aa5e8a725ca5244ddab9b58257fad4accd0327a88745230f10c0027f85e3e90a505449ffe1b1ce339b1054b5dfb

Download Submit
C:\Windows\SysWOW64\Kmjqmi32.exe

Filesize
245KB

MD5
39c229e0ed2fe47c4239d2d7f74762be

SHA1
c5a2f277c6930ee66ed281a350fd0f658118150a

SHA256
2e38163191a946366f1c8ec4e01e224acfb4ea484fe1446a66e24fb8dcf31794

SHA512
f8a94dcc03201c92a8b2f8d59040dde1b618b1549e56c8ffc9b2f7632a76f474a1772e6a750a67b588f6a9b460d105bf77c9d61e4cde224e39ebd5606987bd66

Download Submit
C:\Windows\SysWOW64\Kpepcedo.exe

Filesize
245KB

MD5
cadb91eb7a753c9a52279a4fec64ea21

SHA1
f6bbd27da58942aa4adeffe0bb63f7561a7ff9b0

SHA256
971fc271772bff0b1e1cb60b4021b08b06ca190280912c7e3aa058ecb7881bef

SHA512
f6c6269bc9170419605ab30c30687021621a41e24e7931aad26ee9111fbe2f2c7b2777cef523c600ac8a4476354d3a7ed3eea4f9404f2f738ef0dfc3481e0822

Download Submit
C:\Windows\SysWOW64\Kphmie32.exe

Filesize
245KB

MD5
1ba4cb5f0a8b9c91f791b3e54375dbd6

SHA1
345190cd8499f512eb8247ddbf35a7ef3bba3c24

SHA256
4e38ba0b3f95e290d0f16da75555e61af87ae31d1dace61427c7b643be74078c

SHA512
652ef9a0dc63ce87ccd6eb1ce91d3a2a1e485a2e9cb0feb769ddb7bad81333b9d202342b339317c8698be0b326abe6aa8ddbce5a0451364af8195b519600a9f5

Download Submit
C:\Windows\SysWOW64\Kpmfddnf.exe

Filesize
245KB

MD5
1eae7eb4c6f96a0b6378ce94e8c9f2e7

SHA1
b028527958ae858954b868544213553f5edc1c9c

SHA256
5f0198c73216587400583dd618b4c85539ae201a6e6979922acfc794f9336e69

SHA512
5eacff83678607a979a376b63820d1083d1f7438b4eb24a71ad03a495da179d4d248b461e11e3a2fd6f97d5d98b2308ecf32bca40eb175f0a9324f1dad1fd2d4

Download Submit
C:\Windows\SysWOW64\Lcdegnep.exe

Filesize
245KB

MD5
b1d532bc10f0db971abe31d0ea8542fc

SHA1
bd2ce727da198df672d682d92f72ee7887e38ae9

SHA256
cd855cf1ee45f00b6f82dd1a3fb57df4bf3ba5c55c0c4996ff73b7d9eec1819e

SHA512
2be05aa520a7649cd28fe98528e0e55a1a175b98c29feed54099571a34c562c0f6b241fd044e2711b64550e2a54585b34ff819ceda47e8a9c6452f5932866edb

Download Submit
C:\Windows\SysWOW64\Ldmlpbbj.exe

Filesize
245KB

MD5
3b4fc8b17f8536afa7bc5ced97c6ef54

SHA1
82d0581fdd559391e81367c21c23f74ed578ae8b

SHA256
3718d1838717283840742bc00642b616c016cd5cdd1e9e23072fbf1fe4a599b5

SHA512
8926427049309711ef537bfbac2986f7a7655eab7c9ccff154f510a2f57703b47a716a981b21aca4df35a625bfdecffb69746cfe9939f394320fe9192a8d2189

Download Submit
C:\Windows\SysWOW64\Ldohebqh.exe

Filesize
245KB

MD5
b7dea4bd401a33d87963dd210c577b2f

SHA1
d76c0358af41111e3cdd525d9cba59ed47fcbdcd

SHA256
7317b9274b715d5b341fed858071ffef7d711fce8af67876dc3db09659ebaaab

SHA512
3d64ef6a9611027e7f8bdbb023a2786a1e75c57b12cfec6c05b8a03c291431d1aff61a8da450c4296dceae0188caa1a7bccb2eb99546b8f35ba8af1ce0101a0e

Download Submit
C:\Windows\SysWOW64\Lenamdem.exe

Filesize
245KB

MD5
cbdaee31afd6dcc27beaf1f54a860e04

SHA1
bfa4416c061e7be91e8fdccb3776a88729ad2fb8

SHA256
c01b0661731c31d358a6f097416a3a6069ed8433eacc2a0177a5fd67c62e9b78

SHA512
d48bc9ad5be94535a323e3566804c6d70b704419b1d1eab5c457606537c75addcabd34e272614e37f72e77248e33fde319aafe5d432ad260f08e4b5a4798f802

Download Submit
C:\Windows\SysWOW64\Lgikfn32.exe

Filesize
245KB

MD5
c64f3c70a6f4baeea55896ce0d97fd6e

SHA1
571406172a851ad88f14ee7d89c6b81dac33f647

SHA256
33a892d2360b3e4802478bf911870ba4f36585ba14a00c450f809678178f8a14

SHA512
56cc8f65283cc5fb4d78ff75b3497d93344c9bf07b54fe2cae5acef672198937d2f4105b9fa4bdd7696721a0a957af5855533d26a8a400989c57c304addb5230

Download Submit
C:\Windows\SysWOW64\Liekmj32.exe

Filesize
245KB

MD5
38072f0d03c304d28c1156b395d2dcdc

SHA1
6e5deb157b9f0f8dc743c50845c2ae288c01a523

SHA256
6b481a07f4e22b65ddaff8cfa497565db30427692b186ddd3b1848e60e9df8fa

SHA512
3cc2985a12b1008706dc45639f4c29267883200a58e6da2f23f303ccf03e7e01f1aaa9ec08896c76d09e79f83358ef22125f33ff5b2937022cf80be7e47e04c7

Download Submit
C:\Windows\SysWOW64\Lijdhiaa.exe

Filesize
245KB

MD5
66c9ee30e5e4901654e9f8dd9e7b6379

SHA1
2530dbac2b0766f217a00432478e311c80bedd6a

SHA256
e4c71830ab3f08b2a988f91c4e2252136c53a9d059a55e946828769438ef0fca

SHA512
ac227e26463f76b974b4c8ef01fb80619465edfe6aaed4fb0a3e988a01b2deee3a95bb39561bde12323dd58f9e4fccb9ee9c21d4659fd5491a16ecac6715b133

Download Submit
C:\Windows\SysWOW64\Lilanioo.exe

Filesize
245KB

MD5
96ef9686010eeb975125b0b10571b39a

SHA1
f1e56903ad6f96851ab7f22ea17c1956dfa63d22

SHA256
d7792264afffa3f17f32372e7f5bb3f1da02fd2fd3bc17285169ec615481d95d

SHA512
9271dbe03a5eeade3ee8bd225aef75e2ce121a32ac93e6c1b5956ce7e03393461262b2de542641ebf582c94f96943f9106efd4bcada767c6e36f1a3301296210

Download Submit
C:\Windows\SysWOW64\Lknjmkdo.exe

Filesize
245KB

MD5
8711d4e61a7aed8c09e0074788d02842

SHA1
f464fed64a938801592fdff81c18f6e8a7a46102

SHA256
19fc98e7324a3f736b3951d2a0a7e3d28bd39f0559c2235d8b354905b3bddce0

SHA512
c5ff634b571c4b8b7210aa23149ab0a99d50a02245dfdf3af93c72596bc23888edce9740f2442fab7e616d5ea783c9c0f2538939d2446aeb3d92d7af6245f476

Download Submit
C:\Windows\SysWOW64\Lmccchkn.exe

Filesize
245KB

MD5
fe7dad7183b9feb2133ec9638a3dbcb8

SHA1
267881af68376462e4b515f167b3188c6e03c6fc

SHA256
feffcd516b8a6647dede1685e83babf7b680e922bfd16bc9657b1189899d1ac1

SHA512
fd2b14e275b79e552d9dd5b11b6f4fd02411c1cfca77ff57467e535a411eb6b14137518aff12e7b90b17ee82baf7676763a6a418f6ef42c9039e6ec4918498e9

Download Submit
C:\Windows\SysWOW64\Lnjjdgee.exe

Filesize
245KB

MD5
847c1ec84a86635465192cd1a100f452

SHA1
acdcdfb9541e4d29901c4c12b8d6a99c477142f7

SHA256
111a7da63c829d4b9eb7b213834d060712f14a13c18440e89860481edcb9fe17

SHA512
6fa4ddebc09af69c8cc5c7393f72eb05c2307c8a3fabedbd3a7d2a46a86c9067b3559933c25f21ef843d5f7309d3a436dc3d8f1ad0eefc4305275c3526de0dbb

Download Submit
C:\Windows\SysWOW64\Lpfijcfl.exe

Filesize
245KB

MD5
98c69881ac98c701820602b7de1ac868

SHA1
4fe868338271635e599a00c2966ad6884af113ae

SHA256
756d458309ab482d360f2cc9b3b0ca0f5db38d6faaa88122707657511d515c49

SHA512
366770cef611f0b064966d0b0d46621e40535d124e5ab1a7ce82e2c5d8c31170bd3737013d36dc1c92a5545e6d63a6edfb788b29c6c26be076f3ac9b8a61c9fb

Download Submit
C:\Windows\SysWOW64\Lphfpbdi.exe

Filesize
245KB

MD5
11e532c8b582ec17a5f5943c56d1e2dc

SHA1
d0ba395be5b63397cbf5ea275bcc5cc67fe4a309

SHA256
4980f82d39ad79b3d893969151302bf7c466758c0d8c29ccba2291d364003e67

SHA512
670283ff1c352defa17dda14ed4fab1b4354ae9154e3e79ae54caef72b28626007bc1bc17d788a715a91925486a2dd0ad0b199b37b62ed65481a5b1925da8061

Download Submit
C:\Windows\SysWOW64\Mdehlk32.exe

Filesize
245KB

MD5
6f74bb662e0295f42ad1f0e8d36f434f

SHA1
f464d280a411ed9a55f538933cdbe10a45351e1c

SHA256
7ec043878166e7d2b411cc57305acc568c11e9d890d1a990cacdc1eb7851f73a

SHA512
fd05a954ab1173076cbd54f267f972b9643ccd317012274b8579f6088aa5701a8fb57a4851add4cbfd83ef538d2be0a983bc33ba59b4e2700c52dc4b6e5069f3

Download Submit
C:\Windows\SysWOW64\Mipcob32.exe

Filesize
245KB

MD5
398190eb1c528babed3c769c913c51f3

SHA1
43add1f3ca2563562c5e969d7cdd6e74bcbf0ac4

SHA256
6be32bffed871b3bd37dbea30a27390616c1b6f32fb298fa59a5dc0a920af931

SHA512
592887008d874b822937ec917960dcfb19428e172ada00ac18aa7f746972eef668840f15bf83bbb7571534a0e0bb20c6a5cf9659f29e40a7dbeb5f9f29783b28

Download Submit
C:\Windows\SysWOW64\Mjhqjg32.exe

Filesize
64KB

MD5
14c3a91b301fc8618bfc474e675040f0

SHA1
d2b301994a57c5e369decb0d0db3240696fa4d4e

SHA256
7c85f97218423a37f42e6cec86235dc97626fe7a82fceaec0476d473989eafb1

SHA512
8db4520d0c9363c44de6a2673b3e2f8e2179d7521ad1921bfb881ee3c7d42dca3d030e37e6dbdddd71fa1bbd36881fafa827c03471ac0bef785efeea367121fc

Download Submit
C:\Windows\SysWOW64\Nepgjaeg.exe

Filesize
245KB

MD5
9219b0269555aad2ac839bfd3159982d

SHA1
a7d464f04e9b1415702cb492f97e6d8c8ebcc948

SHA256
a46e10c508e9771b8dc35dfc5c4c64e4649c8b6bb97b8c7e8bdbe1fb8e155092

SHA512
90493efc03afe2409fccae664daa53654452c41aba21c861909afec857c2bc6005683598b74eab4e585ad334c00807ae28e8796521c294c5bfb771e51a46e319

Download Submit
C:\Windows\SysWOW64\Njogjfoj.exe

Filesize
245KB

MD5
bcf46d6f375d7e102c74be3d9f504fe0

SHA1
af221b6719ac24b466a60bcd8a59ca299775d94a

SHA256
046d7812dcd4c53af06ce475874efed68a565767870810cf7a2c4e37a58f1893

SHA512
71dd4de7861bcbf8017b27e67dfdd28cf78f2967febdd22ff0231674b3986c1cb69a4dd0d0100ddebcd50fc0010b61f24be9e5fe8703c2d351e2f7bc39603694

Download Submit
C:\Windows\SysWOW64\Okeieh32.exe

Filesize
245KB

MD5
d2e12e774d1963cd60901d8d21136418

SHA1
078686b371a78c25e8a4d01edf07732e99548ac4

SHA256
854948ec3674e08836c794d3340070ac4aa5ec8edcc1be97d40f7a02d4e4f034

SHA512
6b21dd115d1b267458bd325efe1a18697237269487ef1c96afeec68d3d507a5ef500e6bd9550dc936dfd7016e2563ac94f957faf7daf52ea40ba209581232afb

Download Submit
C:\Windows\SysWOW64\Oqdoboli.exe

Filesize
245KB

MD5
fa66fe909a257e8d8a148a58214c134c

SHA1
6008901bcfe2ac0dc102679258828894fd24fd8b

SHA256
fc96aff6f546ddb3c2ce28adc03e3a7e9f1367726ab5a4bfd2f47003d097c203

SHA512
5dff0233433044f8c9311ae59498d834d68d59ff497c5aa1fed6dc488c400904fb9ae1059ba5533d0e89a18b6831a5118997e2862d3e3a085c64f01d5fff7d05

Download Submit
C:\Windows\SysWOW64\Pbddcoei.exe

Filesize
245KB

MD5
60d9755f9c0d902aa71529a92827c5fb

SHA1
f5a73b9984dbf6f16886041e25f4eadd426820bc

SHA256
4351147c96d1de99f9ce237bd202d1923a13e27eec5bd0258a16266452ea53d5

SHA512
2f417e810d8d2e618024783d5e63c230fe8a3b0dabb207e6538971dee091117264f0bfbdc3b416757f18d4ee8d15a56b8dfb398b34a3c052fbe30aff445c2053

Download Submit
C:\Windows\SysWOW64\Pnbbbabh.exe

Filesize
245KB

MD5
454a53090c5b3c08dadb772b408c94d5

SHA1
1e3ed4c2e0f1a6e38d0be560c1add046a0565a32

SHA256
942a16cffec8ef2b6103d61744779c33202b14a79d49dd8f2198aea9b48fc46f

SHA512
2728f3fb268eb2f7ffd120447eaff2f4802b0bdb8c41f56e1ee766fb37845ea74c12d671c7f2c0064502cd910cde1a04b4ec8267360fddf09cd833d7718528cd

Download Submit
C:\Windows\SysWOW64\Qbimoo32.exe

Filesize
245KB

MD5
85fe8b8c0684e9a10cf5335112c69651

SHA1
0eb897dde2143b0ae0e78858661f924f6e89e846

SHA256
8acda957982562400309d6ee70c4e93c92c12cc4d93c61d0ebc5ae8ad75a4ea2

SHA512
6724ac3289f54bc6ad02d88af3151b1b2d49f8d88771c8a16c9b890b34ea2a5a15badfedd91b3887f5785fd13c5620b94956051c39e18ca9548c0977be92f004

Download Submit
memory/424-216-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/428-255-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/432-316-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/720-228-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/768-240-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1064-248-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1084-49-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1144-363-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1148-429-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1160-232-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1360-286-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1516-103-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1544-112-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1564-143-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1668-405-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1780-322-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1952-393-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1972-304-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2072-29-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2160-340-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2224-403-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2240-46-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2244-375-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2428-13-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2512-387-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2524-280-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2580-268-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2732-423-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2740-310-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2976-441-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/3032-411-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/3068-61-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/3112-128-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/3168-88-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/3480-381-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/3620-352-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/3672-208-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/3788-136-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/3872-275-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/3952-184-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4036-334-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4060-65-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4220-160-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4292-417-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4312-292-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4316-328-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4404-204-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4416-17-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4472-369-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4536-96-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4556-120-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4708-447-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4720-298-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4740-0-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4740-77-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4740-6-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4804-152-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4836-192-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4884-37-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4920-176-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4924-346-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/5008-435-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/5012-167-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/5076-262-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads