71bcb40fac4b9d7475357bba2a8830bffc3d4809e815b50fba76ded26d5e2a92

Analysis

max time kernel
150s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71bcb40fac4b9d7475357bba2a8830bffc3d4809e815b50fba76ded26d5e2a92.exe
Size

280KB
MD5

cac9c7103281ce07d0bfff3dad2be353
SHA1

b47d3f9f9112585f9fa049ec1880293bf3cb138c
SHA256

71bcb40fac4b9d7475357bba2a8830bffc3d4809e815b50fba76ded26d5e2a92
SHA512

b08b7a39da8202af6f2cd1cc42058529745784c30343185125f08fa2e10d6540a1faf2fddae69cbff3ded61d708b0a1e84b7c450c050730285f9b8a687949e7f
SSDEEP

1536:TF2w9mv5oZE9e1JXGojLZDWIcyohseMUKPeoxZslAGhZxPBljjGs8f7hG6q+jiWB:Rmv5XeDD4hZK7xVG9Btj676ZBI

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ooqqdi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bljlfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eppjfgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aanbhp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qklmpalf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnljkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpoalo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adkqoohc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kqmkae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgipcogp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enigke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jqhafffk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdbjhbbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpfkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nliaao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aoabad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkhkjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Egohdegl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnljkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbedga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icknfcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmennnni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmpcbhji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgkiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmncnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhkgoiqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhnikc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	71bcb40fac4b9d7475357bba2a8830bffc3d4809e815b50fba76ded26d5e2a92.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kageaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qhmqdemc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiahnnph.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdjblf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efblbbqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ookoaokf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbhijepa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcjcnoej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddnfmqng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdaile32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgmgqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iplkpa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bochmn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obafpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfigpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhmofj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbiado32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlljnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfoafi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgllfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oafcqcea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Doojec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Meepdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpkmal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbedga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojgjndno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agdcpkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojqcnhkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmbgdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbfkceca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klmpiiai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjpijpdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiieicml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjafok32.exe

Executes dropped EXE 64 IoCs

pid	Process
2028	Kmdqgd32.exe
4120	Kikame32.exe
4800	Kfoafi32.exe
412	Kdeoemeg.exe
312	Kmncnb32.exe
1992	Lffhfh32.exe
3836	Lbmhlihl.exe
4716	Llemdo32.exe
2260	Lfkaag32.exe
688	Llgjjnlj.exe
4484	Lgmngglp.exe
3552	Lpebpm32.exe
3864	Lmiciaaj.exe
1692	Mlopkm32.exe
2924	Mgddhf32.exe
4016	Mlampmdo.exe
4472	Mgfqmfde.exe
1004	Mdjagjco.exe
3888	Mdmnlj32.exe
2348	Npcoakfp.exe
4548	Ndaggimg.exe
4744	Nlmllkja.exe
1068	Njqmepik.exe
3528	Ofnckp32.exe
3504	Odocigqg.exe
2420	Oqhacgdh.exe
4720	Pdfjifjo.exe
1428	Pqmjog32.exe
5072	Pggbkagp.exe
772	Pflplnlg.exe
4936	Pgllfp32.exe
4764	Qnhahj32.exe
3028	Qceiaa32.exe
4500	Qjoankoi.exe
1660	Qddfkd32.exe
1592	Qffbbldm.exe
4996	Acjclpcf.exe
2984	Aeiofcji.exe
2504	Amddjegd.exe
3436	Aeklkchg.exe
4180	Aabmqd32.exe
2092	Afoeiklb.exe
2600	Bnhjohkb.exe
2720	Bganhm32.exe
4724	Beeoaapl.exe
4292	Bnmcjg32.exe
4536	Bnpppgdj.exe
4856	Hocqam32.exe
4780	Keonap32.exe
4916	Khmknk32.exe
4084	Kngcje32.exe
3384	Keakgpko.exe
2492	Kpgodhkd.exe
4804	Kfqgab32.exe
8	Klmpiiai.exe
2252	Kfcdfbqo.exe
2392	Llpmoiof.exe
3428	Lhfmdj32.exe
4140	Lifjnm32.exe
452	Lppbkgcj.exe
3244	Lhkgoiqe.exe
1172	Lpbopfag.exe
2596	Lflgmqhd.exe
3240	Lhncdi32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Kmdqgd32.exe	71bcb40fac4b9d7475357bba2a8830bffc3d4809e815b50fba76ded26d5e2a92.exe
File created	C:\Windows\SysWOW64\Bpdkcl32.dll	Kfoafi32.exe
File created	C:\Windows\SysWOW64\Aoabad32.exe	Ajdjin32.exe
File created	C:\Windows\SysWOW64\Pcijdmpm.dll	Emkndc32.exe
File created	C:\Windows\SysWOW64\Gmfmgg32.dll	Kjepjkhf.exe
File created	C:\Windows\SysWOW64\Lhnblp32.dll	Fjhacf32.exe
File opened for modification	C:\Windows\SysWOW64\Hkbmqb32.exe	Hkpqkcpd.exe
File opened for modification	C:\Windows\SysWOW64\Lhkgoiqe.exe	Lppbkgcj.exe
File created	C:\Windows\SysWOW64\Miomdk32.exe	Mbedga32.exe
File opened for modification	C:\Windows\SysWOW64\Jgpfbjlo.exe	Jljbeali.exe
File created	C:\Windows\SysWOW64\Ekngemhd.exe	Eddnic32.exe
File created	C:\Windows\SysWOW64\Ngmeal32.dll	Nobdbkhf.exe
File created	C:\Windows\SysWOW64\Ajlgckkf.dll	Oafcqcea.exe
File opened for modification	C:\Windows\SysWOW64\Hlepcdoa.exe	Hblkjo32.exe
File opened for modification	C:\Windows\SysWOW64\Hdokdg32.exe	Hlhccj32.exe
File created	C:\Windows\SysWOW64\Afpjel32.exe	Qpeahb32.exe
File opened for modification	C:\Windows\SysWOW64\Qjffpe32.exe	Qppaclio.exe
File created	C:\Windows\SysWOW64\Qhjgbbnj.dll	Qfmfefni.exe
File opened for modification	C:\Windows\SysWOW64\Mlopkm32.exe	Lmiciaaj.exe
File created	C:\Windows\SysWOW64\Lflgmqhd.exe	Lpbopfag.exe
File created	C:\Windows\SysWOW64\Oemefcap.exe	Oboijgbl.exe
File created	C:\Windows\SysWOW64\Cleegp32.exe	Cbpajgmf.exe
File created	C:\Windows\SysWOW64\Qnbidcgp.dll	Bgkiaj32.exe
File opened for modification	C:\Windows\SysWOW64\Bgbpaipl.exe	Bphgeo32.exe
File opened for modification	C:\Windows\SysWOW64\Pdfjifjo.exe	Oqhacgdh.exe
File created	C:\Windows\SysWOW64\Qohpkf32.exe	Qhngolpo.exe
File created	C:\Windows\SysWOW64\Lddgmbpb.exe	Lklbdm32.exe
File opened for modification	C:\Windows\SysWOW64\Bjhkmbho.exe	Bpqjjjjl.exe
File created	C:\Windows\SysWOW64\Fhoqoo32.dll	Lifjnm32.exe
File opened for modification	C:\Windows\SysWOW64\Ilccoh32.exe	Ijegcm32.exe
File created	C:\Windows\SysWOW64\Onpjichj.exe	Olanmgig.exe
File opened for modification	C:\Windows\SysWOW64\Eokqkh32.exe	Eiahnnph.exe
File created	C:\Windows\SysWOW64\Nnkoiaif.dll	Ncbafoge.exe
File opened for modification	C:\Windows\SysWOW64\Fbaahf32.exe	Fjjjgh32.exe
File created	C:\Windows\SysWOW64\Ogajpp32.dll	Cbkfbcpb.exe
File created	C:\Windows\SysWOW64\Gfibje32.dll	Flqdlnde.exe
File opened for modification	C:\Windows\SysWOW64\Igbalblk.exe	Idcepgmg.exe
File created	C:\Windows\SysWOW64\Njinmf32.exe	Nelfeo32.exe
File created	C:\Windows\SysWOW64\Bdpkjpdi.dll	Lcjcnoej.exe
File created	C:\Windows\SysWOW64\Lhnoigkk.dll	Opbean32.exe
File created	C:\Windows\SysWOW64\Chalkm32.dll	Olijhmgj.exe
File created	C:\Windows\SysWOW64\Phedhmhi.exe	Pakllc32.exe
File created	C:\Windows\SysWOW64\Gefchq32.dll	Hkpqkcpd.exe
File created	C:\Windows\SysWOW64\Kfqgab32.exe	Kpgodhkd.exe
File opened for modification	C:\Windows\SysWOW64\Nijqcf32.exe	Nhhdnf32.exe
File opened for modification	C:\Windows\SysWOW64\Lbchba32.exe	Lhncdi32.exe
File created	C:\Windows\SysWOW64\Bgeemcfc.dll	Nnbnhedj.exe
File created	C:\Windows\SysWOW64\Knnhjcog.exe	Kegpifod.exe
File created	C:\Windows\SysWOW64\Qhmqdemc.exe	Qkipkani.exe
File created	C:\Windows\SysWOW64\Jkjpda32.dll	Kjjbjd32.exe
File created	C:\Windows\SysWOW64\Qpeahb32.exe	Qjiipk32.exe
File opened for modification	C:\Windows\SysWOW64\Fqfojblo.exe	Fbaahf32.exe
File opened for modification	C:\Windows\SysWOW64\Mblcnj32.exe	Mhfppabl.exe
File created	C:\Windows\SysWOW64\Onlche32.dll	Nenbjo32.exe
File created	C:\Windows\SysWOW64\Hpidaqmj.dll	Jgpfbjlo.exe
File opened for modification	C:\Windows\SysWOW64\Cbpajgmf.exe	Ckeimm32.exe
File opened for modification	C:\Windows\SysWOW64\Ncbafoge.exe	Ncpeaoih.exe
File created	C:\Windows\SysWOW64\Fbaahf32.exe	Fjjjgh32.exe
File created	C:\Windows\SysWOW64\Ofimgb32.dll	Phganm32.exe
File created	C:\Windows\SysWOW64\Emkndc32.exe	Ejlbhh32.exe
File created	C:\Windows\SysWOW64\Glmoga32.dll	Kgipcogp.exe
File created	C:\Windows\SysWOW64\Cbgpnkdm.dll	Nemmoe32.exe
File created	C:\Windows\SysWOW64\Ldjcfk32.dll	Kpoalo32.exe
File created	C:\Windows\SysWOW64\Kjamidgd.dll	Afbgkl32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6676	6308	WerFault.exe	673

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlkipgpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dphiaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efehkimj.dll"	Dgdncplk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bblnindg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lqndhcdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nenbjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdbijb32.dll"	Nmnqjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmeandma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qadoba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plbhknkl.dll"	Hkbmqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njinmf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmeandma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llpmoiof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlingkpe.dll"	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nofoidko.dll"	Hocqam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmjpbc32.dll"	Bhbcfbjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdjagjco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Khmknk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohkbbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmpcbhji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opbean32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Leopnglc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oeoblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdmpmdpj.dll"	Keimof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jofill32.dll"	Fmpqfq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jocefm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhkfkmmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mefmimif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjjfgb32.dll"	Bljlfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Loighj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajdjin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hildmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpoejj32.dll"	Ojcpdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hclnnc32.dll"	Eiieicml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmhdkknd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkdoio32.dll"	Imnocf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldjcfk32.dll"	Kpoalo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlmgnn32.dll"	Bcddcbab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Alkijdci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jqhafffk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdeeipfp.dll"	Fjhmbihg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jdfjld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgeemcfc.dll"	Nnbnhedj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efgemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Joicekop.dll"	Lekmnajj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfnjpfcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aonhghjl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oqklkbbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmncnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcmpdfhi.dll"	Legjmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qohpkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkhkjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibhkfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jecffa32.dll"	Meamcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egjoqncg.dll"	Afgacokc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enkdaepb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibhkfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hnnljj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfbhcl32.dll"	Egkddo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kageaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hgmgqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjnafk32.dll"	Mhdckaeo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 2028	4272	71bcb40fac4b9d7475357bba2a8830bffc3d4809e815b50fba76ded26d5e2a92.exe	89
PID 4272 wrote to memory of 2028	4272	71bcb40fac4b9d7475357bba2a8830bffc3d4809e815b50fba76ded26d5e2a92.exe	89
PID 4272 wrote to memory of 2028	4272	71bcb40fac4b9d7475357bba2a8830bffc3d4809e815b50fba76ded26d5e2a92.exe	89
PID 2028 wrote to memory of 4120	2028	Kmdqgd32.exe	90
PID 2028 wrote to memory of 4120	2028	Kmdqgd32.exe	90
PID 2028 wrote to memory of 4120	2028	Kmdqgd32.exe	90
PID 4120 wrote to memory of 4800	4120	Kikame32.exe	91
PID 4120 wrote to memory of 4800	4120	Kikame32.exe	91
PID 4120 wrote to memory of 4800	4120	Kikame32.exe	91
PID 4800 wrote to memory of 412	4800	Kfoafi32.exe	93
PID 4800 wrote to memory of 412	4800	Kfoafi32.exe	93
PID 4800 wrote to memory of 412	4800	Kfoafi32.exe	93
PID 412 wrote to memory of 312	412	Kdeoemeg.exe	94
PID 412 wrote to memory of 312	412	Kdeoemeg.exe	94
PID 412 wrote to memory of 312	412	Kdeoemeg.exe	94
PID 312 wrote to memory of 1992	312	Kmncnb32.exe	95
PID 312 wrote to memory of 1992	312	Kmncnb32.exe	95
PID 312 wrote to memory of 1992	312	Kmncnb32.exe	95
PID 1992 wrote to memory of 3836	1992	Lffhfh32.exe	96
PID 1992 wrote to memory of 3836	1992	Lffhfh32.exe	96
PID 1992 wrote to memory of 3836	1992	Lffhfh32.exe	96
PID 3836 wrote to memory of 4716	3836	Lbmhlihl.exe	97
PID 3836 wrote to memory of 4716	3836	Lbmhlihl.exe	97
PID 3836 wrote to memory of 4716	3836	Lbmhlihl.exe	97
PID 4716 wrote to memory of 2260	4716	Llemdo32.exe	98
PID 4716 wrote to memory of 2260	4716	Llemdo32.exe	98
PID 4716 wrote to memory of 2260	4716	Llemdo32.exe	98
PID 2260 wrote to memory of 688	2260	Lfkaag32.exe	99
PID 2260 wrote to memory of 688	2260	Lfkaag32.exe	99
PID 2260 wrote to memory of 688	2260	Lfkaag32.exe	99
PID 688 wrote to memory of 4484	688	Llgjjnlj.exe	100
PID 688 wrote to memory of 4484	688	Llgjjnlj.exe	100
PID 688 wrote to memory of 4484	688	Llgjjnlj.exe	100
PID 4484 wrote to memory of 3552	4484	Lgmngglp.exe	101
PID 4484 wrote to memory of 3552	4484	Lgmngglp.exe	101
PID 4484 wrote to memory of 3552	4484	Lgmngglp.exe	101
PID 3552 wrote to memory of 3864	3552	Lpebpm32.exe	102
PID 3552 wrote to memory of 3864	3552	Lpebpm32.exe	102
PID 3552 wrote to memory of 3864	3552	Lpebpm32.exe	102
PID 3864 wrote to memory of 1692	3864	Lmiciaaj.exe	103
PID 3864 wrote to memory of 1692	3864	Lmiciaaj.exe	103
PID 3864 wrote to memory of 1692	3864	Lmiciaaj.exe	103
PID 1692 wrote to memory of 2924	1692	Mlopkm32.exe	104
PID 1692 wrote to memory of 2924	1692	Mlopkm32.exe	104
PID 1692 wrote to memory of 2924	1692	Mlopkm32.exe	104
PID 2924 wrote to memory of 4016	2924	Mgddhf32.exe	105
PID 2924 wrote to memory of 4016	2924	Mgddhf32.exe	105
PID 2924 wrote to memory of 4016	2924	Mgddhf32.exe	105
PID 4016 wrote to memory of 4472	4016	Mlampmdo.exe	106
PID 4016 wrote to memory of 4472	4016	Mlampmdo.exe	106
PID 4016 wrote to memory of 4472	4016	Mlampmdo.exe	106
PID 4472 wrote to memory of 1004	4472	Mgfqmfde.exe	107
PID 4472 wrote to memory of 1004	4472	Mgfqmfde.exe	107
PID 4472 wrote to memory of 1004	4472	Mgfqmfde.exe	107
PID 1004 wrote to memory of 3888	1004	Mdjagjco.exe	108
PID 1004 wrote to memory of 3888	1004	Mdjagjco.exe	108
PID 1004 wrote to memory of 3888	1004	Mdjagjco.exe	108
PID 3888 wrote to memory of 2348	3888	Mdmnlj32.exe	109
PID 3888 wrote to memory of 2348	3888	Mdmnlj32.exe	109
PID 3888 wrote to memory of 2348	3888	Mdmnlj32.exe	109
PID 2348 wrote to memory of 4548	2348	Npcoakfp.exe	110
PID 2348 wrote to memory of 4548	2348	Npcoakfp.exe	110
PID 2348 wrote to memory of 4548	2348	Npcoakfp.exe	110
PID 4548 wrote to memory of 4744	4548	Ndaggimg.exe	111

C:\Users\Admin\AppData\Local\Temp\71bcb40fac4b9d7475357bba2a8830bffc3d4809e815b50fba76ded26d5e2a92.exe
"C:\Users\Admin\AppData\Local\Temp\71bcb40fac4b9d7475357bba2a8830bffc3d4809e815b50fba76ded26d5e2a92.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\Kmdqgd32.exe
  C:\Windows\system32\Kmdqgd32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\Kikame32.exe
    C:\Windows\system32\Kikame32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Windows\SysWOW64\Kfoafi32.exe
      C:\Windows\system32\Kfoafi32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4800
    - - C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:412
      - C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:312
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1992
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3836
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4716
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2260
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:688
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3864
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1692
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3888
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2348
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        23⤵
        Executes dropped EXE
        
        PID:4744
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        24⤵
        Executes dropped EXE
        
        PID:1068
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        25⤵
        Executes dropped EXE
        
        PID:3528
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        26⤵
        Executes dropped EXE
        
        PID:3504
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2420
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4720
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        29⤵
        Executes dropped EXE
        
        PID:1428
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        30⤵
        Executes dropped EXE
        
        PID:5072
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        31⤵
        Executes dropped EXE
        
        PID:772
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4936
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        33⤵
        Executes dropped EXE
        
        PID:4764
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        34⤵
        Executes dropped EXE
        
        PID:3028
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        35⤵
        Executes dropped EXE
        
        PID:4500
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        36⤵
        Executes dropped EXE
        
        PID:1660
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        37⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        38⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        39⤵
        Executes dropped EXE
        
        PID:2984
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2504
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3436
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        42⤵
        Executes dropped EXE
        
        PID:4180
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        43⤵
        Executes dropped EXE
        
        PID:2092
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2600
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        45⤵
        Executes dropped EXE
        
        PID:2720
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        46⤵
        Executes dropped EXE
        
        PID:4724
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        47⤵
        Executes dropped EXE
        
        PID:4292
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        48⤵
        Executes dropped EXE
        
        PID:4536
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4856
        
        C:\Windows\SysWOW64\Keonap32.exe
        
        C:\Windows\system32\Keonap32.exe
        50⤵
        Executes dropped EXE
        
        PID:4780
        
        C:\Windows\SysWOW64\Khmknk32.exe
        
        C:\Windows\system32\Khmknk32.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4916
        
        C:\Windows\SysWOW64\Kngcje32.exe
        
        C:\Windows\system32\Kngcje32.exe
        52⤵
        Executes dropped EXE
        
        PID:4084
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        53⤵
        Executes dropped EXE
        
        PID:3384
        
        C:\Windows\SysWOW64\Kpgodhkd.exe
        
        C:\Windows\system32\Kpgodhkd.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2492
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        55⤵
        Executes dropped EXE
        
        PID:4804
        
        C:\Windows\SysWOW64\Klmpiiai.exe
        
        C:\Windows\system32\Klmpiiai.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:8
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        57⤵
        Executes dropped EXE
        
        PID:2252
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2392
        
        C:\Windows\SysWOW64\Lhfmdj32.exe
        
        C:\Windows\system32\Lhfmdj32.exe
        59⤵
        Executes dropped EXE
        
        PID:3428
        
        C:\Windows\SysWOW64\Lifjnm32.exe
        
        C:\Windows\system32\Lifjnm32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4140
        
        C:\Windows\SysWOW64\Lppbkgcj.exe
        
        C:\Windows\system32\Lppbkgcj.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:452
        
        C:\Windows\SysWOW64\Lhkgoiqe.exe
        
        C:\Windows\system32\Lhkgoiqe.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3244
        
        C:\Windows\SysWOW64\Lpbopfag.exe
        
        C:\Windows\system32\Lpbopfag.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1172
        
        C:\Windows\SysWOW64\Lflgmqhd.exe
        
        C:\Windows\system32\Lflgmqhd.exe
        64⤵
        Executes dropped EXE
        
        PID:2596
        
        C:\Windows\SysWOW64\Lhncdi32.exe
        
        C:\Windows\system32\Lhncdi32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3240
        
        C:\Windows\SysWOW64\Lbchba32.exe
        
        C:\Windows\system32\Lbchba32.exe
        66⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        67⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Mbedga32.exe
        
        C:\Windows\system32\Mbedga32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4424
        
        C:\Windows\SysWOW64\Miomdk32.exe
        
        C:\Windows\system32\Miomdk32.exe
        69⤵
        
        PID:316
        
        C:\Windows\SysWOW64\Molelb32.exe
        
        C:\Windows\system32\Molelb32.exe
        70⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Mefmimif.exe
        
        C:\Windows\system32\Mefmimif.exe
        71⤵
        Modifies registry class
        
        PID:4752
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        72⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\Mffjcopi.exe
        
        C:\Windows\system32\Mffjcopi.exe
        73⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\Mhgfkg32.exe
        
        C:\Windows\system32\Mhgfkg32.exe
        74⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\Mpnnle32.exe
        
        C:\Windows\system32\Mpnnle32.exe
        75⤵
        
        PID:324
        
        C:\Windows\SysWOW64\Mfhfhong.exe
        
        C:\Windows\system32\Mfhfhong.exe
        76⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Mleoafmn.exe
        
        C:\Windows\system32\Mleoafmn.exe
        77⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Kgopidgf.exe
        
        C:\Windows\system32\Kgopidgf.exe
        78⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\Kjmmepfj.exe
        
        C:\Windows\system32\Kjmmepfj.exe
        79⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4104
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        81⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Kjpijpdg.exe
        
        C:\Windows\system32\Kjpijpdg.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2896
        
        C:\Windows\SysWOW64\Lgcjdd32.exe
        
        C:\Windows\system32\Lgcjdd32.exe
        83⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        84⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        85⤵
        Modifies registry class
        
        PID:4072
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        86⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        87⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        88⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        89⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        90⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        91⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        92⤵
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        93⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Mngegmbc.exe
        
        C:\Windows\system32\Mngegmbc.exe
        94⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        95⤵
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        96⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        97⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Mhafeb32.exe
        
        C:\Windows\system32\Mhafeb32.exe
        98⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        99⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        100⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Mhdckaeo.exe
        
        C:\Windows\system32\Mhdckaeo.exe
        101⤵
        Modifies registry class
        
        PID:5860
        
        C:\Windows\SysWOW64\Malgcg32.exe
        
        C:\Windows\system32\Malgcg32.exe
        102⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        103⤵
        Drops file in System32 directory
        
        PID:5944
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        104⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        105⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        106⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        107⤵
        Drops file in System32 directory
        
        PID:6116
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        108⤵
        Drops file in System32 directory
        
        PID:3956
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        109⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Noeahkfc.exe
        
        C:\Windows\system32\Noeahkfc.exe
        110⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        111⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5388
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        113⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        114⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Nojjcj32.exe
        
        C:\Windows\system32\Nojjcj32.exe
        115⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        116⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        117⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        118⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        119⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        120⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        121⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        122⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5380
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        124⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        125⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        126⤵
        Drops file in System32 directory
        
        PID:5808
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        127⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        128⤵
        Modifies registry class
        
        PID:5252
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5508
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        130⤵
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        131⤵
        Drops file in System32 directory
        
        PID:6140
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        132⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Oafcqcea.exe
        
        C:\Windows\system32\Oafcqcea.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6040
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        134⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        135⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Piphgq32.exe
        
        C:\Windows\system32\Piphgq32.exe
        136⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        137⤵
        Drops file in System32 directory
        
        PID:6260
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        138⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        139⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        140⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        141⤵
        Drops file in System32 directory
        
        PID:6452
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        142⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        143⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        144⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        145⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        146⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        147⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        148⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        149⤵
        Modifies registry class
        
        PID:6800
        
        C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        150⤵
        Drops file in System32 directory
        
        PID:6840
        
        C:\Windows\SysWOW64\Qohpkf32.exe
        
        C:\Windows\system32\Qohpkf32.exe
        151⤵
        Modifies registry class
        
        PID:6884
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        152⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        153⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        154⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        155⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Achegd32.exe
        
        C:\Windows\system32\Achegd32.exe
        156⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        157⤵
        Modifies registry class
        
        PID:7144
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        158⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6220
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        160⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6288
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6380
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        162⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Acokhc32.exe
        
        C:\Windows\system32\Acokhc32.exe
        163⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        164⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        165⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        166⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6788
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        168⤵
        Modifies registry class
        
        PID:6848
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        169⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        170⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7056
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        172⤵
        Modifies registry class
        
        PID:7096
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        173⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6248
        
        C:\Windows\SysWOW64\Cmcolgbj.exe
        
        C:\Windows\system32\Cmcolgbj.exe
        175⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        176⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        177⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        178⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        179⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        180⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        181⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Ccdnjp32.exe
        
        C:\Windows\system32\Ccdnjp32.exe
        182⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        183⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        184⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        185⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        186⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        187⤵
        Drops file in System32 directory
        
        PID:7140
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        188⤵
        Drops file in System32 directory
        
        PID:6436
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        189⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        190⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        191⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        192⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        193⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        194⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        195⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        196⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        197⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        198⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7304
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        200⤵
        Drops file in System32 directory
        
        PID:7348
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        201⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        202⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        203⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        204⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        205⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        206⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        207⤵
        Drops file in System32 directory
        
        PID:7644
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        208⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        209⤵
        Modifies registry class
        
        PID:7728
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        210⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        211⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        212⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        213⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        214⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7976
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        216⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        217⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        218⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8168
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        220⤵
        Drops file in System32 directory
        
        PID:7200
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        221⤵
        Modifies registry class
        
        PID:7284
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        222⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        223⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        224⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        225⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        226⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        227⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        228⤵
        Drops file in System32 directory
        
        PID:7832
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        229⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7992
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        231⤵
        Modifies registry class
        
        PID:8072
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        232⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        233⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        234⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        235⤵
        Drops file in System32 directory
        
        PID:3332
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        236⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        237⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        238⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        239⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        240⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7888
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        242⤵
        Drops file in System32 directory
        
        PID:7984
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        243⤵
        
        PID:828
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        244⤵
        
        PID:632
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        245⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        246⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        247⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        248⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        249⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        250⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        251⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        252⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        253⤵
        Modifies registry class
        
        PID:7704
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        254⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        255⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7380
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7972
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        258⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        259⤵
        Modifies registry class
        
        PID:8108
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        260⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8208
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        262⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        263⤵
        Drops file in System32 directory
        
        PID:8308
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8348
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        265⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        266⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        267⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        268⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        269⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        270⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        271⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        272⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8744
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        274⤵
        Drops file in System32 directory
        
        PID:8788
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        275⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        276⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        277⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        278⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9012
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        280⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        281⤵
        Modifies registry class
        
        PID:9096
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        282⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        283⤵
        Modifies registry class
        
        PID:9188
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        284⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        285⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        286⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        287⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        288⤵
        
        PID:880
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8648
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        290⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        291⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        292⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        293⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        294⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        295⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        296⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9028
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        297⤵
        Drops file in System32 directory
        
        PID:9104
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        298⤵
        Modifies registry class
        
        PID:9156
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        299⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1904
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3132
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        301⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        302⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        303⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        304⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        305⤵
        Modifies registry class
        
        PID:2520
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        306⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        307⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        308⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        309⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        310⤵
        Drops file in System32 directory
        
        PID:368
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        311⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        312⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        313⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9200
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        315⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        316⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        317⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        318⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        319⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        320⤵
        Drops file in System32 directory
        
        PID:3212
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8976
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9080
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        323⤵
        
        PID:412
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        324⤵
        Modifies registry class
        
        PID:8228
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        325⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        326⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        327⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        328⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        329⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        330⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        331⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        332⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        333⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4800
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        335⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        336⤵
        
        PID:772
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        337⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        338⤵
        
        PID:376
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8356
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        340⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        341⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        342⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        343⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        344⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        345⤵
        Modifies registry class
        
        PID:4016
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        346⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        347⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        348⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        349⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        350⤵
        Drops file in System32 directory
        
        PID:4508
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        351⤵
        Drops file in System32 directory
        
        PID:2948
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        352⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        353⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        354⤵
        Modifies registry class
        
        PID:2884
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        355⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        356⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        357⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        358⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        359⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        360⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        361⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        362⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        363⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        364⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        365⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        366⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        367⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        368⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        369⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        370⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        371⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        372⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9312
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9352
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        374⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        375⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9476
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        377⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        378⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        379⤵
        Modifies registry class
        
        PID:9616
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9652
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9700
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        382⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        383⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        384⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        385⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        386⤵
        Modifies registry class
        
        PID:9968
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        387⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10056
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        389⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        390⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        391⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        392⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        393⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        394⤵
        Modifies registry class
        
        PID:9364
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        395⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        396⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        397⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9552
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        398⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        399⤵
        Drops file in System32 directory
        
        PID:9720
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        400⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        401⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        402⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        403⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        404⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        405⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        406⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        407⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        408⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        409⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        410⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        411⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        412⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        413⤵
        Modifies registry class
        
        PID:10052
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        414⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        415⤵
        Modifies registry class
        
        PID:10216
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4300
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        417⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        418⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        419⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        420⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        421⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        422⤵
        Modifies registry class
        
        PID:10148
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        423⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        424⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        425⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        426⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        427⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        428⤵
        Drops file in System32 directory
        
        PID:9580
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        429⤵
        Drops file in System32 directory
        
        PID:9800
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        430⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        431⤵
        Drops file in System32 directory
        
        PID:5700
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        432⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        433⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        434⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        435⤵
        Modifies registry class
        
        PID:9688
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        436⤵
        
        PID:748
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        437⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:10280
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        438⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        439⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        440⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        441⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        442⤵
        Drops file in System32 directory
        
        PID:10528
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        443⤵
        Modifies registry class
        
        PID:10812
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        444⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        445⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        446⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        447⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        448⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        449⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        450⤵
        Drops file in System32 directory
        
        PID:11104
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        451⤵
        Drops file in System32 directory
        
        PID:11140
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        452⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        453⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        454⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        455⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        456⤵
        Drops file in System32 directory
        
        PID:10356
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        457⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        458⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        459⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        460⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4888
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        461⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        462⤵
        Modifies registry class
        
        PID:10616
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        463⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        464⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2844
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        465⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        466⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4464
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        468⤵
        Modifies registry class
        
        PID:4116
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        469⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        470⤵
        Modifies registry class
        
        PID:4620
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        471⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        472⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:324
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        474⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        475⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        476⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        477⤵
        Drops file in System32 directory
        
        PID:11048
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        478⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        479⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        480⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        481⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        482⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10312
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        484⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        485⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        486⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        487⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        488⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2528
        
        C:\Windows\SysWOW64\Damfao32.exe
        
        C:\Windows\system32\Damfao32.exe
        489⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        490⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        491⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        492⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        493⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3548
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        494⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        495⤵
        Modifies registry class
        
        PID:3220
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        496⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        497⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        498⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        499⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        500⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4856
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        501⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        502⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        503⤵
        Drops file in System32 directory
        
        PID:4492
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        504⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        505⤵
        Drops file in System32 directory
        
        PID:3392
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        506⤵
        Drops file in System32 directory
        
        PID:1740
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        507⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        508⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2480
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        509⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3944
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        510⤵
        Modifies registry class
        
        PID:3116
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        511⤵
        Modifies registry class
        
        PID:4072
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        512⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        513⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        514⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        515⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        516⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        517⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        518⤵
        
        PID:708
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        519⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\Qppaclio.exe
        
        C:\Windows\system32\Qppaclio.exe
        520⤵
        Drops file in System32 directory
        
        PID:10664
        
        C:\Windows\SysWOW64\Qjffpe32.exe
        
        C:\Windows\system32\Qjffpe32.exe
        521⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        522⤵
        Drops file in System32 directory
        
        PID:2452
        
        C:\Windows\SysWOW64\Aiplmq32.exe
        
        C:\Windows\system32\Aiplmq32.exe
        523⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Ajohfcpj.exe
        
        C:\Windows\system32\Ajohfcpj.exe
        524⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        525⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        526⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Bpqjjjjl.exe
        
        C:\Windows\system32\Bpqjjjjl.exe
        527⤵
        Drops file in System32 directory
        
        PID:10996
        
        C:\Windows\SysWOW64\Bjhkmbho.exe
        
        C:\Windows\system32\Bjhkmbho.exe
        528⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        529⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        530⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Bdcmkgmm.exe
        
        C:\Windows\system32\Bdcmkgmm.exe
        531⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Bgdemb32.exe
        
        C:\Windows\system32\Bgdemb32.exe
        532⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        533⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Cbkfbcpb.exe
        
        C:\Windows\system32\Cbkfbcpb.exe
        534⤵
        Drops file in System32 directory
        
        PID:6020
        
        C:\Windows\SysWOW64\Cmpjoloh.exe
        
        C:\Windows\system32\Cmpjoloh.exe
        535⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Cdjblf32.exe
        
        C:\Windows\system32\Cdjblf32.exe
        536⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5660
        
        C:\Windows\SysWOW64\Cmbgdl32.exe
        
        C:\Windows\system32\Cmbgdl32.exe
        537⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5520
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        538⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Ckggnp32.exe
        
        C:\Windows\system32\Ckggnp32.exe
        539⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Cgmhcaac.exe
        
        C:\Windows\system32\Cgmhcaac.exe
        540⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        541⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6132
        
        C:\Windows\SysWOW64\Dkkaiphj.exe
        
        C:\Windows\system32\Dkkaiphj.exe
        542⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Dphiaffa.exe
        
        C:\Windows\system32\Dphiaffa.exe
        543⤵
        Modifies registry class
        
        PID:6772
        
        C:\Windows\SysWOW64\Dknnoofg.exe
        
        C:\Windows\system32\Dknnoofg.exe
        544⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Dnljkk32.exe
        
        C:\Windows\system32\Dnljkk32.exe
        545⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6900
        
        C:\Windows\SysWOW64\Dgdncplk.exe
        
        C:\Windows\system32\Dgdncplk.exe
        546⤵
        Modifies registry class
        
        PID:3448
        
        C:\Windows\SysWOW64\Dckoia32.exe
        
        C:\Windows\system32\Dckoia32.exe
        547⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        548⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Dpopbepi.exe
        
        C:\Windows\system32\Dpopbepi.exe
        549⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        550⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Dkedonpo.exe
        
        C:\Windows\system32\Dkedonpo.exe
        551⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Daollh32.exe
        
        C:\Windows\system32\Daollh32.exe
        552⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\Ddmhhd32.exe
        
        C:\Windows\system32\Ddmhhd32.exe
        553⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Egkddo32.exe
        
        C:\Windows\system32\Egkddo32.exe
        554⤵
        Modifies registry class
        
        PID:6072
        
        C:\Windows\SysWOW64\Ejjaqk32.exe
        
        C:\Windows\system32\Ejjaqk32.exe
        555⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Edoencdm.exe
        
        C:\Windows\system32\Edoencdm.exe
        556⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Ekimjn32.exe
        
        C:\Windows\system32\Ekimjn32.exe
        557⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Enhifi32.exe
        
        C:\Windows\system32\Enhifi32.exe
        558⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        559⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Ejojljqa.exe
        
        C:\Windows\system32\Ejojljqa.exe
        560⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        561⤵
        Drops file in System32 directory
        
        PID:6288
        
        C:\Windows\SysWOW64\Ekngemhd.exe
        
        C:\Windows\system32\Ekngemhd.exe
        562⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        563⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Egegjn32.exe
        
        C:\Windows\system32\Egegjn32.exe
        564⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        565⤵
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Fjjjgh32.exe
        
        C:\Windows\system32\Fjjjgh32.exe
        566⤵
        Drops file in System32 directory
        
        PID:6736
        
        C:\Windows\SysWOW64\Fbaahf32.exe
        
        C:\Windows\system32\Fbaahf32.exe
        567⤵
        Drops file in System32 directory
        
        PID:10428
        
        C:\Windows\SysWOW64\Fqfojblo.exe
        
        C:\Windows\system32\Fqfojblo.exe
        568⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Fbfkceca.exe
        
        C:\Windows\system32\Fbfkceca.exe
        569⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6184
        
        C:\Windows\SysWOW64\Ggccllai.exe
        
        C:\Windows\system32\Ggccllai.exe
        570⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Gjaphgpl.exe
        
        C:\Windows\system32\Gjaphgpl.exe
        571⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Gdgdeppb.exe
        
        C:\Windows\system32\Gdgdeppb.exe
        572⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Gkalbj32.exe
        
        C:\Windows\system32\Gkalbj32.exe
        573⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Gbkdod32.exe
        
        C:\Windows\system32\Gbkdod32.exe
        574⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Gclafmej.exe
        
        C:\Windows\system32\Gclafmej.exe
        575⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Gbmadd32.exe
        
        C:\Windows\system32\Gbmadd32.exe
        576⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6308 -s 400
        577⤵
        Program crash
        
        PID:6676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6308 -ip 6308
1⤵
PID:6456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acfhad32.exe

Filesize
280KB

MD5
9c64e7b84521274f34248524052f7bd1

SHA1
42313ea732e8f24db1909f8a5d19bf7b14a613eb

SHA256
50d383c52026d4a955c93b02eb2f46b93b4defaa69387561d749b6f2a43431a9

SHA512
247cf9aed7c95d87c3d0d71e0247148bff31869ce069440432971d9c4c4bfc6a4ce6c58db1f0b652d208e8e24c45e126cafbc07ec4afa14852399b16595d286a

Download Submit
C:\Windows\SysWOW64\Acjclpcf.exe

Filesize
280KB

MD5
a7996ec6f57d479b47dbc9cc3ea174a2

SHA1
729ef6e85ed9612f31d020ca151a6fbe12ba33ad

SHA256
8bb9b809f662b766bfcadaa157abaa189f8aa3e2bdf504121620665d269117d8

SHA512
1a84dc5c4fab04e4733b9f0f3abb5d527aa16ff5559b0cc771fddebc0a483e46723260beac1ae43834be3418a0f7d52f6e395bfac10e4b574db245edaa0dbeb3

Download Submit
C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
280KB

MD5
46286c55133adfe1bd9e04c30add2957

SHA1
d9e7c5f1ca98d33b37f18607eb64766ca8905257

SHA256
a5357468cfe98ab1b837d5e0ba63f38ac5a7364f1988cb1536e617fba7491496

SHA512
ad629c5fbf2aa77af9cf47f7b177e8d4559391a04b0a196600cca1c251c322e61c9205ebf53fc50d7a9f59db49ee5cdc0c6a839574fab9cc087a71524c9398c5

Download Submit
C:\Windows\SysWOW64\Beeoaapl.exe

Filesize
280KB

MD5
2d87992dd5146baadbb76707938e3965

SHA1
740b574be8f34bbb3f40153a9832fffec6121f2c

SHA256
050c7a535c389fb8eea0a8868a96d6db8945b20bda60fb11eed99b52bd95a76c

SHA512
a8caff6bad765e57115c65a0b77b9624ef9b3f1f4880eec6944f750a7887d8308cfefd7c004510a9cf204f18e6a13669103548c2e9925a26413d7a6f2d8669d6

Download Submit
C:\Windows\SysWOW64\Cmhigf32.exe

Filesize
256KB

MD5
fca7e89a511e6d60b4291c5af78e9612

SHA1
9d5ee4f14edb268a7b6475ae5ad5a7dfbb78f1e6

SHA256
2aee7b2c2e171e5056b16e5b052f563c6f98f0b0fe5eae5e49e7a78a5bdd5155

SHA512
f6e060cb395f2e61a5f14060c0518be90c6e571f9b543ffd1031dc7b8441563c84b7b0c38fb080527f0b0229d3dc492b99d7403e0d8d6e4b7792a3c0c7a6b70b

Download Submit
C:\Windows\SysWOW64\Doojec32.exe

Filesize
280KB

MD5
dc6529e41e4f1c736a98138558e7efe7

SHA1
6c843b562229c68a6ac4a288a02a7173b79ede89

SHA256
02d518ffe7a8141698eb0a7e3d63f3864b0e38165f203ef0fd2aecce77bda052

SHA512
20abccdf8888bf2f4e319cedd9b5b576a5e9be8cfd6c9002b60b6f50eedaafe11e7be5a957ae901915eeec71ce5438a5cfd702ddb3c4ea1a3001e32349cf0022

Download Submit
C:\Windows\SysWOW64\Fpjcgm32.exe

Filesize
64KB

MD5
0255784d5d79d3457bdc69061c542a10

SHA1
91023b759d2f3615bb1f258497e2911a43ebbfd9

SHA256
9021775aef40f27c2bfb55a3caa022d954b70e81ee4ee67abd9f3647bff54f52

SHA512
01b1ea1689e182496ca5c0ef0353a9dcfc561a2ee3f20a2ff162a7b4e476a64f3f470ceaf780682442ff4fbe1fc0a815fff91dd2ca17a72eb04e9e6a5dd723a4

Download Submit
C:\Windows\SysWOW64\Gkhkjd32.exe

Filesize
280KB

MD5
080db62ab8125723e02a232af220c009

SHA1
3146b136ab0ca7134cb5619b0cbd2050fcd9f84c

SHA256
9675225479e5a4cac490657c743ac11e5c9ea84e8a89d717ea66d171d65f1fa6

SHA512
feb3ff9e75273393b0e017dc3096b421bf63e37a3b401590dbc5f4fe80b7216cdd12e87ae80cee4a824a6a47a38d6a78da8d74b7e386fdf0cdf2901f954887f7

Download Submit
C:\Windows\SysWOW64\Hkpqkcpd.exe

Filesize
280KB

MD5
afa213d28b8439abd0df0c4906a9f892

SHA1
10db4d96083b9024597153e9ba94d85bebf63e3c

SHA256
02ff06ce616ecbb60edec3506f08ab090ab6569aef71eb79c1cb90745889b44c

SHA512
c022c8b064bc316ddc01512e7a0b0fe1be6bc6d3b3cb91655a636aa68c25a5844e9cc760ad117897472d57d1efdc6f8f451c89811084992803feb6be3af2a29a

Download Submit
C:\Windows\SysWOW64\Hnnljj32.exe

Filesize
280KB

MD5
3a0fc449e9847203d5fba4d27a747f8f

SHA1
e715abb273027b511e25f6a8cf7fd0bc4e969aa4

SHA256
1e263fc06af09ca707227e6b615e922ac209fb8c30abe5831d9665208036038e

SHA512
ac1358fca40f51843036a0adf0ec5efe85f0284c6240feabff620a4b245c7c891b7741b132371fa0cdfcdd8ca1d6da6f56a6478956ca3785d8db64a9caf283bd

Download Submit
C:\Windows\SysWOW64\Icdheded.exe

Filesize
280KB

MD5
2115557a39f6934c1faa7cf14402f2ba

SHA1
f6664fce11282957bf1ff24603b4c2ccf74b810c

SHA256
82145f6fb7afa8dcb2f4af5963aa4e7b5ff31e32a232b9a1fa0fb66f8f4d0f27

SHA512
ecdd1fc691f88b45f9a5e80b2c8f8c65b4dc6ccb5200d590260c5a6790cafe2fc561ae3f73015f46f7f4a3de7819e9a3f58b0da37de30c0da008a0c5c912fc54

Download Submit
C:\Windows\SysWOW64\Kdeoemeg.exe

Filesize
280KB

MD5
a11c5daba424060a0abd097a7b8ec31d

SHA1
369055456ef17f4b08349b15a5bb23efa812db63

SHA256
e2e16665d595f75fb5ab987dae3f04395a6b8b3db54aa7258309bb55b3876ac3

SHA512
2e9b11498507fc678b466247b0f3e736c8a79c5343cfb8b05c2835da4349c877b5926d15ce0d5228aa61d73d0946479ee14548b441082af83aa4df0604fa92e7

Download Submit
C:\Windows\SysWOW64\Kfoafi32.exe

Filesize
280KB

MD5
48483aabffbfdfccfae30426357cd4cd

SHA1
1ddb5781dffd835e9f96e9110537dde4a922671f

SHA256
86ed10509c5b11898800996d9b1399160892f73f89d16dbd51fd4bf54692c447

SHA512
9ef43d881e66bfb3db85044722223901e014103ef0f471f5c52942c89143647b15dd295eaa859c12c2c6a4c00885ca73aab217cc744f677737317c2a89783362

Download Submit
C:\Windows\SysWOW64\Kikame32.exe

Filesize
280KB

MD5
5c2bc990f08120bf132480c78ed813aa

SHA1
1ddc91c857941e8de13263eefbeebc35aec299df

SHA256
abac9be86adfcdf26dc095f81c95306d7bb5bbd540b7f640d7eb0107433a6160

SHA512
e702ae513f9a2f9ae15dfc41e5c97a611e924195d3f4d24905317b85bbe605763a595023304578971c82e4aa6b730774acd16bad2771bb5dc7148dcf2146cf39

Download Submit
C:\Windows\SysWOW64\Kmdqgd32.exe

Filesize
280KB

MD5
93e0ba45bdc473b30f99926040c74f89

SHA1
c22618122c61ebd1ea5592d9f5d08d6bba498dfe

SHA256
027a8276ba0a87460543d1f6c0b6fafc2c499979a440b8b552bfe76fb82e88d0

SHA512
031ba92b310a50dea969aba01a5d4dcd6611abc971c972b913dd70fbdc0d7596a5784f0f7b677601ade6f652ace905d66f7f8967b3aea6b8a2e83dc1499c1be9

Download Submit
C:\Windows\SysWOW64\Kmncnb32.exe

Filesize
280KB

MD5
2f9cba2d13bb7449268d3d9b5c1aa8af

SHA1
e9a1e107babd0ca2a6707b182f6d350b9161b718

SHA256
66c4d26483abe224c3e0e3b052321244a3beba5676806be8a3255d38425a6dd8

SHA512
4b4963d5d9d5d22da320f9ef4265b6568734f4918094037150c085c0d7aaa5d0abfa2cd9616af276b5a4a32bfde770ed6f73efb8d6b225edca87d1861dc9a406

Download Submit
C:\Windows\SysWOW64\Lbmhlihl.exe

Filesize
280KB

MD5
4192d7b73c17dc349e323a3e7ec05f8e

SHA1
79757dce0602c430f6cd3c18d670bacdb2302713

SHA256
28b59ad19feacb9db04ebdd5519b9e543fc599b3b750c66a4c425fc9d4cb77f6

SHA512
366ce26a10e4aa3584cd469e480dea45ad0639308fd4c19037b08b95bbac7276d6ff218f382d14873f8730d32bd82f8a5f3af5854c76a754da5708c62799dd29

Download Submit
C:\Windows\SysWOW64\Lffhfh32.exe

Filesize
280KB

MD5
41150dcf5db807e2c9ceceb4bde93d6e

SHA1
3b3123f4afe7df35fc329dd6565fd6af87bf64e6

SHA256
ea25f705c71f3b0a0aecaa594c5eb27a67d62a7a63662bcbe49d3c651dad4457

SHA512
c426746ec042f3858fe02929f1cd59781195f9a715cdc019d41e70e64f709a86d69375e1786e588c264e089f31efdc18c6ea5dc445eef6fb04cf4e2733b5f613

Download Submit
C:\Windows\SysWOW64\Lfkaag32.exe

Filesize
280KB

MD5
771addf997d1531c885bc75e870de9cc

SHA1
e193ad1450e20f4fb93a961cc5481a91b7260b03

SHA256
92e24c2379f155cd825f0053fd0dad02dbfb4f95cb93c2174e712b90bbe49533

SHA512
07140d9b4911d7b7e9cd98782daf6caf75fa67f9ffad82ab0d35dd9d8416b8392ac1b86b52fba56b3124e7e6d78fb91fd612355b78406e31dc67ae41850bbc7c

Download Submit
C:\Windows\SysWOW64\Lgmngglp.exe

Filesize
280KB

MD5
5b9e3c05453cfee82daa1b736a982c9e

SHA1
4a14d3716b178c909e37307329a9495de5dffddb

SHA256
b3af3a9a1de6ce813a5db907f4a9f3c45f48efa5908f357bcd03b14c74f289d6

SHA512
efef7de639e005e2e6a76b4bf0f3f3d0a880eb3ad589ee915a7901ada4f4a0b01adecbc5abdbd6a22b35ef9fc6acd6d3a2900f89452cd93d01f0ef7e3754447a

Download Submit
C:\Windows\SysWOW64\Llemdo32.exe

Filesize
280KB

MD5
4889bfb17975afec75ef60f0b0bdc757

SHA1
a60df4a3b4009266715162621b5ec6623324b0ba

SHA256
0135603d1c14acae05359b26a36664097df012a0463bb59f13d87867eddedd2c

SHA512
75e8510e65e375f231bb079407c63a6b570361f6a4b6b8c14e461807f070e51b61b3876820034c4afcacb3a22ecc0c77b179d9c2e4220f92b9b2263dd7c6857e

Download Submit
C:\Windows\SysWOW64\Llgjjnlj.exe

Filesize
280KB

MD5
4096c96aed2d6d8a6a83bcd3ee6e1c05

SHA1
89ce11beba0fb35a140d56f80364082643ab6d98

SHA256
a201068f95513c9d97a353edf8743fa0f1619564eb9c113b0894eb6650db931e

SHA512
46077f808af98079c4d84c2fba93e5bc55be58037dab7d0223326238bcd65d0da484a2ce96463334c8e4fe392d3185b6231ef1dbc7b82dde716ec2df59d19723

Download Submit
C:\Windows\SysWOW64\Llpmoiof.exe

Filesize
280KB

MD5
baf21381434a3c96115ac2240b0c71a0

SHA1
da81fafdcb13f3a252fe9452a375371d03750a62

SHA256
e7d8eb8426449249e2c7925a7c49381438fe919cb40782bcf7a4a814a6f45906

SHA512
715e747d7226d91daa07a205a06d299040b387c772ff855470246647ff4729795aabcd0c16c018cb63d8dd9362219701a3475a08d5ae582028a2c9ff64a15fc6

Download Submit
C:\Windows\SysWOW64\Lmiciaaj.exe

Filesize
280KB

MD5
00a6a199cf033a63537ca9d0e443e270

SHA1
4c0488c4fb1df26304f55c80258fb88a6828b0ac

SHA256
956fc30f9cae5d538924c702918e1d9fb53d696ac5a6f1cc8173133ab3238bb1

SHA512
eafa4acafb168283b81d8818323fcd82593aa99342fe1172e82073ed8f791e10007120575c940418148228560b6b2e0b0202fa7d5a7a012d7a5e6e7208261b30

Download Submit
C:\Windows\SysWOW64\Lpebpm32.exe

Filesize
280KB

MD5
073d363107b2cadde0efffa8ce484243

SHA1
a75d666c9736de72e4b3ad29f2a21bbea2868913

SHA256
f929d612141cebc84ff743cda70006ec513e533f3d24fb783e486bce2d8a31c6

SHA512
475e61c8a61c3d8fe779401e99cd3b76f6bfaba13e45dd59c492adaae73c003d42123cd9a1b720f2dc878495e6afcb48af92edcb9858e3045a904c780cb94ed3

Download Submit
C:\Windows\SysWOW64\Mdjagjco.exe

Filesize
280KB

MD5
b88ea29829d1473803cb45376aad8660

SHA1
a63d04d246bf8af66de97fd654c7f7fcd8b95063

SHA256
0fdf3ddedacb5f64008acf1090de1f0f6ba056f3e7dbad33234ffd5250dc3699

SHA512
2ac229af477560efd7db556d3899dff52210388157a98fc9ecbd85fa5d0385af5d292fd5b9d34646bd401f6487d1818ed69e94e816a041a59a6c52436cb757d4

Download Submit
C:\Windows\SysWOW64\Mdmnlj32.exe

Filesize
280KB

MD5
1a1b66bf613fee88add40e64212ed513

SHA1
9bc58ec52ad2eb7959f2d39b8c9606a7e84a4ac9

SHA256
053959928ca7a5c60fad2effeff4383f2184ef8b912950743876d3e4eb277b56

SHA512
f77ecb60ce0f31ede3edc5d87336e175e7e90209ba043a7d46f67b788b776a858fc5a1c83e616a70820cc4bf671c3c318667c4c57d35cd4c4c29f6a987144d3f

Download Submit
C:\Windows\SysWOW64\Mefmimif.exe

Filesize
280KB

MD5
b754cc821ff979dafbbba76c28f759de

SHA1
33baad3a87637ac1c92eafc4b4f1c534c0a9232f

SHA256
6e860686081867ec589bccb4be7039c46c1ccbc98c2307cad79d80ff5207812e

SHA512
ddf6f5343bfdd89d8a04d30635e83763bf2ce2d748e1440c4059d6070833e64ae993ad2abff3954126d381dcd13fef3306dd31a1cc4415f156cd044976620c9a

Download Submit
C:\Windows\SysWOW64\Mgddhf32.exe

Filesize
280KB

MD5
4a49a24e3e979b521461a0db1d512e7b

SHA1
37d3a4e43e7d02809d7b65a132d0929e70ddd22c

SHA256
9c582eb536fab1315517d6a66dc5a6dbdc14435138756647ea5165a53d821e82

SHA512
0332d04196b0a68b567c3fca3cd314c13cda010dc575e30a75ec6e1870e4598e85e50a0633acedb88a8d66bb26be6b6a511b37d66fca4b0486e9f94b0a11e4c7

Download Submit
C:\Windows\SysWOW64\Mgfqmfde.exe

Filesize
280KB

MD5
44d9b4a9fd0abdbe8ffdd008550e356b

SHA1
dd1e626ed99b7b36d12ad4d622959802d192d413

SHA256
ebf8fe54ea8a6798b1c25b91adb77ca01b7361c5b8ba96dd3752de567a5bc90b

SHA512
9d50d16ce9ad7aefa9258ea26f6df203677649219c2ba13dcffce20d338ba7bb0609042daa4cc13d086667901f819701233c8991badcd65bbf97728fe31944d1

Download Submit
C:\Windows\SysWOW64\Mlampmdo.exe

Filesize
280KB

MD5
4b9766c1eb40a86e5f49e2e5f6dd0dcb

SHA1
c9c6120c8dfdef0fe0cb3af877f46ec9d7486c88

SHA256
7772fa911258214d2fee657cef9ef226d59d6691627fd6e7a8e0840d364fff81

SHA512
a7da9c1b88da132dcdc4ac7be9e5f4e4ca38e82a19bd3fa38b443ce45a455000a4b01c619dfff078a8d81d7da346e35e55a25dcc6b4cbe3c06d29220c14d035d

Download Submit
C:\Windows\SysWOW64\Mlopkm32.exe

Filesize
280KB

MD5
8506448493bb71e967567ed20f0467da

SHA1
31fcbfea255dadcd1c57e15a3ce484f8f9e8c54b

SHA256
21b68854084c8380822a27f6ed7d5f26401c4750f57a46cbd211742b176a60f8

SHA512
62d7cc764519682e25d7539657592249a205c1e17122a2a2e52ae08e6736cb692549d883d9d23d8b003bcd5eff944891c485a67fd0ac9d042857098085a5f2b7

Download Submit
C:\Windows\SysWOW64\Ndaggimg.exe

Filesize
280KB

MD5
6207285ba0a08ea7217af9752297550d

SHA1
8f38139c44d2089ff190784048cd7f088e2660ca

SHA256
624e67a10cdfd37382451caa8202fa3174d699804684d92346e1206b8c28223b

SHA512
1d87c9766cddf0ef10d7071651b8108d9c7d803ed4d70da030587fd905b781f6d9f03afc37f8a32628dc7de125b3f132b38a3b87e01f44c3f89ededa9ca6d757

Download Submit
C:\Windows\SysWOW64\Nimbkc32.exe

Filesize
280KB

MD5
8b236379d80819e0755652eb330ec5f7

SHA1
ad9d91108e3dad4161b620c8c092c3d6b1cb19ea

SHA256
e8e7eaa5adb047c740114627a13f17f1e3cb5d9c9cd3d4da8c64e9aa806b9616

SHA512
547580c60e07c0b077ded9742e92c4ab45e6f222004611c8207df515547959f25dbe58e843da3f6a5f8ab65d2cb2317cecb61d540717b6bc16d2523fb1e08ea9

Download Submit
C:\Windows\SysWOW64\Njqmepik.exe

Filesize
256KB

MD5
e1453a824afa11b591bb75b7a814ed44

SHA1
0bb18b1b15ad74ce5ddc5f68fb58e824746ce935

SHA256
43b9901936b554743c1f8af0d5ca15335952dcbbb9a29b3ef21d1109b4188445

SHA512
b7526d0dd43ce2ca05d750b29d4ae47c510da6ba37a66c3af95486e14f7d23c2ffec1b1ed5a11fc8ce111cc0e49c48a2e79832f908f3fc4e771d8e8cc04a67c9

Download Submit
C:\Windows\SysWOW64\Njqmepik.exe

Filesize
280KB

MD5
abb1c5400b37f5deb9b155c38a7ad98f

SHA1
a3ea6202641caa69d6d43ba816c00a5463d7251e

SHA256
7b33052f6404cbb2637977ac67057b7d5a57144542e93470ea6f3dac5604ddee

SHA512
30e862a751cba2a9443c69211e00cfbae5a83d5cc27b65cba14f40f0cf10d7f12263f50ef687bddb37c876abe80b58c21a12976a2a1c7132e67af4ba43a0ba6f

Download Submit
C:\Windows\SysWOW64\Nlmllkja.exe

Filesize
280KB

MD5
f553c8a778b53e640026e196a2b63abe

SHA1
28e4ac663f0a8729b672e9f7b8a5b69422fb2903

SHA256
59bd77a77fe4cc92e24ffee6520a78dc5caa3e2f0f54d4919143d2606315470e

SHA512
3a4343e3698a9cb186bf8325c6ec41123d286d26ae1874ded468a6ffacb4d4085b2a5f45eb21a3070954a97f82e8f012648ecd7ac5b4ce30a4dee62a4d7068a5

Download Submit
C:\Windows\SysWOW64\Nlmllkja.exe

Filesize
211KB

MD5
e92bf642b731268095e736e347d779df

SHA1
78d2bdc67e5026b13760f7db506fb03d9d9723c4

SHA256
902d731a2338240867db810e271ffc7ce5038ccdafd8f4a014bbea2bdd7a0529

SHA512
38441d17c5065f14efd2e6104352d9dc31e2acbca8f445ad88fd6bb03616bd5a239918eb2f974aade960141be18e2f893dc5bfccdeb7af8395486e66d210b107

Download Submit
C:\Windows\SysWOW64\Npcoakfp.exe

Filesize
280KB

MD5
7fd63d6611e6ad9678ee569d04f4d2b2

SHA1
e88645edf95ad01eb984ad1e4f15ee444cfe5fdf

SHA256
929886dc54fc6ea49a0ba27d3294bd33d5d1a96018b9643588cdf61e2271ce6c

SHA512
bbbab21b4b0faad7edad7a028083f8ce5e8886b0846cfebf91f79bda6d06b9a6d6d040d9e4f8db23a6a9a0d7aeab36d27e03aa119cbe990602e6dc1cbabefce4

Download Submit
C:\Windows\SysWOW64\Odocigqg.exe

Filesize
280KB

MD5
15b23feab884aa1d96595312bd2d9f2d

SHA1
b840040c32b914d028cb5b55ae8977a3c9b905b0

SHA256
66d2adcd021414f36bd76b25c6b8d9a5c1825c273f1ba14447c32f10c3d2d8e4

SHA512
0ee05ada231ae707ab35a309281deda147ef57e0faf3b7e408e37687e6885a31982816b14b1717b51e3345e4f9294c512119f1d1e074a8d838613a4a9b322812

Download Submit
C:\Windows\SysWOW64\Ofnckp32.exe

Filesize
280KB

MD5
988f7cd2d7813be4f37b215ac04ac594

SHA1
3562f965bb644c12a22837aaebe6319b45bf433e

SHA256
37b3fa98799dc578444b15c74b6bc81d7b4cc68cea198bd4a7167bda1159ef1a

SHA512
ad2fe3c6e4ac53077c2a93e82a8ab0fc95ff43ad5484dad357376ec19670a09dfb7c703def85e2e10d0ea785ac3acef99e98ef2b9faac24dad660cc5401ae29c

Download Submit
C:\Windows\SysWOW64\Oqhacgdh.exe

Filesize
280KB

MD5
10ec73445028814638164d9ffdc0f679

SHA1
d1a70366638b95dec062dcfc02d276e2c2290207

SHA256
35f3902708ae32178307d1059eebea585936cc8922cdced500d2ab8bfa1d5dc9

SHA512
078b04de34554f6519940d37a403337fb668c426f477d29ed63dab84752148df37aaec58b0c0bf43d5d2961edc73c90a4566253d52ffe437ec94f3547e62151c

Download Submit
C:\Windows\SysWOW64\Pdfjifjo.exe

Filesize
280KB

MD5
7219fe5aba8b52d183d04b7d6ae1e841

SHA1
5fa32fbfbe88c699e0fd507bc1e8679bfff0c3d5

SHA256
c48d7b459a93f3895ac3358019c44d9250b209d95652ac7fae3c510025c3dd73

SHA512
61b3c1d0040ed765c49f8b42b965398fc7bae87da4ad264b1a37bd20de3f5e6750ec1fd6861c9cc57a5fbe50b98f6103676a7945f136bd6a0e3c148bd62889a5

Download Submit
C:\Windows\SysWOW64\Pflplnlg.exe

Filesize
280KB

MD5
231e41193765795a028c2281e4be9ddd

SHA1
db5af2f17a04484d9cea8ebc4a3dd097c8204639

SHA256
1304fcdca09471307ff24c08428f310824774be866d386042760143cf30f8c34

SHA512
8de57a0ebfebc4fc26f675d1ec22b8732866b52b328fc54e79dbaa44be54f88687b8c148a83180abf8ab2e7d51e732c30d3ec986091f7729b8cb58aa725d5f7c

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
280KB

MD5
dfd3dbc4971b1e63c3ad60df4560a011

SHA1
f6eaa6f3ff0b554a55a05e6c9d15c3cfc6caf469

SHA256
823a76ae4abdf47da4e19886f8820d26985e59898a6e06ddb118af2f0f9ae607

SHA512
a61a690c71fc94af53fcb7c4ee203c92e6950562d2f031f85b2626afdf3cf31f92244a6ef4342ea354343cff63c016fd69938955acfcd27e4ac9e1b835651f52

Download Submit
C:\Windows\SysWOW64\Pgllfp32.exe

Filesize
280KB

MD5
95d55cf819e3f30f3f6000e725325aec

SHA1
44785bb3c01209414c9a114018d277943f5abc17

SHA256
56acff393e245c8c4e00fe5bea55318d2a75782561172427cd5096ebbed09f14

SHA512
6c45571b1ba1c70b18937c5e1540015d2a60cc4e30da94358145f3a96bc814c7a4daa8fdcba84b585dc5334708886b2c9292e490db2687bd5dab3128cb472736

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
280KB

MD5
4a72205965ed0286e0005da9b8d73a96

SHA1
54a04d6ef4b45685932562143185747a8424675c

SHA256
9311d7a16ce5e5c9fa2db44ecc831cdd31e6f44567be9e65e9489487d5546308

SHA512
f44563dbeefbffb6ae679917ae823ea94583cb0b6c48f3ece4c746c703333aa1c34976e6aded54feeb9b726974e1df0c9539d79304a56310b1b619fd77c3a265

Download Submit
C:\Windows\SysWOW64\Qnhahj32.exe

Filesize
280KB

MD5
3e8e1bff478b79e43812b0b84fc09ac9

SHA1
c514a1654ba9a6dd1dd3994e9808bd344dfa6988

SHA256
6470e7c887865b6ab617e93b2698556322059de1418d0f6b5e761eac9254d11e

SHA512
65a4111a8f539f71580ae06c3cd764fb66d4ffc6c437672da415c82bc9ef09429880f63aef523068b56b360d5ad7856eed30ab2408163040652db6b276682f62

Download Submit
memory/8-401-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/312-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/312-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/412-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/412-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/452-441-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/688-435-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/688-85-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/772-550-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/772-241-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1004-146-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1004-521-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1068-185-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1068-543-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1428-226-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1428-548-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1592-282-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1660-276-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1692-118-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1992-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1992-414-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2028-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2028-355-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2092-318-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2252-408-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2260-73-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2260-432-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2348-161-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2348-540-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2392-415-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2420-209-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2420-546-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2492-392-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2504-300-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2600-327-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2720-330-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2924-489-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2924-122-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-294-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3028-264-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3244-443-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3384-387-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3428-422-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3436-306-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3504-545-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3504-201-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3528-544-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3528-193-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3552-98-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3552-456-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3836-57-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3836-420-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3864-105-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3864-469-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3888-154-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3888-535-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4016-502-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4016-130-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4084-375-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4120-361-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4120-17-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4140-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4180-312-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4272-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4272-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4272-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4292-342-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4472-508-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4472-138-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4484-90-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4484-448-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4500-270-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4536-348-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4548-541-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4548-169-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4716-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4716-428-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4720-547-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4720-217-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4724-336-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4744-542-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4744-177-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4764-258-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4780-372-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4800-381-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4800-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4804-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4856-367-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4916-374-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4936-249-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4936-551-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4996-288-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5072-234-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5072-549-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads