9d8612486f4bb5e5e1a80c28b5c3ac528d5742b805e398d05c6968e8fb395b8a

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9d8612486f4bb5e5e1a80c28b5c3ac528d5742b805e398d05c6968e8fb395b8a.exe
Size

192KB
MD5

538c20187357cad461d33e7b5de561e0
SHA1

9277daf2d5b9c49b346c9d27998abd473d0f5459
SHA256

9d8612486f4bb5e5e1a80c28b5c3ac528d5742b805e398d05c6968e8fb395b8a
SHA512

027e9d1d0c324bcb6e2813d9da85d3e516957380fc47d4840ce0ef1ee9344d2cd9f2eee7cdf7726c7639ce3caf367efc78bbb380cdbb4c792e30bc5a4886d412
SSDEEP

3072:M249s/0141Xy1Hze/gFM9MEl7lFH3mrlKm8emCR/EC5hBiz8lwDY:M249uXyMIFM6234lKm3mo8Yvi4Ks

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaqgek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bemlmgnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cojjqlpk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clbceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eaklidoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fhcpgmjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfcbjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jfhlejnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bblckl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgmpccl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdbiedpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdffocib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eaklidoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hkkhqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbpjhp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paegjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pncgmkmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aacckjaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gokdeeec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfnphn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kpeiioac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbhoqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ecmeig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkffog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdqejn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Agglboim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pbddcoei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Edbklofb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdeoemeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lebkhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahoimd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ipnjab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeaikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oboaabga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cklaknjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nngokoej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pndohaqe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fakdpb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndaggimg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojjffddl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pbpjhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Elgfgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jlnnmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocdqjceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pmoahijl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odednmpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjghpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ecoangbg.exe

Executes dropped EXE 64 IoCs

pid	Process
2824	Kmegbjgn.exe
1612	Kbapjafe.exe
4904	Kilhgk32.exe
4488	Kacphh32.exe
4384	Kdaldd32.exe
2480	Kinemkko.exe
4412	Kaemnhla.exe
4436	Kdcijcke.exe
1540	Kgbefoji.exe
4564	Kmlnbi32.exe
2080	Kdffocib.exe
2484	Kgdbkohf.exe
1168	Kajfig32.exe
1668	Kdhbec32.exe
4144	Kgfoan32.exe
5092	Liekmj32.exe
980	Lpocjdld.exe
3732	Lcmofolg.exe
3704	Lmccchkn.exe
532	Lcpllo32.exe
4912	Lkgdml32.exe
3000	Lnepih32.exe
1872	Lcbiao32.exe
904	Lilanioo.exe
4848	Lpfijcfl.exe
3564	Lcdegnep.exe
2352	Lnjjdgee.exe
3288	Lphfpbdi.exe
1040	Lcgblncm.exe
3052	Mjqjih32.exe
2160	Mpkbebbf.exe
1416	Mciobn32.exe
704	Mnocof32.exe
1420	Mpmokb32.exe
4048	Mcklgm32.exe
3972	Mkbchk32.exe
3112	Mamleegg.exe
4224	Mcnhmm32.exe
4460	Mjhqjg32.exe
4760	Mdmegp32.exe
1692	Mglack32.exe
696	Mjjmog32.exe
4584	Mdpalp32.exe
2264	Mgnnhk32.exe
4044	Njljefql.exe
4652	Nacbfdao.exe
4984	Ndbnboqb.exe
3416	Nklfoi32.exe
364	Nnjbke32.exe
2696	Nqiogp32.exe
2340	Ngcgcjnc.exe
404	Njacpf32.exe
4328	Nqklmpdd.exe
908	Ncihikcg.exe
3096	Ngedij32.exe
4972	Njcpee32.exe
4864	Ncldnkae.exe
1396	Nbmelbid.exe
776	Okeieh32.exe
948	Ojhiqefo.exe
5056	Oboaabga.exe
4996	Odnnnnfe.exe
2332	Ogljjiei.exe
4416	Ojjffddl.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Njcpee32.exe
File opened for modification	C:\Windows\SysWOW64\Bdolhc32.exe	Bemlmgnp.exe
File created	C:\Windows\SysWOW64\Ecmeig32.exe	Ekemhj32.exe
File opened for modification	C:\Windows\SysWOW64\Ambgef32.exe	Anogiicl.exe
File created	C:\Windows\SysWOW64\Ncldnkae.exe	Njcpee32.exe
File created	C:\Windows\SysWOW64\Jfcibe32.dll	Blfdia32.exe
File created	C:\Windows\SysWOW64\Hmabdibj.exe	Hiefcj32.exe
File created	C:\Windows\SysWOW64\Lplhdc32.dll	Melnob32.exe
File created	C:\Windows\SysWOW64\Dngdgf32.dll	Lcpllo32.exe
File created	C:\Windows\SysWOW64\Dgifdn32.dll	Chghdqbf.exe
File opened for modification	C:\Windows\SysWOW64\Ocdqjceo.exe	Oqfdnhfk.exe
File created	C:\Windows\SysWOW64\Pfaigm32.exe	Pqdqof32.exe
File created	C:\Windows\SysWOW64\Kihgme32.dll	Ahoimd32.exe
File opened for modification	C:\Windows\SysWOW64\Bbifelba.exe	Bhdbhcck.exe
File created	C:\Windows\SysWOW64\Hnigkegh.dll	Chpada32.exe
File created	C:\Windows\SysWOW64\Ghaliknf.exe	Gfbploob.exe
File created	C:\Windows\SysWOW64\Mcnhmm32.exe	Mamleegg.exe
File created	C:\Windows\SysWOW64\Olihhh32.dll	Pnpemb32.exe
File created	C:\Windows\SysWOW64\Fdmlkkap.dll	Pbddcoei.exe
File opened for modification	C:\Windows\SysWOW64\Adapgfqj.exe	Aacckjaf.exe
File created	C:\Windows\SysWOW64\Mlopkm32.exe	Medgncoe.exe
File created	C:\Windows\SysWOW64\Ngmgne32.exe	Ndokbi32.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Cdcoim32.exe
File opened for modification	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bnmcjg32.exe
File created	C:\Windows\SysWOW64\Lbhnnj32.dll	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Aneonqmj.dll	Bhfonc32.exe
File created	C:\Windows\SysWOW64\Choehhlk.dll	Hioiji32.exe
File created	C:\Windows\SysWOW64\Jbhfjljd.exe	Jcefno32.exe
File created	C:\Windows\SysWOW64\Klngdpdd.exe	Kipkhdeq.exe
File created	C:\Windows\SysWOW64\Papbpdoi.dll	Qfcfml32.exe
File created	C:\Windows\SysWOW64\Beapme32.dll	Odocigqg.exe
File created	C:\Windows\SysWOW64\Pqmjog32.exe	Pjcbbmif.exe
File opened for modification	C:\Windows\SysWOW64\Pcojkhap.exe	Pqpnombl.exe
File created	C:\Windows\SysWOW64\Inlekh32.dll	Eepjpb32.exe
File opened for modification	C:\Windows\SysWOW64\Hkkhqd32.exe	Hmhhehlb.exe
File created	C:\Windows\SysWOW64\Iejcji32.exe	Ifgbnlmj.exe
File created	C:\Windows\SysWOW64\Onhhamgg.exe	Ofqpqo32.exe
File created	C:\Windows\SysWOW64\Ibaabn32.dll	Anogiicl.exe
File created	C:\Windows\SysWOW64\Anphnl32.dll	Gkhbdg32.exe
File created	C:\Windows\SysWOW64\Bagplp32.dll	Jcioiood.exe
File created	C:\Windows\SysWOW64\Ikkokgea.dll	Lllcen32.exe
File opened for modification	C:\Windows\SysWOW64\Njnpppkn.exe	Ngpccdlj.exe
File created	C:\Windows\SysWOW64\Ickchq32.exe	Imakkfdg.exe
File created	C:\Windows\SysWOW64\Kbaipkbi.exe	Kpbmco32.exe
File opened for modification	C:\Windows\SysWOW64\Medgncoe.exe	Mdckfk32.exe
File opened for modification	C:\Windows\SysWOW64\Ajkaii32.exe	Afoeiklb.exe
File created	C:\Windows\SysWOW64\Kdffocib.exe	Kmlnbi32.exe
File created	C:\Windows\SysWOW64\Pbpjhp32.exe	Pndohaqe.exe
File created	C:\Windows\SysWOW64\Dceohhja.exe	Dkoggkjo.exe
File created	C:\Windows\SysWOW64\Gjihje32.dll	Dedkdcie.exe
File created	C:\Windows\SysWOW64\Ingfla32.dll	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Icfpbq32.dll	Fooeif32.exe
File opened for modification	C:\Windows\SysWOW64\Hckjacjg.exe	Hopnqdan.exe
File created	C:\Windows\SysWOW64\Phaedfje.dll	Jlkagbej.exe
File created	C:\Windows\SysWOW64\Icpnnd32.dll	Kfoafi32.exe
File created	C:\Windows\SysWOW64\Olmeci32.exe	Ofcmfodb.exe
File created	C:\Windows\SysWOW64\Mjqjih32.exe	Lcgblncm.exe
File created	C:\Windows\SysWOW64\Kmdigkkd.dll	Mjqjih32.exe
File opened for modification	C:\Windows\SysWOW64\Cafigg32.exe	Cklaknjd.exe
File created	C:\Windows\SysWOW64\Bapolp32.dll	Deanodkh.exe
File opened for modification	C:\Windows\SysWOW64\Qnjnnj32.exe	Qfcfml32.exe
File created	C:\Windows\SysWOW64\Lbabpnmn.dll	Ddakjkqi.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File opened for modification	C:\Windows\SysWOW64\Pnpemb32.exe	Pkaiqf32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12476	12384	WerFault.exe	593

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pbddcoei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eckgieoo.dll"	Dkoggkjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ndokbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nlmllkja.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdmai32.dll"	Ocdqjceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oqihnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlkefpan.dll"	Pkaiqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ekacmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ippohl32.dll"	Jmmjgejj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keblci32.dll"	Ipknlb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ieolehop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kdqejn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kahdohfm.dll"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlkolh32.dll"	Becifhfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ekhjmiad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkbbae32.dll"	Hofdacke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ocnjidkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ogbipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pclgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cdiooblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bqhimici.dll"	Edbklofb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lplhdc32.dll"	Melnob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mgkjhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Beglgani.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jijjfldq.dll"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hmhhehlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jplfcpin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Medgncoe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohjdgn32.dll"	Ofnckp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pmdkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcoppd32.dll"	Ojjffddl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Glhonj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmalco32.dll"	Nklfoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dkoggkjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akichh32.dll"	Beeoaapl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kepelfam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iljnde32.dll"	9d8612486f4bb5e5e1a80c28b5c3ac528d5742b805e398d05c6968e8fb395b8a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcpkbc32.dll"	Kaemnhla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afomjffg.dll"	Imfdff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kdqejn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kplpjn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Chmndlge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kdaldd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipagf32.dll"	Kdhbec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ajkhdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iddoeojd.dll"	Dlncan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlkhie32.dll"	Ipdqba32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Milgab32.dll"	Kdcijcke.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2824	2444	9d8612486f4bb5e5e1a80c28b5c3ac528d5742b805e398d05c6968e8fb395b8a.exe	90
PID 2444 wrote to memory of 2824	2444	9d8612486f4bb5e5e1a80c28b5c3ac528d5742b805e398d05c6968e8fb395b8a.exe	90
PID 2444 wrote to memory of 2824	2444	9d8612486f4bb5e5e1a80c28b5c3ac528d5742b805e398d05c6968e8fb395b8a.exe	90
PID 2824 wrote to memory of 1612	2824	Kmegbjgn.exe	91
PID 2824 wrote to memory of 1612	2824	Kmegbjgn.exe	91
PID 2824 wrote to memory of 1612	2824	Kmegbjgn.exe	91
PID 1612 wrote to memory of 4904	1612	Kbapjafe.exe	92
PID 1612 wrote to memory of 4904	1612	Kbapjafe.exe	92
PID 1612 wrote to memory of 4904	1612	Kbapjafe.exe	92
PID 4904 wrote to memory of 4488	4904	Kilhgk32.exe	93
PID 4904 wrote to memory of 4488	4904	Kilhgk32.exe	93
PID 4904 wrote to memory of 4488	4904	Kilhgk32.exe	93
PID 4488 wrote to memory of 4384	4488	Kacphh32.exe	94
PID 4488 wrote to memory of 4384	4488	Kacphh32.exe	94
PID 4488 wrote to memory of 4384	4488	Kacphh32.exe	94
PID 4384 wrote to memory of 2480	4384	Kdaldd32.exe	95
PID 4384 wrote to memory of 2480	4384	Kdaldd32.exe	95
PID 4384 wrote to memory of 2480	4384	Kdaldd32.exe	95
PID 2480 wrote to memory of 4412	2480	Kinemkko.exe	96
PID 2480 wrote to memory of 4412	2480	Kinemkko.exe	96
PID 2480 wrote to memory of 4412	2480	Kinemkko.exe	96
PID 4412 wrote to memory of 4436	4412	Kaemnhla.exe	97
PID 4412 wrote to memory of 4436	4412	Kaemnhla.exe	97
PID 4412 wrote to memory of 4436	4412	Kaemnhla.exe	97
PID 4436 wrote to memory of 1540	4436	Kdcijcke.exe	98
PID 4436 wrote to memory of 1540	4436	Kdcijcke.exe	98
PID 4436 wrote to memory of 1540	4436	Kdcijcke.exe	98
PID 1540 wrote to memory of 4564	1540	Kgbefoji.exe	99
PID 1540 wrote to memory of 4564	1540	Kgbefoji.exe	99
PID 1540 wrote to memory of 4564	1540	Kgbefoji.exe	99
PID 4564 wrote to memory of 2080	4564	Kmlnbi32.exe	100
PID 4564 wrote to memory of 2080	4564	Kmlnbi32.exe	100
PID 4564 wrote to memory of 2080	4564	Kmlnbi32.exe	100
PID 2080 wrote to memory of 2484	2080	Kdffocib.exe	101
PID 2080 wrote to memory of 2484	2080	Kdffocib.exe	101
PID 2080 wrote to memory of 2484	2080	Kdffocib.exe	101
PID 2484 wrote to memory of 1168	2484	Kgdbkohf.exe	102
PID 2484 wrote to memory of 1168	2484	Kgdbkohf.exe	102
PID 2484 wrote to memory of 1168	2484	Kgdbkohf.exe	102
PID 1168 wrote to memory of 1668	1168	Kajfig32.exe	103
PID 1168 wrote to memory of 1668	1168	Kajfig32.exe	103
PID 1168 wrote to memory of 1668	1168	Kajfig32.exe	103
PID 1668 wrote to memory of 4144	1668	Kdhbec32.exe	104
PID 1668 wrote to memory of 4144	1668	Kdhbec32.exe	104
PID 1668 wrote to memory of 4144	1668	Kdhbec32.exe	104
PID 4144 wrote to memory of 5092	4144	Kgfoan32.exe	105
PID 4144 wrote to memory of 5092	4144	Kgfoan32.exe	105
PID 4144 wrote to memory of 5092	4144	Kgfoan32.exe	105
PID 5092 wrote to memory of 980	5092	Liekmj32.exe	106
PID 5092 wrote to memory of 980	5092	Liekmj32.exe	106
PID 5092 wrote to memory of 980	5092	Liekmj32.exe	106
PID 980 wrote to memory of 3732	980	Lpocjdld.exe	107
PID 980 wrote to memory of 3732	980	Lpocjdld.exe	107
PID 980 wrote to memory of 3732	980	Lpocjdld.exe	107
PID 3732 wrote to memory of 3704	3732	Lcmofolg.exe	108
PID 3732 wrote to memory of 3704	3732	Lcmofolg.exe	108
PID 3732 wrote to memory of 3704	3732	Lcmofolg.exe	108
PID 3704 wrote to memory of 532	3704	Lmccchkn.exe	109
PID 3704 wrote to memory of 532	3704	Lmccchkn.exe	109
PID 3704 wrote to memory of 532	3704	Lmccchkn.exe	109
PID 532 wrote to memory of 4912	532	Lcpllo32.exe	110
PID 532 wrote to memory of 4912	532	Lcpllo32.exe	110
PID 532 wrote to memory of 4912	532	Lcpllo32.exe	110
PID 4912 wrote to memory of 3000	4912	Lkgdml32.exe	111

C:\Users\Admin\AppData\Local\Temp\9d8612486f4bb5e5e1a80c28b5c3ac528d5742b805e398d05c6968e8fb395b8a.exe
"C:\Users\Admin\AppData\Local\Temp\9d8612486f4bb5e5e1a80c28b5c3ac528d5742b805e398d05c6968e8fb395b8a.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\Kmegbjgn.exe
  C:\Windows\system32\Kmegbjgn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\Kbapjafe.exe
    C:\Windows\system32\Kbapjafe.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1612
  - - C:\Windows\SysWOW64\Kilhgk32.exe
      C:\Windows\system32\Kilhgk32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4904
    - - C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4488
      - C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1668
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4144
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:980
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3704
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:532
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        23⤵
        Executes dropped EXE
        
        PID:3000
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        24⤵
        Executes dropped EXE
        
        PID:1872
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        25⤵
        Executes dropped EXE
        
        PID:904
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        26⤵
        Executes dropped EXE
        
        PID:4848
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        27⤵
        Executes dropped EXE
        
        PID:3564
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        28⤵
        Executes dropped EXE
        
        PID:2352
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3288
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1040
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3052
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        32⤵
        Executes dropped EXE
        
        PID:2160
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        33⤵
        Executes dropped EXE
        
        PID:1416
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        34⤵
        Executes dropped EXE
        
        PID:704
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        35⤵
        Executes dropped EXE
        
        PID:1420
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        36⤵
        Executes dropped EXE
        
        PID:4048
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        37⤵
        Executes dropped EXE
        
        PID:3972
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3112
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        39⤵
        Executes dropped EXE
        
        PID:4224
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        40⤵
        Executes dropped EXE
        
        PID:4460
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        41⤵
        Executes dropped EXE
        
        PID:4760
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        42⤵
        Executes dropped EXE
        
        PID:1692
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        43⤵
        Executes dropped EXE
        
        PID:696
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        44⤵
        Executes dropped EXE
        
        PID:4584
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2264
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        46⤵
        Executes dropped EXE
        
        PID:4044
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        47⤵
        Executes dropped EXE
        
        PID:4652
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        48⤵
        Executes dropped EXE
        
        PID:4984
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3416
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        50⤵
        Executes dropped EXE
        
        PID:364
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        51⤵
        Executes dropped EXE
        
        PID:2696
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        52⤵
        Executes dropped EXE
        
        PID:2340
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        53⤵
        Executes dropped EXE
        
        PID:404
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        54⤵
        Executes dropped EXE
        
        PID:4328
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        55⤵
        Executes dropped EXE
        
        PID:908
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        56⤵
        Executes dropped EXE
        
        PID:3096
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4972
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        58⤵
        Executes dropped EXE
        
        PID:4864
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        59⤵
        Executes dropped EXE
        
        PID:1396
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        60⤵
        Executes dropped EXE
        
        PID:776
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        61⤵
        Executes dropped EXE
        
        PID:948
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5056
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        63⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        64⤵
        Executes dropped EXE
        
        PID:2332
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4416
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        66⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        67⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        68⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        69⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        70⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        71⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        72⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        73⤵
        Modifies registry class
        
        PID:4292
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1544
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        75⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        76⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        77⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        78⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        79⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5320
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        80⤵
        Drops file in System32 directory
        
        PID:5360
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        81⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        82⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        83⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        84⤵
        Drops file in System32 directory
        
        PID:5520
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        85⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        86⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5660
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5704
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        89⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        90⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        91⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        92⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5912
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        94⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        95⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        96⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        97⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4948
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        99⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        100⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        101⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        102⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        103⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        104⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        105⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        106⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        107⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5880
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        109⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        110⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        111⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1932
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        113⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        114⤵
        Modifies registry class
        
        PID:5352
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        115⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        116⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        117⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5812
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        119⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        120⤵
        Modifies registry class
        
        PID:6044
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        121⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        122⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        123⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        124⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        125⤵
        Drops file in System32 directory
        
        PID:5848
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        126⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        127⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        128⤵
        Drops file in System32 directory
        
        PID:5548
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        129⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6128
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5692
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        132⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5712
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        134⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        135⤵
        Drops file in System32 directory
        
        PID:6164
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        136⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        137⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        138⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6336
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        140⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        141⤵
        Drops file in System32 directory
        
        PID:6432
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6472
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        143⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        144⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        145⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        146⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        147⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        148⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        149⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        150⤵
        Modifies registry class
        
        PID:6816
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        151⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        152⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        153⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        154⤵
        Drops file in System32 directory
        
        PID:6992
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7032
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        156⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        157⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        158⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        159⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        160⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        161⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        162⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        163⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        164⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        165⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        166⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        167⤵
        Drops file in System32 directory
        
        PID:6700
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        168⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        169⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        170⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        171⤵
        Drops file in System32 directory
        
        PID:6988
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        172⤵
        Modifies registry class
        
        PID:7040
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        173⤵
        Modifies registry class
        
        PID:7120
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6148
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        175⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        176⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        177⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        178⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        179⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        180⤵
        Drops file in System32 directory
        
        PID:6708
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6844
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        182⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        183⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        184⤵
        Modifies registry class
        
        PID:5908
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6264
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6612
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        187⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        188⤵
        Drops file in System32 directory
        
        PID:7016
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6172
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        190⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        191⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        192⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        193⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        194⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        195⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7200
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        197⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        198⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7328
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        200⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        201⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        202⤵
        Drops file in System32 directory
        
        PID:7448
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        203⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        204⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        205⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        206⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7652
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        208⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        209⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        210⤵
        Drops file in System32 directory
        
        PID:7776
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        211⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        212⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        213⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        214⤵
        Modifies registry class
        
        PID:7968
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        215⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        216⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        217⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        218⤵
        Drops file in System32 directory
        
        PID:8184
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        219⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7264
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        221⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        222⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        223⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        224⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        225⤵
        Drops file in System32 directory
        
        PID:7704
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        226⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        227⤵
        Drops file in System32 directory
        
        PID:7864
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        228⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        229⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        230⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        231⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        232⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        233⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        234⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        235⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7832
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        237⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8060
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8164
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        239⤵
        Modifies registry class
        
        PID:7360
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        240⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        241⤵
        Drops file in System32 directory
        
        PID:7856
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        242⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        243⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        244⤵
        Modifies registry class
        
        PID:7812
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        245⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        246⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        247⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8232
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        249⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        250⤵
        Drops file in System32 directory
        
        PID:8316
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        251⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        252⤵
        Drops file in System32 directory
        
        PID:8396
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        253⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        254⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        255⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        256⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        257⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        258⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        259⤵
        Modifies registry class
        
        PID:8700
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        260⤵
        Modifies registry class
        
        PID:8744
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        261⤵
        Modifies registry class
        
        PID:8788
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        262⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8868
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        264⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        265⤵
        Drops file in System32 directory
        
        PID:8952
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        266⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        267⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        268⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        269⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9172
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        271⤵
        Drops file in System32 directory
        
        PID:9212
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        272⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8304
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        274⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        275⤵
        Modifies registry class
        
        PID:8448
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        276⤵
        Modifies registry class
        
        PID:8512
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        277⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        278⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        279⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        280⤵
        Drops file in System32 directory
        
        PID:8780
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8852
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        282⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        283⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        284⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        285⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        286⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        287⤵
        Drops file in System32 directory
        
        PID:8228
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        288⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        289⤵
        Modifies registry class
        
        PID:8468
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8540
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8672
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        292⤵
        Drops file in System32 directory
        
        PID:8808
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        293⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        294⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        295⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        296⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        297⤵
        Drops file in System32 directory
        
        PID:8424
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        298⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8796
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9036
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        301⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        302⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        303⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        304⤵
        Modifies registry class
        
        PID:8772
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        305⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        306⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        307⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        308⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        309⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        310⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        311⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        312⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        313⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        314⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        315⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        316⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        317⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        318⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        319⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        320⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        321⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9808
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        323⤵
        Drops file in System32 directory
        
        PID:9860
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        324⤵
        Drops file in System32 directory
        
        PID:9900
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        325⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9944
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        326⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        327⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        328⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        329⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        330⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        331⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        332⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        333⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        334⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        335⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        336⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        337⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9520
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        338⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        339⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        340⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        341⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        342⤵
        Modifies registry class
        
        PID:9884
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        343⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        344⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        345⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        346⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10104
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        347⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        348⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9308
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        350⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9552
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        352⤵
        Drops file in System32 directory
        
        PID:9732
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        353⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        354⤵
        Modifies registry class
        
        PID:9920
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        355⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        356⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        357⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        358⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        359⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        360⤵
        Modifies registry class
        
        PID:9792
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        361⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        362⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        363⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        364⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        365⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        366⤵
        Modifies registry class
        
        PID:9276
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        367⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        368⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        369⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        370⤵
        Modifies registry class
        
        PID:10260
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        371⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        372⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        373⤵
        Drops file in System32 directory
        
        PID:10380
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        374⤵
        Modifies registry class
        
        PID:10424
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        375⤵
        Drops file in System32 directory
        
        PID:10464
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        376⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        377⤵
        Drops file in System32 directory
        
        PID:10540
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10584
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        379⤵
        Drops file in System32 directory
        
        PID:10620
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        380⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10704
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        382⤵
        Modifies registry class
        
        PID:10744
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        383⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10832
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        385⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        386⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        387⤵
        Drops file in System32 directory
        
        PID:10952
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        388⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        389⤵
        Modifies registry class
        
        PID:11032
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        390⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        391⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        392⤵
        Modifies registry class
        
        PID:11160
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        393⤵
        Modifies registry class
        
        PID:11200
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        394⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        395⤵
        Modifies registry class
        
        PID:10248
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        396⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        397⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10376
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        398⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        399⤵
        Modifies registry class
        
        PID:10500
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        400⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        401⤵
        Modifies registry class
        
        PID:10656
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        402⤵
        Drops file in System32 directory
        
        PID:10716
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        403⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        404⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        405⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10980
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        407⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        408⤵
        Drops file in System32 directory
        
        PID:11096
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        409⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        410⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        411⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        412⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        413⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        414⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        415⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        416⤵
        Drops file in System32 directory
        
        PID:11040
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        417⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        418⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10408
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        420⤵
        Modifies registry class
        
        PID:10628
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        421⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        422⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        423⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        424⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        425⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        426⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        427⤵
        Drops file in System32 directory
        
        PID:10904
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        428⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        429⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11256
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        430⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        431⤵
        Modifies registry class
        
        PID:11312
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        432⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        433⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        434⤵
        Modifies registry class
        
        PID:11436
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        435⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11516
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        437⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        438⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        439⤵
        Modifies registry class
        
        PID:11636
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        440⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        441⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:11764
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        443⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11800
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        444⤵
        Modifies registry class
        
        PID:11844
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        445⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        446⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        447⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        448⤵
        Modifies registry class
        
        PID:12024
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12072
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        450⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        451⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        452⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12232
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        454⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        455⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        456⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        457⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        458⤵
        Modifies registry class
        
        PID:11500
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11568
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        460⤵
        Modifies registry class
        
        PID:11644
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        461⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        462⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        463⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11872
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        464⤵
        Drops file in System32 directory
        
        PID:11924
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        465⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        466⤵
        
        PID:12060
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12132
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        468⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        469⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12264
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        470⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        471⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11556
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        473⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        474⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11792
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        475⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        476⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12104
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        478⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        479⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10616
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        480⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        481⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        482⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        483⤵
        
        PID:12032
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        484⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        485⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        486⤵
        Modifies registry class
        
        PID:11524
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        487⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        488⤵
        Modifies registry class
        
        PID:12120
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        489⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        490⤵
        Drops file in System32 directory
        
        PID:12020
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        491⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        492⤵
        Modifies registry class
        
        PID:11540
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        493⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        494⤵
        
        PID:12296
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        495⤵
        Drops file in System32 directory
        
        PID:12340
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        496⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12384 -s 408
        497⤵
        Program crash
        
        PID:12476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 12384 -ip 12384
1⤵
PID:12444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bjfaeh32.exe

Filesize
192KB

MD5
1682d0df37473f3d8a14b7dea77bd63d

SHA1
533ddb3eb2407d84dac5e5bdb72e0ab694ebdf28

SHA256
55b8bdb759bc8c57aee52772f8419b093aa9679d72d9d2f390e589504576f112

SHA512
afb6a2a96bc7aeef402b03e6bef25ef062a484c38ce4daaf3fa643b39f90f61eeaca6d5c45683910ba1bba4160193d6ef3f66f7d6cb3338dccf5ec098b55c5d7

Download Submit
C:\Windows\SysWOW64\Bjghpn32.exe

Filesize
192KB

MD5
4f7b2ab367916326bcfa27cb514181ff

SHA1
b26f44af1a92737120e16384bfe54149dbfde585

SHA256
fdc831b440e224ab47662eecd887054de5e5a853410485635b3b5fb927cbaa60

SHA512
365048b12e3ced5dc7c4330eb0ea4f2d7874151f2689291345ecc7c94e4241518b2babcef1fb4642e6aaf96d4dc322232771f8d62a878b773725ede68ce87e81

Download Submit
C:\Windows\SysWOW64\Bnckcnhb.dll

Filesize
7KB

MD5
c887a7fc83d82805c836726d730026e6

SHA1
0f6e36befea91384c66a2655b03af5b5e15aea21

SHA256
536a9df2e52095a2e1045db733a46faec9c5d5f69662333f87fad5d647a65c68

SHA512
395ac373895399b8e883674afa926511a78578eea12dabe4553b5a1dc450bfb08c5b8a90019cd3758aa59f298db6c8079bca20d240f90ca2984c2b002f191600

Download Submit
C:\Windows\SysWOW64\Hodgkc32.exe

Filesize
192KB

MD5
fc1ef89348666d2dc5cc47b97f1e350d

SHA1
3c72e04a3f6638db8e4772c3ecbbaa0388ab1f39

SHA256
0bb1d471637c10e563f3d9dfdc494000ddf0811e484bc55f3211da4b456ea305

SHA512
6002367675c214803d7b1c339c46f65c4cca32c6df72238d3ef3049ad6b4f29a25c95b7b74b018ce7a7167e8699748c982daca4cbc7eba4cbc1950265860a48f

Download Submit
C:\Windows\SysWOW64\Jifhaenk.exe

Filesize
192KB

MD5
536e27c9f1e992b7e21926ec163cf395

SHA1
08d025bd0c57711913c3afe3b56c152736b219f5

SHA256
03139c8133a33631781a4ccc06b9b792ebf448a6d7adba14adee9c2fcb419d39

SHA512
5b1faccefb3e47674edc93e9c89259e00124403cbd2220386789c74b9ef695167463764fbc3a213dfe845a59e5b2208f866bdcad273d992ef47ec8607d2fc300

Download Submit
C:\Windows\SysWOW64\Kacphh32.exe

Filesize
192KB

MD5
e63f676d86f177a579a359ae79dbd7ec

SHA1
c060116a940b12abbb47119502f111b6ca1af726

SHA256
af31867cc492e023522f61b7d61af20fc05449f98fd78f4a20879d891cf2e6c2

SHA512
39d0ddb942052e6a0c325da0b22e3e3fe47a43bd89713af19186f3ace4ffa206ceb60655f880b1b0ac5e654c88b1dd59d1b8daf373162929ba686bb5d3d5cc1b

Download Submit
C:\Windows\SysWOW64\Kaemnhla.exe

Filesize
192KB

MD5
911acf947abe8890225ccfe729a49e00

SHA1
f12ff5aa69f383886afb49276d7d479ac6572685

SHA256
9e41c919dd08871f57fd619c9557e1e808b0f652bf8524dab8edbf48e26cbeb7

SHA512
9507e2edc3304817e07b836fab2567e63a194d0d27c19021c3dc57588ba074785e228a0c83621c045cab4221742019f7958433bc2b6a1d42bea9befd9c034b9a

Download Submit
C:\Windows\SysWOW64\Kajfig32.exe

Filesize
192KB

MD5
a98d290d90198f769c6e1f3c4cbe6c9c

SHA1
3f2318a8b073a2968b434a6d6a5f338500878ca1

SHA256
448d968ac895c2cd138030d06a96cc83dd135cdcf40f3ba4da8da26967b9c429

SHA512
12bac9554ee6a478e842055a94899f42f156b202115ef290e7b4ebf9291891b75be40ec75df6f0de3ca4a0abaa20e6149da3b28e07ae605f2014353e5e7520b4

Download Submit
C:\Windows\SysWOW64\Kbapjafe.exe

Filesize
192KB

MD5
8532cde194b7dc46e99bd49ef61e4c47

SHA1
c104c6d7b3b7b524916db03bc4c520f2af1a0db8

SHA256
5954c2cf8596b099d1902313654771a69784d1b7cf2cbb6860a1772f15e48323

SHA512
58b43d3121d97cdb19c4e3817e411f0271c3029cb398a9cc9c175a10adc762caf9be0678b931ae9fac366dbece25fe383dd57ea435c984b18854275eaa5870b1

Download Submit
C:\Windows\SysWOW64\Kdaldd32.exe

Filesize
192KB

MD5
777387a41ad5e9bd2450602e67980533

SHA1
3b4296abc64240887d65447816dcf7ee2ff8095e

SHA256
ea8c6518b864aac1b4b361f9dc8d15decc32c81b20e149a5efec5d9c17df135b

SHA512
8a5cf515e82fae7c31adeeabbc064ab006b25f95c309355639cfd64eb2c8ce225f66cbb4a551e558481a0b27928ed30f54e12ba4aea687bef39cbca290650910

Download Submit
C:\Windows\SysWOW64\Kdcijcke.exe

Filesize
192KB

MD5
1449b52f70f3b2dbd0bbb8c5838eb922

SHA1
72e2c00a70fa4b69edbf3cf8dfdcf39a43e79c26

SHA256
62ce570282f77077d67bd1497d44d46853223281463213e2bcc82a0308c08328

SHA512
54c17e93eafa142a8123421d1bc54d3be15fa768416a09f45fc6b5961084497ac3531abac644ffe813f96fdcd5393e3f3a42e7be59f16a6f0fe831e17e79da25

Download Submit
C:\Windows\SysWOW64\Kdffocib.exe

Filesize
192KB

MD5
59045e981ed6100bfb10a89c4bfcc824

SHA1
ebd857332e65617d771b482489105580d5032f94

SHA256
430cabb07bb94a413c5c11627e656594c780a9dacd20d975e6fc74c215dbc0ca

SHA512
26ea54a9857edfdd1349840c744037fcdd92c802d37f049e1a055b3f49400c475cd3fcae9f11c6fe021e4332dbc8544b3c3b18639b432d3850ff40a7c9d95414

Download Submit
C:\Windows\SysWOW64\Kdhbec32.exe

Filesize
192KB

MD5
05bd272a29fe543570a8417f4da8406f

SHA1
73f209d6957ac172f0c8ada643851b6b43450efe

SHA256
cd72a2a947ea269e6162a95c275db87e737066198cb3868771cec4ba144bb3cb

SHA512
69dae6e1a2b1172fb21907fdeec6812e4d05abcbef7bc2ff9730b5b04e3c06f013aeb244483677562c544421017fe422088f945549d42f5977b2bc98ae6f5a00

Download Submit
C:\Windows\SysWOW64\Kgbefoji.exe

Filesize
192KB

MD5
8300e3f0136ba615fee8ae97ba65b65e

SHA1
3a0c876afa81a6e31f1606ca6ee3e1d93f7e6a80

SHA256
1c3b5eb2ec350419f2e7a34e2d17da501ffe97b77d883e55fd2d602bc7564921

SHA512
8b67e322a99b56a5abea11935691d7d15177679b64f6da39551a8d8cb077354fca8a40b674e53a6c2fad045c35eeff861ba0c776cb164a6e17e33dd8c3ef4f41

Download Submit
C:\Windows\SysWOW64\Kgdbkohf.exe

Filesize
192KB

MD5
f53c238f4977513d60b3030fa69402a5

SHA1
ebd67f07eed969999a77c72ea29975c29a8418cb

SHA256
64b140f3dd71d7cbf10e6e7e2aa5ea9e93f4e38c730e915f608ebdb5d871a130

SHA512
94d71a4ec2e74fb033fb9b76b1fb6b1932283e5c32e66773be017835934e8f4a21db0412b496f5cf9c766a40aa86453fc5bbadd9b3f28fd0ac7267ccc096072e

Download Submit
C:\Windows\SysWOW64\Kgfoan32.exe

Filesize
192KB

MD5
5c86ee3405a74f82bfd3c6d8d44acd75

SHA1
d73cb4f39ea0b97998cebef97ccb54b469e0d0db

SHA256
817ada135cab7bc04d536857173d6499286a7631959be8f2b8c90cb7edd9d7a1

SHA512
a3696cffa736d39532ff98b3e80049f51f1a22798d54ff0d2e9b72dab08f5b7d2a2df3715607fb8a06aaa9a4d4f107db64da93b62291c996fd0a86f8344f86ca

Download Submit
C:\Windows\SysWOW64\Kilhgk32.exe

Filesize
192KB

MD5
98e40dd97592d7e25795440f83426ac7

SHA1
6e7eb9277b75e212c38e5f2833d62f58a8849f94

SHA256
435ff24b414bafecdcb7fc08f632362939e40a4a4cd9574f50e110885c110ecf

SHA512
430bdb9f4e2ec39ad1ddd6e6c3f2df042a638dddfd59588dabf9f8721c2c7fa0781650c3b80c5dfd1ff31535958e818462fb8919b917f34d77614672b460f42d

Download Submit
C:\Windows\SysWOW64\Kinemkko.exe

Filesize
192KB

MD5
249ed211f59a7dd75aef8ef25a26660d

SHA1
adfdcbec3e205f9a863a99d07f7feebf4da5156d

SHA256
e2212266a5628c2ed46837de996ba61196f0947b25d155749da727b2e22b00c0

SHA512
7e2da8748eef11288112b2b63baf4e614143bfb3e2e758d4dcdaf62b6a88ed85cf64a1787129282579ec767e94f1680efa37a6b497d6a27e43cf69ba876243ae

Download Submit
C:\Windows\SysWOW64\Kmegbjgn.exe

Filesize
192KB

MD5
5aec3d21778dbdc35630acd9ec2994b7

SHA1
d195d764b6c09e9b07623ff6b37489537966a7ae

SHA256
5a74e09889e1030445af617bab6d492f54d1e404eea2c41fb965f635f420b853

SHA512
740ef5df381adf49bea97bd2a2bf1d9cb1421d7601f12a2dff6bb4ca5ddeaebd0092bfcd016e5bb5392709493a362a48efcf4f877a51cadc45630ae7a498e229

Download Submit
C:\Windows\SysWOW64\Kmlnbi32.exe

Filesize
192KB

MD5
1ff3b85d6c83f37b7ebfd4a566872758

SHA1
bad97eac4a98e0a135ceed23fc591f5817d933ca

SHA256
41493438bab657cba66ba6f910dbaf8fe5f35674ba979c8ddc0c0f7daf26caf4

SHA512
37d17718ec8f3ede9abfa68edfa712be65a7e98e9e83181174e632af209e0022ed988f8866576436950b2430af57175724abff41e1fdba713446be61f24b2b73

Download Submit
C:\Windows\SysWOW64\Lcbiao32.exe

Filesize
192KB

MD5
519b53f3bafecbfcb44d59619539f6c4

SHA1
baae3a04179da40039921296981aca2602834644

SHA256
2b7995d9fca05edaa7cd7fc09267cf997f397dfec08f18c4fcde350b9377d82a

SHA512
e3b63600c65b46419c71054f9287675576fcb1723b461ab4dbc6dc776b021e5f0b27bdb6c8f1fe7636f4e5ffe7b9c79f03af5ad23c87f1021d60a0f75e514c7a

Download Submit
C:\Windows\SysWOW64\Lcdegnep.exe

Filesize
192KB

MD5
5562e501b041b4773391a85b3150c1ba

SHA1
dc2aba0d90374dc8615ccd34bf1b411de4ca3c86

SHA256
f01bf52c520aa51c489f36366de60024e6a8fa1cf25e60f87fd1ebc813f476f6

SHA512
acc27bed1b6ebc668bac21058264f0e4fdd3a7fe38ea62ead7043f07d3c6f6a1bbe7f6a16da90819eaa88f8ec001bd729473dda43fe66cda927297abac305118

Download Submit
C:\Windows\SysWOW64\Lcgblncm.exe

Filesize
192KB

MD5
6d5629819ad2a2366ff26007c643f30c

SHA1
1961f19021d315cb6f0f6eb82e53586b1a318180

SHA256
6c7f8d9740625f01c44be5bbf8d81aa9e2506e26320e3356f6a8f6fe9274fecb

SHA512
d991c7b1636c2bdd902f7f9a962411b4f0c6fc1341de097c3accf0738c9813d10c81f3ce6041ca69cb02d4d5d120a5ad22ef880418ef7840692147c2d4aaa9d2

Download Submit
C:\Windows\SysWOW64\Lcmofolg.exe

Filesize
192KB

MD5
9d7fdea47b7e28be416ea6080e6fe9c5

SHA1
9a08ff7b47e0c8fcdb4a1b089837d414b65b870e

SHA256
2c446b9f09a13c4af2460d983204b065b9ec0052f197882c141a082ee38e03ce

SHA512
8a1a8fa834dc77f9e37000bf4135230b4ecd1b05415ac03bf620e25676e35d38c64e8c569a889d80f29ccbb374b5874c6bcc81d5d186db71d94d2ffd7302353a

Download Submit
C:\Windows\SysWOW64\Lcpllo32.exe

Filesize
192KB

MD5
7dfa4c0361129c3b345a64cd76014d7c

SHA1
76ace4c1a0294a9dfc87c680b62834b702b664ff

SHA256
6f56842972eaf701da7f9392ca4ab3c20e57eac4f00374018c3aab649af8ca4a

SHA512
6a324d0b1fded12b78baa728b9b2c8d2da86dc1f1d26869870e6a3ccd7af7e37dabe92576c356a84bb70d445ea5ae9278cca86d58eabaf61eb5196350b3153cd

Download Submit
C:\Windows\SysWOW64\Liekmj32.exe

Filesize
192KB

MD5
d7cee73b6848411cdcf08a90a4f56d66

SHA1
de5b24fa38538e42f74bf225cecd36baccc613e4

SHA256
f946078946fe82d3eb7f220294a7c93146c00f58d38950e22e9bb2e6303b7057

SHA512
47960319b86fa28b2bd6f8e1463aa102f0ba5b82004961d075c61188885e631393c84638e59fd839d76fb294a67565820946335c30ce5e0e291fcc49ec5ef44c

Download Submit
C:\Windows\SysWOW64\Lilanioo.exe

Filesize
192KB

MD5
53d8a10a2d3d3da192cfbde8681a6acd

SHA1
df60906d18b456d665820f7dc694b367fd8c5bdd

SHA256
be11cac155e13018b22afc61d600bc1c3665bb5b90fa414922d2853f3f77b8fe

SHA512
42924dc485e556c7f465b3bda9c7862b5afa433a39473ca24a30d580c4036c3c70f65762a9d15beb7240d8c5da4e19dbde946c8a7b1dc917424aafb297ae9ace

Download Submit
C:\Windows\SysWOW64\Lkgdml32.exe

Filesize
192KB

MD5
1aefbec0e1635fc6266ef71ec6d52c79

SHA1
9813092ccae6199bb8f7e56dfaaa26978473a070

SHA256
92085875b762247818334388e5024ccd07b8d23f21a2178785fe4a0f0f3f7138

SHA512
cd6b33948bd222fb12c7ca470dfe2961a13081a0f8b9c9854a682e19e2285828008cc87fee885a4fe80678941995d167449f6343c3643e1745b8dc9d0b319a27

Download Submit
C:\Windows\SysWOW64\Lmccchkn.exe

Filesize
192KB

MD5
524fcfd59fd8a150db3c27599a7d269c

SHA1
9fd5dd316383561b82fc97625752a325a2f4bed9

SHA256
7d8ee13faab4ccdda5421401ab4a39a52221b4934288481a633938694166c873

SHA512
aa9e6ed1e2c0c0b8ac490bf6fa65ddfc379acbdea2ab8b13f6707e3f0c054cb9d193e08ea95c70ae7e30473b67f933c4d411a4b3053b987adb98883e52331347

Download Submit
C:\Windows\SysWOW64\Lnepih32.exe

Filesize
192KB

MD5
3ee3e11cf8d1b9db0115d3ea399b74c9

SHA1
73222042fe733c9152ac4c63cdd30390f2c1a37f

SHA256
a1f54cb0838ffb3ad7fb3f1aeacc5e5094d62dc84a830d99f43af7a36698f62f

SHA512
ecf604eb588b94fd8d1307b1c37dd44d18451c559051b99f0bc5a07e2f1d48e23cbf50d89e871bd8e3144ff75dfc67f60e8cf667ca9baf755dacf8a428dde828

Download Submit
C:\Windows\SysWOW64\Lnjjdgee.exe

Filesize
192KB

MD5
1811a6cb1a419318a9dc15c7d99a8252

SHA1
a39245fbbbf14a13cb74f0713cc62b8b4b837f61

SHA256
603ecb67f93147eb54b3283e11ffc4c6853d2d8153112ee5fbbeff7dfed11ce4

SHA512
944a241c19155d1f5c9dc9e10f6e679d21f30bbd897a838a8b22e36c62ac55b334e0b90741d24667277334295d1baa3109e622edac308de05a40f4120a36ace5

Download Submit
C:\Windows\SysWOW64\Lpfijcfl.exe

Filesize
192KB

MD5
4e7102c90ba5d8546054676794b0513c

SHA1
c8562875bfaa1f990236e6a824ece5eed605fabf

SHA256
c9a8331f32c7764fe635c11db7d50e4e30f95969aedccb2fb2347dd59e0370a1

SHA512
da709d3ec7a3fa815bbe0aa887162f0e01b23b10712755c54ef60ae6edc035b90842244cd04e6149fea026883e09a115de32245bec573dccf96715465e5acd56

Download Submit
C:\Windows\SysWOW64\Lphfpbdi.exe

Filesize
192KB

MD5
a85bb44d54d56b1274dac1d482f8dd09

SHA1
6a0f5512c4aa234c5db90f08131652b8b9a7c0a9

SHA256
f732baf2dd3a0d2b063e57d9a1968055825c15fd50f2fb551920ae17598f3101

SHA512
7105af1985ddb70c7d12dcb420bacd590c88fb12462b9f4aa6a783d8b6cb64cfe4a36e46f6eed101eb53f4e491a42c483a872bbbf817a51a5c3b02d4f7acc2ea

Download Submit
C:\Windows\SysWOW64\Lpocjdld.exe

Filesize
192KB

MD5
34734ee7dccc33721b5bd3d95f42d89b

SHA1
d611561ab16bcc3d6d5a5a165b9f10eef255cfb6

SHA256
2d8f628423a595e46f76488c44b7904018a7a53409556c492a6c8221df59bdc8

SHA512
06047552aa34e945f40a5f0bd7ada2c46c8ecf7cfa96e24ed8a050902b8ba9016f82f645b981e05418da21430045d6cedb27319e27fddab3e49f231150cfc5a6

Download Submit
C:\Windows\SysWOW64\Mciobn32.exe

Filesize
192KB

MD5
cb1de615be3027dcfebedd062c34f6ad

SHA1
abfa8a5d00768bb8cf04dff14c71de5613309686

SHA256
6cfbec7bb71e0c40c28012d358c3104344fe979ad65d38436df9353bbbecd8b9

SHA512
e959c81de41d490ec00731c1ea27c818e7515b1421bb715d13a29b14c29fbe513c33ea03e093529fc08cfc8e739c8d139525a98516002b1b368d62e29a50352c

Download Submit
C:\Windows\SysWOW64\Mjqjih32.exe

Filesize
192KB

MD5
df20cd51fd1175c5587763ccda0c04eb

SHA1
01b08354d6a8272c4b0f8c39cc76b45f27bd5bc4

SHA256
e5506f938b5e5f6f0f5fc33133599b493c059e10c474cb6b2ed9d94b8950df80

SHA512
d1aa2d0803d8c6b3524a2010fbc8463839cc6a213c115d4ddfa4c63b041fe8646a4d145897de99cb30c9f0179bc6232d8b6b0c42d0a738450b359420ed1c7284

Download Submit
C:\Windows\SysWOW64\Mnocof32.exe

Filesize
192KB

MD5
55e3a75b0150c553beca89cb4411d086

SHA1
75b010bab6ee6f375395b28db2c94a96db76e7d8

SHA256
dad3dae381175406244a92d802840d0b59c07baf057a2242a392f07b6a92d1aa

SHA512
66be126186c87f5edf1e6cc89d061b2650103f6fa819e87c7b5c46f97c5fdde7a48ea6cb7a0b7f6b6000687dc5f5caf0e7a72fdc0dddc8ac5809d576fe303b8a

Download Submit
C:\Windows\SysWOW64\Mpkbebbf.exe

Filesize
192KB

MD5
ce1083ac556991175893a417930b5a00

SHA1
7421be3342147177b242a2bf54a1d9a7030f98ea

SHA256
61559cc4c3e6bb17dc2061bbab76c7f979dc1436608dc046e7ec987b7fb19915

SHA512
d34798be0fd5a454431d1c517e78ad8c9d78dc0423b9c11682f821ad4304c47a53a5dc5a9919eaf422183036f28a05c56a9254b492312b4a2bef97732875ed68

Download Submit
C:\Windows\SysWOW64\Nbmelbid.exe

Filesize
192KB

MD5
b2aa6a501037b96b6d909d393026df7d

SHA1
342891444c7ef4b908d7ca65c6d815913040510b

SHA256
29eb519b1115f9d9c7a99c99744d4696ac65113d735701c1a1c6b42bea723160

SHA512
9395729b2b8465d7dca36c7ac40005d21acbe92b933db2f0a5950957b839e731ec6294f1a894beba4d0728b6c8541f0f6c232d88828992dbfeb15eb4fd55ea67

Download Submit
C:\Windows\SysWOW64\Njcpee32.exe

Filesize
192KB

MD5
6ca68ff5103d9f5d16461e956b407c8b

SHA1
d4ed7bc15e4eeb8fdef93d685598b6343c30c67b

SHA256
9133d7c76387e9c0e99841598753374e45f0f44c130980a5dcaaf250824f3499

SHA512
1e60c5f220e18d89d3bd88d8bcd0f510d2061f56702d10267cc02183f465b5926893caf0d95c727bdb197dd695b5385112c11c4e2f3364abb54d54313a591011

Download Submit
C:\Windows\SysWOW64\Pkaiqf32.exe

Filesize
192KB

MD5
be5b1c77dab68fc7f61608465153cc5e

SHA1
3ea4d119c81069dc4c9eea384c8b8835747b6c34

SHA256
0de8c5b690323dbd771ffb9b803d3d19318d60ebd7eb3652a1283bb1d3c1bbec

SHA512
7cf0efbe2aa5fed923176251e9ea02ad15fcd5783ade01c7d5816fe7f0f6b9a2d60d66228f68712b64d92f1e9b2b0abd5b3d95bbb601ac2d6316aaa609ad0621

Download Submit
memory/364-358-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/404-376-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/532-159-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/696-316-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/704-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/776-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/904-191-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/908-388-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/948-427-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/980-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1040-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1168-103-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1396-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1416-255-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1420-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1540-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1612-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1668-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1692-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1872-183-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2080-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2160-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2264-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2332-446-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2340-370-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2352-216-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2444-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2480-47-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2484-95-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2664-3252-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2696-364-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2824-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3000-175-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3052-239-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3096-394-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3112-286-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3288-223-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3416-352-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3564-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3704-152-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3732-143-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3972-280-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4044-334-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4048-274-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4144-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4224-292-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4328-386-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4384-39-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4412-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4436-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4460-298-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4488-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4564-84-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4584-322-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4652-340-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4760-304-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4848-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4864-406-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4904-28-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4912-167-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4972-400-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4984-346-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4996-436-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5056-430-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5092-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11444-3272-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11540-3251-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11556-3271-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11652-3262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11704-3270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11968-3267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/12032-3260-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/12060-3277-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/12104-3266-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/12164-3259-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/12220-3265-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/12296-3249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/12384-3247-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads