d9775bffc4f0c177915e6b5dbc98ee286e90a711a268b31aa40910fb66ccc593

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9775bffc4f0c177915e6b5dbc98ee286e90a711a268b31aa40910fb66ccc593.exe
Size

352KB
MD5

c071ceb62bd80a4859056d8fb4b109b0
SHA1

8bcd1aa79e81e16be4e7426d367f063cdd9e13d7
SHA256

d9775bffc4f0c177915e6b5dbc98ee286e90a711a268b31aa40910fb66ccc593
SHA512

bead71acdcc0c0332276eb3884ac3ba984a4ec3cc7ff6f2b825af9b710439996f28f09abe7e6d164b8045af877a81d5f2899ce23868ba3458e567014be7a077b
SSDEEP

6144:ofclGHIAz9iWis/j9SrJz9ieis/j9SrJz9is/j9SrJwWisp:of2sUasUqsU6sp

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkfkfohj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqpgdfnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdmcidam.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckedalaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehljfnpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqknig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajcbgml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhbgqohi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmfkoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcbpab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lffhfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lingibiq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmnldp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogjmdigk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdhmnlcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfcfml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Behbag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfjcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkiqbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhikcb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbdolh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcagphom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hiefcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifgbnlmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnocof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Peimil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkidenlg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dadeieea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fojlngce.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Leihbeib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldanqkki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogifjcdp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldohebqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnaikd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dahode32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpjlklok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acocaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcncpbmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcccfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmbdbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdgljmcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jibeql32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdffocib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkgqfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fohoigfh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njciko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofqpqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdbiedpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kknafn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acocaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dceohhja.exe

Executes dropped EXE 64 IoCs

pid	Process
4992	Imbaemhc.exe
2540	Ibojncfj.exe
2092	Ijfboafl.exe
2060	Ipckgh32.exe
872	Ibagcc32.exe
5080	Iikopmkd.exe
4268	Ipegmg32.exe
3332	Jdcpcf32.exe
4812	Jfaloa32.exe
4912	Jmkdlkph.exe
2500	Jfdida32.exe
2492	Jibeql32.exe
4292	Jmpngk32.exe
3172	Jpojcf32.exe
4720	Jbmfoa32.exe
4572	Jdmcidam.exe
1432	Jkfkfohj.exe
3168	Kmegbjgn.exe
2940	Kkihknfg.exe
1584	Kacphh32.exe
1436	Kbdmpqcb.exe
3048	Kkkdan32.exe
1132	Kmjqmi32.exe
4448	Kknafn32.exe
2528	Kagichjo.exe
2660	Kdffocib.exe
3736	Kgdbkohf.exe
4300	Kpmfddnf.exe
1392	Lalcng32.exe
4372	Lcmofolg.exe
3068	Lkdggmlj.exe
5000	Laopdgcg.exe
1052	Ldmlpbbj.exe
1588	Lnepih32.exe
636	Laalifad.exe
4392	Ldohebqh.exe
2332	Lcbiao32.exe
3932	Lkiqbl32.exe
3392	Laciofpa.exe
2964	Ldaeka32.exe
2952	Lgpagm32.exe
4256	Ljnnch32.exe
1368	Lphfpbdi.exe
1424	Lcgblncm.exe
1732	Lknjmkdo.exe
652	Mahbje32.exe
4212	Mgekbljc.exe
4512	Mnocof32.exe
4872	Mdiklqhm.exe
1880	Mkbchk32.exe
1660	Mnapdf32.exe
4904	Mpolqa32.exe
336	Mcnhmm32.exe
4916	Mkepnjng.exe
3480	Mncmjfmk.exe
3828	Mcpebmkb.exe
4112	Mjjmog32.exe
4400	Maaepd32.exe
3200	Mdpalp32.exe
4484	Mgnnhk32.exe
768	Nacbfdao.exe
4316	Ndbnboqb.exe
1752	Nklfoi32.exe
2364	Nafokcol.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ijhkffjm.dll	Clpgpp32.exe
File opened for modification	C:\Windows\SysWOW64\Ednaqo32.exe	Eapedd32.exe
File created	C:\Windows\SysWOW64\Olmeci32.exe	Ojoign32.exe
File created	C:\Windows\SysWOW64\Jfdida32.exe	Jmkdlkph.exe
File created	C:\Windows\SysWOW64\Ndidbn32.exe	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Bnnjen32.exe	Blpnib32.exe
File created	C:\Windows\SysWOW64\Fojlngce.exe	Fhqcam32.exe
File opened for modification	C:\Windows\SysWOW64\Gkoiefmj.exe	Gdeqhl32.exe
File created	C:\Windows\SysWOW64\Hmcojh32.exe	Hihbijhn.exe
File created	C:\Windows\SysWOW64\Anmjcieo.exe	Qffbbldm.exe
File created	C:\Windows\SysWOW64\Lpfihl32.dll	Ipckgh32.exe
File opened for modification	C:\Windows\SysWOW64\Ogjmdigk.exe	Nbmelbid.exe
File created	C:\Windows\SysWOW64\Iaheeaan.dll	Jioaqfcc.exe
File created	C:\Windows\SysWOW64\Qjkmdp32.dll	Ndaggimg.exe
File opened for modification	C:\Windows\SysWOW64\Lfhdlh32.exe	Ldjhpl32.exe
File opened for modification	C:\Windows\SysWOW64\Lllcen32.exe	Lingibiq.exe
File created	C:\Windows\SysWOW64\Jclhkbae.dll	Nnqbanmo.exe
File opened for modification	C:\Windows\SysWOW64\Aeniabfd.exe	Andqdh32.exe
File opened for modification	C:\Windows\SysWOW64\Dmjocp32.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Ockcknah.dll	Mnocof32.exe
File created	C:\Windows\SysWOW64\Djhgpa32.dll	Eapedd32.exe
File created	C:\Windows\SysWOW64\Gdhmnlcj.exe	Gfembo32.exe
File created	C:\Windows\SysWOW64\Bagplp32.dll	Jcioiood.exe
File created	C:\Windows\SysWOW64\Hhqeiena.dll	Bgehcmmm.exe
File opened for modification	C:\Windows\SysWOW64\Chpada32.exe	Ceaehfjj.exe
File created	C:\Windows\SysWOW64\Dccbbhld.exe	Dohfbj32.exe
File opened for modification	C:\Windows\SysWOW64\Jpgmha32.exe	Jmhale32.exe
File created	C:\Windows\SysWOW64\Ojhnmh32.dll	Klljnp32.exe
File opened for modification	C:\Windows\SysWOW64\Ocpgod32.exe	Opakbi32.exe
File created	C:\Windows\SysWOW64\Jilkmnni.dll	Ojoign32.exe
File created	C:\Windows\SysWOW64\Jnngob32.dll	Lcgblncm.exe
File opened for modification	C:\Windows\SysWOW64\Ndidbn32.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Dqfhilhd.dll	Aadifclh.exe
File opened for modification	C:\Windows\SysWOW64\Kkihknfg.exe	Kmegbjgn.exe
File created	C:\Windows\SysWOW64\Bjdkjo32.exe	Blbknaib.exe
File created	C:\Windows\SysWOW64\Oqfdnhfk.exe	Onhhamgg.exe
File created	C:\Windows\SysWOW64\Dbagnedl.dll	Pncgmkmj.exe
File created	C:\Windows\SysWOW64\Fhemmlhc.exe	Fdialn32.exe
File created	C:\Windows\SysWOW64\Hbgmcnhf.exe	Hkmefd32.exe
File created	C:\Windows\SysWOW64\Ekphijkm.dll	Pclgkb32.exe
File opened for modification	C:\Windows\SysWOW64\Pkhoae32.exe	Pcagphom.exe
File created	C:\Windows\SysWOW64\Lffhfh32.exe	Kdgljmcd.exe
File created	C:\Windows\SysWOW64\Opfkao32.dll	Clnjjpod.exe
File created	C:\Windows\SysWOW64\Dbllbibl.exe	Ckedalaj.exe
File created	C:\Windows\SysWOW64\Nlmbpgdl.dll	Ednaqo32.exe
File created	C:\Windows\SysWOW64\Fhqcam32.exe	Fafkecel.exe
File created	C:\Windows\SysWOW64\Kpihae32.dll	Gicinj32.exe
File created	C:\Windows\SysWOW64\Lingibiq.exe	Lebkhc32.exe
File created	C:\Windows\SysWOW64\Kacphh32.exe	Kkihknfg.exe
File opened for modification	C:\Windows\SysWOW64\Mpolqa32.exe	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cdfkolkf.exe
File created	C:\Windows\SysWOW64\Pqknig32.exe	Pnlaml32.exe
File opened for modification	C:\Windows\SysWOW64\Pcijeb32.exe	Pdfjifjo.exe
File opened for modification	C:\Windows\SysWOW64\Jfdida32.exe	Jmkdlkph.exe
File opened for modification	C:\Windows\SysWOW64\Qbgqio32.exe	Qgallfcq.exe
File opened for modification	C:\Windows\SysWOW64\Bahmfj32.exe	Aniajnnn.exe
File created	C:\Windows\SysWOW64\Ippggbck.exe	Imakkfdg.exe
File created	C:\Windows\SysWOW64\Anmcpemd.dll	Jmbdbd32.exe
File opened for modification	C:\Windows\SysWOW64\Lpcfkm32.exe	Llgjjnlj.exe
File created	C:\Windows\SysWOW64\Pqpgdfnp.exe	Pnakhkol.exe
File created	C:\Windows\SysWOW64\Dnhqigge.dll	Pcccfh32.exe
File created	C:\Windows\SysWOW64\Bhkhibmc.exe	Bemlmgnp.exe
File created	C:\Windows\SysWOW64\Qgallfcq.exe	Pnihcq32.exe
File created	C:\Windows\SysWOW64\Bdfibe32.exe	Bahmfj32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11984	11716	WerFault.exe	585

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjgfjhqm.dll"	Pfjcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pflplnlg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Clpgpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pqpgdfnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Alhhhcal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cbcilkjg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dohfbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhbgqohi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hopnqdan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kacphh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdhmnlcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmhhehlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inpocg32.dll"	Kipkhdeq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kefkme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njciko32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bclhoo32.dll"	Jfdida32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjghpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnjgghdi.dll"	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opbnic32.dll"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ednaqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbbdholl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Memcpg32.dll"	Jidklf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klohppck.dll"	Cliaoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nekfmb32.dll"	Hijooifk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgfqmfde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkkdan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhmkghpm.dll"	Pnihcq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qbgqio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkidenlg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gdeqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lejfpelg.dll"	Hbnjmp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hijooifk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbceejpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngedij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkaejf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcioiood.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Leihbeib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldleel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deimfpda.dll"	Ldanqkki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aajjaf32.dll"	Jdcpcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehljfnpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iiaephpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gijlad32.dll"	Mmnldp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghekjiam.dll"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnmkhg32.dll"	Okolkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qalnjkgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Alkdnboj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhaebcen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gohibf32.dll"	Cklaknjd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojjolnaq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknpkhch.dll"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cehkhecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipegmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhidjpqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoohalad.dll"	Kdnidn32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4992	4900	d9775bffc4f0c177915e6b5dbc98ee286e90a711a268b31aa40910fb66ccc593.exe	88
PID 4900 wrote to memory of 4992	4900	d9775bffc4f0c177915e6b5dbc98ee286e90a711a268b31aa40910fb66ccc593.exe	88
PID 4900 wrote to memory of 4992	4900	d9775bffc4f0c177915e6b5dbc98ee286e90a711a268b31aa40910fb66ccc593.exe	88
PID 4992 wrote to memory of 2540	4992	Imbaemhc.exe	89
PID 4992 wrote to memory of 2540	4992	Imbaemhc.exe	89
PID 4992 wrote to memory of 2540	4992	Imbaemhc.exe	89
PID 2540 wrote to memory of 2092	2540	Ibojncfj.exe	90
PID 2540 wrote to memory of 2092	2540	Ibojncfj.exe	90
PID 2540 wrote to memory of 2092	2540	Ibojncfj.exe	90
PID 2092 wrote to memory of 2060	2092	Ijfboafl.exe	91
PID 2092 wrote to memory of 2060	2092	Ijfboafl.exe	91
PID 2092 wrote to memory of 2060	2092	Ijfboafl.exe	91
PID 2060 wrote to memory of 872	2060	Ipckgh32.exe	92
PID 2060 wrote to memory of 872	2060	Ipckgh32.exe	92
PID 2060 wrote to memory of 872	2060	Ipckgh32.exe	92
PID 872 wrote to memory of 5080	872	Ibagcc32.exe	93
PID 872 wrote to memory of 5080	872	Ibagcc32.exe	93
PID 872 wrote to memory of 5080	872	Ibagcc32.exe	93
PID 5080 wrote to memory of 4268	5080	Iikopmkd.exe	94
PID 5080 wrote to memory of 4268	5080	Iikopmkd.exe	94
PID 5080 wrote to memory of 4268	5080	Iikopmkd.exe	94
PID 4268 wrote to memory of 3332	4268	Ipegmg32.exe	95
PID 4268 wrote to memory of 3332	4268	Ipegmg32.exe	95
PID 4268 wrote to memory of 3332	4268	Ipegmg32.exe	95
PID 3332 wrote to memory of 4812	3332	Jdcpcf32.exe	96
PID 3332 wrote to memory of 4812	3332	Jdcpcf32.exe	96
PID 3332 wrote to memory of 4812	3332	Jdcpcf32.exe	96
PID 4812 wrote to memory of 4912	4812	Jfaloa32.exe	97
PID 4812 wrote to memory of 4912	4812	Jfaloa32.exe	97
PID 4812 wrote to memory of 4912	4812	Jfaloa32.exe	97
PID 4912 wrote to memory of 2500	4912	Jmkdlkph.exe	98
PID 4912 wrote to memory of 2500	4912	Jmkdlkph.exe	98
PID 4912 wrote to memory of 2500	4912	Jmkdlkph.exe	98
PID 2500 wrote to memory of 2492	2500	Jfdida32.exe	99
PID 2500 wrote to memory of 2492	2500	Jfdida32.exe	99
PID 2500 wrote to memory of 2492	2500	Jfdida32.exe	99
PID 2492 wrote to memory of 4292	2492	Jibeql32.exe	101
PID 2492 wrote to memory of 4292	2492	Jibeql32.exe	101
PID 2492 wrote to memory of 4292	2492	Jibeql32.exe	101
PID 4292 wrote to memory of 3172	4292	Jmpngk32.exe	103
PID 4292 wrote to memory of 3172	4292	Jmpngk32.exe	103
PID 4292 wrote to memory of 3172	4292	Jmpngk32.exe	103
PID 3172 wrote to memory of 4720	3172	Jpojcf32.exe	104
PID 3172 wrote to memory of 4720	3172	Jpojcf32.exe	104
PID 3172 wrote to memory of 4720	3172	Jpojcf32.exe	104
PID 4720 wrote to memory of 4572	4720	Jbmfoa32.exe	106
PID 4720 wrote to memory of 4572	4720	Jbmfoa32.exe	106
PID 4720 wrote to memory of 4572	4720	Jbmfoa32.exe	106
PID 4572 wrote to memory of 1432	4572	Jdmcidam.exe	107
PID 4572 wrote to memory of 1432	4572	Jdmcidam.exe	107
PID 4572 wrote to memory of 1432	4572	Jdmcidam.exe	107
PID 1432 wrote to memory of 3168	1432	Jkfkfohj.exe	108
PID 1432 wrote to memory of 3168	1432	Jkfkfohj.exe	108
PID 1432 wrote to memory of 3168	1432	Jkfkfohj.exe	108
PID 3168 wrote to memory of 2940	3168	Kmegbjgn.exe	109
PID 3168 wrote to memory of 2940	3168	Kmegbjgn.exe	109
PID 3168 wrote to memory of 2940	3168	Kmegbjgn.exe	109
PID 2940 wrote to memory of 1584	2940	Kkihknfg.exe	110
PID 2940 wrote to memory of 1584	2940	Kkihknfg.exe	110
PID 2940 wrote to memory of 1584	2940	Kkihknfg.exe	110
PID 1584 wrote to memory of 1436	1584	Kacphh32.exe	111
PID 1584 wrote to memory of 1436	1584	Kacphh32.exe	111
PID 1584 wrote to memory of 1436	1584	Kacphh32.exe	111
PID 1436 wrote to memory of 3048	1436	Kbdmpqcb.exe	112

C:\Users\Admin\AppData\Local\Temp\d9775bffc4f0c177915e6b5dbc98ee286e90a711a268b31aa40910fb66ccc593.exe
"C:\Users\Admin\AppData\Local\Temp\d9775bffc4f0c177915e6b5dbc98ee286e90a711a268b31aa40910fb66ccc593.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\Imbaemhc.exe
  C:\Windows\system32\Imbaemhc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\SysWOW64\Ibojncfj.exe
    C:\Windows\system32\Ibojncfj.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\SysWOW64\Ijfboafl.exe
      C:\Windows\system32\Ijfboafl.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2092
    - - C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2060
      - C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:872
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2492
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3172
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4572
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1432
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3048
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        24⤵
        Executes dropped EXE
        
        PID:1132
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4448
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        26⤵
        Executes dropped EXE
        
        PID:2528
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2660
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        28⤵
        Executes dropped EXE
        
        PID:3736
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        29⤵
        Executes dropped EXE
        
        PID:4300
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        30⤵
        Executes dropped EXE
        
        PID:1392
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        31⤵
        Executes dropped EXE
        
        PID:4372
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        32⤵
        Executes dropped EXE
        
        PID:3068
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        33⤵
        Executes dropped EXE
        
        PID:5000
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        34⤵
        Executes dropped EXE
        
        PID:1052
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        35⤵
        Executes dropped EXE
        
        PID:1588
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        36⤵
        Executes dropped EXE
        
        PID:636
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4392
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2332
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3932
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        40⤵
        Executes dropped EXE
        
        PID:3392
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        41⤵
        Executes dropped EXE
        
        PID:2964
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        42⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        43⤵
        Executes dropped EXE
        
        PID:4256
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1368
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1424
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        46⤵
        Executes dropped EXE
        
        PID:1732
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        47⤵
        Executes dropped EXE
        
        PID:652
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        48⤵
        Executes dropped EXE
        
        PID:4212
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4512
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        50⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        51⤵
        Executes dropped EXE
        
        PID:1880
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1660
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        53⤵
        Executes dropped EXE
        
        PID:4904
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        54⤵
        Executes dropped EXE
        
        PID:336
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        55⤵
        Executes dropped EXE
        
        PID:4916
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        56⤵
        Executes dropped EXE
        
        PID:3480
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3828
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4112
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        59⤵
        Executes dropped EXE
        
        PID:4400
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3200
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4484
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        62⤵
        Executes dropped EXE
        
        PID:768
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        63⤵
        Executes dropped EXE
        
        PID:4316
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1752
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        65⤵
        Executes dropped EXE
        
        PID:2364
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        66⤵
        Modifies registry class
        
        PID:3216
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        67⤵
        
        PID:452
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        68⤵
        Modifies registry class
        
        PID:2392
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        69⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4568
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        70⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4008
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        72⤵
        Drops file in System32 directory
        
        PID:4616
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1572
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        74⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        75⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        76⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        77⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        78⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        79⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        80⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        81⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        82⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        83⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        84⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        85⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        86⤵
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        87⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        88⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        89⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        90⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5624
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        92⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        93⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        94⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        95⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        96⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        97⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        98⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5952
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        100⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        101⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6080
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        103⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        104⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3188
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        105⤵
        Drops file in System32 directory
        
        PID:5188
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        106⤵
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        107⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        108⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        109⤵
        Modifies registry class
        
        PID:5476
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        110⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        111⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        112⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        113⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        114⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        115⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5980
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        117⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        118⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        119⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        120⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        121⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        122⤵
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        123⤵
        Drops file in System32 directory
        
        PID:5688
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        124⤵
        Drops file in System32 directory
        
        PID:5772
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        125⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        126⤵
        Modifies registry class
        
        PID:6024
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        127⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        128⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        129⤵
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        130⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5856
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        132⤵
        Drops file in System32 directory
        
        PID:5932
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        133⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        134⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        135⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5228
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        137⤵
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        138⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        139⤵
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        140⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        142⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        143⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        144⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        145⤵
        Modifies registry class
        
        PID:6364
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        146⤵
        Modifies registry class
        
        PID:6408
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        147⤵
        Modifies registry class
        
        PID:6444
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        148⤵
        Drops file in System32 directory
        
        PID:6484
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        149⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        150⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        151⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        152⤵
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        153⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6732
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        155⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6768
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        156⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        157⤵
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        158⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6932
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        160⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        161⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        162⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        163⤵
        Modifies registry class
        
        PID:7092
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7132
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        165⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        166⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        167⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        168⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        169⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6464
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        171⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        172⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        173⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        174⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6724
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        175⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        176⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        177⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6968
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7032
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7084
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        181⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        182⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        183⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        184⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        185⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        186⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        187⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        188⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        189⤵
        Drops file in System32 directory
        
        PID:7024
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        190⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7116
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        191⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        192⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        193⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6836
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        195⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        196⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        197⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        198⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        199⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7004
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        201⤵
        Drops file in System32 directory
        
        PID:7200
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        202⤵
        Drops file in System32 directory
        
        PID:7244
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7284
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        204⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        205⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        206⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        207⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        208⤵
        Drops file in System32 directory
        
        PID:7476
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        209⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        210⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        211⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        212⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        213⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        214⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        215⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        216⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        217⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        218⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        219⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        220⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        221⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        222⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        223⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        224⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        225⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        226⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        227⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7272
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        228⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        229⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        230⤵
        Drops file in System32 directory
        
        PID:7484
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7576
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        232⤵
        Drops file in System32 directory
        
        PID:7620
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        233⤵
        Modifies registry class
        
        PID:7700
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        234⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        235⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        236⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        237⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8136
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        239⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        240⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        241⤵
        Modifies registry class
        
        PID:7548
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        242⤵
        Modifies registry class
        
        PID:7704
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        243⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        244⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        245⤵
        Drops file in System32 directory
        
        PID:6328
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        246⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        247⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        248⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        249⤵
        Modifies registry class
        
        PID:7388
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7856
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        251⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        252⤵
        Modifies registry class
        
        PID:6752
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        253⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        254⤵
        Modifies registry class
        
        PID:8208
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8248
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        256⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        257⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        258⤵
        Drops file in System32 directory
        
        PID:8360
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        259⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        260⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        261⤵
        Modifies registry class
        
        PID:8472
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        262⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        263⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        264⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        265⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        266⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8708
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        268⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        269⤵
        Drops file in System32 directory
        
        PID:8784
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        270⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        271⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        272⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        273⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        274⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        275⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        276⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        277⤵
        Drops file in System32 directory
        
        PID:9132
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        278⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        279⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        280⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        281⤵
        Drops file in System32 directory
        
        PID:8328
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        282⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        283⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        284⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        285⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        286⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        287⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        288⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        289⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        290⤵
        Modifies registry class
        
        PID:8960
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        291⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        292⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9084
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        293⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8204
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        295⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        296⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        297⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        298⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        299⤵
        Modifies registry class
        
        PID:8796
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        300⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        301⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        302⤵
        Modifies registry class
        
        PID:9160
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        303⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        304⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        305⤵
        Drops file in System32 directory
        
        PID:8652
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        306⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        307⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        308⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        309⤵
        Modifies registry class
        
        PID:8292
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        310⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        311⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        312⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        313⤵
        Modifies registry class
        
        PID:8272
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        314⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9124
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8500
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9196
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        318⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        319⤵
        Drops file in System32 directory
        
        PID:9252
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        320⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        321⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        322⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        323⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        324⤵
        Modifies registry class
        
        PID:9448
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        325⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        326⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        327⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        328⤵
        Drops file in System32 directory
        
        PID:9640
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        329⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        330⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        331⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        332⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        333⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9860
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9896
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        336⤵
        Drops file in System32 directory
        
        PID:9932
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9972
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        338⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        339⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        340⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        341⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        342⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        343⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10236
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        345⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        346⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9360
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        348⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        349⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        350⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        351⤵
        Modifies registry class
        
        PID:9652
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        352⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        353⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        354⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        355⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        356⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        357⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        358⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        359⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        360⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        361⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        362⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        363⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        364⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        365⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        366⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        367⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        368⤵
        Drops file in System32 directory
        
        PID:8996
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        369⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        370⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        371⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        372⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        373⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9576
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        375⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        376⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9796
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9284
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        379⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        380⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        381⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        382⤵
        Drops file in System32 directory
        
        PID:10336
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        383⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        384⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        385⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10456
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        386⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        387⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        388⤵
        Drops file in System32 directory
        
        PID:10576
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        389⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        390⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        391⤵
        Modifies registry class
        
        PID:10688
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        392⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        393⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10808
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10844
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        396⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        397⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        398⤵
        Drops file in System32 directory
        
        PID:10956
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        399⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        400⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        401⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        402⤵
        Drops file in System32 directory
        
        PID:11116
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11156
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        404⤵
        Drops file in System32 directory
        
        PID:11192
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        405⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        406⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        407⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        408⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        409⤵
        Drops file in System32 directory
        
        PID:10444
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10484
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        411⤵
        Drops file in System32 directory
        
        PID:10560
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        412⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10648
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        413⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10672
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        414⤵
        Modifies registry class
        
        PID:10776
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        415⤵
        Drops file in System32 directory
        
        PID:10832
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        416⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        417⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        418⤵
        Modifies registry class
        
        PID:11036
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        419⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        420⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        421⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11228
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        422⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10376
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        424⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        425⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        426⤵
        Modifies registry class
        
        PID:10700
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        427⤵
        Drops file in System32 directory
        
        PID:10828
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        428⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        429⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        430⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        431⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        432⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10308
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        433⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        434⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        435⤵
        Modifies registry class
        
        PID:1232
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        436⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        437⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        438⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        439⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        440⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        441⤵
        Drops file in System32 directory
        
        PID:10276
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        442⤵
        Modifies registry class
        
        PID:10816
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        443⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        444⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        445⤵
        Drops file in System32 directory
        
        PID:10324
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        446⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11344
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        448⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        449⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        450⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        451⤵
        
        PID:11508
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        452⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        453⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        454⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        455⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        456⤵
        Drops file in System32 directory
        
        PID:11700
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        457⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        458⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        459⤵
        
        PID:11820
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        460⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        461⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        462⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        463⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        464⤵
        Modifies registry class
        
        PID:12028
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        465⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        466⤵
        Modifies registry class
        
        PID:12104
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        467⤵
        Modifies registry class
        
        PID:12144
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        468⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        469⤵
        
        PID:12224
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        470⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        471⤵
        Drops file in System32 directory
        
        PID:11088
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        472⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11400
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        474⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        475⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        476⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11604
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        477⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        478⤵
        Modifies registry class
        
        PID:11732
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        479⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        480⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        481⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        482⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        483⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        484⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        485⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        486⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        487⤵
        Drops file in System32 directory
        
        PID:11388
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        488⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        489⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        490⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11716 -s 228
        491⤵
        Program crash
        
        PID:11984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 11716 -ip 11716
1⤵
PID:11892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abbpem32.exe

Filesize
352KB

MD5
c27817dc7b022aed3a36cc75275bf091

SHA1
f20918daa4e2e149b1efceb06b89587b542ede59

SHA256
7cc8c75cca7ea40acd1645e0af13b2306ee56806fbcc7c179e3d4df697cca428

SHA512
e0ef74de9b0ebe1fffe1881d6f4f3c1780190d0bbdd9f5d081db70528c459bca53c50f085bdb75b06736ae498aa01cc7655956b85c1c8624772b6c7c2106259a

Download Submit
C:\Windows\SysWOW64\Agjhgngj.exe

Filesize
352KB

MD5
e5d252dec6b41399384ba4172f6705c0

SHA1
d5676eee723486b0b0596c708746a2bcbccb2cf6

SHA256
b20e7a726a174cde91e3b3b87cdac4f88e98eaf821e0c81c745ecb82e4133da2

SHA512
be8836da1011697571e6f933f172050581c3471fe50844dd6e6a0c0228c49a1f308d34c37b04be4806fe0187b4d027a34960e9d5e771a05c10721416bbd4da7b

Download Submit
C:\Windows\SysWOW64\Bhaebcen.exe

Filesize
352KB

MD5
b05e93010c9753dfe0a5542092bf38ef

SHA1
aad735057d45fc0d3c983cb2f1a55af4e3b33da0

SHA256
461163e4628741db25821f6908cd41763d1963a2cf13311a5a6e40e96ecf41a6

SHA512
c74b89a459910db96583aa33e17ac58d4a8669efe28ee7f49b10ada9ffe60c3baa23c535c255d6e7090bb23c3618898a77fd4c2cfa4205a9dc08ae1b35e8c8bf

Download Submit
C:\Windows\SysWOW64\Cnffqf32.exe

Filesize
352KB

MD5
1883a4feafab3be277fca312139fbd01

SHA1
3b114d63f65ac597f327044c4788d7ac3980f6e7

SHA256
ffda80ece84f7a8041fb8faafa8b069cc154d5a7af5e08ff736aee70aecd99ab

SHA512
e9532e69fe848b0cadebb090c7f8930d09fda3fa9145db5b8a7d0922d5407c05250307c7438d023f760e98793503a4e99a6b03bb8f4aaecccdf7387692bac553

Download Submit
C:\Windows\SysWOW64\Dmjocp32.exe

Filesize
352KB

MD5
cb3d71455e3e1b02b79d5f7d1e400209

SHA1
18a9353e6a4fed57ca343df2993d8fe322105d8a

SHA256
958adfa395cff62b66e921fa5132481bd80a3ddddc074cbe7d981cb7fa284130

SHA512
65b99224fd7287f7ed0e989474afb01c26da5dac3ec023561faae298bcecf0ea0cba6bf2332426e500f7bb3217ad5fb0f00a02a0388d6828b31de46be30e445e

Download Submit
C:\Windows\SysWOW64\Gcagkdba.exe

Filesize
352KB

MD5
47795c385621a07f08cf86c2b8fc27e2

SHA1
991fb3245c87c3eb700982b42051471ea02712aa

SHA256
624c385cae26a48b4002fd2d9ec8e02f7dd10b0d5c1b4a3a6811d3235c4b74ac

SHA512
46dadf8771fb60e36e940af6d14f87ca29ab6496d6189146db0728e4b5cda01ca47ef1867b7d55bf6d07fd2a206f453da4f5c8c0dae569132b7ae40a2356d822

Download Submit
C:\Windows\SysWOW64\Ibagcc32.exe

Filesize
352KB

MD5
94d0adf8616ac945713e09ed2fa16c97

SHA1
90bd1e2042f840cbafc914008c00136be34ba64d

SHA256
94b9c7a8bb5f6fafd3284dfbdc0202243383616c18eb085c2cd8ee58ece80fed

SHA512
743d7ca11490e72006c7d96b29af0b34a6ff281ad093f8b5e6e0d1846ac3b50551b6bcbfa32357d3d083bfea5f83529616a3fc6b6739156db4c7b5d2a2d0ed6f

Download Submit
C:\Windows\SysWOW64\Ibojncfj.exe

Filesize
352KB

MD5
ffa82af21611eea7ad4b005c98dc56b3

SHA1
d60092da7ecf22ff4cec3bd6f617c02397df004e

SHA256
44b69934f908e5f6130eb3a3753dd84118a60950e34e379b85db058b1f533d3f

SHA512
999834f66b88012995235632d7b259395f260f842561a863bd31a0ebb0e96de0945e5ee635cf8026017abf3ce29134db669434e6583890e3ad0dbc00f0592998

Download Submit
C:\Windows\SysWOW64\Iikopmkd.exe

Filesize
352KB

MD5
0379d61b779c5d64edaadb54bffb9730

SHA1
bf6e6d650163b090fe645aa214b18782e77e7904

SHA256
01cf160852805ea93ddd5377fa84a4d8b49c7f4ba5c56da9b0b327736f3a382c

SHA512
4f164125620e95409de6425d5bbced91b1536da98c0e5c4ba2ccc277a70cbc2be482489e4edbae011b59780eb22e1816577c5fbd7d348ba3cb35fcdae1eb6c89

Download Submit
C:\Windows\SysWOW64\Ijfboafl.exe

Filesize
352KB

MD5
a907a1bce44345a9529693022425f79f

SHA1
83b737a7810dbca69bf6e76f0ffcafe7a8100534

SHA256
1cd2d66b60a22364febfdffe0e837f7a1d06d78e6900f4df6ef0a6fe4b11a44f

SHA512
e9406605da1e2497a62df0b87ab08e883bb671aedcd2458507191844b66a80ba1e99419f168b4994d91c99d7a7d3c1015a56dc0d165746cd454c4dc704b16154

Download Submit
C:\Windows\SysWOW64\Imbaemhc.exe

Filesize
352KB

MD5
af3433b1d6c237b06b6aa9b8323c8e7e

SHA1
242ae53ebf9d24d2a95a0e837e0714fc5f416069

SHA256
bd79bd70858da9040224651ee93294bdea3334727002670396b00c5397b9220b

SHA512
34f9dfedfed321893b553176df4aced1c56ffe39a0b7ebd650bd020b7d9ac57a82dd09060c4f2a3fdd6ea4e934bc96d4b5b99b87b3a6a273b01589f2fffb84c0

Download Submit
C:\Windows\SysWOW64\Ipckgh32.exe

Filesize
352KB

MD5
bef5d1cbaaf4cef08989ec761a84ebd7

SHA1
f0bfe7daaa0229c7b488c01e969989cac6e6fef8

SHA256
f8b628e42cc804bc028c2ad441485d33bac3cfcccf8112b6d33bbf6840f45237

SHA512
5952a4f621e32c53dbb4a9d4cc8c79f1736daab67a0a0660735789366ba6b638fb711e35f8d511679dccb788665e37b4ba6fc77a82b12372449a26bb5bb6a318

Download Submit
C:\Windows\SysWOW64\Ipegmg32.exe

Filesize
352KB

MD5
53f1d873572b360961cda0ef54b9704f

SHA1
b5e74f79975dbfac0e1e27e443d0ff3ff8fd9217

SHA256
d29f165cb8d8e4a6adb6c5deb7a602e4438f75769b93258bd06df2eeab1081d8

SHA512
9e674dc015afb1bbd67afc2f38b460d76d5a396f419f18373daf20c51b0d1b64eb95a39504b6081b0cdde7fea1e8591aa0c6e6b14f981bd48270c7a7a52e049c

Download Submit
C:\Windows\SysWOW64\Jbmfoa32.exe

Filesize
352KB

MD5
55ea596e419d5f30676c51bfd50d9cc5

SHA1
718b51ee04ea172210a02c26622235300a657ddb

SHA256
d501b8258dfc06e121d597d90b5bfe9dc070aa0ae873ac3dea5ae12a6ec67b84

SHA512
4c3d089c5d3c5c3b1561edc366ac96c90568a8d9476f0a7ad3c53222c1eca7032f42cac3b0fb1d7ec94525fe996fa8694299971ac5c85f0bd78e560cd1b4c179

Download Submit
C:\Windows\SysWOW64\Jdcpcf32.exe

Filesize
352KB

MD5
b0d77ea1b725ddb17061811ee219a6b3

SHA1
9e1c26bb0fdd1f44c54f5c1be6653f294b189ec5

SHA256
dad61c4b3e8dfef5f73881a95ef920e879673ee1a9b7c78b3ab86d5f3813b8c1

SHA512
639d1b610ddebf8e0e5785879ea99d1200b17a7f2647cca4ac7c805b26cd8db886b1a3ef178e97b0ee842b4e07068a074764aeddbac4908fae7dd0547deb822b

Download Submit
C:\Windows\SysWOW64\Jdmcidam.exe

Filesize
352KB

MD5
c74c7d0783f85a87369ed6cac865c171

SHA1
a1c3beebe5a80a048a15fd3788759d27a353c95b

SHA256
632098e5d991071981c0f8f5a193f6e7abb14d150d4d6a8eb34d29c17c086dce

SHA512
18d2eb033dd2a279069a381f7663e79babaf417c852b622b521343391e5c910df7350ab151780c57399aa5abfac2849d63cd203986b72890ebf425af0b34aed9

Download Submit
C:\Windows\SysWOW64\Jfaloa32.exe

Filesize
352KB

MD5
89f00b795e4f0574e05a1ebaee263ee5

SHA1
adc287263a763472921b7e91932be030100e5a0f

SHA256
0491c1b9ce7a5e93dd2e30ab3d89fd4018a539dfabf49d42962a75750257e1e3

SHA512
fdf84c606f98c4d496229da25e548b10d98df3e849777a97e61617063690af45f89444be8ea9ca751f165d65a1751cb0b63323a2d0dd20e117e36734c723d1a1

Download Submit
C:\Windows\SysWOW64\Jfdida32.exe

Filesize
352KB

MD5
d7a88ef086e7f851ee7b7554453ca1f8

SHA1
253395d7c19b57244abcdd12098caf7dd29f40b0

SHA256
a7cc6b935558af483194940a5a15225916cbb86cc8e92524c07d8c27c45c0bf6

SHA512
a7c565d7e768665b22da5ac82cbf027566a6c7abdad02299a52ef5f2245238fa15c800117b79c402c5f56805e529033241dc89cae62aa2f80817f33be559fa52

Download Submit
C:\Windows\SysWOW64\Jibeql32.exe

Filesize
352KB

MD5
8f5481ef51b1ff5f40a4ca8aa2271a03

SHA1
b0cd356e358798942c305b5846703e0eabe6d76a

SHA256
e732525f9f660221de26ed3dd66a54dba899eb65dd762f37a1df2162a5684d70

SHA512
73e9c85d437b6175390b288facb739f28af96e65400de0a8852f2bc6c67ba6e73aa6f69d1c0950ad30f00732a6ea4c14119d88794f1e4b90f2e8566ff4829d5c

Download Submit
C:\Windows\SysWOW64\Jkfkfohj.exe

Filesize
352KB

MD5
1b4937985fe290c2114b9630d129a087

SHA1
6adcac83b2bd4d30de189505f3740835f688046e

SHA256
623006fda9c4058c84bbeda33cf058922ae66f360eba9ab96199f24a90d0dc81

SHA512
0b539584cf4e83042f21dc7680ac163d386795e0a8ca521de842f5a17dc11af636a8b25a6a43ae03029c0849be6acc9725147bdfbfb2b28e9c4c71891b772ea8

Download Submit
C:\Windows\SysWOW64\Jmkdlkph.exe

Filesize
352KB

MD5
c1aa670aac4866dd0c57d64ab92640c7

SHA1
6fc9ea1db84e94b99805456f41f0f54d2f4c96fd

SHA256
1d9d8a9efda963282e20ca65aedae3ffe9efd63cac4c2a83d3313044153a864a

SHA512
9d730f165468d8ff81260974d0dcf6c6a3f4323d7d159ff360b93df3802d26dd1cad480f686ae20d9f985989f3b536caded4f6ae76c8b3f514ca2a3d44fd13d0

Download Submit
C:\Windows\SysWOW64\Jmpngk32.exe

Filesize
352KB

MD5
90f26b7af38c4505394b14dc90a5dfae

SHA1
37ef0648408c6ab460d5ba28823d56364f028b89

SHA256
80d7ab08e519a231abef1f3094763de975b6ed77b7569b5a24350b525a49a469

SHA512
a2bc0242be058a67a10a1cd532e2ce5c5c740c13271e9d15da81f935da7a5647b40c998767a3cfac87231c07c3e0b4beb977a5bd4b733a3fe6b0952585b17a23

Download Submit
C:\Windows\SysWOW64\Jpojcf32.exe

Filesize
352KB

MD5
6dcdf2e9c0167a956a5b5d9c62faacd9

SHA1
d24c77529ed1ed6c9287df29451e10681e8f4827

SHA256
5ed0051f2fcec33522b9feed9d7b66fd0377fdabc8190e2ecc6435ad0a6df8a6

SHA512
971763bcc2fb43159dbdbe2c0c1936a77c4e62ce8cf942fa0929632f2a068261c0d2434e7a74342771b8ad4817eb770061ce7eecd177c931f9c9408d0e2d9862

Download Submit
C:\Windows\SysWOW64\Kacphh32.exe

Filesize
352KB

MD5
2139bb9fab18c63ed7149110811c785d

SHA1
3180b9f97ddb7db282dd01dab0ead5d383ca5bbc

SHA256
c1fada6135f89ad8a3a005f088adb5270c96e710b0b4448b3b36a979b9b77946

SHA512
4b271553658ea6c1def87c45c4d6eba05fa70e6b55e1e4dc9dc2cd2c45f006cf27e016f905d17ff2e714ce575a92bcb68dfc5ae31de59918fcae76079b422ed9

Download Submit
C:\Windows\SysWOW64\Kagichjo.exe

Filesize
352KB

MD5
822d10a4e6cb21d2a72d105e7c5da247

SHA1
cd858c7d386164246e8d9d91687a7bb46d3758d5

SHA256
f52020b63f0386a17fb0a78939fe49cf45ad2ef72d0463924c4fb765ba56df8b

SHA512
f7c65abf5dd101f25f8ea87a2350e99896d1afc0d87286694db70df6f63bdbf11c4a19442fe27049d7ee0d41c1d06f2362c39e3bd3dc82715bd89ab3c20e043e

Download Submit
C:\Windows\SysWOW64\Kbdmpqcb.exe

Filesize
352KB

MD5
a570ab324daf34b687337b82c7f69b27

SHA1
8662df70f50c0b8a0eaf5a4fa642106be96cafb1

SHA256
801059133eb9614f8987ae65ec2e66af7cae136ecc09bfbf818f1ec5226fc561

SHA512
417c0972396c4fc7e453adf64333c54a53827cbc8711db1be617e3429e4258b4f277e535a91cbbc548a911925772f81dce1028b3c0f22df741b95e44eb9b4357

Download Submit
C:\Windows\SysWOW64\Kdffocib.exe

Filesize
352KB

MD5
bc7a9f6f4d8efd190f3c3bb8a9bfcfb5

SHA1
f61d6b9d4aa4eeeb8bc0f3f29d32076506e633c5

SHA256
381c7d0c6a300fb9cb0a05fb6a712baf109750b855d3abf603fda95ecc1da102

SHA512
6f929ae9f2782ed1559dbb14160b68c6ff246813e62b46e5580e1ec013d66d726b038dc7336265b5ddeb487a862dce44323585189bc15cd4088289d29d4e1f6b

Download Submit
C:\Windows\SysWOW64\Kgdbkohf.exe

Filesize
352KB

MD5
7a690ecfec66f25c8155c2a8e89dfb2a

SHA1
001a27c8b810262b2b7140cc702122b5cca7fe52

SHA256
2a8fed60ac943fa2def436a15d3ee30ecd9ffffb7783b74107c103d646a89cdd

SHA512
a0d796e1d2db2d0565f036be27bca898d0ce11ed757a8893f460233f90fe50c103f02671efcfc6cb7cdba47b877b7192603783fbafd5d38f1f60789d49e78b56

Download Submit
C:\Windows\SysWOW64\Kkihknfg.exe

Filesize
352KB

MD5
951ebaa8607a7f9a104f76b61af4d264

SHA1
9f7c8b0caf2905148822bd216cc4d5125225c1c9

SHA256
a9c0ded0cbc633dadf2c0bc7fafffc3c1e4c4b630b757ff494c203b5af580a74

SHA512
7e160c1dcc1ba7d01658204ffb05ef8f81a7bf126b62e00b54383b086d5528db866698c5baf0526fad5b81841076bed61db04145cb7e533362d49e257d169d1a

Download Submit
C:\Windows\SysWOW64\Kkkdan32.exe

Filesize
352KB

MD5
efc4aeb9788ef9bb4ab9dd06f57f23a2

SHA1
e65cca84861b81c2acdec64bfc9a8730dc34b788

SHA256
d0a6e99050e2ede932d422cf91e2c6001773a67f69eb25b9ed17c756a197b298

SHA512
15a9886af105e80e767f4bfbef59063a5d32075c75c61851633dd599b816a2e27d30e85b29fdcdebfb45edb50b21f42dcede19a65e1193ab5a8d3abd6ab8462d

Download Submit
C:\Windows\SysWOW64\Kkkdan32.exe

Filesize
61KB

MD5
64c33a7d9ff2b62dfec6f1109bf16106

SHA1
758bf9c3efe0385f1fd27c5c133397205cea5aba

SHA256
b534bc29dd09b48f097fa9cae56ae9dfb1e16d8df2f784df845647b69ce675c8

SHA512
6d5ddd204cff2ebe88078ca7f03d4a7ac09cf303a16686d6542bd6f0fb4f6a54f519be7f168806bdf0a091d9c0e0c6f11984ec8a6ea72481cc350cac9b4fce6f

Download Submit
C:\Windows\SysWOW64\Kknafn32.exe

Filesize
352KB

MD5
28bce163f2e95bfad4c6ce3cd276c39e

SHA1
aa62141a50e3c75e1b036bdc01b28497593c7e95

SHA256
44a3518da6f67603e1f821d4f47214ee5ed00f106305f6b5f0d364433805cb73

SHA512
d1d920e380d8dea87fb44a141cc4a4fb4aab5432b1701c04925c5d55045e6b72dfbc9adcaa481466ccd591cc97072d0ccd6861ee748ad27a855cbdd9219826f7

Download Submit
C:\Windows\SysWOW64\Kmegbjgn.exe

Filesize
352KB

MD5
9d417801be14e6ce352fe76af2bd51f0

SHA1
35c02e6b33a9bafc74ee86813464b472f23c216c

SHA256
8fa5c26cea0fe77b799cabbce54fd3e7ad6c5bc0a2d2421e3951371ff1157c5a

SHA512
f9b998935032caf8c5bfa190c6287077077ebd5534dbaea0595841c56ffadaa4111ef2e2036208a9cdfe5b2a9dc4702e035190138d2a05b7bcbac82a068c5c6e

Download Submit
C:\Windows\SysWOW64\Kmjqmi32.exe

Filesize
352KB

MD5
97d0cd175e6ec8fd2f8437b149aae166

SHA1
f24d37fea6cc4dc6b872c1fdb4e40d31170a5758

SHA256
55d7d429bb5e5c33f86c13c2779185806b42cb17de48264e277902a9e7d1f546

SHA512
095d1ddfc502bef1a34b9bced5f862b0fca028800581845e7a224a91ea1f079e055d31e8ccb5511fded34fdc0f12a94aef25fb06c1ce636e66f3d0eed5ea06be

Download Submit
C:\Windows\SysWOW64\Kpmfddnf.exe

Filesize
352KB

MD5
6b2a85c1e5440e6b094bd37d9c146704

SHA1
162a96ba562efbca782d748ccb742737b0fd5d73

SHA256
fc1783f6b6b5fb7689ad70caa7e24f1a093d28f0c81661586fd68b36841806d9

SHA512
c13191260f48654fdd9d0ddf1af27c7aa857aaf1681cadf3f75cc1f6f069cde84ea9bc93bae1121983ff13fb760a15daf79803a7016ef0f95105e37a97d6ff07

Download Submit
C:\Windows\SysWOW64\Lalcng32.exe

Filesize
352KB

MD5
89a2edb8d454bd8ab554d55ead24f5f8

SHA1
07d097290f21364e9d2b9ab7073d2168cb41908c

SHA256
ce0baaf29e0eadfee8524b895682a0dfc25034b34b83bf6a7e53980859988267

SHA512
9f298d894c3aa7c00ead588105b58c40819aab190f4c3650941f7f3169445d62ed18153b3658a74ad329d1b17f96e02033837076a25aabfd5d54962596278348

Download Submit
C:\Windows\SysWOW64\Laopdgcg.exe

Filesize
352KB

MD5
974dd1b64ff6169c0b2ab82eb3e2a173

SHA1
11d4f3b290ea123ebf4093a2b1f9fd843dedc958

SHA256
10deb67941de5987e62a6a2a537a18d27c7299791855155d1f8f0be20fb66a95

SHA512
1d724c5fd422924ca52d9ccf77852a28d96099e5159386d7a74c213030f4554e50ca711103385f099fcb8ef00153eb297497070478ae6c4e0372bf14685b2668

Download Submit
C:\Windows\SysWOW64\Lbdolh32.exe

Filesize
352KB

MD5
baa2677279df32bf6ff3c1152c3664bd

SHA1
de9c7fbe860f5310600a32aeeb7c7cf86ee06b0b

SHA256
0a2a3774a7c10944b88d2259531a7777cab2ec57720b43bb99b5d5a5b06b9a1b

SHA512
a2dad76a35a07c64f96dfc9a92df8e1e69e43ff9115ea98d90ba5a3ab08c2df13ac491076108f8d93f07860ea0521f2a354c1b91092dc99b5ecf78c4e53b7086

Download Submit
C:\Windows\SysWOW64\Lcmofolg.exe

Filesize
352KB

MD5
8ac119829cdf433dcaec24eb8fa4e8b8

SHA1
38ee4499320bbba026a7ea23e60b5cb5b8633c89

SHA256
2457296c722f82699227282c465f6efe146c4f5d0b2848a8797ac47af0188b1b

SHA512
1f3fde1c679d2fdbd3bb15a0d3de3286edd8dc0f63210381d78f5a6dd8797658c8c9227b67a785e9b41f484009b4feb4f73a21c6d502f46d1184c4ebe6513186

Download Submit
C:\Windows\SysWOW64\Lkdggmlj.exe

Filesize
352KB

MD5
2c32a339d501a9290dc81841197c3576

SHA1
2b5099f4c9a4a7c9d9a1af830373830b56ec0839

SHA256
536fe1381ba6c7b34075fc04f07aed9d96d332ac14d46e6dc59bffff33c1cdf1

SHA512
6a0630fa1303266ab56e8417094a506730edc3eb409121c4448d5b2719eafa6012c9f1c1cddfa52b75eadb4481d33d7dafa0ff9d55e5d9cdc5b7723cf3e25f9f

Download Submit
C:\Windows\SysWOW64\Mgekbljc.exe

Filesize
352KB

MD5
05d9463541d3daf15b2dca78270ec4e1

SHA1
07f862a4027caf156ad466ff131e36a6af5b6168

SHA256
98a86106c5af1c26d360489b6d52544c70d16bc5514fe366a7eae3a40721fac2

SHA512
7b8a1da8682b43562d15f11e4092ba1e765be96c2535def3822c889ff035da13be3518281b4a25d492c43d9a992c5206e94bcd32e7f9240cf7792d2999772e56

Download Submit
C:\Windows\SysWOW64\Nnmopdep.exe

Filesize
352KB

MD5
007671d77d7a38b7546f308bed57d585

SHA1
2fcce57562f0fe812cf27bf14a78f28ec67de333

SHA256
b5b8041a091b19faed9386639acd947c1da444bb9aa1244e1fb37d775d328db2

SHA512
9bd184de9a0548d8ac43c99e52a4171effde4edfa4d1235a10200a54b97dda07b66f6013717c719b07806591c4fee7a8a6eb66d36e22e7ce822866d317f7e9a8

Download Submit
C:\Windows\SysWOW64\Ojjolnaq.exe

Filesize
352KB

MD5
8017e7d07bb3d32fa1c7c5cfab24a5fe

SHA1
0f056a9af95cffe562b803c3ad7bfd6bb1097feb

SHA256
aed1885f2c5afce4d56fde3d7a548a6c6afe3996109e6e8dfab45be2d5efa473

SHA512
6e3ae40167d360d565f629316fed512f3b932fd7c063aa68b0be78fae93ac90fe8bd1cc03343cc46d05e265af4cda9c004f73f29a7d8d38ce4f3fb58c8df7ff1

Download Submit
C:\Windows\SysWOW64\Oponmilc.exe

Filesize
352KB

MD5
2497379a4699fbb5d26bcf3f89cc4e16

SHA1
2f706541640d7176da35db764e047b3894f2c1c5

SHA256
403e8929ba6bdb119326f60e5e487c894db6f6d04b4d883a22c610935bfeeb30

SHA512
0ea2d328538a72168c78863aa0ffcb0451d42ae1de3ab14caf243cf5e5efa03cfc8e20a86106d641fd386b9120d63c8324d468f6d37318d7bda31300e56d45e6

Download Submit
C:\Windows\SysWOW64\Qchmagie.exe

Filesize
352KB

MD5
7802fc6e6a5890817407270aaf24cf94

SHA1
d564d471d1f6c92611ffd4582399bfc4472d5550

SHA256
b28aed942b634b26d2805649656f131cee2b8429c43706bac9dcca8c19d4335b

SHA512
13e8e9dcbe9eeffe67d5c7262b1c6f9214f0a31805e23e9d2c9722689f76eb9f79f9403296274b770f30dd5d8adca804cec91e033e4d324df7debd95abd5d165

Download Submit
C:\Windows\SysWOW64\Qgallfcq.exe

Filesize
352KB

MD5
f11f22347451d23d721418d7dc6dca55

SHA1
d4f22f2473048ef34713e1bfe1de8739cbc8f90e

SHA256
24bc8d64bffa5b5c2bbc12b60aef931a0b0433ebb370e8df6d38fdd9658aa43a

SHA512
c533b30162ef428459d90d23cbeb9795c652f7042ce520a77a5f0543625da3cc3dec00587930bdd5afedce878697ec150fea5e9cbebb15d27074a2fb2a3b5e96

Download Submit
memory/336-378-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/452-459-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/636-273-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/652-337-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/768-425-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/872-41-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1132-183-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1368-322-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1392-232-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1424-326-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1436-168-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1588-267-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1660-367-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1752-437-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1880-365-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2060-37-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2092-25-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2332-285-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2364-443-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2392-461-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2492-98-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2500-94-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2528-200-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2540-17-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2660-208-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2940-153-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2952-312-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2964-302-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3048-176-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3068-252-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3168-145-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3172-114-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3200-413-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3216-449-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3332-67-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3392-300-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3480-392-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3736-220-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4112-401-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4212-343-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4256-314-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4268-58-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4292-106-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4300-225-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4316-431-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4372-240-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4392-283-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4400-407-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4448-192-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4484-419-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4512-349-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4568-467-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4572-134-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4720-122-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4812-73-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4872-360-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4900-0-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4900-81-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4900-5-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4912-89-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4916-384-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4992-13-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/5000-256-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/5080-49-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads