76c217baa183594dead8206aa36f30d8cc19a3da9f3f97f3ff9e94032e199f13

Analysis

max time kernel
161s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76c217baa183594dead8206aa36f30d8cc19a3da9f3f97f3ff9e94032e199f13.exe
Size

128KB
MD5

c0de1540787d0e8e75ff2b5af3e2c875
SHA1

9007ec0fe3ab882051362d83b0ea8ba577a351c5
SHA256

76c217baa183594dead8206aa36f30d8cc19a3da9f3f97f3ff9e94032e199f13
SHA512

b264ff657c4a0a08712287639379cfcd38a31d161f505d07c526ee4c9996221406d9c2c828d282574749f8e9d680ae59297a4329396f35d52f4c37204b8c5d65
SSDEEP

3072:pX6TgAC2toWWLOCIGp2/BhHmiImXJ2fYdV46nfPyxWhj8NCM/r:pqTgACnFfIO4BhHmNEcYj9nhV8NCU

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abimhd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpnfak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpankd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbglgg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jognokdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bajqpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Libnapmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekbiaigk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifihckmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmfjodgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nifldj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipmbcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enkmpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Offeahhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jehoemmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kblpnall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emcbcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohnelj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajjcoqdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nglala32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edhado32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Einmaaqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nndjgjhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bopefnnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Doeghk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	76c217baa183594dead8206aa36f30d8cc19a3da9f3f97f3ff9e94032e199f13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhcdnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnoefg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onneeceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ageofe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdafgefe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdmkbmnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhnbkfek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgpcklpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkenkhec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmmoekem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fobomglo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdpgen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmmoekem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibohid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfalhgni.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fphneijl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apeabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Foghhg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmbhhkoa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdhemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdpckbli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jplmglbf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajdbmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bonjnc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oekpdoll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gneaelqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckaffjbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipmbcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbplgbbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pldcdhpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jibejb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qbbggeli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhldio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckaolcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbmdnmdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpifeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpjfng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfomfo32.exe

Executes dropped EXE 64 IoCs

pid	Process
3592	Nconfh32.exe
1144	Okceaikl.exe
4664	Pdngpo32.exe
3980	Pcdqhecd.exe
4540	Pomncfge.exe
3148	Qbngeadf.exe
1800	Ammnhilb.exe
1652	Cpifeb32.exe
3092	Ciiaogon.exe
3180	Dllffa32.exe
4280	Dlncla32.exe
2004	Dpllbp32.exe
2304	Emioab32.exe
3188	Ecidpiad.exe
4692	Fdjnolfd.exe
3740	Gqmnpk32.exe
2748	Gmdoel32.exe
2156	Gnckooob.exe
1752	Hfamia32.exe
5016	Hqimlihn.exe
4712	Hfhbipdb.exe
2280	Igjlibib.exe
4500	Infqklol.exe
2668	Icgbob32.exe
3968	Jcjodbgl.exe
5028	Jcaeea32.exe
3296	Kjpgmj32.exe
1184	Kfidgk32.exe
2052	Loiong32.exe
4560	Mkdiog32.exe
1112	Mobbdf32.exe
4168	Nnfkgp32.exe
4520	Noehac32.exe
4460	Poagma32.exe
636	Pfkpiled.exe
1092	Pfmlok32.exe
1360	Phpbffnp.exe
1260	Qbmpjkqk.exe
2536	Akhaipei.exe
4564	Aeglbeea.exe
4756	Bkfmjnii.exe
5136	Cbglgg32.exe
5184	Cemndbci.exe
5236	Eimlgnij.exe
5276	Fhiphi32.exe
5328	Flghognq.exe
5388	Gpodkdll.exe
5492	Kgemahmg.exe
5536	Labkempb.exe
5576	Mpnngh32.exe
5616	Mmdlflki.exe
5660	Mhjpceko.exe
5720	Npadcfnl.exe
5768	Odaiodbp.exe
5800	Opmcod32.exe
5848	Pdklebje.exe
5888	Pncanhaf.exe
5928	Pgkegn32.exe
6028	Paaidf32.exe
6076	Ckfofe32.exe
6112	Fhbbmc32.exe
5156	Fbggkl32.exe
5200	Ghbkdald.exe
5308	Glbapoqh.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Odelpm32.exe	Omkdcccb.exe
File created	C:\Windows\SysWOW64\Cndeoqhk.dll	Einmaaqb.exe
File created	C:\Windows\SysWOW64\Cpkgmegi.dll	Eblpqono.exe
File opened for modification	C:\Windows\SysWOW64\Djqbeonf.exe	Dpknhfoq.exe
File created	C:\Windows\SysWOW64\Jgoflpal.exe	Jpenoe32.exe
File created	C:\Windows\SysWOW64\Cihckfoa.dll	Odaiodbp.exe
File opened for modification	C:\Windows\SysWOW64\Jfalhgni.exe	Jmihpa32.exe
File opened for modification	C:\Windows\SysWOW64\Amdddkma.exe	Agglld32.exe
File created	C:\Windows\SysWOW64\Ppjghgdg.exe	Pgaboa32.exe
File created	C:\Windows\SysWOW64\Lamjbc32.exe	Khbhdn32.exe
File created	C:\Windows\SysWOW64\Majoikof.exe	Ldohogfe.exe
File created	C:\Windows\SysWOW64\Nddfmc32.dll	Qbbggeli.exe
File created	C:\Windows\SysWOW64\Ljaooodf.exe	Lmmoekem.exe
File opened for modification	C:\Windows\SysWOW64\Npadcfnl.exe	Mhjpceko.exe
File created	C:\Windows\SysWOW64\Eidbbp32.exe	Eibfmp32.exe
File created	C:\Windows\SysWOW64\Nifldj32.exe	Nophfa32.exe
File opened for modification	C:\Windows\SysWOW64\Dcigneeg.exe	Djqbeonf.exe
File opened for modification	C:\Windows\SysWOW64\Lfeldj32.exe	Llmhkd32.exe
File created	C:\Windows\SysWOW64\Aojmda32.dll	Dpllbp32.exe
File created	C:\Windows\SysWOW64\Bhfogiff.exe	Bonjnc32.exe
File created	C:\Windows\SysWOW64\Oleabh32.dll	Onneeceo.exe
File created	C:\Windows\SysWOW64\Kacpncqg.dll	Goediekj.exe
File created	C:\Windows\SysWOW64\Ecbmle32.dll	Lmmoekem.exe
File opened for modification	C:\Windows\SysWOW64\Kjeiij32.exe	Kckqlpck.exe
File opened for modification	C:\Windows\SysWOW64\Cjlbag32.exe	Bnnklg32.exe
File created	C:\Windows\SysWOW64\Dbllkohi.exe	Dbjofp32.exe
File created	C:\Windows\SysWOW64\Iaobiplh.dll	Foebmn32.exe
File created	C:\Windows\SysWOW64\Hbpgle32.exe	Giqlbqcc.exe
File opened for modification	C:\Windows\SysWOW64\Hdhemn32.exe	Gikkof32.exe
File opened for modification	C:\Windows\SysWOW64\Apeabg32.exe	Qhhphebj.exe
File opened for modification	C:\Windows\SysWOW64\Fimhcbkh.exe	Dmcabd32.exe
File created	C:\Windows\SysWOW64\Lqbgcp32.exe	Lkenkhec.exe
File created	C:\Windows\SysWOW64\Ncmdcq32.dll	Emllbe32.exe
File opened for modification	C:\Windows\SysWOW64\Nbadmege.exe	Niipdpae.exe
File opened for modification	C:\Windows\SysWOW64\Pecefa32.exe	Poimigfm.exe
File created	C:\Windows\SysWOW64\Obombeqb.dll	Njnpie32.exe
File opened for modification	C:\Windows\SysWOW64\Jkimae32.exe	Jdodekhg.exe
File created	C:\Windows\SysWOW64\Mjdghj32.dll	Omdpio32.exe
File opened for modification	C:\Windows\SysWOW64\Caapfnkd.exe	Bopgdcnc.exe
File created	C:\Windows\SysWOW64\Hagqiofj.dll	Ggilbb32.exe
File created	C:\Windows\SysWOW64\Lmmoekem.exe	Lcejmeol.exe
File created	C:\Windows\SysWOW64\Elidlmdb.dll	Ebdlkdlp.exe
File opened for modification	C:\Windows\SysWOW64\Iefnjm32.exe	Fjbddh32.exe
File opened for modification	C:\Windows\SysWOW64\Iffmmihf.exe	Fbiooolb.exe
File created	C:\Windows\SysWOW64\Npckcb32.dll	Malgmm32.exe
File created	C:\Windows\SysWOW64\Lhjadp32.dll	Nclida32.exe
File opened for modification	C:\Windows\SysWOW64\Jggjpgmc.exe	Ipmbcm32.exe
File created	C:\Windows\SysWOW64\Djqbeonf.exe	Dpknhfoq.exe
File created	C:\Windows\SysWOW64\Llppob32.dll	Qemhlp32.exe
File opened for modification	C:\Windows\SysWOW64\Kckqlpck.exe	Klahof32.exe
File created	C:\Windows\SysWOW64\Jnpanb32.dll	Kflink32.exe
File created	C:\Windows\SysWOW64\Mmdlflki.exe	Mpnngh32.exe
File opened for modification	C:\Windows\SysWOW64\Aekdolkj.exe	Aploae32.exe
File opened for modification	C:\Windows\SysWOW64\Gdafgefe.exe	Ggnenagl.exe
File created	C:\Windows\SysWOW64\Ckaffjbg.exe	Bfenncdp.exe
File created	C:\Windows\SysWOW64\Bjokpg32.dll	Dhbelp32.exe
File opened for modification	C:\Windows\SysWOW64\Medqmb32.exe	Mpghel32.exe
File created	C:\Windows\SysWOW64\Ogqaqigd.exe	Oafido32.exe
File opened for modification	C:\Windows\SysWOW64\Mpnngh32.exe	Labkempb.exe
File created	C:\Windows\SysWOW64\Oaajoj32.exe	Okgabpgg.exe
File created	C:\Windows\SysWOW64\Aonokdce.exe	Aajoapdk.exe
File opened for modification	C:\Windows\SysWOW64\Caojigoh.exe	Ckealm32.exe
File created	C:\Windows\SysWOW64\Offeahhp.exe	Olqqdo32.exe
File created	C:\Windows\SysWOW64\Glgjfb32.exe	Fikbhiaf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2052	6892	WerFault.exe	704

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Noehac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajjcoqdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jocepc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dnjdigpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elomej32.dll"	Jcaeea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cifdhj32.dll"	Fpjjkh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpenoe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfhbipdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dqhpjohb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcbdhkme.dll"	Nqioqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Domabi32.dll"	Clplff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nclbjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhfogiff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fobomglo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phgagb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbgehd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgdmgi32.dll"	Jncobabm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkaqdc32.dll"	Ckealm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amfemoei.dll"	Cemndbci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klbgag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhgcdjje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cofnba32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gdafgefe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajkgmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Paelpcgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qdmkbmnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpllbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gpodkdll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Egijfjmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Foghhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hhihnihm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjpbkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnkcchff.dll"	Phbhlcpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qkjgomgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Paaidf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oenfbj32.dll"	Jomeoggk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfeiedhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Einmaaqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbkncd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpflql32.dll"	Pnfiia32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpmdabfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ichcim32.dll"	Ageofe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obkapcei.dll"	Oplkgi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmenmgab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Libnapmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kblpnall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgijnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpoknjfd.dll"	Qaofphbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ikpjkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlfbgp32.dll"	Ipjocgdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hokeebcd.dll"	Jmihpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppaoikim.dll"	Lhfmmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnfamk32.dll"	Fpagdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hoheefad.dll"	Jmbhhkoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qoaoflcl.dll"	Mpghel32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djcoko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkjnib32.dll"	Aajoapdk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldhbnhlm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Blieeglf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oafido32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	76c217baa183594dead8206aa36f30d8cc19a3da9f3f97f3ff9e94032e199f13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfnpacjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hagqiofj.dll"	Ggilbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jqpfccgo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 3592	4704	76c217baa183594dead8206aa36f30d8cc19a3da9f3f97f3ff9e94032e199f13.exe	99
PID 4704 wrote to memory of 3592	4704	76c217baa183594dead8206aa36f30d8cc19a3da9f3f97f3ff9e94032e199f13.exe	99
PID 4704 wrote to memory of 3592	4704	76c217baa183594dead8206aa36f30d8cc19a3da9f3f97f3ff9e94032e199f13.exe	99
PID 3592 wrote to memory of 1144	3592	Nconfh32.exe	100
PID 3592 wrote to memory of 1144	3592	Nconfh32.exe	100
PID 3592 wrote to memory of 1144	3592	Nconfh32.exe	100
PID 1144 wrote to memory of 4664	1144	Okceaikl.exe	101
PID 1144 wrote to memory of 4664	1144	Okceaikl.exe	101
PID 1144 wrote to memory of 4664	1144	Okceaikl.exe	101
PID 4664 wrote to memory of 3980	4664	Pdngpo32.exe	102
PID 4664 wrote to memory of 3980	4664	Pdngpo32.exe	102
PID 4664 wrote to memory of 3980	4664	Pdngpo32.exe	102
PID 3980 wrote to memory of 4540	3980	Pcdqhecd.exe	104
PID 3980 wrote to memory of 4540	3980	Pcdqhecd.exe	104
PID 3980 wrote to memory of 4540	3980	Pcdqhecd.exe	104
PID 4540 wrote to memory of 3148	4540	Pomncfge.exe	105
PID 4540 wrote to memory of 3148	4540	Pomncfge.exe	105
PID 4540 wrote to memory of 3148	4540	Pomncfge.exe	105
PID 3148 wrote to memory of 1800	3148	Qbngeadf.exe	106
PID 3148 wrote to memory of 1800	3148	Qbngeadf.exe	106
PID 3148 wrote to memory of 1800	3148	Qbngeadf.exe	106
PID 1800 wrote to memory of 1652	1800	Ammnhilb.exe	107
PID 1800 wrote to memory of 1652	1800	Ammnhilb.exe	107
PID 1800 wrote to memory of 1652	1800	Ammnhilb.exe	107
PID 1652 wrote to memory of 3092	1652	Cpifeb32.exe	108
PID 1652 wrote to memory of 3092	1652	Cpifeb32.exe	108
PID 1652 wrote to memory of 3092	1652	Cpifeb32.exe	108
PID 3092 wrote to memory of 3180	3092	Ciiaogon.exe	109
PID 3092 wrote to memory of 3180	3092	Ciiaogon.exe	109
PID 3092 wrote to memory of 3180	3092	Ciiaogon.exe	109
PID 3180 wrote to memory of 4280	3180	Dllffa32.exe	110
PID 3180 wrote to memory of 4280	3180	Dllffa32.exe	110
PID 3180 wrote to memory of 4280	3180	Dllffa32.exe	110
PID 4280 wrote to memory of 2004	4280	Dlncla32.exe	111
PID 4280 wrote to memory of 2004	4280	Dlncla32.exe	111
PID 4280 wrote to memory of 2004	4280	Dlncla32.exe	111
PID 2004 wrote to memory of 2304	2004	Dpllbp32.exe	112
PID 2004 wrote to memory of 2304	2004	Dpllbp32.exe	112
PID 2004 wrote to memory of 2304	2004	Dpllbp32.exe	112
PID 2304 wrote to memory of 3188	2304	Emioab32.exe	113
PID 2304 wrote to memory of 3188	2304	Emioab32.exe	113
PID 2304 wrote to memory of 3188	2304	Emioab32.exe	113
PID 3188 wrote to memory of 4692	3188	Ecidpiad.exe	114
PID 3188 wrote to memory of 4692	3188	Ecidpiad.exe	114
PID 3188 wrote to memory of 4692	3188	Ecidpiad.exe	114
PID 4692 wrote to memory of 3740	4692	Fdjnolfd.exe	115
PID 4692 wrote to memory of 3740	4692	Fdjnolfd.exe	115
PID 4692 wrote to memory of 3740	4692	Fdjnolfd.exe	115
PID 3740 wrote to memory of 2748	3740	Gqmnpk32.exe	116
PID 3740 wrote to memory of 2748	3740	Gqmnpk32.exe	116
PID 3740 wrote to memory of 2748	3740	Gqmnpk32.exe	116
PID 2748 wrote to memory of 2156	2748	Gmdoel32.exe	117
PID 2748 wrote to memory of 2156	2748	Gmdoel32.exe	117
PID 2748 wrote to memory of 2156	2748	Gmdoel32.exe	117
PID 2156 wrote to memory of 1752	2156	Gnckooob.exe	118
PID 2156 wrote to memory of 1752	2156	Gnckooob.exe	118
PID 2156 wrote to memory of 1752	2156	Gnckooob.exe	118
PID 1752 wrote to memory of 5016	1752	Hfamia32.exe	119
PID 1752 wrote to memory of 5016	1752	Hfamia32.exe	119
PID 1752 wrote to memory of 5016	1752	Hfamia32.exe	119
PID 5016 wrote to memory of 4712	5016	Hqimlihn.exe	120
PID 5016 wrote to memory of 4712	5016	Hqimlihn.exe	120
PID 5016 wrote to memory of 4712	5016	Hqimlihn.exe	120
PID 4712 wrote to memory of 2280	4712	Hfhbipdb.exe	121

C:\Users\Admin\AppData\Local\Temp\76c217baa183594dead8206aa36f30d8cc19a3da9f3f97f3ff9e94032e199f13.exe
"C:\Users\Admin\AppData\Local\Temp\76c217baa183594dead8206aa36f30d8cc19a3da9f3f97f3ff9e94032e199f13.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\Nconfh32.exe
  C:\Windows\system32\Nconfh32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\SysWOW64\Okceaikl.exe
    C:\Windows\system32\Okceaikl.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Windows\SysWOW64\Pdngpo32.exe
      C:\Windows\system32\Pdngpo32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4664
    - - C:\Windows\SysWOW64\Pcdqhecd.exe
        
        C:\Windows\system32\Pcdqhecd.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3980
      - C:\Windows\SysWOW64\Pomncfge.exe
        
        C:\Windows\system32\Pomncfge.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\SysWOW64\Qbngeadf.exe
        
        C:\Windows\system32\Qbngeadf.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\SysWOW64\Ammnhilb.exe
        
        C:\Windows\system32\Ammnhilb.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\SysWOW64\Cpifeb32.exe
        
        C:\Windows\system32\Cpifeb32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\SysWOW64\Ciiaogon.exe
        
        C:\Windows\system32\Ciiaogon.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3092
        
        C:\Windows\SysWOW64\Dllffa32.exe
        
        C:\Windows\system32\Dllffa32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\SysWOW64\Dlncla32.exe
        
        C:\Windows\system32\Dlncla32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\SysWOW64\Dpllbp32.exe
        
        C:\Windows\system32\Dpllbp32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2004
        
        C:\Windows\SysWOW64\Emioab32.exe
        
        C:\Windows\system32\Emioab32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Windows\SysWOW64\Ecidpiad.exe
        
        C:\Windows\system32\Ecidpiad.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3188
        
        C:\Windows\SysWOW64\Fdjnolfd.exe
        
        C:\Windows\system32\Fdjnolfd.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\SysWOW64\Gqmnpk32.exe
        
        C:\Windows\system32\Gqmnpk32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3740
        
        C:\Windows\SysWOW64\Gmdoel32.exe
        
        C:\Windows\system32\Gmdoel32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Windows\SysWOW64\Gnckooob.exe
        
        C:\Windows\system32\Gnckooob.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\SysWOW64\Hfamia32.exe
        
        C:\Windows\system32\Hfamia32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\SysWOW64\Hqimlihn.exe
        
        C:\Windows\system32\Hqimlihn.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Hfhbipdb.exe
        
        C:\Windows\system32\Hfhbipdb.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4712
        
        C:\Windows\SysWOW64\Igjlibib.exe
        
        C:\Windows\system32\Igjlibib.exe
        23⤵
        Executes dropped EXE
        
        PID:2280
        
        C:\Windows\SysWOW64\Infqklol.exe
        
        C:\Windows\system32\Infqklol.exe
        24⤵
        Executes dropped EXE
        
        PID:4500
        
        C:\Windows\SysWOW64\Icgbob32.exe
        
        C:\Windows\system32\Icgbob32.exe
        25⤵
        Executes dropped EXE
        
        PID:2668
        
        C:\Windows\SysWOW64\Jcjodbgl.exe
        
        C:\Windows\system32\Jcjodbgl.exe
        26⤵
        Executes dropped EXE
        
        PID:3968
        
        C:\Windows\SysWOW64\Jcaeea32.exe
        
        C:\Windows\system32\Jcaeea32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5028
        
        C:\Windows\SysWOW64\Kjpgmj32.exe
        
        C:\Windows\system32\Kjpgmj32.exe
        28⤵
        Executes dropped EXE
        
        PID:3296
        
        C:\Windows\SysWOW64\Kfidgk32.exe
        
        C:\Windows\system32\Kfidgk32.exe
        29⤵
        Executes dropped EXE
        
        PID:1184
        
        C:\Windows\SysWOW64\Loiong32.exe
        
        C:\Windows\system32\Loiong32.exe
        30⤵
        Executes dropped EXE
        
        PID:2052
        
        C:\Windows\SysWOW64\Mkdiog32.exe
        
        C:\Windows\system32\Mkdiog32.exe
        31⤵
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\SysWOW64\Mobbdf32.exe
        
        C:\Windows\system32\Mobbdf32.exe
        32⤵
        Executes dropped EXE
        
        PID:1112
        
        C:\Windows\SysWOW64\Nnfkgp32.exe
        
        C:\Windows\system32\Nnfkgp32.exe
        33⤵
        Executes dropped EXE
        
        PID:4168
        
        C:\Windows\SysWOW64\Noehac32.exe
        
        C:\Windows\system32\Noehac32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4520
        
        C:\Windows\SysWOW64\Poagma32.exe
        
        C:\Windows\system32\Poagma32.exe
        35⤵
        Executes dropped EXE
        
        PID:4460
        
        C:\Windows\SysWOW64\Pfkpiled.exe
        
        C:\Windows\system32\Pfkpiled.exe
        36⤵
        Executes dropped EXE
        
        PID:636
        
        C:\Windows\SysWOW64\Pfmlok32.exe
        
        C:\Windows\system32\Pfmlok32.exe
        37⤵
        Executes dropped EXE
        
        PID:1092
        
        C:\Windows\SysWOW64\Phpbffnp.exe
        
        C:\Windows\system32\Phpbffnp.exe
        38⤵
        Executes dropped EXE
        
        PID:1360
        
        C:\Windows\SysWOW64\Qbmpjkqk.exe
        
        C:\Windows\system32\Qbmpjkqk.exe
        39⤵
        Executes dropped EXE
        
        PID:1260
        
        C:\Windows\SysWOW64\Akhaipei.exe
        
        C:\Windows\system32\Akhaipei.exe
        40⤵
        Executes dropped EXE
        
        PID:2536
        
        C:\Windows\SysWOW64\Aeglbeea.exe
        
        C:\Windows\system32\Aeglbeea.exe
        41⤵
        Executes dropped EXE
        
        PID:4564
        
        C:\Windows\SysWOW64\Bkfmjnii.exe
        
        C:\Windows\system32\Bkfmjnii.exe
        42⤵
        Executes dropped EXE
        
        PID:4756
        
        C:\Windows\SysWOW64\Cbglgg32.exe
        
        C:\Windows\system32\Cbglgg32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5136
        
        C:\Windows\SysWOW64\Cemndbci.exe
        
        C:\Windows\system32\Cemndbci.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Eimlgnij.exe
        
        C:\Windows\system32\Eimlgnij.exe
        45⤵
        Executes dropped EXE
        
        PID:5236
        
        C:\Windows\SysWOW64\Fhiphi32.exe
        
        C:\Windows\system32\Fhiphi32.exe
        46⤵
        Executes dropped EXE
        
        PID:5276
        
        C:\Windows\SysWOW64\Flghognq.exe
        
        C:\Windows\system32\Flghognq.exe
        47⤵
        Executes dropped EXE
        
        PID:5328
        
        C:\Windows\SysWOW64\Gpodkdll.exe
        
        C:\Windows\system32\Gpodkdll.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Kgemahmg.exe
        
        C:\Windows\system32\Kgemahmg.exe
        49⤵
        Executes dropped EXE
        
        PID:5492
        
        C:\Windows\SysWOW64\Labkempb.exe
        
        C:\Windows\system32\Labkempb.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5536
        
        C:\Windows\SysWOW64\Mpnngh32.exe
        
        C:\Windows\system32\Mpnngh32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5576
        
        C:\Windows\SysWOW64\Mmdlflki.exe
        
        C:\Windows\system32\Mmdlflki.exe
        52⤵
        Executes dropped EXE
        
        PID:5616
        
        C:\Windows\SysWOW64\Mhjpceko.exe
        
        C:\Windows\system32\Mhjpceko.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5660
        
        C:\Windows\SysWOW64\Npadcfnl.exe
        
        C:\Windows\system32\Npadcfnl.exe
        54⤵
        Executes dropped EXE
        
        PID:5720
        
        C:\Windows\SysWOW64\Odaiodbp.exe
        
        C:\Windows\system32\Odaiodbp.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5768
        
        C:\Windows\SysWOW64\Opmcod32.exe
        
        C:\Windows\system32\Opmcod32.exe
        56⤵
        Executes dropped EXE
        
        PID:5800
        
        C:\Windows\SysWOW64\Pdklebje.exe
        
        C:\Windows\system32\Pdklebje.exe
        57⤵
        Executes dropped EXE
        
        PID:5848
        
        C:\Windows\SysWOW64\Pncanhaf.exe
        
        C:\Windows\system32\Pncanhaf.exe
        58⤵
        Executes dropped EXE
        
        PID:5888
        
        C:\Windows\SysWOW64\Pgkegn32.exe
        
        C:\Windows\system32\Pgkegn32.exe
        59⤵
        Executes dropped EXE
        
        PID:5928
        
        C:\Windows\SysWOW64\Paaidf32.exe
        
        C:\Windows\system32\Paaidf32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6028
        
        C:\Windows\SysWOW64\Ckfofe32.exe
        
        C:\Windows\system32\Ckfofe32.exe
        61⤵
        Executes dropped EXE
        
        PID:6076
        
        C:\Windows\SysWOW64\Fhbbmc32.exe
        
        C:\Windows\system32\Fhbbmc32.exe
        62⤵
        Executes dropped EXE
        
        PID:6112
        
        C:\Windows\SysWOW64\Fbggkl32.exe
        
        C:\Windows\system32\Fbggkl32.exe
        63⤵
        Executes dropped EXE
        
        PID:5156
        
        C:\Windows\SysWOW64\Ghbkdald.exe
        
        C:\Windows\system32\Ghbkdald.exe
        64⤵
        Executes dropped EXE
        
        PID:5200
        
        C:\Windows\SysWOW64\Glbapoqh.exe
        
        C:\Windows\system32\Glbapoqh.exe
        65⤵
        Executes dropped EXE
        
        PID:5308
        
        C:\Windows\SysWOW64\Ijkdkq32.exe
        
        C:\Windows\system32\Ijkdkq32.exe
        66⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\Jomeoggk.exe
        
        C:\Windows\system32\Jomeoggk.exe
        67⤵
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Mcpjnp32.exe
        
        C:\Windows\system32\Mcpjnp32.exe
        68⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Nipokfil.exe
        
        C:\Windows\system32\Nipokfil.exe
        69⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Npighq32.exe
        
        C:\Windows\system32\Npighq32.exe
        70⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Obfpejcl.exe
        
        C:\Windows\system32\Obfpejcl.exe
        71⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Omkdcccb.exe
        
        C:\Windows\system32\Omkdcccb.exe
        72⤵
        Drops file in System32 directory
        
        PID:5696
        
        C:\Windows\SysWOW64\Odelpm32.exe
        
        C:\Windows\system32\Odelpm32.exe
        73⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Okodlgbl.exe
        
        C:\Windows\system32\Okodlgbl.exe
        74⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Olqqdo32.exe
        
        C:\Windows\system32\Olqqdo32.exe
        75⤵
        Drops file in System32 directory
        
        PID:5904
        
        C:\Windows\SysWOW64\Offeahhp.exe
        
        C:\Windows\system32\Offeahhp.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2940
        
        C:\Windows\SysWOW64\Ajjcoqdl.exe
        
        C:\Windows\system32\Ajjcoqdl.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3352
        
        C:\Windows\SysWOW64\Fjbddh32.exe
        
        C:\Windows\system32\Fjbddh32.exe
        78⤵
        Drops file in System32 directory
        
        PID:5984
        
        C:\Windows\SysWOW64\Iefnjm32.exe
        
        C:\Windows\system32\Iefnjm32.exe
        79⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Ilglgfjd.exe
        
        C:\Windows\system32\Ilglgfjd.exe
        80⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Jehcfj32.exe
        
        C:\Windows\system32\Jehcfj32.exe
        81⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Jaodkk32.exe
        
        C:\Windows\system32\Jaodkk32.exe
        82⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\Khimhefk.exe
        
        C:\Windows\system32\Khimhefk.exe
        83⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Koceep32.exe
        
        C:\Windows\system32\Koceep32.exe
        84⤵
        
        PID:624
        
        C:\Windows\SysWOW64\Klgend32.exe
        
        C:\Windows\system32\Klgend32.exe
        85⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Kdipce32.exe
        
        C:\Windows\system32\Kdipce32.exe
        86⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Lilbdcfe.exe
        
        C:\Windows\system32\Lilbdcfe.exe
        87⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Lbdgmh32.exe
        
        C:\Windows\system32\Lbdgmh32.exe
        88⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\Mfgiof32.exe
        
        C:\Windows\system32\Mfgiof32.exe
        89⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\Mfiedfmd.exe
        
        C:\Windows\system32\Mfiedfmd.exe
        90⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\Mkfnlmkl.exe
        
        C:\Windows\system32\Mkfnlmkl.exe
        91⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Niohap32.exe
        
        C:\Windows\system32\Niohap32.exe
        92⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Neeifa32.exe
        
        C:\Windows\system32\Neeifa32.exe
        93⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\Nblfee32.exe
        
        C:\Windows\system32\Nblfee32.exe
        94⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\Pldcdhpi.exe
        
        C:\Windows\system32\Pldcdhpi.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2628
        
        C:\Windows\SysWOW64\Pemhmn32.exe
        
        C:\Windows\system32\Pemhmn32.exe
        96⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Ppgeff32.exe
        
        C:\Windows\system32\Ppgeff32.exe
        97⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\Aploae32.exe
        
        C:\Windows\system32\Aploae32.exe
        98⤵
        Drops file in System32 directory
        
        PID:2156
        
        C:\Windows\SysWOW64\Aekdolkj.exe
        
        C:\Windows\system32\Aekdolkj.exe
        99⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Bnnklg32.exe
        
        C:\Windows\system32\Bnnklg32.exe
        100⤵
        Drops file in System32 directory
        
        PID:5300
        
        C:\Windows\SysWOW64\Cjlbag32.exe
        
        C:\Windows\system32\Cjlbag32.exe
        101⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\Cgpcklpd.exe
        
        C:\Windows\system32\Cgpcklpd.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5380
        
        C:\Windows\SysWOW64\Dgkbfjeg.exe
        
        C:\Windows\system32\Dgkbfjeg.exe
        103⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Dqhpjohb.exe
        
        C:\Windows\system32\Dqhpjohb.exe
        104⤵
        Modifies registry class
        
        PID:4972
        
        C:\Windows\SysWOW64\Gpjfng32.exe
        
        C:\Windows\system32\Gpjfng32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5604
        
        C:\Windows\SysWOW64\Hmdlhk32.exe
        
        C:\Windows\system32\Hmdlhk32.exe
        106⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\Hnfehm32.exe
        
        C:\Windows\system32\Hnfehm32.exe
        107⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Hjmfmnhp.exe
        
        C:\Windows\system32\Hjmfmnhp.exe
        108⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Jognokdi.exe
        
        C:\Windows\system32\Jognokdi.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3296
        
        C:\Windows\SysWOW64\Jknocljn.exe
        
        C:\Windows\system32\Jknocljn.exe
        110⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\Jpjhlche.exe
        
        C:\Windows\system32\Jpjhlche.exe
        111⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Jkplilgk.exe
        
        C:\Windows\system32\Jkplilgk.exe
        112⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Jpmdabfb.exe
        
        C:\Windows\system32\Jpmdabfb.exe
        113⤵
        Modifies registry class
        
        PID:2004
        
        C:\Windows\SysWOW64\Kgnbol32.exe
        
        C:\Windows\system32\Kgnbol32.exe
        114⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Knhkkfod.exe
        
        C:\Windows\system32\Knhkkfod.exe
        115⤵
        
        PID:532
        
        C:\Windows\SysWOW64\Khbhdn32.exe
        
        C:\Windows\system32\Khbhdn32.exe
        116⤵
        Drops file in System32 directory
        
        PID:1328
        
        C:\Windows\SysWOW64\Lamjbc32.exe
        
        C:\Windows\system32\Lamjbc32.exe
        117⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\Lkenkhec.exe
        
        C:\Windows\system32\Lkenkhec.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4612
        
        C:\Windows\SysWOW64\Lqbgcp32.exe
        
        C:\Windows\system32\Lqbgcp32.exe
        119⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\Mnaghb32.exe
        
        C:\Windows\system32\Mnaghb32.exe
        120⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Plfipakk.exe
        
        C:\Windows\system32\Plfipakk.exe
        121⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Qimfoe32.exe
        
        C:\Windows\system32\Qimfoe32.exe
        122⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\Bafgdfim.exe
        
        C:\Windows\system32\Bafgdfim.exe
        123⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\Bajqpe32.exe
        
        C:\Windows\system32\Bajqpe32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5172
        
        C:\Windows\SysWOW64\Blpemn32.exe
        
        C:\Windows\system32\Blpemn32.exe
        125⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Bbjmih32.exe
        
        C:\Windows\system32\Bbjmih32.exe
        126⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Blbabnbk.exe
        
        C:\Windows\system32\Blbabnbk.exe
        127⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Bekfkc32.exe
        
        C:\Windows\system32\Bekfkc32.exe
        128⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Commjgga.exe
        
        C:\Windows\system32\Commjgga.exe
        129⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Damflb32.exe
        
        C:\Windows\system32\Damflb32.exe
        130⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\Dhgoimlo.exe
        
        C:\Windows\system32\Dhgoimlo.exe
        131⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\Dcmcfeke.exe
        
        C:\Windows\system32\Dcmcfeke.exe
        132⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Dlegokbe.exe
        
        C:\Windows\system32\Dlegokbe.exe
        133⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\Dcopke32.exe
        
        C:\Windows\system32\Dcopke32.exe
        134⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\Dhlhcl32.exe
        
        C:\Windows\system32\Dhlhcl32.exe
        135⤵
        
        PID:3804
        
        C:\Windows\SysWOW64\Elojej32.exe
        
        C:\Windows\system32\Elojej32.exe
        136⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Fbiooolb.exe
        
        C:\Windows\system32\Fbiooolb.exe
        137⤵
        Drops file in System32 directory
        
        PID:2636
        
        C:\Windows\SysWOW64\Iffmmihf.exe
        
        C:\Windows\system32\Iffmmihf.exe
        138⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\Ijfbhflj.exe
        
        C:\Windows\system32\Ijfbhflj.exe
        139⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\Jmihpa32.exe
        
        C:\Windows\system32\Jmihpa32.exe
        140⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4484
        
        C:\Windows\SysWOW64\Jfalhgni.exe
        
        C:\Windows\system32\Jfalhgni.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5804
        
        C:\Windows\SysWOW64\Jdembk32.exe
        
        C:\Windows\system32\Jdembk32.exe
        142⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Jibejb32.exe
        
        C:\Windows\system32\Jibejb32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1560
        
        C:\Windows\SysWOW64\Jplmglbf.exe
        
        C:\Windows\system32\Jplmglbf.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5100
        
        C:\Windows\SysWOW64\Jkaadebl.exe
        
        C:\Windows\system32\Jkaadebl.exe
        145⤵
        
        PID:232
        
        C:\Windows\SysWOW64\Jpojml32.exe
        
        C:\Windows\system32\Jpojml32.exe
        146⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Kapclned.exe
        
        C:\Windows\system32\Kapclned.exe
        147⤵
        
        PID:952
        
        C:\Windows\SysWOW64\Kabpan32.exe
        
        C:\Windows\system32\Kabpan32.exe
        148⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\Libnapmg.exe
        
        C:\Windows\system32\Libnapmg.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4928
        
        C:\Windows\SysWOW64\Ldhbnhlm.exe
        
        C:\Windows\system32\Ldhbnhlm.exe
        150⤵
        Modifies registry class
        
        PID:1184
        
        C:\Windows\SysWOW64\Ldohogfe.exe
        
        C:\Windows\system32\Ldohogfe.exe
        151⤵
        Drops file in System32 directory
        
        PID:4280
        
        C:\Windows\SysWOW64\Majoikof.exe
        
        C:\Windows\system32\Majoikof.exe
        152⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Mcklac32.exe
        
        C:\Windows\system32\Mcklac32.exe
        153⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\Nglala32.exe
        
        C:\Windows\system32\Nglala32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5388
        
        C:\Windows\SysWOW64\Nqioqf32.exe
        
        C:\Windows\system32\Nqioqf32.exe
        155⤵
        Modifies registry class
        
        PID:4576
        
        C:\Windows\SysWOW64\Ngbgmpcq.exe
        
        C:\Windows\system32\Ngbgmpcq.exe
        156⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Pgemimck.exe
        
        C:\Windows\system32\Pgemimck.exe
        157⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Pnoefg32.exe
        
        C:\Windows\system32\Pnoefg32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5824
        
        C:\Windows\SysWOW64\Pkhokkel.exe
        
        C:\Windows\system32\Pkhokkel.exe
        159⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Qbbggeli.exe
        
        C:\Windows\system32\Qbbggeli.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1140
        
        C:\Windows\SysWOW64\Qkjlpk32.exe
        
        C:\Windows\system32\Qkjlpk32.exe
        161⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Abimhd32.exe
        
        C:\Windows\system32\Abimhd32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5236
        
        C:\Windows\SysWOW64\Ajdbmf32.exe
        
        C:\Windows\system32\Ajdbmf32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3952
        
        C:\Windows\SysWOW64\Bonjnc32.exe
        
        C:\Windows\system32\Bonjnc32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5436
        
        C:\Windows\SysWOW64\Bhfogiff.exe
        
        C:\Windows\system32\Bhfogiff.exe
        165⤵
        Modifies registry class
        
        PID:5628
        
        C:\Windows\SysWOW64\Bopgdcnc.exe
        
        C:\Windows\system32\Bopgdcnc.exe
        166⤵
        Drops file in System32 directory
        
        PID:6088
        
        C:\Windows\SysWOW64\Caapfnkd.exe
        
        C:\Windows\system32\Caapfnkd.exe
        167⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Chkhbh32.exe
        
        C:\Windows\system32\Chkhbh32.exe
        168⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Dbjofp32.exe
        
        C:\Windows\system32\Dbjofp32.exe
        169⤵
        Drops file in System32 directory
        
        PID:3176
        
        C:\Windows\SysWOW64\Dbllkohi.exe
        
        C:\Windows\system32\Dbllkohi.exe
        170⤵
        
        PID:844
        
        C:\Windows\SysWOW64\Dacebkko.exe
        
        C:\Windows\system32\Dacebkko.exe
        171⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Ddbbngjb.exe
        
        C:\Windows\system32\Ddbbngjb.exe
        172⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Dkljka32.exe
        
        C:\Windows\system32\Dkljka32.exe
        173⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Eaabci32.exe
        
        C:\Windows\system32\Eaabci32.exe
        174⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Fhljpcfk.exe
        
        C:\Windows\system32\Fhljpcfk.exe
        175⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\Foebmn32.exe
        
        C:\Windows\system32\Foebmn32.exe
        176⤵
        Drops file in System32 directory
        
        PID:1652
        
        C:\Windows\SysWOW64\Ffpjihee.exe
        
        C:\Windows\system32\Ffpjihee.exe
        177⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Fljcfa32.exe
        
        C:\Windows\system32\Fljcfa32.exe
        178⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\Fchdnkpi.exe
        
        C:\Windows\system32\Fchdnkpi.exe
        179⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Fdiafc32.exe
        
        C:\Windows\system32\Fdiafc32.exe
        180⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\Fooecl32.exe
        
        C:\Windows\system32\Fooecl32.exe
        181⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Gmjlmo32.exe
        
        C:\Windows\system32\Gmjlmo32.exe
        182⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\Gcddjiel.exe
        
        C:\Windows\system32\Gcddjiel.exe
        183⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Giqlbqcc.exe
        
        C:\Windows\system32\Giqlbqcc.exe
        184⤵
        Drops file in System32 directory
        
        PID:1136
        
        C:\Windows\SysWOW64\Hbpgle32.exe
        
        C:\Windows\system32\Hbpgle32.exe
        185⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Hodgei32.exe
        
        C:\Windows\system32\Hodgei32.exe
        186⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Hfnpacjb.exe
        
        C:\Windows\system32\Hfnpacjb.exe
        187⤵
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Hkkhjj32.exe
        
        C:\Windows\system32\Hkkhjj32.exe
        188⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Ifplgc32.exe
        
        C:\Windows\system32\Ifplgc32.exe
        189⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\Jehoemmb.exe
        
        C:\Windows\system32\Jehoemmb.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5332
        
        C:\Windows\SysWOW64\Klbgag32.exe
        
        C:\Windows\system32\Klbgag32.exe
        191⤵
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Kblpnall.exe
        
        C:\Windows\system32\Kblpnall.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\Kmbdkj32.exe
        
        C:\Windows\system32\Kmbdkj32.exe
        193⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Kboldq32.exe
        
        C:\Windows\system32\Kboldq32.exe
        194⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\Ncdgmkio.exe
        
        C:\Windows\system32\Ncdgmkio.exe
        195⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Njnpie32.exe
        
        C:\Windows\system32\Njnpie32.exe
        196⤵
        Drops file in System32 directory
        
        PID:4588
        
        C:\Windows\SysWOW64\Ngbpbjoe.exe
        
        C:\Windows\system32\Ngbpbjoe.exe
        197⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Nnlhod32.exe
        
        C:\Windows\system32\Nnlhod32.exe
        198⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\Nciahk32.exe
        
        C:\Windows\system32\Nciahk32.exe
        199⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Onneeceo.exe
        
        C:\Windows\system32\Onneeceo.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3556
        
        C:\Windows\SysWOW64\Ocdqcikl.exe
        
        C:\Windows\system32\Ocdqcikl.exe
        201⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\Pnjeqbkb.exe
        
        C:\Windows\system32\Pnjeqbkb.exe
        202⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Pddmml32.exe
        
        C:\Windows\system32\Pddmml32.exe
        203⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Pfeiedhm.exe
        
        C:\Windows\system32\Pfeiedhm.exe
        204⤵
        Modifies registry class
        
        PID:6128
        
        C:\Windows\SysWOW64\Qjjhla32.exe
        
        C:\Windows\system32\Qjjhla32.exe
        205⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\Qdpmij32.exe
        
        C:\Windows\system32\Qdpmij32.exe
        206⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Ampkil32.exe
        
        C:\Windows\system32\Ampkil32.exe
        207⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Ageofe32.exe
        
        C:\Windows\system32\Ageofe32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6260
        
        C:\Windows\SysWOW64\Aancojgn.exe
        
        C:\Windows\system32\Aancojgn.exe
        209⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Agglld32.exe
        
        C:\Windows\system32\Agglld32.exe
        210⤵
        Drops file in System32 directory
        
        PID:6344
        
        C:\Windows\SysWOW64\Amdddkma.exe
        
        C:\Windows\system32\Amdddkma.exe
        211⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Cdcobb32.exe
        
        C:\Windows\system32\Cdcobb32.exe
        212⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Cagolf32.exe
        
        C:\Windows\system32\Cagolf32.exe
        213⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Dajlafon.exe
        
        C:\Windows\system32\Dajlafon.exe
        214⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Dhcdnq32.exe
        
        C:\Windows\system32\Dhcdnq32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6640
        
        C:\Windows\SysWOW64\Egbdekcg.exe
        
        C:\Windows\system32\Egbdekcg.exe
        216⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Emllbe32.exe
        
        C:\Windows\system32\Emllbe32.exe
        217⤵
        Drops file in System32 directory
        
        PID:6748
        
        C:\Windows\SysWOW64\Egdqkk32.exe
        
        C:\Windows\system32\Egdqkk32.exe
        218⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Edhado32.exe
        
        C:\Windows\system32\Edhado32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6884
        
        C:\Windows\SysWOW64\Ekbiaigk.exe
        
        C:\Windows\system32\Ekbiaigk.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6928
        
        C:\Windows\SysWOW64\Eehnnb32.exe
        
        C:\Windows\system32\Eehnnb32.exe
        221⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Egijfjmp.exe
        
        C:\Windows\system32\Egijfjmp.exe
        222⤵
        Modifies registry class
        
        PID:7008
        
        C:\Windows\SysWOW64\Emcbcd32.exe
        
        C:\Windows\system32\Emcbcd32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7052
        
        C:\Windows\SysWOW64\Edmjpoli.exe
        
        C:\Windows\system32\Edmjpoli.exe
        224⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Fobomglo.exe
        
        C:\Windows\system32\Fobomglo.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7140
        
        C:\Windows\SysWOW64\Fdpgen32.exe
        
        C:\Windows\system32\Fdpgen32.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6160
        
        C:\Windows\SysWOW64\Fnhlndqg.exe
        
        C:\Windows\system32\Fnhlndqg.exe
        227⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Fdbdkn32.exe
        
        C:\Windows\system32\Fdbdkn32.exe
        228⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Foghhg32.exe
        
        C:\Windows\system32\Foghhg32.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6328
        
        C:\Windows\SysWOW64\Feapdaof.exe
        
        C:\Windows\system32\Feapdaof.exe
        230⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\Gamjea32.exe
        
        C:\Windows\system32\Gamjea32.exe
        231⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Ghklmk32.exe
        
        C:\Windows\system32\Ghklmk32.exe
        232⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Goediekj.exe
        
        C:\Windows\system32\Goediekj.exe
        233⤵
        Drops file in System32 directory
        
        PID:2132
        
        C:\Windows\SysWOW64\Gfomfo32.exe
        
        C:\Windows\system32\Gfomfo32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6560
        
        C:\Windows\SysWOW64\Gklenf32.exe
        
        C:\Windows\system32\Gklenf32.exe
        235⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Hkobdeok.exe
        
        C:\Windows\system32\Hkobdeok.exe
        236⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Hbppaopp.exe
        
        C:\Windows\system32\Hbppaopp.exe
        237⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Hhihnihm.exe
        
        C:\Windows\system32\Hhihnihm.exe
        238⤵
        Modifies registry class
        
        PID:1384
        
        C:\Windows\SysWOW64\Hnfafpfd.exe
        
        C:\Windows\system32\Hnfafpfd.exe
        239⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Ihlechfj.exe
        
        C:\Windows\system32\Ihlechfj.exe
        240⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Ikcdfbmc.exe
        
        C:\Windows\system32\Ikcdfbmc.exe
        241⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Ifihckmi.exe
        
        C:\Windows\system32\Ifihckmi.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7124
        
        C:\Windows\SysWOW64\Jkfakb32.exe
        
        C:\Windows\system32\Jkfakb32.exe
        243⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Kejepfgd.exe
        
        C:\Windows\system32\Kejepfgd.exe
        244⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Keonke32.exe
        
        C:\Windows\system32\Keonke32.exe
        245⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Kngcdkjo.exe
        
        C:\Windows\system32\Kngcdkjo.exe
        246⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\Kpfonnab.exe
        
        C:\Windows\system32\Kpfonnab.exe
        247⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Lechfeoi.exe
        
        C:\Windows\system32\Lechfeoi.exe
        248⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Lnlloj32.exe
        
        C:\Windows\system32\Lnlloj32.exe
        249⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Llpmhodc.exe
        
        C:\Windows\system32\Llpmhodc.exe
        250⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Lbjeei32.exe
        
        C:\Windows\system32\Lbjeei32.exe
        251⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Lhfmmp32.exe
        
        C:\Windows\system32\Lhfmmp32.exe
        252⤵
        Modifies registry class
        
        PID:4204
        
        C:\Windows\SysWOW64\Lfgnkgbf.exe
        
        C:\Windows\system32\Lfgnkgbf.exe
        253⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Lbnnphhk.exe
        
        C:\Windows\system32\Lbnnphhk.exe
        254⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Lihfmb32.exe
        
        C:\Windows\system32\Lihfmb32.exe
        255⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Loeoei32.exe
        
        C:\Windows\system32\Loeoei32.exe
        256⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Mikcbb32.exe
        
        C:\Windows\system32\Mikcbb32.exe
        257⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Moglkikl.exe
        
        C:\Windows\system32\Moglkikl.exe
        258⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Mimphakb.exe
        
        C:\Windows\system32\Mimphakb.exe
        259⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Mpghel32.exe
        
        C:\Windows\system32\Mpghel32.exe
        260⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5860
        
        C:\Windows\SysWOW64\Medqmb32.exe
        
        C:\Windows\system32\Medqmb32.exe
        261⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Mpiejkql.exe
        
        C:\Windows\system32\Mpiejkql.exe
        262⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Nhicjm32.exe
        
        C:\Windows\system32\Nhicjm32.exe
        263⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Nboggf32.exe
        
        C:\Windows\system32\Nboggf32.exe
        264⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Niipdpae.exe
        
        C:\Windows\system32\Niipdpae.exe
        265⤵
        Drops file in System32 directory
        
        PID:6912
        
        C:\Windows\SysWOW64\Nbadmege.exe
        
        C:\Windows\system32\Nbadmege.exe
        266⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Niklip32.exe
        
        C:\Windows\system32\Niklip32.exe
        267⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Nhbfpl32.exe
        
        C:\Windows\system32\Nhbfpl32.exe
        268⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\Oeffip32.exe
        
        C:\Windows\system32\Oeffip32.exe
        269⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\Oplkgi32.exe
        
        C:\Windows\system32\Oplkgi32.exe
        270⤵
        Modifies registry class
        
        PID:3388
        
        C:\Windows\SysWOW64\Ogfccchd.exe
        
        C:\Windows\system32\Ogfccchd.exe
        271⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\Ohgokknb.exe
        
        C:\Windows\system32\Ohgokknb.exe
        272⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Ooaghe32.exe
        
        C:\Windows\system32\Ooaghe32.exe
        273⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Oekpdoll.exe
        
        C:\Windows\system32\Oekpdoll.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6772
        
        C:\Windows\SysWOW64\Ohnelj32.exe
        
        C:\Windows\system32\Ohnelj32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5380
        
        C:\Windows\SysWOW64\Pllnbh32.exe
        
        C:\Windows\system32\Pllnbh32.exe
        276⤵
        
        PID:532
        
        C:\Windows\SysWOW64\Pgaboa32.exe
        
        C:\Windows\system32\Pgaboa32.exe
        277⤵
        Drops file in System32 directory
        
        PID:1964
        
        C:\Windows\SysWOW64\Ppjghgdg.exe
        
        C:\Windows\system32\Ppjghgdg.exe
        278⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\Plagmh32.exe
        
        C:\Windows\system32\Plagmh32.exe
        279⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Pgfljqia.exe
        
        C:\Windows\system32\Pgfljqia.exe
        280⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Plcdbghi.exe
        
        C:\Windows\system32\Plcdbghi.exe
        281⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Pgihppgo.exe
        
        C:\Windows\system32\Pgihppgo.exe
        282⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\Qodmdb32.exe
        
        C:\Windows\system32\Qodmdb32.exe
        283⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Qjiaak32.exe
        
        C:\Windows\system32\Qjiaak32.exe
        284⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Amjjcf32.exe
        
        C:\Windows\system32\Amjjcf32.exe
        285⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Ajqgbjoh.exe
        
        C:\Windows\system32\Ajqgbjoh.exe
        286⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Agdhln32.exe
        
        C:\Windows\system32\Agdhln32.exe
        287⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Bmfjodgc.exe
        
        C:\Windows\system32\Bmfjodgc.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5392
        
        C:\Windows\SysWOW64\Bimkde32.exe
        
        C:\Windows\system32\Bimkde32.exe
        289⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Bidqddgp.exe
        
        C:\Windows\system32\Bidqddgp.exe
        290⤵
        
        PID:456
        
        C:\Windows\SysWOW64\Cfhani32.exe
        
        C:\Windows\system32\Cfhani32.exe
        291⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\Cclagm32.exe
        
        C:\Windows\system32\Cclagm32.exe
        292⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Cmdfpbkc.exe
        
        C:\Windows\system32\Cmdfpbkc.exe
        293⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Cgijnk32.exe
        
        C:\Windows\system32\Cgijnk32.exe
        294⤵
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Dakampio.exe
        
        C:\Windows\system32\Dakampio.exe
        295⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\Dhejij32.exe
        
        C:\Windows\system32\Dhejij32.exe
        296⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\Dpqonl32.exe
        
        C:\Windows\system32\Dpqonl32.exe
        297⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Djfckenm.exe
        
        C:\Windows\system32\Djfckenm.exe
        298⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\Dapkho32.exe
        
        C:\Windows\system32\Dapkho32.exe
        299⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Einmaaqb.exe
        
        C:\Windows\system32\Einmaaqb.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6364
        
        C:\Windows\SysWOW64\Efamkepl.exe
        
        C:\Windows\system32\Efamkepl.exe
        301⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Eagahnob.exe
        
        C:\Windows\system32\Eagahnob.exe
        302⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\Ehaieh32.exe
        
        C:\Windows\system32\Ehaieh32.exe
        303⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Eibfmp32.exe
        
        C:\Windows\system32\Eibfmp32.exe
        304⤵
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\SysWOW64\Eidbbp32.exe
        
        C:\Windows\system32\Eidbbp32.exe
        305⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Edjgpi32.exe
        
        C:\Windows\system32\Edjgpi32.exe
        306⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Ekdolcbm.exe
        
        C:\Windows\system32\Ekdolcbm.exe
        307⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\Fpagdj32.exe
        
        C:\Windows\system32\Fpagdj32.exe
        308⤵
        Modifies registry class
        
        PID:4760
        
        C:\Windows\SysWOW64\Ffkpadga.exe
        
        C:\Windows\system32\Ffkpadga.exe
        309⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Fmehnn32.exe
        
        C:\Windows\system32\Fmehnn32.exe
        310⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Fdopkhfk.exe
        
        C:\Windows\system32\Fdopkhfk.exe
        311⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Fineho32.exe
        
        C:\Windows\system32\Fineho32.exe
        312⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Fphneijl.exe
        
        C:\Windows\system32\Fphneijl.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7216
        
        C:\Windows\SysWOW64\Fipbnn32.exe
        
        C:\Windows\system32\Fipbnn32.exe
        314⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Fpjjkh32.exe
        
        C:\Windows\system32\Fpjjkh32.exe
        315⤵
        Modifies registry class
        
        PID:7300
        
        C:\Windows\SysWOW64\Gpodfh32.exe
        
        C:\Windows\system32\Gpodfh32.exe
        316⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Ggilbb32.exe
        
        C:\Windows\system32\Ggilbb32.exe
        317⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7376
        
        C:\Windows\SysWOW64\Gmcdolbn.exe
        
        C:\Windows\system32\Gmcdolbn.exe
        318⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Gneaelqk.exe
        
        C:\Windows\system32\Gneaelqk.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7460
        
        C:\Windows\SysWOW64\Ggnenagl.exe
        
        C:\Windows\system32\Ggnenagl.exe
        320⤵
        Drops file in System32 directory
        
        PID:7500
        
        C:\Windows\SysWOW64\Gdafgefe.exe
        
        C:\Windows\system32\Gdafgefe.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7548
        
        C:\Windows\SysWOW64\Hkgnpn32.exe
        
        C:\Windows\system32\Hkgnpn32.exe
        322⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Ihknibbo.exe
        
        C:\Windows\system32\Ihknibbo.exe
        323⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Idbonc32.exe
        
        C:\Windows\system32\Idbonc32.exe
        324⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Ijogfj32.exe
        
        C:\Windows\system32\Ijogfj32.exe
        325⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Iddlccfp.exe
        
        C:\Windows\system32\Iddlccfp.exe
        326⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Inombh32.exe
        
        C:\Windows\system32\Inombh32.exe
        327⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Ikcmklih.exe
        
        C:\Windows\system32\Ikcmklih.exe
        328⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Jqpfccgo.exe
        
        C:\Windows\system32\Jqpfccgo.exe
        329⤵
        Modifies registry class
        
        PID:7876
        
        C:\Windows\SysWOW64\Jkejalge.exe
        
        C:\Windows\system32\Jkejalge.exe
        330⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Jhijjp32.exe
        
        C:\Windows\system32\Jhijjp32.exe
        331⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Kjffngap.exe
        
        C:\Windows\system32\Kjffngap.exe
        332⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Kelkkpae.exe
        
        C:\Windows\system32\Kelkkpae.exe
        333⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Kjhccf32.exe
        
        C:\Windows\system32\Kjhccf32.exe
        334⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Kabkpqgj.exe
        
        C:\Windows\system32\Kabkpqgj.exe
        335⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Kgopbj32.exe
        
        C:\Windows\system32\Kgopbj32.exe
        336⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Lbgaecjg.exe
        
        C:\Windows\system32\Lbgaecjg.exe
        337⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Ljbfiegb.exe
        
        C:\Windows\system32\Ljbfiegb.exe
        338⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Lnpopcni.exe
        
        C:\Windows\system32\Lnpopcni.exe
        339⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Lhhchi32.exe
        
        C:\Windows\system32\Lhhchi32.exe
        340⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\Mecjbl32.exe
        
        C:\Windows\system32\Mecjbl32.exe
        341⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Mjpbkc32.exe
        
        C:\Windows\system32\Mjpbkc32.exe
        342⤵
        Modifies registry class
        
        PID:7484
        
        C:\Windows\SysWOW64\Mlooef32.exe
        
        C:\Windows\system32\Mlooef32.exe
        343⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Malgmm32.exe
        
        C:\Windows\system32\Malgmm32.exe
        344⤵
        Drops file in System32 directory
        
        PID:7620
        
        C:\Windows\SysWOW64\Nophfa32.exe
        
        C:\Windows\system32\Nophfa32.exe
        345⤵
        Drops file in System32 directory
        
        PID:7700
        
        C:\Windows\SysWOW64\Nifldj32.exe
        
        C:\Windows\system32\Nifldj32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7736
        
        C:\Windows\SysWOW64\Nbnpmp32.exe
        
        C:\Windows\system32\Nbnpmp32.exe
        347⤵
        
        PID:800
        
        C:\Windows\SysWOW64\Nacmnlkd.exe
        
        C:\Windows\system32\Nacmnlkd.exe
        348⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Nlknqd32.exe
        
        C:\Windows\system32\Nlknqd32.exe
        349⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Oeccijoh.exe
        
        C:\Windows\system32\Oeccijoh.exe
        350⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\Olnkfd32.exe
        
        C:\Windows\system32\Olnkfd32.exe
        351⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Oidhehcl.exe
        
        C:\Windows\system32\Oidhehcl.exe
        352⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Okgabpgg.exe
        
        C:\Windows\system32\Okgabpgg.exe
        353⤵
        Drops file in System32 directory
        
        PID:3196
        
        C:\Windows\SysWOW64\Oaajoj32.exe
        
        C:\Windows\system32\Oaajoj32.exe
        354⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Olgnlb32.exe
        
        C:\Windows\system32\Olgnlb32.exe
        355⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Obafim32.exe
        
        C:\Windows\system32\Obafim32.exe
        356⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Phnoac32.exe
        
        C:\Windows\system32\Phnoac32.exe
        357⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Pcepdl32.exe
        
        C:\Windows\system32\Pcepdl32.exe
        358⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Phbhlcpi.exe
        
        C:\Windows\system32\Phbhlcpi.exe
        359⤵
        Modifies registry class
        
        PID:7356
        
        C:\Windows\SysWOW64\Polpim32.exe
        
        C:\Windows\system32\Polpim32.exe
        360⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Pefhfgoc.exe
        
        C:\Windows\system32\Pefhfgoc.exe
        361⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Phgagb32.exe
        
        C:\Windows\system32\Phgagb32.exe
        362⤵
        Modifies registry class
        
        PID:7584
        
        C:\Windows\SysWOW64\Qaofphbd.exe
        
        C:\Windows\system32\Qaofphbd.exe
        363⤵
        Modifies registry class
        
        PID:7684
        
        C:\Windows\SysWOW64\Qlejnqbj.exe
        
        C:\Windows\system32\Qlejnqbj.exe
        364⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Qaabfgpa.exe
        
        C:\Windows\system32\Qaabfgpa.exe
        365⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Qkjgomgb.exe
        
        C:\Windows\system32\Qkjgomgb.exe
        366⤵
        Modifies registry class
        
        PID:5772
        
        C:\Windows\SysWOW64\Ajkgmd32.exe
        
        C:\Windows\system32\Ajkgmd32.exe
        367⤵
        Modifies registry class
        
        PID:2636
        
        C:\Windows\SysWOW64\Aklddmep.exe
        
        C:\Windows\system32\Aklddmep.exe
        368⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\Aebhaede.exe
        
        C:\Windows\system32\Aebhaede.exe
        369⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Ahpdnaci.exe
        
        C:\Windows\system32\Ahpdnaci.exe
        370⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Afddge32.exe
        
        C:\Windows\system32\Afddge32.exe
        371⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Alnmdojp.exe
        
        C:\Windows\system32\Alnmdojp.exe
        372⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Afgame32.exe
        
        C:\Windows\system32\Afgame32.exe
        373⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Bhldio32.exe
        
        C:\Windows\system32\Bhldio32.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7368
        
        C:\Windows\SysWOW64\Bkmmkj32.exe
        
        C:\Windows\system32\Bkmmkj32.exe
        375⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Bbgehd32.exe
        
        C:\Windows\system32\Bbgehd32.exe
        376⤵
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Bkoiqjdj.exe
        
        C:\Windows\system32\Bkoiqjdj.exe
        377⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Bfenncdp.exe
        
        C:\Windows\system32\Bfenncdp.exe
        378⤵
        Drops file in System32 directory
        
        PID:7828
        
        C:\Windows\SysWOW64\Ckaffjbg.exe
        
        C:\Windows\system32\Ckaffjbg.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7860
        
        C:\Windows\SysWOW64\Cbkncd32.exe
        
        C:\Windows\system32\Cbkncd32.exe
        380⤵
        Modifies registry class
        
        PID:7912
        
        C:\Windows\SysWOW64\Ckdcli32.exe
        
        C:\Windows\system32\Ckdcli32.exe
        381⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Cbnkhcha.exe
        
        C:\Windows\system32\Cbnkhcha.exe
        382⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Ccpdhfmb.exe
        
        C:\Windows\system32\Ccpdhfmb.exe
        383⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\Cilmpmki.exe
        
        C:\Windows\system32\Cilmpmki.exe
        384⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\Cioifm32.exe
        
        C:\Windows\system32\Cioifm32.exe
        385⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\Dcdnce32.exe
        
        C:\Windows\system32\Dcdnce32.exe
        386⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Djnfppqi.exe
        
        C:\Windows\system32\Djnfppqi.exe
        387⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Dpknhfoq.exe
        
        C:\Windows\system32\Dpknhfoq.exe
        388⤵
        Drops file in System32 directory
        
        PID:3868
        
        C:\Windows\SysWOW64\Djqbeonf.exe
        
        C:\Windows\system32\Djqbeonf.exe
        389⤵
        Drops file in System32 directory
        
        PID:6136
        
        C:\Windows\SysWOW64\Dcigneeg.exe
        
        C:\Windows\system32\Dcigneeg.exe
        390⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Djcoko32.exe
        
        C:\Windows\system32\Djcoko32.exe
        391⤵
        Modifies registry class
        
        PID:5236
        
        C:\Windows\SysWOW64\Dldlbgbb.exe
        
        C:\Windows\system32\Dldlbgbb.exe
        392⤵
        
        PID:876
        
        C:\Windows\SysWOW64\Emphhhoh.exe
        
        C:\Windows\system32\Emphhhoh.exe
        393⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Eblpqono.exe
        
        C:\Windows\system32\Eblpqono.exe
        394⤵
        Drops file in System32 directory
        
        PID:6088
        
        C:\Windows\SysWOW64\Fihecici.exe
        
        C:\Windows\system32\Fihecici.exe
        395⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Fikbhiaf.exe
        
        C:\Windows\system32\Fikbhiaf.exe
        396⤵
        Drops file in System32 directory
        
        PID:7668
        
        C:\Windows\SysWOW64\Glgjfb32.exe
        
        C:\Windows\system32\Glgjfb32.exe
        397⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Gikkof32.exe
        
        C:\Windows\system32\Gikkof32.exe
        398⤵
        Drops file in System32 directory
        
        PID:5716
        
        C:\Windows\SysWOW64\Hdhemn32.exe
        
        C:\Windows\system32\Hdhemn32.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4256
        
        C:\Windows\SysWOW64\Hdjbcnjo.exe
        
        C:\Windows\system32\Hdjbcnjo.exe
        400⤵
        
        PID:844
        
        C:\Windows\SysWOW64\Hmbflc32.exe
        
        C:\Windows\system32\Hmbflc32.exe
        401⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\Igmgji32.exe
        
        C:\Windows\system32\Igmgji32.exe
        402⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Ingpgcmj.exe
        
        C:\Windows\system32\Ingpgcmj.exe
        403⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Icdhojka.exe
        
        C:\Windows\system32\Icdhojka.exe
        404⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Injmlbkh.exe
        
        C:\Windows\system32\Injmlbkh.exe
        405⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Igbaeh32.exe
        
        C:\Windows\system32\Igbaeh32.exe
        406⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Ikpjkf32.exe
        
        C:\Windows\system32\Ikpjkf32.exe
        407⤵
        Modifies registry class
        
        PID:7748
        
        C:\Windows\SysWOW64\Ipmbcm32.exe
        
        C:\Windows\system32\Ipmbcm32.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5916
        
        C:\Windows\SysWOW64\Jggjpgmc.exe
        
        C:\Windows\system32\Jggjpgmc.exe
        409⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Jnqbmadp.exe
        
        C:\Windows\system32\Jnqbmadp.exe
        410⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\Jgigfg32.exe
        
        C:\Windows\system32\Jgigfg32.exe
        411⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Jncobabm.exe
        
        C:\Windows\system32\Jncobabm.exe
        412⤵
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Jdmgok32.exe
        
        C:\Windows\system32\Jdmgok32.exe
        413⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Jjjpgb32.exe
        
        C:\Windows\system32\Jjjpgb32.exe
        414⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Jdodekhg.exe
        
        C:\Windows\system32\Jdodekhg.exe
        415⤵
        Drops file in System32 directory
        
        PID:5780
        
        C:\Windows\SysWOW64\Jkimae32.exe
        
        C:\Windows\system32\Jkimae32.exe
        416⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Jdaajkfd.exe
        
        C:\Windows\system32\Jdaajkfd.exe
        417⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Jkligd32.exe
        
        C:\Windows\system32\Jkligd32.exe
        418⤵
        
        PID:548
        
        C:\Windows\SysWOW64\Jlmfomcp.exe
        
        C:\Windows\system32\Jlmfomcp.exe
        419⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Kkelmc32.exe
        
        C:\Windows\system32\Kkelmc32.exe
        420⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Kmfhelke.exe
        
        C:\Windows\system32\Kmfhelke.exe
        421⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\Kglmbd32.exe
        
        C:\Windows\system32\Kglmbd32.exe
        422⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Lmkbpk32.exe
        
        C:\Windows\system32\Lmkbpk32.exe
        423⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Lcejmeol.exe
        
        C:\Windows\system32\Lcejmeol.exe
        424⤵
        Drops file in System32 directory
        
        PID:5980
        
        C:\Windows\SysWOW64\Lmmoekem.exe
        
        C:\Windows\system32\Lmmoekem.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1640
        
        C:\Windows\SysWOW64\Ljaooodf.exe
        
        C:\Windows\system32\Ljaooodf.exe
        426⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Ljcldo32.exe
        
        C:\Windows\system32\Ljcldo32.exe
        427⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Lclpmdhd.exe
        
        C:\Windows\system32\Lclpmdhd.exe
        428⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Mmdefi32.exe
        
        C:\Windows\system32\Mmdefi32.exe
        429⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Mgjicb32.exe
        
        C:\Windows\system32\Mgjicb32.exe
        430⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Mmfalimb.exe
        
        C:\Windows\system32\Mmfalimb.exe
        431⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\Mnfnfl32.exe
        
        C:\Windows\system32\Mnfnfl32.exe
        432⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Mkjnop32.exe
        
        C:\Windows\system32\Mkjnop32.exe
        433⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Meepne32.exe
        
        C:\Windows\system32\Meepne32.exe
        434⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Mjahfl32.exe
        
        C:\Windows\system32\Mjahfl32.exe
        435⤵
        
        PID:996
        
        C:\Windows\SysWOW64\Nnpalk32.exe
        
        C:\Windows\system32\Nnpalk32.exe
        436⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Nclida32.exe
        
        C:\Windows\system32\Nclida32.exe
        437⤵
        Drops file in System32 directory
        
        PID:8228
        
        C:\Windows\SysWOW64\Nmenmgab.exe
        
        C:\Windows\system32\Nmenmgab.exe
        438⤵
        Modifies registry class
        
        PID:8268
        
        C:\Windows\SysWOW64\Ncofjaho.exe
        
        C:\Windows\system32\Ncofjaho.exe
        439⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Nndjgjhe.exe
        
        C:\Windows\system32\Nndjgjhe.exe
        440⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8348
        
        C:\Windows\SysWOW64\Ndaboafl.exe
        
        C:\Windows\system32\Ndaboafl.exe
        441⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Onkphi32.exe
        
        C:\Windows\system32\Onkphi32.exe
        442⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Odhipp32.exe
        
        C:\Windows\system32\Odhipp32.exe
        443⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Onnmmipj.exe
        
        C:\Windows\system32\Onnmmipj.exe
        444⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Oldjlm32.exe
        
        C:\Windows\system32\Oldjlm32.exe
        445⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Oaqbdc32.exe
        
        C:\Windows\system32\Oaqbdc32.exe
        446⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Ohkkanbe.exe
        
        C:\Windows\system32\Ohkkanbe.exe
        447⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Pacojc32.exe
        
        C:\Windows\system32\Pacojc32.exe
        448⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Phmhgmpc.exe
        
        C:\Windows\system32\Phmhgmpc.exe
        449⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Paelpcgc.exe
        
        C:\Windows\system32\Paelpcgc.exe
        450⤵
        Modifies registry class
        
        PID:8788
        
        C:\Windows\SysWOW64\Phodlm32.exe
        
        C:\Windows\system32\Phodlm32.exe
        451⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Poimigfm.exe
        
        C:\Windows\system32\Poimigfm.exe
        452⤵
        Drops file in System32 directory
        
        PID:8880
        
        C:\Windows\SysWOW64\Pecefa32.exe
        
        C:\Windows\system32\Pecefa32.exe
        453⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Poliog32.exe
        
        C:\Windows\system32\Poliog32.exe
        454⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Phdngljk.exe
        
        C:\Windows\system32\Phdngljk.exe
        455⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Pmafpchb.exe
        
        C:\Windows\system32\Pmafpchb.exe
        456⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Pdkolm32.exe
        
        C:\Windows\system32\Pdkolm32.exe
        457⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Qdmkbmnl.exe
        
        C:\Windows\system32\Qdmkbmnl.exe
        458⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9128
        
        C:\Windows\SysWOW64\Qoboofnb.exe
        
        C:\Windows\system32\Qoboofnb.exe
        459⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Qemhlp32.exe
        
        C:\Windows\system32\Qemhlp32.exe
        460⤵
        Drops file in System32 directory
        
        PID:9208
        
        C:\Windows\SysWOW64\Amhlpb32.exe
        
        C:\Windows\system32\Amhlpb32.exe
        461⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Ahmqnkbp.exe
        
        C:\Windows\system32\Ahmqnkbp.exe
        462⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Addabl32.exe
        
        C:\Windows\system32\Addabl32.exe
        463⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Akniofoa.exe
        
        C:\Windows\system32\Akniofoa.exe
        464⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Aecnmo32.exe
        
        C:\Windows\system32\Aecnmo32.exe
        465⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Aajoapdk.exe
        
        C:\Windows\system32\Aajoapdk.exe
        466⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8516
        
        C:\Windows\SysWOW64\Aonokdce.exe
        
        C:\Windows\system32\Aonokdce.exe
        467⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\Bhgcdjje.exe
        
        C:\Windows\system32\Bhgcdjje.exe
        468⤵
        Modifies registry class
        
        PID:8548
        
        C:\Windows\SysWOW64\Bncllqhm.exe
        
        C:\Windows\system32\Bncllqhm.exe
        469⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Bhipiihc.exe
        
        C:\Windows\system32\Bhipiihc.exe
        470⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Bemqcngl.exe
        
        C:\Windows\system32\Bemqcngl.exe
        471⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Boeelcmm.exe
        
        C:\Windows\system32\Boeelcmm.exe
        472⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Beomhm32.exe
        
        C:\Windows\system32\Beomhm32.exe
        473⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Blieeglf.exe
        
        C:\Windows\system32\Blieeglf.exe
        474⤵
        Modifies registry class
        
        PID:8896
        
        C:\Windows\SysWOW64\Bafnmnjn.exe
        
        C:\Windows\system32\Bafnmnjn.exe
        475⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Bllbkg32.exe
        
        C:\Windows\system32\Bllbkg32.exe
        476⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Bnmobopb.exe
        
        C:\Windows\system32\Bnmobopb.exe
        477⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Ckaolcol.exe
        
        C:\Windows\system32\Ckaolcol.exe
        478⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9072
        
        C:\Windows\SysWOW64\Cakghn32.exe
        
        C:\Windows\system32\Cakghn32.exe
        479⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Clplff32.exe
        
        C:\Windows\system32\Clplff32.exe
        480⤵
        Modifies registry class
        
        PID:9196
        
        C:\Windows\SysWOW64\Cbmdnmdf.exe
        
        C:\Windows\system32\Cbmdnmdf.exe
        481⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5504
        
        C:\Windows\SysWOW64\Cbpacmbc.exe
        
        C:\Windows\system32\Cbpacmbc.exe
        482⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Cleeafbi.exe
        
        C:\Windows\system32\Cleeafbi.exe
        483⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Cbbnim32.exe
        
        C:\Windows\system32\Cbbnim32.exe
        484⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Cofnba32.exe
        
        C:\Windows\system32\Cofnba32.exe
        485⤵
        Modifies registry class
        
        PID:8500
        
        C:\Windows\SysWOW64\Dhnbkfek.exe
        
        C:\Windows\system32\Dhnbkfek.exe
        486⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3356
        
        C:\Windows\SysWOW64\Dohkhq32.exe
        
        C:\Windows\system32\Dohkhq32.exe
        487⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Dmcabd32.exe
        
        C:\Windows\system32\Dmcabd32.exe
        488⤵
        Drops file in System32 directory
        
        PID:6340
        
        C:\Windows\SysWOW64\Fimhcbkh.exe
        
        C:\Windows\system32\Fimhcbkh.exe
        489⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Gpnfak32.exe
        
        C:\Windows\system32\Gpnfak32.exe
        490⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8932
        
        C:\Windows\SysWOW64\Gejoib32.exe
        
        C:\Windows\system32\Gejoib32.exe
        491⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Gppcfk32.exe
        
        C:\Windows\system32\Gppcfk32.exe
        492⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Gemkobia.exe
        
        C:\Windows\system32\Gemkobia.exe
        493⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Gpbplkhh.exe
        
        C:\Windows\system32\Gpbplkhh.exe
        494⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Hfaaddlo.exe
        
        C:\Windows\system32\Hfaaddlo.exe
        495⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Hlpfak32.exe
        
        C:\Windows\system32\Hlpfak32.exe
        496⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Hbjonepq.exe
        
        C:\Windows\system32\Hbjonepq.exe
        497⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Hehkjpod.exe
        
        C:\Windows\system32\Hehkjpod.exe
        498⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Hpnohinj.exe
        
        C:\Windows\system32\Hpnohinj.exe
        499⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Hfhgdc32.exe
        
        C:\Windows\system32\Hfhgdc32.exe
        500⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Ilepmjdo.exe
        
        C:\Windows\system32\Ilepmjdo.exe
        501⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Ibohid32.exe
        
        C:\Windows\system32\Ibohid32.exe
        502⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6924
        
        C:\Windows\SysWOW64\Imdlgm32.exe
        
        C:\Windows\system32\Imdlgm32.exe
        503⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Ibadoc32.exe
        
        C:\Windows\system32\Ibadoc32.exe
        504⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Iikmlnae.exe
        
        C:\Windows\system32\Iikmlnae.exe
        505⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Ipeehhhb.exe
        
        C:\Windows\system32\Ipeehhhb.exe
        506⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Iimjan32.exe
        
        C:\Windows\system32\Iimjan32.exe
        507⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Icfnjcec.exe
        
        C:\Windows\system32\Icfnjcec.exe
        508⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Iipfgm32.exe
        
        C:\Windows\system32\Iipfgm32.exe
        509⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\Ipjocgdm.exe
        
        C:\Windows\system32\Ipjocgdm.exe
        510⤵
        Modifies registry class
        
        PID:3548
        
        C:\Windows\SysWOW64\Jlqohhja.exe
        
        C:\Windows\system32\Jlqohhja.exe
        511⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Jgfcfajg.exe
        
        C:\Windows\system32\Jgfcfajg.exe
        512⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Jmplbk32.exe
        
        C:\Windows\system32\Jmplbk32.exe
        513⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\Jghpkq32.exe
        
        C:\Windows\system32\Jghpkq32.exe
        514⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Jmbhhkoa.exe
        
        C:\Windows\system32\Jmbhhkoa.exe
        515⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8252
        
        C:\Windows\SysWOW64\Jocepc32.exe
        
        C:\Windows\system32\Jocepc32.exe
        516⤵
        Modifies registry class
        
        PID:6856
        
        C:\Windows\SysWOW64\Jndenjmo.exe
        
        C:\Windows\system32\Jndenjmo.exe
        517⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Jgmjfpco.exe
        
        C:\Windows\system32\Jgmjfpco.exe
        518⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Jpenoe32.exe
        
        C:\Windows\system32\Jpenoe32.exe
        519⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8856
        
        C:\Windows\SysWOW64\Jgoflpal.exe
        
        C:\Windows\system32\Jgoflpal.exe
        520⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Kllodfpd.exe
        
        C:\Windows\system32\Kllodfpd.exe
        521⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Kedcml32.exe
        
        C:\Windows\system32\Kedcml32.exe
        522⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\Kgdpgo32.exe
        
        C:\Windows\system32\Kgdpgo32.exe
        523⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Klahof32.exe
        
        C:\Windows\system32\Klahof32.exe
        524⤵
        Drops file in System32 directory
        
        PID:6480
        
        C:\Windows\SysWOW64\Kckqlpck.exe
        
        C:\Windows\system32\Kckqlpck.exe
        525⤵
        Drops file in System32 directory
        
        PID:8644
        
        C:\Windows\SysWOW64\Kjeiij32.exe
        
        C:\Windows\system32\Kjeiij32.exe
        526⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\Koaaaaip.exe
        
        C:\Windows\system32\Koaaaaip.exe
        527⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Kflink32.exe
        
        C:\Windows\system32\Kflink32.exe
        528⤵
        Drops file in System32 directory
        
        PID:7164
        
        C:\Windows\SysWOW64\Kpankd32.exe
        
        C:\Windows\system32\Kpankd32.exe
        529⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8952
        
        C:\Windows\SysWOW64\Kgkfhngo.exe
        
        C:\Windows\system32\Kgkfhngo.exe
        530⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Lnendhol.exe
        
        C:\Windows\system32\Lnendhol.exe
        531⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Lcbfmomc.exe
        
        C:\Windows\system32\Lcbfmomc.exe
        532⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Ljloii32.exe
        
        C:\Windows\system32\Ljloii32.exe
        533⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Lfbpnjjd.exe
        
        C:\Windows\system32\Lfbpnjjd.exe
        534⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Llmhkd32.exe
        
        C:\Windows\system32\Llmhkd32.exe
        535⤵
        Drops file in System32 directory
        
        PID:6872
        
        C:\Windows\SysWOW64\Lfeldj32.exe
        
        C:\Windows\system32\Lfeldj32.exe
        536⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Nnojad32.exe
        
        C:\Windows\system32\Nnojad32.exe
        537⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Nclbjk32.exe
        
        C:\Windows\system32\Nclbjk32.exe
        538⤵
        Modifies registry class
        
        PID:2728
        
        C:\Windows\SysWOW64\Njekfenc.exe
        
        C:\Windows\system32\Njekfenc.exe
        539⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Nmdgbamf.exe
        
        C:\Windows\system32\Nmdgbamf.exe
        540⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Ngikpjml.exe
        
        C:\Windows\system32\Ngikpjml.exe
        541⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Nfohafad.exe
        
        C:\Windows\system32\Nfohafad.exe
        542⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\Ojmqgd32.exe
        
        C:\Windows\system32\Ojmqgd32.exe
        543⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Oafido32.exe
        
        C:\Windows\system32\Oafido32.exe
        544⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7132
        
        C:\Windows\SysWOW64\Ogqaqigd.exe
        
        C:\Windows\system32\Ogqaqigd.exe
        545⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Ommjipel.exe
        
        C:\Windows\system32\Ommjipel.exe
        546⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Ogcnfheb.exe
        
        C:\Windows\system32\Ogcnfheb.exe
        547⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Ompfnoci.exe
        
        C:\Windows\system32\Ompfnoci.exe
        548⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Ogeklh32.exe
        
        C:\Windows\system32\Ogeklh32.exe
        549⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Opqopj32.exe
        
        C:\Windows\system32\Opqopj32.exe
        550⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Omdpio32.exe
        
        C:\Windows\system32\Omdpio32.exe
        551⤵
        Drops file in System32 directory
        
        PID:3144
        
        C:\Windows\SysWOW64\Pnfiia32.exe
        
        C:\Windows\system32\Pnfiia32.exe
        552⤵
        Modifies registry class
        
        PID:3944
        
        C:\Windows\SysWOW64\Pdcaahbk.exe
        
        C:\Windows\system32\Pdcaahbk.exe
        553⤵
        
        PID:408
        
        C:\Windows\SysWOW64\Pjmjnb32.exe
        
        C:\Windows\system32\Pjmjnb32.exe
        554⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\Pagbklae.exe
        
        C:\Windows\system32\Pagbklae.exe
        555⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Qhfcbfdl.exe
        
        C:\Windows\system32\Qhfcbfdl.exe
        556⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Qanhkk32.exe
        
        C:\Windows\system32\Qanhkk32.exe
        557⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Qhhphebj.exe
        
        C:\Windows\system32\Qhhphebj.exe
        558⤵
        Drops file in System32 directory
        
        PID:1180
        
        C:\Windows\SysWOW64\Apeabg32.exe
        
        C:\Windows\system32\Apeabg32.exe
        559⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4768
        
        C:\Windows\SysWOW64\Aogbpo32.exe
        
        C:\Windows\system32\Aogbpo32.exe
        560⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Aphngglp.exe
        
        C:\Windows\system32\Aphngglp.exe
        561⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\Ahofidlb.exe
        
        C:\Windows\system32\Ahofidlb.exe
        562⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Akpojpic.exe
        
        C:\Windows\system32\Akpojpic.exe
        563⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Apmhbf32.exe
        
        C:\Windows\system32\Apmhbf32.exe
        564⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\Agfpoqog.exe
        
        C:\Windows\system32\Agfpoqog.exe
        565⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\Baldmiom.exe
        
        C:\Windows\system32\Baldmiom.exe
        566⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\Bopefnnf.exe
        
        C:\Windows\system32\Bopefnnf.exe
        567⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6292
        
        C:\Windows\SysWOW64\Bnjkbi32.exe
        
        C:\Windows\system32\Bnjkbi32.exe
        568⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Cdhmjc32.exe
        
        C:\Windows\system32\Cdhmjc32.exe
        569⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Ckealm32.exe
        
        C:\Windows\system32\Ckealm32.exe
        570⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4276
        
        C:\Windows\SysWOW64\Caojigoh.exe
        
        C:\Windows\system32\Caojigoh.exe
        571⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\Cocjbkna.exe
        
        C:\Windows\system32\Cocjbkna.exe
        572⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Cdpckbli.exe
        
        C:\Windows\system32\Cdpckbli.exe
        573⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:436
        
        C:\Windows\SysWOW64\Doeghk32.exe
        
        C:\Windows\system32\Doeghk32.exe
        574⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6936
        
        C:\Windows\SysWOW64\Ddbppa32.exe
        
        C:\Windows\system32\Ddbppa32.exe
        575⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Dnjdigpf.exe
        
        C:\Windows\system32\Dnjdigpf.exe
        576⤵
        Modifies registry class
        
        PID:2920
        
        C:\Windows\SysWOW64\Dhphfppl.exe
        
        C:\Windows\system32\Dhphfppl.exe
        577⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Dhbelp32.exe
        
        C:\Windows\system32\Dhbelp32.exe
        578⤵
        Drops file in System32 directory
        
        PID:4056
        
        C:\Windows\SysWOW64\Eglkhk32.exe
        
        C:\Windows\system32\Eglkhk32.exe
        579⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\Edplapnf.exe
        
        C:\Windows\system32\Edplapnf.exe
        580⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Ebdlkdlp.exe
        
        C:\Windows\system32\Ebdlkdlp.exe
        581⤵
        Drops file in System32 directory
        
        PID:1900
        
        C:\Windows\SysWOW64\Enkmpe32.exe
        
        C:\Windows\system32\Enkmpe32.exe
        582⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4344
        
        C:\Windows\SysWOW64\Ekoniian.exe
        
        C:\Windows\system32\Ekoniian.exe
        583⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\Eqkfapoe.exe
        
        C:\Windows\system32\Eqkfapoe.exe
        584⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Fomfpg32.exe
        
        C:\Windows\system32\Fomfpg32.exe
        585⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\Fdiohnek.exe
        
        C:\Windows\system32\Fdiohnek.exe
        586⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Fkcgdh32.exe
        
        C:\Windows\system32\Fkcgdh32.exe
        587⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Fbmoabde.exe
        
        C:\Windows\system32\Fbmoabde.exe
        588⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Fkfcjh32.exe
        
        C:\Windows\system32\Fkfcjh32.exe
        589⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Fbplgbbb.exe
        
        C:\Windows\system32\Fbplgbbb.exe
        590⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5196
        
        C:\Windows\SysWOW64\Fkjmeggp.exe
        
        C:\Windows\system32\Fkjmeggp.exe
        591⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6892 -s 408
        592⤵
        Program crash
        
        PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3392 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:5860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6892 -ip 6892
1⤵
PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aekdolkj.exe

Filesize
128KB

MD5
3fa03c4905140d898a755c094a8084fd

SHA1
7583174c585eedc65c7aa92a034d0b01c984db8d

SHA256
75f49ef523a022c255ae8d321f4944e9f9a8ec35470e4ef2fdb7edf213079d3b

SHA512
f064639cafa865b77000c8a862d88adc5d8b3d737177d186eba8765a9c4d40bfdd36b9c1da9e4d93c407ab96104b9e95f4eeaf5de0cec148558d8609075fcede

Download Submit
C:\Windows\SysWOW64\Agdhln32.exe

Filesize
128KB

MD5
146f4a24cdbf9b5c8113df98d2e2040e

SHA1
0a4fc0f3321da3a7dec54742675b25fae1b545e6

SHA256
8610e70550c2adc5c97ef321224a300afa9c56cbf94ffe7aa1c435ed930646a6

SHA512
621a5c24027e21b0ea6291d1811e43382da0444ede9ffbacf1f12b41295fb0b10cd2604885e4a6ed9e95a619c79d8ebc019d505377cec48349995d1a9bb40c06

Download Submit
C:\Windows\SysWOW64\Ammnhilb.exe

Filesize
128KB

MD5
a62ff7e9a818340e157c75653d65d416

SHA1
ed38b1e9b429490251ecb1eecf95333b1da4b825

SHA256
a3f372dc69169d140fd2f2279a726b6e2541c5017ec12e79e734b2f86b7eb273

SHA512
76fb3374b194ca7be37dc059c9cdffb5963e7038c95b53ae0fcc55e3c0ce8a643aee03f66ab6c97a1c806ffdfd77ec5b25fc15fb8bd8ba7e3ac9e514766804b4

Download Submit
C:\Windows\SysWOW64\Aonokdce.exe

Filesize
128KB

MD5
cbd88501daf5f11d87bfd79697a803af

SHA1
a60b53e9601a80349318a0062214e4c309517c13

SHA256
68f53a7da73eac9fdafca3b5fa706936712f010341e195b00b39cf78df57016e

SHA512
ee0fbbe4b8f48d96fe24fae3f1f4207f80ccd115bca975e8518b5383554b2acdd53f559199b0d8bedab583621db98afed34d5ee287f97cc5f923d66e36663970

Download Submit
C:\Windows\SysWOW64\Cbmdnmdf.exe

Filesize
128KB

MD5
ff118a6ba53e6b53852812a4f2c29d0f

SHA1
3716ffa97fac789c2a25c345b68c341cfdb6f924

SHA256
71705bcad7cceb388038d7864764555130ff211df7f22ed56549866a99dc8323

SHA512
d532e94c4f23976b4b15fc95fb604fe398ce8d5b54c8ec95af5f012e359e8073f947a495e11a11d2a5effc19911105be11c34f50125d12466f91aa798b709894

Download Submit
C:\Windows\SysWOW64\Cgpcklpd.exe

Filesize
128KB

MD5
58fdf2b7058438448e940d6af03899d6

SHA1
0a39d46e23caa198c310cb69365ee18bf0a200d1

SHA256
77d7133d852986ccba7bbe1aa5983507fc8771bc195462f0b261625e2bf09859

SHA512
3d50c2bafe8330ea0ef9ca49579c148d9eefbcd83edf3e44a887727e95b4231a01773aa5b227f3452b837bd8130641e1b0688767410555a506a0a3bc240f57a6

Download Submit
C:\Windows\SysWOW64\Ciiaogon.exe

Filesize
128KB

MD5
ca5c88c22d12714113135cefc182df53

SHA1
cb5ad8ae38cb55647503ddcf00f5069c3f41958d

SHA256
48586eec9289ba887fa33faf13f76706802491a419c9d62a8b42dce72410c33d

SHA512
7cb2957fa6e87b9458db53f1969aea89d90d983406d9f0681a84a0937ab39bae79128bc951b898c2a6cbadb05ea7186f7cfb3cf4c257617db9cc14a38ac6c01f

Download Submit
C:\Windows\SysWOW64\Cpifeb32.exe

Filesize
128KB

MD5
59782cf371bf1f636df28a39236a8b64

SHA1
b35dadc9ede3611d11e041d6f66b795de7631821

SHA256
f24e9ad9fba9dee013ece57715b2e3ca995b0dec4a0811e319882720b0b200a3

SHA512
e4883a41182f9fc3025763ceebaad09c9743ccba5b6a7e321296435db0948fa3c9ac67956e1c9458595eb07dff6024f0ff4165db4435a87a7f20eb99aa4ebd44

Download Submit
C:\Windows\SysWOW64\Dllffa32.exe

Filesize
128KB

MD5
08bd6d77c0d82dead85a16a7d9abd4db

SHA1
e4a58867d39dc3ea3905f7106448f9812c2ad09c

SHA256
532c98521633fb486002c5be22e28e67c9041f55051350321a5c231593105458

SHA512
6c9485f71c3fafe6130fcea8578191c1046ae35c4c2b40aba6a5e1ed52a57d96a97b8adeb8ff98cbf329dd839224aed0f93fd760d33622fbeec7682db7f9ac63

Download Submit
C:\Windows\SysWOW64\Dlncla32.exe

Filesize
128KB

MD5
76b37baa25c46d651f86da47b5a370f0

SHA1
52b1f87aa399bae4d40a371b5407fb0fa0ed293a

SHA256
c76e4fe40a59908cfcf68f1d3e7655c5e347e9c418816136e228843865a66c9b

SHA512
56e6e0e6e1c84bd2336343cbf5fdf676c1e847ddbd2e74381d11c24251300167e8004f3ce93d582c0d4282f6a0d861d405e443f4d0f37bd73383fd020cd9454b

Download Submit
C:\Windows\SysWOW64\Dpllbp32.exe

Filesize
128KB

MD5
571e3b86fa556e433d2519383495e2cf

SHA1
27fde79ab79e489f45b8925ce4fdb32a8b086318

SHA256
df323447df3405e8a48438799a05599221c5d4b0fb465acf8f582d9d011f4f54

SHA512
47790feea644cc3f74580ca566db41681cc6b59f374dfeda0f6c9587a530a7373c6fc603a5bf7608d2f34e2da90c644b432a097ec15ca1d0269bd3b1d225e9c5

Download Submit
C:\Windows\SysWOW64\Dqhpjohb.exe

Filesize
128KB

MD5
c9e732862231148f0309104c4cde837a

SHA1
7a33c5d84ee7c8a75bb56f4c17aea0d6a3b868a9

SHA256
b8e2e8679907695146783898777c2369720d3113bfe8552d21b36aa18472b27b

SHA512
32d678379aa92beefa7c366388ab857c96c092360873689e394e7f2f19f48e197106527c63098bf1972b003aa75a75d9c57011ab71c3189394533cdf487f7c06

Download Submit
C:\Windows\SysWOW64\Ecidpiad.exe

Filesize
128KB

MD5
8ae995d393292512f5acff337c25e6de

SHA1
232ed0435f64668a113adffbc20f067c884e230e

SHA256
e2541c95641e500152319ed2f9858b7e8d5941aa6fd1864c6f9e1065c358b112

SHA512
2b2d36217d418c948c0854b460df31670b04c276b1261b1eb6a011d5a228f6130a4e14208b54cc91c9290d7ca7423d1fc0c5bc38474b2eb02ff2f6e79c166ad9

Download Submit
C:\Windows\SysWOW64\Emioab32.exe

Filesize
128KB

MD5
f64bcc8be5a971c028b19e17909cb6e7

SHA1
4a43bf9de4d457d3732f0b9e25c75f39fd1be4dc

SHA256
0c3949a12de102c9dea3a766e55905a48911a38fe0b30b77b06405cde8a2ca5c

SHA512
00f784ef7ca1ea18383b1f3cab3868f51b94d4fb1ee1b097ad1eea495c820931390cd2c721810e036dc297168d63e77ac1baf180b81cc202f2137f5d2f030e74

Download Submit
C:\Windows\SysWOW64\Enkmpe32.exe

Filesize
128KB

MD5
fde9814da94eb72e544c8560d01fae95

SHA1
f8001732ac032816d1c7e84060cadc762a0409ac

SHA256
529b039f275da34131709c27e2a8b61d2d833653d16dc4633a1754465e4b9cee

SHA512
27fae24712e7869748361bca56dff3603094dda7517810883a17011ce31ec97854d9faa65679850c1dd73f51b6ba8351e0de6667bda73d8a3c27734c7a13bd5e

Download Submit
C:\Windows\SysWOW64\Fdjnolfd.exe

Filesize
128KB

MD5
2771484af5cef1d939887a5befd8ffc2

SHA1
39cba9610e2efee3694d3a6105564174d162f048

SHA256
9a851938ebeea41a2b7d1166194467141b94c35388cea6cacb5ff97eb7e9b140

SHA512
4d845d289aa3bda20333c224ec102530faee798a71dccf3cb02271bca39648fecdac6b385490217494f1cb04cfa618475281e5717919b42f964c59cdb4ed74ed

Download Submit
C:\Windows\SysWOW64\Fhiphi32.exe

Filesize
128KB

MD5
0ec80235b461cd7fbf65c1059206f34b

SHA1
b1f3518b7459d299d0dbaf02c4398b1f52a61eef

SHA256
f476b84a758c358f8ca793e32033f4514c58ee303d80c16d0d82a17273a0dd2e

SHA512
c3f1ea3e13f45cdc487bc0fbd9e7daa7a98828843ceacbedc738a9b945937f0c09a7ae81ad9dcc8d2165c0e9d0d7f05f175f64d49cb05780829c7fdb26f8cdf6

Download Submit
C:\Windows\SysWOW64\Ggnenagl.exe

Filesize
128KB

MD5
183cb575e58205f0e8ce85a0f7950062

SHA1
e2ab6935c30e64ca4542369ccdd78b2be3701392

SHA256
83a5b9e436bd19e30e919c95ac9c123eaee7388259590645d00c39b2b1d47dd4

SHA512
712d4bfb13b8ece95e22d755af52f01c047f872be5fb97cfda7bf6a4e69538c8b60f2984b84044a5e1095d93fff589848bd409711e0f808eb1d2827ba3054363

Download Submit
C:\Windows\SysWOW64\Gmdoel32.exe

Filesize
128KB

MD5
c86e7ecbe6622f21ad299f40cfefbc57

SHA1
eba7edf7319cef89943de232cf96673b5ecd0aaa

SHA256
22699e4a4aa8f9148777454f722516b13bcdb4ceb68c026cf88756dec800d549

SHA512
1cfde61f0bd401118450b2fab39ea07c8fc21b15d8c43acf51b776401ae0cdcc137fc2d0631c98a7ff8648aee61e9ac14d59456c0471f56d816117272b7880c6

Download Submit
C:\Windows\SysWOW64\Gnckooob.exe

Filesize
128KB

MD5
b56475173dbce80e9f6561d895eef29b

SHA1
2b7e45bd30ef355e55a65630ad0291d57aa6cd2f

SHA256
bcd3b695d6e2317b6a067a0a936d99d13fe1ae6de6b841925da238f2d722b666

SHA512
fa61412fa463182b345247319fb1c03c222b920ff96dbf36582400b3eb974faab1c2cd13c23dcbbe21e31387400ad88ec0051be1481c78f2b4dc41ac00a955bd

Download Submit
C:\Windows\SysWOW64\Gqmnpk32.exe

Filesize
128KB

MD5
d3786e4f7cb8984af0d6f0eb8dc346ca

SHA1
6ade780b31aab8b1dc22aee093b131a2c66ea418

SHA256
eebe3bfed88b96a1e003bc00fe0d462a09f8d88805bbfc17e9bbb17ed4a0d06f

SHA512
d7ee027daa3e9b4ca32c85d09c8104f8a0be4e6486643ca7c85e3e925ce0987652a0e2d30002587fdfcb314b458661d6d4a4d3404113b46c015049c76e57ff42

Download Submit
C:\Windows\SysWOW64\Hdhemn32.exe

Filesize
128KB

MD5
92fcdcdf893908ba146e62f84d7b8f37

SHA1
643df9e4c3965afe5c67f2969a0f7220fcc7b1b3

SHA256
7dac308270a006e9d8ab5796c27ff258380d94454d6c3e4b1c280546ebf45a77

SHA512
a626fdbca2f87fb8f05191a4b4d72c1c5dea4328db58608e4dfcfe89b7bffe3492e6ac5b089aa463f87014a075e3f0fc4f22d9af4d9c88faee0fd0d05c936cf1

Download Submit
C:\Windows\SysWOW64\Hfamia32.exe

Filesize
128KB

MD5
5c3c6023650cf1754cc078204ce93d7b

SHA1
758315d63c60c5f73321e327c9f326c3ab1daceb

SHA256
f22e4464a1466fc618d4f3477e458235b844b40a563bcf2f813cb3dad5283813

SHA512
e82b0c3be1cfec16e52e49ac0142b5914763b1cef9a60875bc528ab7b9322d5e4f89c0be2f700485b73e3e136916ca4401d7e19f9443e66ac67be26f70a6a5ca

Download Submit
C:\Windows\SysWOW64\Hfhbipdb.exe

Filesize
128KB

MD5
9a2dd2794f3f5cc6d6a17cf7ec4b2295

SHA1
c9186e34946d1b96b0f04b5d0c6b211c1901fa2a

SHA256
2d7ad05c0f2a9d19e7a0e24ff60f0ccf6679d55563e3b6332caa4e7bb55a9fee

SHA512
a5f0e0b7682b80998641c3da685ea4cb65aa6b82e4b0eabbf77d1eb1f156c1e7e1c4c61ae2902eb86c18822e41f5c4f8d882243ee84ab760260a4307dc7abe56

Download Submit
C:\Windows\SysWOW64\Hmbflc32.exe

Filesize
128KB

MD5
11db33298058037a1d9bffc102390e84

SHA1
0da92eb306b8536f7979cfde3fb6f69e25bb22d1

SHA256
e5eca6bbc89805691b3299e4e8f99667989aa2fb58bcdc78b0dc378241d11a42

SHA512
c7d01e9dfc7b7195a08b614cbb2df342a1d48389dc4665fab764b312620603ed33845e1a5c84f91d515c218ddfa8c97da7ecc1849f2f7c91c4fd3dc89b83afc0

Download Submit
C:\Windows\SysWOW64\Hqimlihn.exe

Filesize
128KB

MD5
5e59918070a24c03ad99421443b21041

SHA1
9c23d9922861fbc6b0d12f6db06c4a6ddab2898b

SHA256
def7ea894f6d62ba6950b090eda37c15484e7afe461a07ab2a26387a93e26ade

SHA512
792884ad5d321c7110e0c0b53aad55f80a615b15998eb758d263db10cd95caaff83aed6e59d6adb493ad65f9a859e477711f6aacfaf8b50e5e45f911a8822e2c

Download Submit
C:\Windows\SysWOW64\Icgbob32.exe

Filesize
128KB

MD5
d16add9ad78f7b5aba098fdccde3ec3f

SHA1
ba0bcd0e5d7228f65c66a08c4df595d3af816cd8

SHA256
e8c1588cff0e652eb3065f69632604324586d280e13487617c4301f538673566

SHA512
5f8b2171b0944b991acf9e5ff827bc806e020a0312247a9493ddc261a6d77f05ca77fa99d2d589b34aac3db50880440a54f0e525f40793b85d782cbbeec12a1d

Download Submit
C:\Windows\SysWOW64\Igjlibib.exe

Filesize
128KB

MD5
22df1400204a061348fc8854425376e9

SHA1
758c2179fd5680feb506ad4a7518fd8656785a0a

SHA256
ce6834c9ecd314b42ca6012bb5a90e808eab98579d3f1a33acdc6c068254b649

SHA512
532c3ddd1ebc8d09f67e0d4d5490911a6d0c8debcb849df8d77b6e8a4ebe9bdbb183f37790356229415b697442ad1d0cd97c32c2aea84b943698190da0f4087e

Download Submit
C:\Windows\SysWOW64\Ihknibbo.exe

Filesize
128KB

MD5
01367499255e541bfc9b27dea7a1f63e

SHA1
7e08c030177208c65e2faca7912a1c425335742f

SHA256
6da4f15da3cc1f5ec0265a4023352cf68576d121bab94402f1496737c45418b2

SHA512
90fe5652507ea08ab0931af41c5eff2b334dbeb6977516f0c9529b07c5ec8354a813469902084f4b7229aa9d44a4aa5c5e0d30cf465981dfe44d1708926d51fd

Download Submit
C:\Windows\SysWOW64\Ikcmklih.exe

Filesize
128KB

MD5
0d64c70d5437d781195cc14726e47090

SHA1
c7898b6b44eaf0f43791df82d301d32f65296e5f

SHA256
9af021a558e7ca166a315846d723a249211a265969eec69d5af7b9a35f9ee5d2

SHA512
bede68db2a75668d76c1a5193d21c5b05e3f87ee86e52083b341567841785cc2f97011533bef029f0a0549a852757fe5d48e8170641258408aef8fd587343ffe

Download Submit
C:\Windows\SysWOW64\Infqklol.exe

Filesize
128KB

MD5
639c2289f50e2b87644604ee4e98a13b

SHA1
3ffa3e5e8674c9c5cc8e6d16d552e07deaa024bb

SHA256
68d737f2a1936aaca62ecaae7030ce1c448319d618127d4f938e54f2b3ebd6e2

SHA512
5caa0dfab232c215649d84185f8bea69d6f35b577f9d8313942325588d49ccd932169d4c2ddb5cc0f99e96763be0c4406aa8d2e9238fdeff19308bde3e69c250

Download Submit
C:\Windows\SysWOW64\Jcaeea32.exe

Filesize
128KB

MD5
211129da2a2032d0009556fdda8304cf

SHA1
7227be4e2c8770badc98f12a1dde83fa5f243a9c

SHA256
a8eeae765f40c620a88bf9094191d82d8b8e3b3e15d8755d191f3ac978e7f12b

SHA512
a1ea430508c07365809f9f98204588bc0e18b4550bebf7b1c459a42377952792404866ea634fc565a6617661a277f505814b5c1073fc307f7264937eb14f519d

Download Submit
C:\Windows\SysWOW64\Jcjodbgl.exe

Filesize
128KB

MD5
ba0e0e5e340c9595727c50c58484f3a4

SHA1
7b0437f2ff4a67e464caf7ee49b6db5ec049e598

SHA256
500fcd452e43a74c553cd24dd39cfc181a6f1400e14a9a3ba85b2743e7187b05

SHA512
9d013f1a0aa4978eff22b068bf6296984627fed546f94f76d3a2112695624f79650c1a43f83ee88dac73bbcaca212d13b4bec89e92fb69b714c047f430f9af5e

Download Submit
C:\Windows\SysWOW64\Jmihpa32.exe

Filesize
128KB

MD5
5d357c291cf793deca2005e1e716f771

SHA1
346b02783360ea8c287ae879352d7da5bea39e40

SHA256
6aadebea211d4a2dfed203033a1b7027655875eb9062ddb64b9cc3ab42b9a0d2

SHA512
52ebf6b0f7a7c0efc251003872de93323ea7da57b078bae10d2a73322bf0db0ca2649670444eeda4c22eeab86fc5ad108cc0a8e9406176b9d427ddf68a71c550

Download Submit
C:\Windows\SysWOW64\Kabpan32.exe

Filesize
128KB

MD5
518cc222d1f4b7bec4b1ed1da462769c

SHA1
c582d17beb2b5f77968895383a14adff7148e5be

SHA256
6a8e15c9e16b56a57289e67735817aaa35425b864869af7f3eda036eed60f5f9

SHA512
a5914a526d5f2796b3c3e6d542f2beeed181d1c2ccbfcc9f0fd3ab7babe5ef35c021f806da2d9fd593ebc4e9c28e5f5117a17db2a54351c1f54a67a314a5aa33

Download Submit
C:\Windows\SysWOW64\Kfidgk32.exe

Filesize
128KB

MD5
f7d2a58c58ae440614048a49cc58ef58

SHA1
1013bbf6566707882efb7c585c0ed4fe4805dbba

SHA256
6af68497fefd00e14e75ed1e26289311af8f357af7af43902ddd8d85630ef81b

SHA512
4503653b9ded06535fe7629bf8cb97e19ba3f0ffd694b7e2e918e14edcfb84d75c855ff0443ad977f1cecbb7b9c044fd00a240d73843424bca9a8e99d8470749

Download Submit
C:\Windows\SysWOW64\Kjpgmj32.exe

Filesize
128KB

MD5
13ed99fff6af4ab30cda605b2f2c7c4e

SHA1
65c3761079e149a0bbb4f4be2d2009189932c46b

SHA256
3fd2026530374fe934e146e5a1e388f8de25adb6f440875283b4ab006b652640

SHA512
b3d0284bf372708bdbcad223f5c1e060a3f9b3175042ecf2ea6ac6e59c30ce572b7b91fc87cb6418729a4ad679ecb3134975352755dedbd26a0b36935c32d46f

Download Submit
C:\Windows\SysWOW64\Lbgaecjg.exe

Filesize
128KB

MD5
dcb405d4ea24e538db21e2c1d9bd2e29

SHA1
8018435046ba9ac4253f9b7b568dff729e9f4894

SHA256
bf82d521ba91df2592e742d31ea6261be4a0a949ce73ae7cfe948d108e9d3129

SHA512
a61d411e63abbcf7fa208194dc2947e64a76a0523e97d16bd7abd943b43697198b0393cd83f0a11080bef75ef0e7bdb26c9fcb976a283076e3e62806269bec35

Download Submit
C:\Windows\SysWOW64\Lclpmdhd.exe

Filesize
128KB

MD5
087d04dbdd25a07328754d3a8a521f91

SHA1
55b967c48fd14dbf06dadbe4f9d9ce6ef534a8d7

SHA256
285ab65b626a1e2a7201cbcba91ec6c8348f03e8f2f6948bdd53acd218a89974

SHA512
864ae7f678933d53d0996083629946d070272c28b2fc85d7c5d43110b542ecd78eff6960ee31547ac3ee202613406c59169632672cd5dea49ba67f10732b691f

Download Submit
C:\Windows\SysWOW64\Lnpopcni.exe

Filesize
128KB

MD5
8123982b61b5fac1a276258f146f9255

SHA1
199b4fc03943352c142be42a2b2dedef87ea8333

SHA256
20cfe313a774c4d17e7b68e9555b35176a9f261bc52559d9350279d167c1f21c

SHA512
31183b2c17055db7d2973f7aa9dec1eef03a3eed64daa6ad71632d0087335b9cd489fdc2c2debb76f2bde46cda211690007d6dce0d86097c62eab27092f04f07

Download Submit
C:\Windows\SysWOW64\Loiong32.exe

Filesize
128KB

MD5
25f6a18048ec5c2a8a3290540f5faac9

SHA1
b469b297c3888f9d955542a7d99a271034ac207e

SHA256
68855097a650af2eaa69cc49a3fc2aeaafe04fa8cf3cda156c1d506658c29c1e

SHA512
740023805c8354aaf1f0d65cd9e88c1765eb959aa601d68f4103b01386601beea14fbc9790ce9cf830b56fd94a6bf098829b94d61a77429a799474b025468dfc

Download Submit
C:\Windows\SysWOW64\Mfiedfmd.exe

Filesize
128KB

MD5
2325443a1018916f4509813198318f20

SHA1
625949dabd512114884d88f2be98d10e02a1d5a5

SHA256
a2c5c0c2891c96f384f7a4b75c804dd3a3a5fb87283b1cadad714e73cb22d7ed

SHA512
a5d8914a13231d66f9564d3420e3d0c114824049f73860d3e24e807e7db14d2e363c12eeca5af264797c49e59cc0e2fe55fdcb25e23b111a4f776cbd1c30d67a

Download Submit
C:\Windows\SysWOW64\Mkdiog32.exe

Filesize
128KB

MD5
7cd72e11c7f3d06a8b0d406753268f2d

SHA1
fac5d421aa8c03ead45ab0636eac946a380e2838

SHA256
f62b1c499fec9730918c3a7b69db0323bee5256659f86447242892fcfcd1966b

SHA512
1fa79a15a712b64f83d34b55c4a2fbf467f23241b5ea4bbd6fa9dc88148c19615d2c07e6c6d5558e29d8c63b0011a184a951a0d15d44ba86ca5cc740059e7e44

Download Submit
C:\Windows\SysWOW64\Mkjnop32.exe

Filesize
128KB

MD5
c91087235faa293bf0903db19b01f150

SHA1
1d00e1bc6113267f5932c6de1d4f535ee29bed60

SHA256
a66a260b99477fead4f33738a559effc9707906c806ad679f8eba5c11e68d82a

SHA512
7229b9cb67f84445ab67e0c05993564a6ee50cdd8a745adbc45d7a63aaeeced2fcf50066035fa0f6c8f692a4ea80cda023e16903854ef45d8e74c6e96bde3a56

Download Submit
C:\Windows\SysWOW64\Mobbdf32.exe

Filesize
128KB

MD5
ac94e6ccd5c3667e3d776125003a6526

SHA1
be018ccfd6e38fc32f98595fe879230c0a88ff74

SHA256
b50de5d03535eab8e6cf2157f50ad53a6075e6ba5110e4e6ba46e93d73bec78f

SHA512
5940578b7973dcb5ce5c9910b4084b050a701db7c218d33088c69bd91e8e31a58aabcb83b0af8bb1b9c6463f8bd9e59fdd03e4b1494f7213ae0a4aeda25e3062

Download Submit
C:\Windows\SysWOW64\Nconfh32.exe

Filesize
128KB

MD5
ec5838922bcf6cfef4c306364f19cffe

SHA1
2b52e9973d39302e7bf19967563b67fd85539e81

SHA256
963d129c6c913e1edbff8dbea73ddf2ed3f3f51a99958b4b34d675dc1b9b84f9

SHA512
f3a987bf10df53edfccc07d1255c63a1c618845d7b5af88b5eb7b0eb28607c2165a0ad8ad7e1b3e9bcabfbe7a2c434562318fb41796e9ff955d9a27e4b34f36a

Download Submit
C:\Windows\SysWOW64\Nnfkgp32.exe

Filesize
128KB

MD5
b7e732f9db919e855dd5f3c70c893b4e

SHA1
69d9c87adaeb287fc66705d50ee324ba3fd738cb

SHA256
7e135cb629f8358252484d2b37475f640e4531f38b30bdec1b122f837642ba74

SHA512
fb8a43437dd861fa650b3002eff7937a2a61ce1510a38476b859b58141245d621a6b98d3fe84d776a301f01d80888670322329cf6a2419986e690451254f2bbe

Download Submit
C:\Windows\SysWOW64\Ojmqgd32.exe

Filesize
128KB

MD5
84aa8efd6650a7a4e737a5deb8656185

SHA1
08c15ec5e24912f211feb48e77c167f660fa8297

SHA256
a1e924a084fbffcb85141fba8d950b2208bfcf35c0220f4c1c12d4598826c7ca

SHA512
77037664629664c80423725fc05874c068ab062f9cd900217f352c9f1af0504df820c5fb2648e7023f9b8f0b48d9d5b145124e2be2ed34696c0d9428cc908c69

Download Submit
C:\Windows\SysWOW64\Okceaikl.exe

Filesize
128KB

MD5
21a8ee80e1b36f487d237655f11fad85

SHA1
cb7f128b722f54d889b049f25edc4cb93badff14

SHA256
f15f8ff81eb7a7aae6013ca1ba2c1aea89144b0c16c55f9d819d57bf08c15a9f

SHA512
398d19645a6429a2d721daf1e46eb4347ee5cfd4dffc08900754f630e18ee5a3e031525fc864d2583ccc3f5f4615b5086a31ccfd4c1ee092765967a17294f73c

Download Submit
C:\Windows\SysWOW64\Pcdqhecd.exe

Filesize
128KB

MD5
c8318e18a3dc36da0441b08471320d36

SHA1
77aa0bd445b1b64cc4752807878f60ab585cf856

SHA256
97ab49d74028b10e3313ad47b12d034371224388797865bf86c87a4f5fce330d

SHA512
7d09b006884eeaeffcc52064ac10f3c66a47c9a78b313eaea045f9c4d9d4d2aa8ee7262203fdd69414419b05d6d578364d1f7bb91f97182973a20fd14ba89444

Download Submit
C:\Windows\SysWOW64\Pdklebje.exe

Filesize
128KB

MD5
8b4523bd4ae96f74dc581d878a75beb5

SHA1
a7c46ffdda0961c1df427482ba803136b6efcc16

SHA256
c07927b58a504e98ca1fefa926391c3638740f58a5c23aa0a082ee027cc73e68

SHA512
26a65cbf0385da3b39f3de482be68df53cb87aa966d532eb45087ebe3fc37ec99490f362518a973b1d952d5e2abe832b227e7fd1a3cf5e6e86347637b03837cb

Download Submit
C:\Windows\SysWOW64\Pdngpo32.exe

Filesize
128KB

MD5
291f9b3d31ed0ad6c5fe93716bad3637

SHA1
7087d09585a9fd5749eaead4ae48708da021836e

SHA256
5c04f18266024785cfde2abde686154723a827d6c1171cbe74a4df92f996be8a

SHA512
f4f42a632082617dfb87aca4634cfad6d3eccbfc3cb3aac94f534da1152f7b2ae217c030d805826c8a411243911b9c7c42fe059591f530ea06ccad8903de0cbc

Download Submit
C:\Windows\SysWOW64\Pomncfge.exe

Filesize
128KB

MD5
4642621ebae223192141ba08df5e943c

SHA1
f9edc54b6a2ffde4d70807a0894da0553dcbc5e3

SHA256
3af82895a0e44ffbaa7c8532e15490e48f4c14216e2ce5ac0f7e75f38ffe0b75

SHA512
2d8891e5b952d041bf9e15bd5c894580beb308957032cb02b7a16fd05f6bb6159322aeb19f2d64e5b612a78054a5493de669b83919e4891a6bb4ecdf4d98d3e0

Download Submit
C:\Windows\SysWOW64\Qbngeadf.exe

Filesize
128KB

MD5
8cb0610ca44790f5da01e6b92b1ff6a7

SHA1
a490035184388291d9119a4fc6bcc3209b97bd3e

SHA256
80a3afda436c66a1cdd9733f0bee569010b18f45ae678e8009d5c8bd36fd8a2a

SHA512
4e4583ab206f4d6280847891e031de4c0b355da5fb078ad44feeecdb21aaf82a14334ecea6db25697d03230fd6ac754c569d25a18fc385a5e8d6f8062123bea5

Download Submit
memory/636-276-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1092-286-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1112-250-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1144-21-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1184-225-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1260-294-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1360-288-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1652-65-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1752-153-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1800-57-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2004-97-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2052-234-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2156-145-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2280-177-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2304-105-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2536-300-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2668-193-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2748-138-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3092-73-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3148-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3180-82-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3188-114-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3296-217-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3592-8-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3740-129-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3968-202-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3980-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4168-258-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4280-90-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4460-270-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4500-185-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4520-269-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4540-41-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4560-241-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4564-306-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4664-29-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4692-121-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4704-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4704-81-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4704-1-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4712-169-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4756-312-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5016-161-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5028-210-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5136-318-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5184-328-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5236-330-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5276-336-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5328-345-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5388-348-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5492-354-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5536-362-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5576-366-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5616-372-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5660-378-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5720-384-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5768-394-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5800-396-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5848-406-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5888-412-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5928-414-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/6028-420-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/6076-426-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/6112-432-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads