9491f4619cc30536f1b132a67cdd880f33fbbac4bc5e631d1feab6e941f7faaf

Analysis

max time kernel
141s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9491f4619cc30536f1b132a67cdd880f33fbbac4bc5e631d1feab6e941f7faaf.exe
Size

45KB
MD5

dd790503c37570d968a2317369011af6
SHA1

e1180984b9247c740f2268b0b5c7e3c035713c75
SHA256

9491f4619cc30536f1b132a67cdd880f33fbbac4bc5e631d1feab6e941f7faaf
SHA512

f5e90733ea2f98382058c2df38667f8d76a0e0745cf53486a29d1401fa374820b219883731972958e0166f9c9b37154609fa221add6f5845139555f5db353689
SSDEEP

768:rW4sFAqGsqYUOpbc1GmFKb/rU2nJVGRMZnYW9sXhfPuk/1H5r:J+AqGhYPp41vKbj2UnYWw3u6R

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cknnpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffgqqaip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Himldi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbfbkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpnhekgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcnnaikp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgemphmn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojgbfocc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhjfhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpihai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcjapi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chdkoa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dohfbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dafbne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kipkhdeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Liddbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdifoehl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acmflf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alhhhcal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dahode32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hioiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipbdmaah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odocigqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	9491f4619cc30536f1b132a67cdd880f33fbbac4bc5e631d1feab6e941f7faaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmklen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipldfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogjmdigk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkgqfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngbpidjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmfbjnbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmjqmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifmcdblq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmjdjgjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npfkgjdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Neeqea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hihicplj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmjdjgjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpnlpnih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlmllkja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgmlkp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Demecd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnebeogl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gqkhjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqkdcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gqkhjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfjmgdlf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfdida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blpnib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpenfjad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdqgmmjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibnccmbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfnphn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqdoboli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmbmibhb.exe

Executes dropped EXE 64 IoCs

pid	Process
3560	Gfedle32.exe
1956	Gidphq32.exe
4308	Gqkhjn32.exe
988	Gpnhekgl.exe
2524	Gcidfi32.exe
4552	Gfhqbe32.exe
3392	Gifmnpnl.exe
3144	Gppekj32.exe
1552	Hclakimb.exe
368	Hfjmgdlf.exe
4100	Hihicplj.exe
4328	Hmdedo32.exe
380	Hcnnaikp.exe
4852	Hbanme32.exe
1420	Hjhfnccl.exe
1652	Hikfip32.exe
3332	Hmfbjnbp.exe
1160	Hpenfjad.exe
4928	Hcqjfh32.exe
1548	Hfofbd32.exe
2044	Hjjbcbqj.exe
928	Hmioonpn.exe
2000	Hadkpm32.exe
2260	Hpgkkioa.exe
4532	Hbeghene.exe
3188	Hfachc32.exe
4976	Hmklen32.exe
4432	Hpihai32.exe
4160	Hcedaheh.exe
1348	Hfcpncdk.exe
3880	Hjolnb32.exe
1076	Hmmhjm32.exe
3244	Haidklda.exe
1752	Ipldfi32.exe
2424	Ibjqcd32.exe
4176	Iffmccbi.exe
4212	Iidipnal.exe
208	Impepm32.exe
2392	Iakaql32.exe
844	Icjmmg32.exe
4380	Ibmmhdhm.exe
2400	Ijdeiaio.exe
4464	Iiffen32.exe
3104	Imbaemhc.exe
1748	Iannfk32.exe
1188	Icljbg32.exe
2372	Ibojncfj.exe
672	Ijfboafl.exe
3592	Iiibkn32.exe
1688	Iapjlk32.exe
4500	Ipckgh32.exe
4304	Ibagcc32.exe
2180	Ifmcdblq.exe
4384	Iikopmkd.exe
4468	Iabgaklg.exe
5044	Ipegmg32.exe
2432	Idacmfkj.exe
880	Ifopiajn.exe
2688	Ijkljp32.exe
2120	Iinlemia.exe
3292	Iinlemia.exe
4172	Jaedgjjd.exe
896	Jpgdbg32.exe
2188	Jdcpcf32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ahmlgd32.exe	Adapgfqj.exe
File created	C:\Windows\SysWOW64\Jlednamo.exe	Jifhaenk.exe
File created	C:\Windows\SysWOW64\Accfbokl.exe	Ajkaii32.exe
File created	C:\Windows\SysWOW64\Jjblgaie.dll	Kkihknfg.exe
File created	C:\Windows\SysWOW64\Gkmlofol.exe	Ghopckpi.exe
File created	C:\Windows\SysWOW64\Gfembo32.exe	Gbiaapdf.exe
File opened for modification	C:\Windows\SysWOW64\Iiaephpc.exe	Hfcicmqp.exe
File opened for modification	C:\Windows\SysWOW64\Jfkoeppq.exe	Jbocea32.exe
File opened for modification	C:\Windows\SysWOW64\Bbgipldd.exe	Bjpaooda.exe
File created	C:\Windows\SysWOW64\Ncnkogdb.dll	Bnnjen32.exe
File opened for modification	C:\Windows\SysWOW64\Ekhjmiad.exe	Eleiam32.exe
File created	C:\Windows\SysWOW64\Jheiojpj.dll	Ncldnkae.exe
File opened for modification	C:\Windows\SysWOW64\Odgqdlnj.exe	Oqkdcn32.exe
File created	C:\Windows\SysWOW64\Imoneg32.exe	Iehfdi32.exe
File opened for modification	C:\Windows\SysWOW64\Cffdpghg.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Mjeddggd.exe	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Cbqlfkmi.exe	Bkidenlg.exe
File opened for modification	C:\Windows\SysWOW64\Ifefimom.exe	Icgjmapi.exe
File opened for modification	C:\Windows\SysWOW64\Migjoaaf.exe	Mgimcebb.exe
File created	C:\Windows\SysWOW64\Fcjkaiib.dll	Andgoobc.exe
File opened for modification	C:\Windows\SysWOW64\Mlampmdo.exe	Megdccmb.exe
File created	C:\Windows\SysWOW64\Liimncmf.exe	Lenamdem.exe
File created	C:\Windows\SysWOW64\Djgjlelk.exe	Danecp32.exe
File created	C:\Windows\SysWOW64\Beihma32.exe	Bgehcmmm.exe
File opened for modification	C:\Windows\SysWOW64\Hcedaheh.exe	Hpihai32.exe
File created	C:\Windows\SysWOW64\Lcdegnep.exe	Lpfijcfl.exe
File opened for modification	C:\Windows\SysWOW64\Onfbfc32.exe	Ogljjiei.exe
File created	C:\Windows\SysWOW64\Edbklofb.exe	Eepjpb32.exe
File created	C:\Windows\SysWOW64\Honhef32.dll	Ncnadk32.exe
File created	C:\Windows\SysWOW64\Iihqganf.dll	Liimncmf.exe
File created	C:\Windows\SysWOW64\Jfenmm32.dll	Mlcifmbl.exe
File created	C:\Windows\SysWOW64\Ngpccdlj.exe	Npfkgjdn.exe
File created	C:\Windows\SysWOW64\Echmafdm.dll	Oqdoboli.exe
File created	C:\Windows\SysWOW64\Bpflfc32.dll	Anpncp32.exe
File opened for modification	C:\Windows\SysWOW64\Pflplnlg.exe	Pqpgdfnp.exe
File created	C:\Windows\SysWOW64\Bhhdil32.exe	Beihma32.exe
File created	C:\Windows\SysWOW64\Gifmnpnl.exe	Gfhqbe32.exe
File created	C:\Windows\SysWOW64\Ppmeid32.dll	Hfachc32.exe
File created	C:\Windows\SysWOW64\Qngfmkdl.dll	Ibmmhdhm.exe
File created	C:\Windows\SysWOW64\Nnolfdcn.exe	Nkqpjidj.exe
File opened for modification	C:\Windows\SysWOW64\Jlnnmb32.exe	Jedeph32.exe
File created	C:\Windows\SysWOW64\Gnbbnj32.dll	Gfhqbe32.exe
File created	C:\Windows\SysWOW64\Mcklgm32.exe	Mdiklqhm.exe
File opened for modification	C:\Windows\SysWOW64\Pnpemb32.exe	Pkaiqf32.exe
File opened for modification	C:\Windows\SysWOW64\Edbklofb.exe	Eepjpb32.exe
File opened for modification	C:\Windows\SysWOW64\Ehgqln32.exe	Eeidoc32.exe
File created	C:\Windows\SysWOW64\Hcpclbfa.exe	Hkikkeeo.exe
File created	C:\Windows\SysWOW64\Icpnnd32.dll	Kbceejpf.exe
File opened for modification	C:\Windows\SysWOW64\Oqfdnhfk.exe	Odocigqg.exe
File opened for modification	C:\Windows\SysWOW64\Iikopmkd.exe	Ifmcdblq.exe
File opened for modification	C:\Windows\SysWOW64\Lpocjdld.exe	Lmqgnhmp.exe
File opened for modification	C:\Windows\SysWOW64\Ocgdji32.exe	Oqihnn32.exe
File created	C:\Windows\SysWOW64\Olihhh32.dll	Pbkamqmd.exe
File opened for modification	C:\Windows\SysWOW64\Hfcpncdk.exe	Hcedaheh.exe
File created	C:\Windows\SysWOW64\Fojkiimn.dll	Icljbg32.exe
File opened for modification	C:\Windows\SysWOW64\Abemjmgg.exe	Alkdnboj.exe
File opened for modification	C:\Windows\SysWOW64\Hmhhehlb.exe	Himldi32.exe
File created	C:\Windows\SysWOW64\Hfmbha32.dll	Icplcpgo.exe
File created	C:\Windows\SysWOW64\Mlampmdo.exe	Megdccmb.exe
File created	C:\Windows\SysWOW64\Hpgkkioa.exe	Hadkpm32.exe
File created	C:\Windows\SysWOW64\Hmmhjm32.exe	Hjolnb32.exe
File created	C:\Windows\SysWOW64\Hbocda32.dll	Lcbiao32.exe
File created	C:\Windows\SysWOW64\Aecqac32.dll	Cliaoq32.exe
File created	C:\Windows\SysWOW64\Gpnhekgl.exe	Gqkhjn32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
13560	13512	WerFault.exe	667

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anjekdho.dll"	Jbhmdbnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhikcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbqlfkmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Flqimk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncldlbah.dll"	Iinlemia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkaiqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddbbeade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Beihma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jkdnpo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Elppfmoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ieolehop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlaegk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iannfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phogofep.dll"	Ibojncfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aolmfp32.dll"	Pkceffcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qnnanphk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gcddpdpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eifnachf.dll"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fhgjblfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hckjacjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njohbh32.dll"	Ifefimom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nepgjaeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnjbke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aegikj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hoiafcic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pclneicb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	9491f4619cc30536f1b132a67cdd880f33fbbac4bc5e631d1feab6e941f7faaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ghaliknf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkcfedla.dll"	Himldi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hafgeo32.dll"	Gbiaapdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnmacdaj.dll"	Icgjmapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjcfkp32.dll"	Hpgkkioa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jiikak32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cbqlfkmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fljcmlfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdegandp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckmllpik.dll"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qoqbfpfe.dll"	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmafhe32.dll"	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjegoo32.dll"	Hbpgbo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmioonpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgifdn32.dll"	Cdkldb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aafdghob.dll"	Pclneicb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jeaikh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfjmgdlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckcgkldl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Clbceo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dekhneap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajbajd32.dll"	Aaqgek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkoggkjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edbklofb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imdhga32.dll"	Cbcilkjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbbkaako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmoahijl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnnjen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpoefk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qnjnnj32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 3560	1044	9491f4619cc30536f1b132a67cdd880f33fbbac4bc5e631d1feab6e941f7faaf.exe	89
PID 1044 wrote to memory of 3560	1044	9491f4619cc30536f1b132a67cdd880f33fbbac4bc5e631d1feab6e941f7faaf.exe	89
PID 1044 wrote to memory of 3560	1044	9491f4619cc30536f1b132a67cdd880f33fbbac4bc5e631d1feab6e941f7faaf.exe	89
PID 3560 wrote to memory of 1956	3560	Gfedle32.exe	90
PID 3560 wrote to memory of 1956	3560	Gfedle32.exe	90
PID 3560 wrote to memory of 1956	3560	Gfedle32.exe	90
PID 1956 wrote to memory of 4308	1956	Gidphq32.exe	91
PID 1956 wrote to memory of 4308	1956	Gidphq32.exe	91
PID 1956 wrote to memory of 4308	1956	Gidphq32.exe	91
PID 4308 wrote to memory of 988	4308	Gqkhjn32.exe	92
PID 4308 wrote to memory of 988	4308	Gqkhjn32.exe	92
PID 4308 wrote to memory of 988	4308	Gqkhjn32.exe	92
PID 988 wrote to memory of 2524	988	Gpnhekgl.exe	93
PID 988 wrote to memory of 2524	988	Gpnhekgl.exe	93
PID 988 wrote to memory of 2524	988	Gpnhekgl.exe	93
PID 2524 wrote to memory of 4552	2524	Gcidfi32.exe	94
PID 2524 wrote to memory of 4552	2524	Gcidfi32.exe	94
PID 2524 wrote to memory of 4552	2524	Gcidfi32.exe	94
PID 4552 wrote to memory of 3392	4552	Gfhqbe32.exe	95
PID 4552 wrote to memory of 3392	4552	Gfhqbe32.exe	95
PID 4552 wrote to memory of 3392	4552	Gfhqbe32.exe	95
PID 3392 wrote to memory of 3144	3392	Gifmnpnl.exe	96
PID 3392 wrote to memory of 3144	3392	Gifmnpnl.exe	96
PID 3392 wrote to memory of 3144	3392	Gifmnpnl.exe	96
PID 3144 wrote to memory of 1552	3144	Gppekj32.exe	97
PID 3144 wrote to memory of 1552	3144	Gppekj32.exe	97
PID 3144 wrote to memory of 1552	3144	Gppekj32.exe	97
PID 1552 wrote to memory of 368	1552	Hclakimb.exe	98
PID 1552 wrote to memory of 368	1552	Hclakimb.exe	98
PID 1552 wrote to memory of 368	1552	Hclakimb.exe	98
PID 368 wrote to memory of 4100	368	Hfjmgdlf.exe	99
PID 368 wrote to memory of 4100	368	Hfjmgdlf.exe	99
PID 368 wrote to memory of 4100	368	Hfjmgdlf.exe	99
PID 4100 wrote to memory of 4328	4100	Hihicplj.exe	100
PID 4100 wrote to memory of 4328	4100	Hihicplj.exe	100
PID 4100 wrote to memory of 4328	4100	Hihicplj.exe	100
PID 4328 wrote to memory of 380	4328	Hmdedo32.exe	101
PID 4328 wrote to memory of 380	4328	Hmdedo32.exe	101
PID 4328 wrote to memory of 380	4328	Hmdedo32.exe	101
PID 380 wrote to memory of 4852	380	Hcnnaikp.exe	102
PID 380 wrote to memory of 4852	380	Hcnnaikp.exe	102
PID 380 wrote to memory of 4852	380	Hcnnaikp.exe	102
PID 4852 wrote to memory of 1420	4852	Hbanme32.exe	103
PID 4852 wrote to memory of 1420	4852	Hbanme32.exe	103
PID 4852 wrote to memory of 1420	4852	Hbanme32.exe	103
PID 1420 wrote to memory of 1652	1420	Hjhfnccl.exe	104
PID 1420 wrote to memory of 1652	1420	Hjhfnccl.exe	104
PID 1420 wrote to memory of 1652	1420	Hjhfnccl.exe	104
PID 1652 wrote to memory of 3332	1652	Hikfip32.exe	105
PID 1652 wrote to memory of 3332	1652	Hikfip32.exe	105
PID 1652 wrote to memory of 3332	1652	Hikfip32.exe	105
PID 3332 wrote to memory of 1160	3332	Hmfbjnbp.exe	106
PID 3332 wrote to memory of 1160	3332	Hmfbjnbp.exe	106
PID 3332 wrote to memory of 1160	3332	Hmfbjnbp.exe	106
PID 1160 wrote to memory of 4928	1160	Hpenfjad.exe	107
PID 1160 wrote to memory of 4928	1160	Hpenfjad.exe	107
PID 1160 wrote to memory of 4928	1160	Hpenfjad.exe	107
PID 4928 wrote to memory of 1548	4928	Hcqjfh32.exe	108
PID 4928 wrote to memory of 1548	4928	Hcqjfh32.exe	108
PID 4928 wrote to memory of 1548	4928	Hcqjfh32.exe	108
PID 1548 wrote to memory of 2044	1548	Hfofbd32.exe	109
PID 1548 wrote to memory of 2044	1548	Hfofbd32.exe	109
PID 1548 wrote to memory of 2044	1548	Hfofbd32.exe	109
PID 2044 wrote to memory of 928	2044	Hjjbcbqj.exe	111

C:\Users\Admin\AppData\Local\Temp\9491f4619cc30536f1b132a67cdd880f33fbbac4bc5e631d1feab6e941f7faaf.exe
"C:\Users\Admin\AppData\Local\Temp\9491f4619cc30536f1b132a67cdd880f33fbbac4bc5e631d1feab6e941f7faaf.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\Gfedle32.exe
  C:\Windows\system32\Gfedle32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Windows\SysWOW64\Gidphq32.exe
    C:\Windows\system32\Gidphq32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Windows\SysWOW64\Gqkhjn32.exe
      C:\Windows\system32\Gqkhjn32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4308
    - - C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:988
      - C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:380
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\SysWOW64\Hikfip32.exe
        
        C:\Windows\system32\Hikfip32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1160
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1548
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:928
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2000
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2260
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        26⤵
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3188
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4976
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4432
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4160
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        31⤵
        Executes dropped EXE
        
        PID:1348
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3880
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        33⤵
        Executes dropped EXE
        
        PID:1076
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        34⤵
        Executes dropped EXE
        
        PID:3244
        
        C:\Windows\SysWOW64\Ipldfi32.exe
        
        C:\Windows\system32\Ipldfi32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1752
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        36⤵
        Executes dropped EXE
        
        PID:2424
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        37⤵
        Executes dropped EXE
        
        PID:4176
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        38⤵
        Executes dropped EXE
        
        PID:4212
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        39⤵
        Executes dropped EXE
        
        PID:208
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        40⤵
        Executes dropped EXE
        
        PID:2392
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        41⤵
        Executes dropped EXE
        
        PID:844
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4380
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        43⤵
        Executes dropped EXE
        
        PID:2400
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        44⤵
        Executes dropped EXE
        
        PID:4464
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        45⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1748
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1188
        
        C:\Windows\SysWOW64\Ibojncfj.exe
        
        C:\Windows\system32\Ibojncfj.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2372
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        49⤵
        Executes dropped EXE
        
        PID:672
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        50⤵
        Executes dropped EXE
        
        PID:3592
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        51⤵
        Executes dropped EXE
        
        PID:1688
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        52⤵
        Executes dropped EXE
        
        PID:4500
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        53⤵
        Executes dropped EXE
        
        PID:4304
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2180
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        55⤵
        Executes dropped EXE
        
        PID:4384
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        56⤵
        Executes dropped EXE
        
        PID:4468
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        57⤵
        Executes dropped EXE
        
        PID:5044
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        58⤵
        Executes dropped EXE
        
        PID:2432
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        59⤵
        Executes dropped EXE
        
        PID:880
        
        C:\Windows\SysWOW64\Ijkljp32.exe
        
        C:\Windows\system32\Ijkljp32.exe
        60⤵
        Executes dropped EXE
        
        PID:2688
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2120
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        62⤵
        Executes dropped EXE
        
        PID:3292
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        63⤵
        Executes dropped EXE
        
        PID:4172
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        64⤵
        Executes dropped EXE
        
        PID:896
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        65⤵
        Executes dropped EXE
        
        PID:2188
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        66⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        67⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        68⤵
        
        PID:824
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        69⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        70⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        71⤵
        Modifies registry class
        
        PID:4756
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4676
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        73⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        74⤵
        
        PID:872
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        75⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        76⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        77⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        78⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        79⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Jjbako32.exe
        
        C:\Windows\system32\Jjbako32.exe
        80⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        81⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        82⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        83⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        84⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        85⤵
        Modifies registry class
        
        PID:5384
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        86⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        87⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        88⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        89⤵
        Drops file in System32 directory
        
        PID:5572
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        90⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        91⤵
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        92⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        93⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        94⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5836
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        96⤵
        Drops file in System32 directory
        
        PID:5880
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        97⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        98⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        99⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        100⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        101⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        102⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5200
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        104⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        105⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        106⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        107⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        108⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        109⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        110⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        111⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        112⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        113⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        114⤵
        Drops file in System32 directory
        
        PID:5992
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        115⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        116⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        117⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        118⤵
        Modifies registry class
        
        PID:5336
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        119⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        120⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        121⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        122⤵
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        123⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        124⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        125⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        126⤵
        Drops file in System32 directory
        
        PID:5160
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        127⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5636
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        129⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        130⤵
        Drops file in System32 directory
        
        PID:5908
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        131⤵
        Modifies registry class
        
        PID:5140
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        132⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        133⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        134⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        135⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        136⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        137⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        138⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        139⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        140⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        141⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        142⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        143⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        144⤵
        Drops file in System32 directory
        
        PID:6360
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        145⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        146⤵
        Drops file in System32 directory
        
        PID:6464
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        147⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        148⤵
        Modifies registry class
        
        PID:6544
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6588
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        150⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6668
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        152⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        153⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        154⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        155⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        156⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        157⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6968
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        159⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        160⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        161⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7140
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        163⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        164⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        165⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        166⤵
        Modifies registry class
        
        PID:6356
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        167⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        168⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        169⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        170⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        171⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        172⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        173⤵
        Drops file in System32 directory
        
        PID:6844
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        174⤵
        Modifies registry class
        
        PID:6916
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        175⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        176⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7076
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        177⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        178⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        179⤵
        Drops file in System32 directory
        
        PID:6264
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6348
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        181⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        182⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        183⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        184⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        185⤵
        Drops file in System32 directory
        
        PID:6956
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        186⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6160
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        188⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        189⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        190⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Oqgkhnjf.exe
        
        C:\Windows\system32\Oqgkhnjf.exe
        191⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        192⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        193⤵
        Drops file in System32 directory
        
        PID:6268
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        194⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        195⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        196⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6552
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        198⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7072
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6272
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        201⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7196
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        202⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        203⤵
        Drops file in System32 directory
        
        PID:7300
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        204⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        205⤵
        Modifies registry class
        
        PID:7380
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        206⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        207⤵
        Modifies registry class
        
        PID:7464
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        208⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        209⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        210⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        211⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        212⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        213⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        214⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        215⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        216⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        217⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        218⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        219⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        220⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        221⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        222⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        223⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        224⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        225⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        226⤵
        Modifies registry class
        
        PID:7372
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        227⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        228⤵
        Modifies registry class
        
        PID:7492
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        229⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        230⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        231⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        232⤵
        Drops file in System32 directory
        
        PID:7760
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        233⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7892
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        235⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        236⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        237⤵
        Modifies registry class
        
        PID:8136
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        238⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        239⤵
        Drops file in System32 directory
        
        PID:7264
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        240⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        241⤵
        Drops file in System32 directory
        
        PID:7472
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        242⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7704
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        244⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        245⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        246⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        247⤵
        Drops file in System32 directory
        
        PID:7180
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        248⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        249⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        250⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        251⤵
        Drops file in System32 directory
        
        PID:7864
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        252⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        253⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7924
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        255⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7680
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        256⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        257⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        258⤵
        Modifies registry class
        
        PID:8200
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        259⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        260⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        261⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        262⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        263⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        264⤵
        Drops file in System32 directory
        
        PID:8452
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        265⤵
        Modifies registry class
        
        PID:8500
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        266⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        267⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        268⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        269⤵
        Drops file in System32 directory
        
        PID:8660
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        270⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        271⤵
        Modifies registry class
        
        PID:8756
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        272⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        273⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8872
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        275⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        276⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        277⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        278⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        279⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        280⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        281⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        282⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8232
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        284⤵
        Modifies registry class
        
        PID:8300
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        285⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        286⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        287⤵
        Modifies registry class
        
        PID:8496
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        288⤵
        Modifies registry class
        
        PID:8588
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        289⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        290⤵
        Modifies registry class
        
        PID:8724
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        291⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8908
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        293⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9072
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        295⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        296⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        297⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        298⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        299⤵
        Modifies registry class
        
        PID:8656
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        300⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8868
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9108
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        303⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        304⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        305⤵
        Modifies registry class
        
        PID:8732
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        306⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9196
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        308⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        309⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        310⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        311⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        312⤵
        Modifies registry class
        
        PID:9256
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        313⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        314⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        315⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        316⤵
        Drops file in System32 directory
        
        PID:9428
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        317⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        318⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        319⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        320⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        321⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        322⤵
        Drops file in System32 directory
        
        PID:9684
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        323⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        324⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        325⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        326⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        327⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        328⤵
        Drops file in System32 directory
        
        PID:9956
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        329⤵
        Modifies registry class
        
        PID:9992
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        330⤵
        Modifies registry class
        
        PID:10040
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        331⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        332⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        333⤵
        Modifies registry class
        
        PID:10164
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        334⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        335⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        336⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        337⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        338⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        339⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        340⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        341⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9700
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        343⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        344⤵
        Modifies registry class
        
        PID:9840
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        345⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        346⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        347⤵
        Modifies registry class
        
        PID:10064
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        348⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        349⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        350⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9324
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        352⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        353⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        354⤵
        Modifies registry class
        
        PID:9664
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9768
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        356⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        357⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        358⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        359⤵
        Drops file in System32 directory
        
        PID:10184
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        360⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        361⤵
        Modifies registry class
        
        PID:9456
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        362⤵
        Modifies registry class
        
        PID:9712
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        363⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        364⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10060
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        365⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        366⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        367⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        368⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        369⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        370⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        371⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        372⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        373⤵
        Modifies registry class
        
        PID:9524
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        374⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        375⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        376⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        377⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        378⤵
        Modifies registry class
        
        PID:10404
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        379⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        380⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        381⤵
        Drops file in System32 directory
        
        PID:10536
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        382⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10624
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:10664
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        385⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        386⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        387⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        388⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10888
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        390⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10928
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        391⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        392⤵
        Modifies registry class
        
        PID:11016
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        393⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        394⤵
        Drops file in System32 directory
        
        PID:11112
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        395⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        396⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        397⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11248
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        398⤵
        Modifies registry class
        
        PID:9892
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        399⤵
        Drops file in System32 directory
        
        PID:10320
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        400⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        401⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        402⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        403⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        404⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        405⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10740
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        406⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        407⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10920
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        409⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        410⤵
        Modifies registry class
        
        PID:11080
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        411⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        412⤵
        Drops file in System32 directory
        
        PID:11168
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        413⤵
        Modifies registry class
        
        PID:7220
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        414⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        415⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        416⤵
        Drops file in System32 directory
        
        PID:10592
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        417⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        418⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        419⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        420⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        421⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        422⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        423⤵
        Drops file in System32 directory
        
        PID:10308
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        424⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        425⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        426⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        427⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        428⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        429⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        430⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        431⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        432⤵
        Drops file in System32 directory
        
        PID:11260
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        433⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        434⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11192
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10264
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        437⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        438⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        439⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        440⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        441⤵
        
        PID:11456
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        442⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        443⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        444⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11580
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11624
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        446⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        447⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        448⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11748
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        449⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        450⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        451⤵
        Drops file in System32 directory
        
        PID:11872
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        452⤵
        Drops file in System32 directory
        
        PID:11912
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        453⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        454⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        455⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        456⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        457⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        458⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        459⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        460⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        461⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        462⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        463⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        464⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        465⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        466⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        467⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        468⤵
        Drops file in System32 directory
        
        PID:11764
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        469⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        470⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        471⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        472⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        473⤵
        Drops file in System32 directory
        
        PID:12116
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        474⤵
        Modifies registry class
        
        PID:12156
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        475⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        476⤵
        Drops file in System32 directory
        
        PID:11316
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        477⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        478⤵
        
        PID:11528
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        479⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        480⤵
        
        PID:11732
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        481⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11940
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        483⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        484⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        485⤵
        Modifies registry class
        
        PID:11004
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        486⤵
        Modifies registry class
        
        PID:11380
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        487⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        488⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11744
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        489⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        490⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        491⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11616
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        492⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        493⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12076
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        494⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12308
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        495⤵
        
        PID:12352
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        496⤵
        
        PID:12396
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        497⤵
        
        PID:12448
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        498⤵
        
        PID:12496
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        499⤵
        
        PID:12532
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        500⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12580
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        501⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        502⤵
        
        PID:12680
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        503⤵
        
        PID:12732
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        504⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12772
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        505⤵
        
        PID:12820
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        506⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        507⤵
        
        PID:12900
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        508⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        509⤵
        
        PID:12988
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        510⤵
        
        PID:13032
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        511⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:13072
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        512⤵
        
        PID:13120
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        513⤵
        
        PID:13160
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        514⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        515⤵
        
        PID:13244
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        516⤵
        Modifies registry class
        
        PID:13280
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        517⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        518⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        519⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12404
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        520⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        521⤵
        Modifies registry class
        
        PID:12520
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        522⤵
        Drops file in System32 directory
        
        PID:12576
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        523⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        524⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        525⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        526⤵
        
        PID:12868
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        527⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        528⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        529⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        530⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        531⤵
        Modifies registry class
        
        PID:13116
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        532⤵
        
        PID:13188
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        533⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13240
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        534⤵
        Modifies registry class
        
        PID:13308
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        535⤵
        
        PID:12368
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        536⤵
        
        PID:12360
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        537⤵
        
        PID:12572
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        538⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        539⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        540⤵
        Drops file in System32 directory
        
        PID:3748
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        541⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12692
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        542⤵
        
        PID:12808
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        543⤵
        
        PID:12908
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        544⤵
        
        PID:12984
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        545⤵
        
        PID:13092
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        546⤵
        Drops file in System32 directory
        
        PID:13216
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        547⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        548⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12504
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        549⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        550⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        551⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        552⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12884
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        553⤵
        
        PID:13156
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        554⤵
        Modifies registry class
        
        PID:12376
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        555⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        556⤵
        Modifies registry class
        
        PID:12876
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        557⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        558⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        559⤵
        Drops file in System32 directory
        
        PID:13196
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        560⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13000
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        561⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        562⤵
        Drops file in System32 directory
        
        PID:13140
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        563⤵
        
        PID:13324
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        564⤵
        
        PID:13364
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        565⤵
        
        PID:13404
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        566⤵
        
        PID:13440
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        567⤵
        
        PID:13476
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        568⤵
        
        PID:13512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13512 -s 396
        569⤵
        Program crash
        
        PID:13560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 13512 -ip 13512
1⤵
PID:13532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ajckij32.exe

Filesize
45KB

MD5
18b6c25e8091f3fbd97e3a61034a1847

SHA1
2ad7fc975e73d6e3c8ffcfdb887d38b6c6e3c55c

SHA256
57c9633da1e5aedf7b4f4fdd574e434adb48a1a51f37b68bb401ca5e030f9747

SHA512
e16d0753459a45b5ce3f9af8d3cfa06b139e562e67d90e88e01be722d3340d47e7cc51dcb2fd7f536345dac39f44d6a00ae8f8d1c3b4278bd37572eae51d97c1

Download Submit
C:\Windows\SysWOW64\Ajkaii32.exe

Filesize
45KB

MD5
333bac7833893c4219ec20beff4de457

SHA1
900d42fedef9c1da56ba7b15bb637213f8e58423

SHA256
d0c3237bb81d9408eb6d5fe451662dae5255e3bddafccc55b562b0339d6c7d97

SHA512
c838e01c4e5417c2d7c6b8d067fb0ad8e9fc14beb877bf4aadde6258d9b9f033f3230699632649387bb7586bff4fd2b5f82100e464a5bae8d7b1f60934cc9b96

Download Submit
C:\Windows\SysWOW64\Anadoi32.exe

Filesize
45KB

MD5
d69c2fe451ed9921cf59801f0184dd31

SHA1
16ab2d3e7df191e82918924379ce4187efdbeb27

SHA256
69279f3e179f17441890f5b9a579a4ea458ffee7cefd1292344b140b0c9c8996

SHA512
3f954cd0073a230d691f290ebc485661f9efd6c426c9d39f738b8b227924a7129cdb45679d828f77d7be2c7261bb0758c24347d05085aefa332184198af8078f

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
45KB

MD5
fc36b8953731ca644c6cdc50247cf44c

SHA1
cf765a02ab60aff22c4601e2b4dcbef10f782f1c

SHA256
7609811594ab35e8f25b04d7be6b30b773be82c57fe160728a60523c0923a9f5

SHA512
dd8ccb24cd69986d7abe1ae9d8aab4278041adeaf625e8b5743b3b9868471f58a453f79bfd3e6ff5d4d15433889da424f6e468bc69ff11516081075816241de2

Download Submit
C:\Windows\SysWOW64\Bnmcjg32.exe

Filesize
45KB

MD5
fb8a1570771b9479d8b7a44ee5386455

SHA1
0f603c035a6dcef50314fb390d3d2d5f4e59f659

SHA256
82a10183f23c2340eaf20facd459b107c8b97a430eb40415614333a807d4c3b3

SHA512
0db8b6801b9ee96c49569ff58e0d8433d7ea781c03d7f116070c3ec888d847131da3d488e1c0d60da53bd50e1d50c9c69a40d9d978aee8095727c2553551b2cb

Download Submit
C:\Windows\SysWOW64\Cegdnopg.exe

Filesize
45KB

MD5
e99b289153973518b3ef8a448ed60e23

SHA1
1498db69481ba01926358b58c0d2dc8fcc8a1625

SHA256
9cbd5eb174b6eb5a5040b8032454965a293b8411f479783a60be4ae1717a01f8

SHA512
db9088c1c69bb1366f059daee6737d81cbab4f74f2ddbb2598bb7ebde3144ff580a8834d1b4e3143104b516a0e00016793d8ee8b40e16bca09e2ddc873552b63

Download Submit
C:\Windows\SysWOW64\Deokon32.exe

Filesize
45KB

MD5
9adece726f7caf5b87907d6b93c979bc

SHA1
3e3cde1517011fce0274cac76a35a16c5b355741

SHA256
b7ca4a128b702d4eac68d3f0ec0b542df7ef5e8ead41744d0ac6a883d390de35

SHA512
209dc6828ce8e169bee3b29b02ca15479e24b710b3e5f264e311bb921f82653f69b02c7b6499e79f8ed24d3c7f0926cdeda2b3ea66d72f29602326e633290198

Download Submit
C:\Windows\SysWOW64\Djgjlelk.exe

Filesize
45KB

MD5
5920d60d4ed8fd36f4dc2fcf2eef67df

SHA1
ad378fa08af7eb6397a27c4cd8bd880a32f83b80

SHA256
67d89834075e8063b220f3a25ad65af0fe0588382ff6e22086dd0badaea04f38

SHA512
7eac0be0e89f2e9638580b4ae84e722af860d386a56851ceb782d40b81f28e8102d76ab99fa5afcdb00f23c375455c1ca07d57880990e82a5e03a246940aeb1b

Download Submit
C:\Windows\SysWOW64\Gcidfi32.exe

Filesize
45KB

MD5
320ce9c55f47ba6da0f0b33795c89acb

SHA1
822579365c35c8719892ac8b6f6c3e7f7ec0011d

SHA256
87da80b2f36108ba332ce8362764d1fb622914b0d027afe6e9ad6b30f013413d

SHA512
e6b2a7a63d51adbab7a47d858c079430a3781b4540d3ad202729f1ec5747a220eac2e5e4f7cd6eeb6fb917769d5261f9ac813ebcfceaacf1b0ae46a2040afbbf

Download Submit
C:\Windows\SysWOW64\Gfedle32.exe

Filesize
45KB

MD5
e90762b468627daa2c41976860ab16e1

SHA1
c1df415161822b48057ab59792d6e723e696ba99

SHA256
41646d64a7c0305bc4c08ed3533f78f3733344c320e96b06dfecd19871cf328c

SHA512
ef4544d47246ed7326027269db8544a63cc2df57f5cc55ffd4e75419365af4fd70be53ee472d776b6b76920b2cc1b32fd4cd39715a45c2f2b9c2dcdf2d323d2b

Download Submit
C:\Windows\SysWOW64\Gfhqbe32.exe

Filesize
45KB

MD5
612fd2f6a0f159f7c8db671b3aba1fa9

SHA1
fa41b332aaaba457811f9aa60e6aac87ae98e49c

SHA256
58cc9c5e9ff550054df3b13c7a8867539c1d280db4af1e0fe25055e2b8874fca

SHA512
cd3d8b6e199b879737037ec1b6372d8225bd1d78ce54b34f88b9ceaf76c46759bba71cad9491de5b8253e5e0984ebe91b693bf78df6794fe63fb293730fce9c9

Download Submit
C:\Windows\SysWOW64\Gidphq32.exe

Filesize
45KB

MD5
2a37d30cb58dbaaccf27c15281cefd9b

SHA1
24830690adc849cbd8c1e0f878ae0d8eb721530b

SHA256
c8d37dfd1ec9987b1a5195bc825ea879ce874462f4a9c8376face6fa98bfe274

SHA512
b618f18bb468739b362fb6a815c9307bcf6654cfdd9593b8caa410170657b5707f46da6b4fc1e91ee7b24793c8c80a95be2bc84231d2c6ffd0442bece769773c

Download Submit
C:\Windows\SysWOW64\Gifmnpnl.exe

Filesize
45KB

MD5
3e48a05580c7a0cad6b34b3d76be404b

SHA1
f306dbc02e1284000f446a6853b9489085f7cc02

SHA256
477a815547d8d9e10a67613cb9c2fad4c5e291a5564b28f15b87abf2dc9a78c4

SHA512
d1b8117b51770dc415dd463f6853c198dc3cdf4b338223826d4b0a0e561886706a9efd721157a65fdc47d132b9ea4ea9531bd1002a613ddd40a0d9d07f89abec

Download Submit
C:\Windows\SysWOW64\Gpnhekgl.exe

Filesize
45KB

MD5
5783ffbc44617b3118bfed5b736822df

SHA1
ee2f877ebd29e1fa07b78c32667bff168ff09a11

SHA256
284824a5258160eaca10ddbf703fbd3824002c7272927e28e80d432f4ad288aa

SHA512
666593d5963a058fc72d01b3936edf50e00fb921525cea900c42ced7290cdab2775fda9be1007de119b1b067509556dbd1a8d7d79ca3b632d5c381d8c888b299

Download Submit
C:\Windows\SysWOW64\Gppekj32.exe

Filesize
45KB

MD5
e0980de27265a8d3dcba3efb5d4225d8

SHA1
38199b72b0a3f3cad7acef405b9c25da7f6e234c

SHA256
4a971ac5f0d637654b9fdad90d823dd2966978fe1dd0bbbd753c0120d135bce7

SHA512
1c61c91cefd029d469666eae50e3bb28494f446573fd602dba2979110d27b9156d8cc8cedb4b727ed5f83d1084f516ca414f1b2b3c1fe05bbe5bab14f1691f45

Download Submit
C:\Windows\SysWOW64\Gqkhjn32.exe

Filesize
45KB

MD5
0ddf23ff286a5ae3c44b2a70c8d3288e

SHA1
dab6f62bdbc06b184183ebf21adce1b9f2e5be86

SHA256
72f9c368fa23b3be1509c6cd7fbf802c1f406c1f7b6b41110dcc49cd0ec4a864

SHA512
8186b7b04c8af63bef210dc09ec87bb0b075f6f89624c27f7cda2d0a34e77200e710e1367704d49eaab0e0fda267dc5cd075d3dd6bae8027e95f08f36c54c9d7

Download Submit
C:\Windows\SysWOW64\Hadkpm32.exe

Filesize
45KB

MD5
f5351dd8b6bafc4a73aee219d1858ce1

SHA1
56ab0574d5672da725f8633977654fc4c553ffe7

SHA256
ec330f87bc55af8621712888603954f201a62869a51185a29c6d3cf8d3503295

SHA512
c2577891b0adaec9dc12a30d98e3160a0dc38506686e693c3bb7aa51574edb5e3b6b89b2b31f2ca96b40e4d6d145b6b407b1c287613f4498fa098e192a6bea26

Download Submit
C:\Windows\SysWOW64\Hbanme32.exe

Filesize
45KB

MD5
6edbde7dc200f290a58fd48f6f19395e

SHA1
7a127fcb1ec56b8d996b2043445b0b0b682c673a

SHA256
2077497954758207dcbc7c6b4690c311c568f520644e92d28489e1f4e4bc09dc

SHA512
109587113601435fbb3d70739277f0d39c88669018f01cd043a7315ca6db275970d4c5bf580b5ff6f8a1a626de03a9996bceb3376963368608ea32ad03d1c54e

Download Submit
C:\Windows\SysWOW64\Hbeghene.exe

Filesize
45KB

MD5
5dc24505a9425c5aa43a6d479641ec75

SHA1
f0fc9a8fd5a57c8fdd41eb9592805ba01e7d96c9

SHA256
ce64973e3e8a28254e8f37ecbf42662b847b01eda8e246a33f5b21cd68847ae0

SHA512
c93489eae93e75c29a53c465b0f3aa5db3ba63210fd4c92ca7308a367205b936c06af091c7fc79975871c73885d219012b9996738d9b1269e281bfc53b1b30bc

Download Submit
C:\Windows\SysWOW64\Hcedaheh.exe

Filesize
45KB

MD5
69a860b95fa31c28c60b9a44ea93e650

SHA1
f4945735bc61d9767ab5dffc99ef2b2f6085453b

SHA256
aec672b7a681564fc83be23e52bd0adc1f8c8e121a4cd3c071d17f1661c7113e

SHA512
9b9c0e8de0018a4b6e76c2bb4b8b00cdf718735739fb7ef8d5e06dc8fb92af566526e770decc0abb3b2aee44a75bbb47f8b0205293ee8c55bb977d978751d9b2

Download Submit
C:\Windows\SysWOW64\Hclakimb.exe

Filesize
45KB

MD5
40672ee608fafe500445ec155725cc1f

SHA1
f3300177da36fb1d7c2cf47c4f8c359a580363dd

SHA256
f4b525e7afc78c6170823e82b9e5c0fbdf5d260ea2b674c227f53ca760f40df0

SHA512
164d9bf56c2c2bc19a605d2cd5a75298a4cb92b70dccde02ca57cade1412de3d219abd97490f5c1f401da7f479223bd0f6a54a9330caf8e1e2c8bfea998a7d6d

Download Submit
C:\Windows\SysWOW64\Hcnnaikp.exe

Filesize
45KB

MD5
4e85e225ef90387190bc7aab93486f3e

SHA1
7f2ac4f467581028fdeb84974b14c03fb786dbc6

SHA256
4aa54f017d62d138f1ef761595b16be008da5f238bcce8e11277bd3dc3d95e90

SHA512
3f6de5d75a87f0ea375f3d17d5757230c3804de1d9990b52b31e61377ce836c9780ea4a8a4e589c33a0421511ad8cafd1bcd9f0557ed0ef4e18b8b07d2030143

Download Submit
C:\Windows\SysWOW64\Hcqjfh32.exe

Filesize
45KB

MD5
14267c5ead3aa7d3e44e9056f971c378

SHA1
5b58914a9fe73a5533f9ba2c71e3b3be864dc2f7

SHA256
dc5f2bcab49fb5943bc55b13eaee5ad5043499eb2078600a47017c2f303df407

SHA512
8d12a8a9d06b811f41845387bd85cfd621d5ece8cfa4835ed2861459d82f6af3e66d95b4564b74c57085d2779fc713f341148f9f8f9696dbb947271ff5b2b6d3

Download Submit
C:\Windows\SysWOW64\Hfachc32.exe

Filesize
45KB

MD5
1f2eab74e1de69050510eb629dbed490

SHA1
d5b8c08a435c517893d30a9ee4c885107b52c305

SHA256
addba46801bb6f9f1985765d4444466d429573e4390cfad7b1ed3e326b40c0ef

SHA512
4a52421284f86ce3ea9ead60f74cc8d6f1aad38f67325ec8e9cf6c7ae863de824808567e5665a04e9bdf6f4197098e1c391ddb758278563d2f03ed6c3bce6849

Download Submit
C:\Windows\SysWOW64\Hfcpncdk.exe

Filesize
45KB

MD5
16830d366570febb1df6e0a53b3d17f0

SHA1
52faf2aace89cd504a0c931493980b44a7a2e388

SHA256
c0ea1de3a4bca64f90a8fd9af3c4261d7f38572368c4ceb14db49e3b6ea3b5cc

SHA512
b195c0a0a95bc89577bb6874b10eba858ce4759a7928abfd21d92de8c5c5a87ac159c59033843184ba828dc345febcc5be6c88b5670fd3b9674600afb7e71262

Download Submit
C:\Windows\SysWOW64\Hfjmgdlf.exe

Filesize
45KB

MD5
ae81a740198dac30c9e710ca7f69e8d2

SHA1
efe1cbf4e3de4aa8d1f56aae4b121ecfd7cdf238

SHA256
cd1a582c572563bd2549bc50277a576c999ec7386739ae656f31f473d32b2c77

SHA512
b155a02b7a4e9ca9adf72bf32ca90cbc2af835bfb18d02bfb547deaf38c5ed866f1e9fa64fe7795f1535ebc4b829af3541e5492bb9077b96bb839df43eb200ca

Download Submit
C:\Windows\SysWOW64\Hfofbd32.exe

Filesize
45KB

MD5
f428b63ec6e7269be9abc45c4927b0a9

SHA1
63aefb70b6f47d4f89d1cdd8348a9616ae4e24e9

SHA256
c403ebb298e7315a899c5270ffe1f5789cf4578e434208353b5e7c64f88823ee

SHA512
69f33dcd2bae5cecf6f6e3b3d9ea91ec8c82f2657c7c4712fac105bb8b4c36583996026e7c1fc3253935c8f2164ad609681b3de59294791edf05733379e9445f

Download Submit
C:\Windows\SysWOW64\Hihicplj.exe

Filesize
45KB

MD5
18ac40a9cf229d7a8ce238a48c23fadf

SHA1
a7783b91daee7e61823316d84a3bf2c922b0dbbd

SHA256
3c04099ec8a0e6f5593edf3330cb9236e3e63213e52ae0e5b4173e37ea2a0580

SHA512
9f4446a8b5d93436dd0c526a59c308c95c35f47c137bd5db9962696526bc5d837a3300b6509f7c5b2b4ac902b36e64b7f791411aa6db9e9b63df4a23117d01de

Download Submit
C:\Windows\SysWOW64\Hikfip32.exe

Filesize
45KB

MD5
3560912f476ccd753bbbb38f91e7d610

SHA1
5402bc1c6f60340c0a8a3e18ea3fea9e3d97f83a

SHA256
bd50d9ef39691609a5ceeb61003bd75b399dc6c767f6d1201f53f339fb597f43

SHA512
157d8e74d2dfea0a0f90ebdfcb5ba4aad34f7277e8a908522c266e0b4618c64aea3a75ab8f0e57de054474b136deabb92a047f9bd3c9f3ffdb609970533615da

Download Submit
C:\Windows\SysWOW64\Hjhfnccl.exe

Filesize
45KB

MD5
80f942bfef410e3a7a91b3573ff718ce

SHA1
c8cef01c37d445d0da30111b82336a1f65384391

SHA256
0a6c24fab42668fdcdf1cf5d66ce1c701ec27802045e0f6bf89280106df5dab5

SHA512
deb764cbfbeb187f15bcd1895db6ea013d22821de20694313d0f2a9f68d2e19094cfe2403a16e357af7fbc4ca2d12b669b405292bdd6965e6f2da78959f6dbfc

Download Submit
C:\Windows\SysWOW64\Hjjbcbqj.exe

Filesize
45KB

MD5
b3169f6da7dfb4d486529a94484ce69e

SHA1
9bd6d42af9c4aac93e8cdb2db7e716b2f9a959b3

SHA256
44bd88144a4525a83f761bbda2240f85e54fc9df0c33a79671be687ba5244dc5

SHA512
8db3681ca6424ca77c98bbf8fa3a9e7f4e2ad1c0fa1d764ab7a04d5a9551dbbeed2dea070dd76645d1c195f012bd046fa2b24d1bfbe42e056410788e9f860d4b

Download Submit
C:\Windows\SysWOW64\Hjolnb32.exe

Filesize
45KB

MD5
1d942ae3a8e5d6cffb2630e292910a0e

SHA1
0d86699339c75a7e1f813635bd0f52af9470a1e2

SHA256
ead44ca8ad2a3ea3b2e6833a691591da83d2b3994a5641cdbe1b92065bb874a8

SHA512
5dc5da11cfbe1c30c9e55a31663c89cfe419afe66f5fc8c4986117941028a988359db2e5200c694654193d1746b18a7cf45a6b524f3f98de764bebea1079d2a3

Download Submit
C:\Windows\SysWOW64\Hmdedo32.exe

Filesize
45KB

MD5
aacbb943e701366d3023a116a4dcd312

SHA1
f2852df16ca7526f2db1087600e2f7f62d342af9

SHA256
890a6dad009d8a82c5fa3c1a589c8967793637260494561b12f60fae10a5437d

SHA512
282350d972756f96a01fd8d09813813f375fcec31a3e81bd9612d339a57ae760f050e4988365559e5ad7ed17b75c302fb3eb42ba397525569fd581ce90159b55

Download Submit
C:\Windows\SysWOW64\Hmfbjnbp.exe

Filesize
45KB

MD5
5a145d9e29f39b1f1aef46f3a6603566

SHA1
efd4b393c45305a894aed29b5ea4bb4c38c25e35

SHA256
6747e3549d39e626bde5260d63f4a9277a954b82363e35d85306164e491da97c

SHA512
b326170eaedcd4457f41aaca1ec61ca2c62547062395c9bbea5ee12dee47d7bd8e3bdaf657cd0ef3ddc785d48abd16bbfe78c5167691ccacff9684f18535ad62

Download Submit
C:\Windows\SysWOW64\Hmioonpn.exe

Filesize
45KB

MD5
a6d7df76aef30ec6b0bcd5075cfb1a66

SHA1
f738155852a55587d887eb6b94ef484410a24faa

SHA256
ca254e06372c6dbdfde6c552b23a11c3560e8f51aa3de7317b4f56e2ea4fb5cd

SHA512
2b5fe6a48c6d333d863f8a19af1cb63148f14496cca50bc98eb5a7f4a49122564c4adeef4ed40ed11db057c06209a83e11a40546e85c1cf08a462bdaeb3070f9

Download Submit
C:\Windows\SysWOW64\Hmklen32.exe

Filesize
45KB

MD5
989e953c947ab2ce5ef32bbf69f88a81

SHA1
069ebe9519ba82470fa0645ad7d87654ba38cc04

SHA256
7e8017e83f448d7425414b798e03483528c6ea050bbfa2158dd73a9e2c1326e5

SHA512
d825f5a83b70419db42e051cef32081eca8aefb16fdf53b3d03258fc1ea0e14279a82d9a912b2c393de25d8b3223630316a0e29b5a40488c784e88f3c4499f7b

Download Submit
C:\Windows\SysWOW64\Hmmhjm32.exe

Filesize
45KB

MD5
ca92713d49cf7b3724de2b263de02267

SHA1
cae2740f76728b51870f01bea4123e83b0dcdecd

SHA256
09abceb5a66fdfebbb09d77ca6535e10868cf798a820400d612d02852058294f

SHA512
f8074efe625a3a2548f8c2e017c57438aeacd3b57aa2c247b42801b8764814fb97ac2c75ed12264c2bdf21d0fcbccdd0294cb9ec887e658d95a5341232d7b0a8

Download Submit
C:\Windows\SysWOW64\Hpenfjad.exe

Filesize
45KB

MD5
f594bf439f2be67955e95e5265354db6

SHA1
070e569051b10a1750180ffdbffa3f97d069fd8f

SHA256
424d628f0aac53aa2055e54467d999477fa3a3a0c5170fd2d51b7a8255f7be49

SHA512
d90c04e92b7d99c3ca38917d8f53d0f4bb2a30e172287493e56f00677adb9107006b63c44d8f93013d47144de6972ecf4f9ddabdacb8d431ee17267deaa1ff34

Download Submit
C:\Windows\SysWOW64\Hpgkkioa.exe

Filesize
45KB

MD5
4fd203bfed1546ccfe697ba31fdbdf7a

SHA1
cfecffae29c40f571203bb898a45fe6a6fc59cb6

SHA256
46a701e6e27fa56fe5a30145fed6710f89d1b6eee68eb98c087b85b7c97394d8

SHA512
db9e68cda83336e1bdff695321ba923478765e4a7d9c48b354dc76700b4bb318c0a35c3232e9a0cbe5836f618815cc00af39d3c6648a953ce7980d6a947a7edb

Download Submit
C:\Windows\SysWOW64\Hpihai32.exe

Filesize
45KB

MD5
41f898d557027bd9b00dd45b81852fa8

SHA1
8424198ce9705ce98f825264ab80e0c349f70a60

SHA256
6c9ff5fdd0071bbd252e37d40e05f42e908ec227c9aba0ee80b3d22ac680f660

SHA512
f701625148750be4bf59a5b32a7405e4d29471aa730bbc2407db80d4b10dd07698471d6359619ebd543811c723e598dbdbdad02db3527ef0bf8a1a8ef0881f22

Download Submit
C:\Windows\SysWOW64\Iapjlk32.exe

Filesize
45KB

MD5
8d4857bbe33bfc4184304e3239a106bd

SHA1
24b0b5910d18430afba5831094058483345a7cd0

SHA256
a8bce3ae37b4f3cbdeb0e7bc153520f17a311491d00720ef57797db430ad0128

SHA512
292767c690e3cbf735266a8c4b46b62818fec2d931a734171cf5c1a460b48e0cbf0b979c77723eee8e012ba370c296d0e619bff34320fbf18b2cf738a92e789c

Download Submit
C:\Windows\SysWOW64\Iffmccbi.exe

Filesize
45KB

MD5
c7f13fad0db5ea10a4b0bea17bb57b72

SHA1
60df706b41a804cc0ff6a14fc1574bd8fe693083

SHA256
3156d627409e3e5787c9c57ea28b5a54401e5c644a1fa300c6b9ed4c537f9a4a

SHA512
82b2e2182f1b6bb559c0bb3091af6ae1e13b8aaeb677640c2d5ad0b4122072e7fffff03f1a539e3499924af6710d782525f747f20a7d2c3db6c41260f6f95c76

Download Submit
C:\Windows\SysWOW64\Ijfboafl.exe

Filesize
45KB

MD5
c41cdd348233294f61a0f4c0b6dfa9b9

SHA1
e16d8fbcd730ed34fd7d2b539d09e5324f2ec8aa

SHA256
0f6f0f1496b80b05cfbaba2c7b4ef96fa686aa6c7ab09d98b78e5fd87e84a288

SHA512
f1c4f2b97d3e2a152671de6668a130080e1fea9d3b5606970bfcc9a4039904efdc5432e542325fa3cad5da80901bbd5777d9da9f1e04975767022298d4c4d5b4

Download Submit
C:\Windows\SysWOW64\Ilghlc32.exe

Filesize
45KB

MD5
6e7b88bcba1a0c4d00791fbc320e8756

SHA1
36136f40aa3ad91ed903036900f2b3bbabb08759

SHA256
4014dc4bf2836dc5173f9385bc165046444bc425b4d1f251b54a55e6d2a24f7a

SHA512
719931301582806295e35ffa48338d17f5df00ae35e971aaac21d954efa17a401d52fb1972b04476a5f3ce979646f45810409f55cebbb36dc3c71d099cb3be52

Download Submit
C:\Windows\SysWOW64\Imbaemhc.exe

Filesize
45KB

MD5
9803c4d31b52b3b7c123c66a242bfb3d

SHA1
60c53f70d61d66dc0e6fd76f688f4a1d1526d433

SHA256
22eb8c57a3ff9e0046f305295c430890c73b1d9d24cbe17fd71c768f303550c5

SHA512
7b8f5635f48e21bf879a40757cdcc8c63d78576ed60b5f973092dec5352c86994938155d4b35d1a8b018eb87933cb8db7a614537d8f0627491161ddd96f55e40

Download Submit
C:\Windows\SysWOW64\Jcgbco32.exe

Filesize
45KB

MD5
22e8ba39810eb13054134ef14dd88f51

SHA1
d9e7c8d9cae2e8e7497088fe168dd36957142ec1

SHA256
70ef34b11e62ced9dd78a64b894a1a6e27dfc896fe69becaeab9eed04756f985

SHA512
a77589a2bd07b9405c2b31e5f414eaa702c53367f60da27ac6e15550a71934a2de1ab29509b7aeef424979593ad458fce8eae5801fa25897a358793460592ec8

Download Submit
C:\Windows\SysWOW64\Jdhine32.exe

Filesize
45KB

MD5
49d992d924a85e48da15bff7e7dc92b9

SHA1
a24402e8609a12846b360a247dd03def339db36d

SHA256
3e39d26d7ef16dd84f6617ebff0dbe69285c8bca7289fefea2ac3081fe6443ef

SHA512
9ab46a4845f9fefa96f52f65413e0b18937214eee588c00843fa688c7558517cd3d70244c4fb3aab482e3263568e776f3b3c3f9b9226b74ca8d81a9c79000bdb

Download Submit
C:\Windows\SysWOW64\Jeaikh32.exe

Filesize
45KB

MD5
b3e060323129b73e1efcbd861894bb00

SHA1
1c4f46a2d7efac603962cd967bcaa297c57800f7

SHA256
aff7ab7f21550e4bb0c0909081fcea2c67e27b427773fed8962fed2c58576280

SHA512
d32a26cf98f5d8e1e3f2d8940dae3d8277eecbda0bb974d021cbf876bcf8611aae3c09f5dcad3209131cdb9831a5bc04b54e47fc5c897f2cd1fbd3d609f7a1bc

Download Submit
C:\Windows\SysWOW64\Jfaloa32.exe

Filesize
45KB

MD5
b263e4853616c936b7509ce30ed837f0

SHA1
f11df59933dd5b8b9eec4c199e97be189faa05ab

SHA256
37c970631c29e920c0b43c50878f28db94a3fcf7e2405435c53511690e433d20

SHA512
ef5850e9f6cb8e1570adbf1994880523664605a29af5361875fe22c1b067c1c9b85b2cecda182faa4da2a03496d0da8f059d7a902c761572ce25c58eb8a4f508

Download Submit
C:\Windows\SysWOW64\Jfhbppbc.exe

Filesize
45KB

MD5
470b1950d28871ab62a6b30f8d49c111

SHA1
4805c59d3e8bf944583dae54e6d5595776333f69

SHA256
77906d057047c9b6a86a9da64db53f81f85ae36f0c91a9a7633cce8814368da7

SHA512
3d67702e8a62737edcf83146a77e39778d57fdcc9bbb0ec523e55fe48ffc6c02f3e262bf1e52c88fd181030de8389fa09127b9e9d4b693aa47d5cbf61279fdf5

Download Submit
C:\Windows\SysWOW64\Jjpeepnb.exe

Filesize
45KB

MD5
dd422b78e108870f958fd9cfad5e1af7

SHA1
95336a5b521001e068499ce6514377b2ba1c4f59

SHA256
cd08e99b194752868daaf49b17b1e9a5fbcc7a87bf443a91d4549b8e8352f998

SHA512
48474c34eb30cff55d9aa59ca888b93a2e4a33a2b6c3cd6e9ffc7b45a05557e58b45083ca15e054c0ff3673a10544d7562ad749846f4fe1249c63de7c3b8b9ce

Download Submit
C:\Windows\SysWOW64\Kpbmco32.exe

Filesize
45KB

MD5
11d212104ef8350d3b034a24d75f976b

SHA1
fd8ee6cffbe1d86de5585fcdbebc758170d95fad

SHA256
bbe14edc8fb3bc9f933e19827f6baa309505357ead3f66249155180548cecede

SHA512
779304a5c1d549d11bb72f1ca72ed9b6fc3eabbeb0274dee42ac5949cab5c29a2db47c4b89f798d8aacf5f624f3e73643fcf24577b616830c88cc493552f7fc8

Download Submit
C:\Windows\SysWOW64\Ldoaklml.exe

Filesize
45KB

MD5
b76ba6fe60fd52f9addf991d054802cd

SHA1
c3c0c118e2563918fe167bda7bc1d3e032696b2e

SHA256
56218d373291a4a98b50eae24d6a479a6e90dad5af099359eac0195c8b20425d

SHA512
d7bf8e167d7501d28d8729950a24ba8d3b239261f7768f3faa71182c8c6eba4001864021ca1bd9d2194144f22aa8787c84d209db6c5b6286bc4ce0e3e28d4ec8

Download Submit
C:\Windows\SysWOW64\Pdifoehl.exe

Filesize
45KB

MD5
93e64a83e9e1be3cd7ed2d4c43db19cc

SHA1
68f718768cf75a7e1af5e495617cf92ac367213a

SHA256
dba86eaf6a831b874760e08d50b7be65b8cb1a5962048909e6adffb0d53c15b7

SHA512
87f926eab4e78729971b05bc71bc86cc8f19f7609dd655707d0451bacd8db4786724f4fee43a50b6dcb7f5b500295f8f60f6f38cb7b38edb6ebb4a3c782d14cd

Download Submit
memory/208-296-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/368-84-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/380-108-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/672-356-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/844-309-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/880-412-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/896-438-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/928-176-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/988-32-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1044-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1076-256-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1160-144-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1188-344-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1348-244-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1420-120-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1548-164-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1552-72-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1652-128-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1688-368-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1748-334-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1752-268-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1948-3628-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1956-17-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2000-188-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2044-168-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2120-425-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2180-382-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2260-192-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2312-3639-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2372-346-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2392-303-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2400-316-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2424-278-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2432-406-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2524-40-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2568-3650-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2688-424-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3104-328-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3144-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3188-207-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3244-266-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3292-426-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3332-136-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3392-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3560-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3592-358-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3748-3649-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3880-248-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4100-88-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4160-232-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4172-437-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4176-285-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4212-290-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4304-380-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4308-28-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4328-95-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4380-314-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4384-388-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4388-3640-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4432-228-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4464-327-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4468-398-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4500-370-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4532-203-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4552-47-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4852-112-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4928-152-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4976-220-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5044-404-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5096-3651-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/6440-3638-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/12324-3642-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/12504-3641-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/12572-3652-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/12692-3648-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/12756-3631-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/12808-3647-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/12884-3637-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/12908-3646-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/12984-3645-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/13000-3629-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/13092-3644-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/13140-3627-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/13196-3630-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/13216-3643-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/13324-3626-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/13364-3625-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/13404-3624-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/13440-3623-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/13476-3622-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/13512-3621-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads