9f8c09991a92061dfb7ae335a947e840f223003e528d6d049af2a86106806a7d

Analysis

max time kernel
153s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f8c09991a92061dfb7ae335a947e840f223003e528d6d049af2a86106806a7d.exe
Size

488KB
MD5

a5ed0e4ffc25394b4f9b774e95df81cf
SHA1

e6919006ca8ae67fa695e52810ad2ca04171fbf3
SHA256

9f8c09991a92061dfb7ae335a947e840f223003e528d6d049af2a86106806a7d
SHA512

32bd35013e54b037d8ae214619b94fc7d607a710c787cc1e2f82504cbf869904b40dd5e4ad4fe45e14038990e798a2b5cb77f7ab9e1a246ecabe3e5862dd6ad7
SSDEEP

6144:maY4Yfon/TNId/1fon/T9P7GSon/TNId/1fon/T2oI0YokOsfY7Uon2KO:LYaNIVyeNIVy2oIvPKiKO

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jniood32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahdpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Egened32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lafmjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqphic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baadiiif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jofalmmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqncnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiacacpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obpkcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbiejoaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnnbqnjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kqnbkl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlmdbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhblllfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lldfjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Midfokpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpaihooo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkaicd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkjeomld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipkdek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gndbie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkpnga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfadkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikqqlgem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enlcahgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gclafmej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocfdgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Podkmgop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ledepn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpjmph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddfbgelh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkabbgol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihgnkkbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlpfhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eppjfgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcdciiec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfkkqmiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkkaiphj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjolie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igfkfo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhoipb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gqnejaff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkohchko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkabbgol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abpcja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iohjlmeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgogbgei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odalmibl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eqkondfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdngpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kniieo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncofplba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpnmbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Feenjgfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acppddig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbnpcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emkndc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmeoqlpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qemhbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfbcke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjecpkcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpfbcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hiacacpg.exe

Executes dropped EXE 64 IoCs

pid	Process
2008	Iohjlmeg.exe
2384	Ifbbig32.exe
4124	Iokgal32.exe
2352	Ifdonfka.exe
2928	Igfkfo32.exe
3712	Ibkpcg32.exe
4476	Ioopml32.exe
1296	Iigdfa32.exe
2888	Ioambknl.exe
1552	Ibpiogmp.exe
4884	Jnnpdg32.exe
2404	Lldfjh32.exe
1756	Midfokpm.exe
1388	Nbadcpbh.exe
1624	Oidofh32.exe
4504	Oiihahme.exe
4692	Ocamjm32.exe
2804	Ocdjpmac.exe
3812	Ocffempp.exe
3692	Pedbahod.exe
4516	Pcicklnn.exe
4676	Phjenbhp.exe
1564	Ppamophb.exe
2212	Pofjpl32.exe
932	Aqoiqn32.exe
3128	Aijnep32.exe
2020	Ajjjocap.exe
4256	Bqdblmhl.exe
4356	Bfqkddfd.exe
2808	Bfedoc32.exe
5108	Bpnihiio.exe
4872	Bfjnjcni.exe
876	Cfadkb32.exe
8	Cceddf32.exe
4960	Caienjfd.exe
3124	Cidjbmcp.exe
3500	Dgejpd32.exe
4092	Diffglam.exe
1948	Djfcaohp.exe
3972	Dapkni32.exe
552	Dcogje32.exe
2584	Dikpbl32.exe
2380	Dpehof32.exe
4264	Djklmo32.exe
2028	Dmihij32.exe
4472	Djmibn32.exe
2748	Eagaoh32.exe
632	Efdjgo32.exe
4836	Emnbdioi.exe
312	Eplnpeol.exe
2708	Epokedmj.exe
1532	Efhcbodf.exe
3684	Embkoi32.exe
4372	Epagkd32.exe
760	Emehdh32.exe
3600	Edopabqn.exe
1788	Filiii32.exe
568	Fdamgb32.exe
3984	Fkkeclfh.exe
3700	Hkjjlhle.exe
4288	Ikqqlgem.exe
4996	Iqmidndd.exe
3676	Iggaah32.exe
2852	Iqpfjnba.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gjcmngnj.exe	Gcjdam32.exe
File created	C:\Windows\SysWOW64\Bkoigdom.exe	Bhamkipi.exe
File created	C:\Windows\SysWOW64\Jacpcl32.exe	Jjihfbno.exe
File created	C:\Windows\SysWOW64\Hfibjl32.dll	Ghojbq32.exe
File opened for modification	C:\Windows\SysWOW64\Nghekkmn.exe	Manmoq32.exe
File created	C:\Windows\SysWOW64\Adnbpqkj.dll	Bkibgh32.exe
File created	C:\Windows\SysWOW64\Kikdcj32.dll	Mkohaj32.exe
File opened for modification	C:\Windows\SysWOW64\Bfendmoc.exe	Bcfahbpo.exe
File created	C:\Windows\SysWOW64\Gbabigfj.exe	Glengm32.exe
File created	C:\Windows\SysWOW64\Dodfed32.dll	Eqkondfl.exe
File opened for modification	C:\Windows\SysWOW64\Qppkhfec.exe	Qifbll32.exe
File created	C:\Windows\SysWOW64\Jecffa32.dll	Mbbagk32.exe
File created	C:\Windows\SysWOW64\Fniihmpf.exe	Fkjmlaac.exe
File created	C:\Windows\SysWOW64\Acppddig.exe	Akihcfid.exe
File created	C:\Windows\SysWOW64\Ncabfkqo.exe	Nabfjpak.exe
File created	C:\Windows\SysWOW64\Coiaiakf.exe	Cioilg32.exe
File opened for modification	C:\Windows\SysWOW64\Dfjpfj32.exe	Diccgfpd.exe
File created	C:\Windows\SysWOW64\Ndnljbeg.dll	Lgdidgjg.exe
File created	C:\Windows\SysWOW64\Hlppno32.exe	Hiacacpg.exe
File created	C:\Windows\SysWOW64\Jpgdai32.exe	Jafdcbge.exe
File created	C:\Windows\SysWOW64\Oihoif32.dll	Emehdh32.exe
File opened for modification	C:\Windows\SysWOW64\Hkjjlhle.exe	Fkkeclfh.exe
File created	C:\Windows\SysWOW64\Eeccjdie.dll	Klhnfo32.exe
File created	C:\Windows\SysWOW64\Daollh32.exe	Dalofi32.exe
File opened for modification	C:\Windows\SysWOW64\Fdbkja32.exe	Fbdnne32.exe
File created	C:\Windows\SysWOW64\Caienjfd.exe	Cceddf32.exe
File created	C:\Windows\SysWOW64\Eehnaq32.dll	Bajqda32.exe
File opened for modification	C:\Windows\SysWOW64\Cnaaib32.exe	Ckbemgcp.exe
File created	C:\Windows\SysWOW64\Okhbek32.dll	Cdkifmjq.exe
File created	C:\Windows\SysWOW64\Gjecbd32.dll	Bmjkic32.exe
File opened for modification	C:\Windows\SysWOW64\Jekqmhia.exe	Joahqn32.exe
File created	C:\Windows\SysWOW64\Ekfkeh32.dll	Keimof32.exe
File created	C:\Windows\SysWOW64\Djmibn32.exe	Dmihij32.exe
File opened for modification	C:\Windows\SysWOW64\Akffafgg.exe	Njiegl32.exe
File created	C:\Windows\SysWOW64\Cqglioac.dll	Nnbnhedj.exe
File created	C:\Windows\SysWOW64\Pmpockdl.dll	Afbgkl32.exe
File created	C:\Windows\SysWOW64\Jpbhgp32.dll	Ehpadhll.exe
File opened for modification	C:\Windows\SysWOW64\Jlikkkhn.exe	Jadgnb32.exe
File created	C:\Windows\SysWOW64\Aijnep32.exe	Aqoiqn32.exe
File created	C:\Windows\SysWOW64\Hjjcnl32.dll	Hbdgec32.exe
File created	C:\Windows\SysWOW64\Nbadcpbh.exe	Midfokpm.exe
File created	C:\Windows\SysWOW64\Fjadje32.exe	Fdglmkeg.exe
File created	C:\Windows\SysWOW64\Jjdejk32.dll	Hmnmgnoh.exe
File created	C:\Windows\SysWOW64\Kngekilj.dll	Ieagmcmq.exe
File created	C:\Windows\SysWOW64\Kiejmi32.exe	Kqnbkl32.exe
File opened for modification	C:\Windows\SysWOW64\Kcbfcigf.exe	Klhnfo32.exe
File opened for modification	C:\Windows\SysWOW64\Lkabjbih.exe	Lnnbqnjn.exe
File opened for modification	C:\Windows\SysWOW64\Aojefobm.exe	Aogiap32.exe
File created	C:\Windows\SysWOW64\Ldldehjm.dll	Hedafk32.exe
File created	C:\Windows\SysWOW64\Ejlgio32.dll	Lmbhgd32.exe
File opened for modification	C:\Windows\SysWOW64\Qifbll32.exe	Qfgfpp32.exe
File opened for modification	C:\Windows\SysWOW64\Fohfbpgi.exe	Fniihmpf.exe
File created	C:\Windows\SysWOW64\Emphocjj.exe	Efepbi32.exe
File created	C:\Windows\SysWOW64\Lkchelci.exe	Lqndhcdc.exe
File created	C:\Windows\SysWOW64\Ndflak32.exe	Nagpeo32.exe
File created	C:\Windows\SysWOW64\Nlefjnno.exe	Napameoi.exe
File opened for modification	C:\Windows\SysWOW64\Bombmcec.exe	Bmofagfp.exe
File opened for modification	C:\Windows\SysWOW64\Diccgfpd.exe	Ccgjopal.exe
File created	C:\Windows\SysWOW64\Bajqda32.exe	Bkphhgfc.exe
File opened for modification	C:\Windows\SysWOW64\Cdmfllhn.exe	Coqncejg.exe
File created	C:\Windows\SysWOW64\Llnnmhfe.exe	Ledepn32.exe
File created	C:\Windows\SysWOW64\Leoema32.dll	Fkkeclfh.exe
File created	C:\Windows\SysWOW64\Malpia32.exe	Mkohaj32.exe
File created	C:\Windows\SysWOW64\Oeehkn32.exe	Nmnqjp32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hejqldci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkkaiphj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hjolie32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnajppda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kcjjhdjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gcghkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiciojhd.dll"	Khgbqkhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdnjfojj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jacpcl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djklmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbgihaji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nefdbekh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbplml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Geoapenf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jafdcbge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fohogfgd.dll"	Ddhomdje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hchqbkkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qemhbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hedafk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekfjcc32.dll"	Iliinc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcnobqph.dll"	Jglklggl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ejojljqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enabbk32.dll"	Ecefqnel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmfbkh32.dll"	Gnmlhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnbnhedj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gnmlhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijiopd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqgkec32.dll"	Igfkfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iicfkknk.dll"	Pcicklnn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phjenbhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Epdime32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhbjnc32.dll"	Eddnic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Neqopnhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dahcld32.dll"	Ibhkfm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enfckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gimqajgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlelal32.dll"	Iomoenej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjgeedch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggkqgaol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdokpl32.dll"	Mifljdjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbhijepa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckgofgjn.dll"	Aefjii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dccfme32.dll"	Dkkaiphj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pigbqakg.dll"	Emmdom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jilpfgkh.dll"	Dhphmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcfidb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdbbeh32.dll"	Bqdblmhl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkohaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgkfnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjecbd32.dll"	Bmjkic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbdgec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncabfkqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gnnccl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jadgnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfadkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkgillpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilhkigcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifkqol32.dll"	Jddiegbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gipjam32.dll"	Nfnjbdep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pbbgicnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgfcle32.dll"	Bkoigdom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hlpfhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anfjipgp.dll"	Ccpdoqgd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 2008	4032	9f8c09991a92061dfb7ae335a947e840f223003e528d6d049af2a86106806a7d.exe	87
PID 4032 wrote to memory of 2008	4032	9f8c09991a92061dfb7ae335a947e840f223003e528d6d049af2a86106806a7d.exe	87
PID 4032 wrote to memory of 2008	4032	9f8c09991a92061dfb7ae335a947e840f223003e528d6d049af2a86106806a7d.exe	87
PID 2008 wrote to memory of 2384	2008	Iohjlmeg.exe	88
PID 2008 wrote to memory of 2384	2008	Iohjlmeg.exe	88
PID 2008 wrote to memory of 2384	2008	Iohjlmeg.exe	88
PID 2384 wrote to memory of 4124	2384	Ifbbig32.exe	89
PID 2384 wrote to memory of 4124	2384	Ifbbig32.exe	89
PID 2384 wrote to memory of 4124	2384	Ifbbig32.exe	89
PID 4124 wrote to memory of 2352	4124	Iokgal32.exe	90
PID 4124 wrote to memory of 2352	4124	Iokgal32.exe	90
PID 4124 wrote to memory of 2352	4124	Iokgal32.exe	90
PID 2352 wrote to memory of 2928	2352	Ifdonfka.exe	91
PID 2352 wrote to memory of 2928	2352	Ifdonfka.exe	91
PID 2352 wrote to memory of 2928	2352	Ifdonfka.exe	91
PID 2928 wrote to memory of 3712	2928	Igfkfo32.exe	92
PID 2928 wrote to memory of 3712	2928	Igfkfo32.exe	92
PID 2928 wrote to memory of 3712	2928	Igfkfo32.exe	92
PID 3712 wrote to memory of 4476	3712	Ibkpcg32.exe	93
PID 3712 wrote to memory of 4476	3712	Ibkpcg32.exe	93
PID 3712 wrote to memory of 4476	3712	Ibkpcg32.exe	93
PID 4476 wrote to memory of 1296	4476	Ioopml32.exe	94
PID 4476 wrote to memory of 1296	4476	Ioopml32.exe	94
PID 4476 wrote to memory of 1296	4476	Ioopml32.exe	94
PID 1296 wrote to memory of 2888	1296	Iigdfa32.exe	95
PID 1296 wrote to memory of 2888	1296	Iigdfa32.exe	95
PID 1296 wrote to memory of 2888	1296	Iigdfa32.exe	95
PID 2888 wrote to memory of 1552	2888	Ioambknl.exe	96
PID 2888 wrote to memory of 1552	2888	Ioambknl.exe	96
PID 2888 wrote to memory of 1552	2888	Ioambknl.exe	96
PID 1552 wrote to memory of 4884	1552	Ibpiogmp.exe	98
PID 1552 wrote to memory of 4884	1552	Ibpiogmp.exe	98
PID 1552 wrote to memory of 4884	1552	Ibpiogmp.exe	98
PID 4884 wrote to memory of 2404	4884	Jnnpdg32.exe	100
PID 4884 wrote to memory of 2404	4884	Jnnpdg32.exe	100
PID 4884 wrote to memory of 2404	4884	Jnnpdg32.exe	100
PID 2404 wrote to memory of 1756	2404	Lldfjh32.exe	101
PID 2404 wrote to memory of 1756	2404	Lldfjh32.exe	101
PID 2404 wrote to memory of 1756	2404	Lldfjh32.exe	101
PID 1756 wrote to memory of 1388	1756	Midfokpm.exe	102
PID 1756 wrote to memory of 1388	1756	Midfokpm.exe	102
PID 1756 wrote to memory of 1388	1756	Midfokpm.exe	102
PID 1388 wrote to memory of 1624	1388	Nbadcpbh.exe	103
PID 1388 wrote to memory of 1624	1388	Nbadcpbh.exe	103
PID 1388 wrote to memory of 1624	1388	Nbadcpbh.exe	103
PID 1624 wrote to memory of 4504	1624	Oidofh32.exe	105
PID 1624 wrote to memory of 4504	1624	Oidofh32.exe	105
PID 1624 wrote to memory of 4504	1624	Oidofh32.exe	105
PID 4504 wrote to memory of 4692	4504	Oiihahme.exe	106
PID 4504 wrote to memory of 4692	4504	Oiihahme.exe	106
PID 4504 wrote to memory of 4692	4504	Oiihahme.exe	106
PID 4692 wrote to memory of 2804	4692	Ocamjm32.exe	107
PID 4692 wrote to memory of 2804	4692	Ocamjm32.exe	107
PID 4692 wrote to memory of 2804	4692	Ocamjm32.exe	107
PID 2804 wrote to memory of 3812	2804	Ocdjpmac.exe	108
PID 2804 wrote to memory of 3812	2804	Ocdjpmac.exe	108
PID 2804 wrote to memory of 3812	2804	Ocdjpmac.exe	108
PID 3812 wrote to memory of 3692	3812	Ocffempp.exe	109
PID 3812 wrote to memory of 3692	3812	Ocffempp.exe	109
PID 3812 wrote to memory of 3692	3812	Ocffempp.exe	109
PID 3692 wrote to memory of 4516	3692	Pedbahod.exe	110
PID 3692 wrote to memory of 4516	3692	Pedbahod.exe	110
PID 3692 wrote to memory of 4516	3692	Pedbahod.exe	110
PID 4516 wrote to memory of 4676	4516	Pcicklnn.exe	111

C:\Users\Admin\AppData\Local\Temp\9f8c09991a92061dfb7ae335a947e840f223003e528d6d049af2a86106806a7d.exe
"C:\Users\Admin\AppData\Local\Temp\9f8c09991a92061dfb7ae335a947e840f223003e528d6d049af2a86106806a7d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\SysWOW64\Iohjlmeg.exe
  C:\Windows\system32\Iohjlmeg.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\Ifbbig32.exe
    C:\Windows\system32\Ifbbig32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Windows\SysWOW64\Iokgal32.exe
      C:\Windows\system32\Iokgal32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4124
    - - C:\Windows\SysWOW64\Ifdonfka.exe
        
        C:\Windows\system32\Ifdonfka.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2352
      - C:\Windows\SysWOW64\Igfkfo32.exe
        
        C:\Windows\system32\Igfkfo32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\SysWOW64\Ibkpcg32.exe
        
        C:\Windows\system32\Ibkpcg32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\SysWOW64\Ioopml32.exe
        
        C:\Windows\system32\Ioopml32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\Iigdfa32.exe
        
        C:\Windows\system32\Iigdfa32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1296
        
        C:\Windows\SysWOW64\Ioambknl.exe
        
        C:\Windows\system32\Ioambknl.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2888
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\SysWOW64\Jnnpdg32.exe
        
        C:\Windows\system32\Jnnpdg32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\SysWOW64\Lldfjh32.exe
        
        C:\Windows\system32\Lldfjh32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\SysWOW64\Midfokpm.exe
        
        C:\Windows\system32\Midfokpm.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\SysWOW64\Nbadcpbh.exe
        
        C:\Windows\system32\Nbadcpbh.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Windows\SysWOW64\Oiihahme.exe
        
        C:\Windows\system32\Oiihahme.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\SysWOW64\Ocamjm32.exe
        
        C:\Windows\system32\Ocamjm32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2804
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Windows\SysWOW64\Pedbahod.exe
        
        C:\Windows\system32\Pedbahod.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\SysWOW64\Pcicklnn.exe
        
        C:\Windows\system32\Pcicklnn.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4676
        
        C:\Windows\SysWOW64\Ppamophb.exe
        
        C:\Windows\system32\Ppamophb.exe
        24⤵
        Executes dropped EXE
        
        PID:1564
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        25⤵
        Executes dropped EXE
        
        PID:2212
        
        C:\Windows\SysWOW64\Aqoiqn32.exe
        
        C:\Windows\system32\Aqoiqn32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:932
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        27⤵
        Executes dropped EXE
        
        PID:3128
        
        C:\Windows\SysWOW64\Ajjjocap.exe
        
        C:\Windows\system32\Ajjjocap.exe
        28⤵
        Executes dropped EXE
        
        PID:2020
        
        C:\Windows\SysWOW64\Bqdblmhl.exe
        
        C:\Windows\system32\Bqdblmhl.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4256
        
        C:\Windows\SysWOW64\Bfqkddfd.exe
        
        C:\Windows\system32\Bfqkddfd.exe
        30⤵
        Executes dropped EXE
        
        PID:4356
        
        C:\Windows\SysWOW64\Bfedoc32.exe
        
        C:\Windows\system32\Bfedoc32.exe
        31⤵
        Executes dropped EXE
        
        PID:2808
        
        C:\Windows\SysWOW64\Bpnihiio.exe
        
        C:\Windows\system32\Bpnihiio.exe
        32⤵
        Executes dropped EXE
        
        PID:5108
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        33⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SysWOW64\Cfadkb32.exe
        
        C:\Windows\system32\Cfadkb32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:876
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:8
        
        C:\Windows\SysWOW64\Caienjfd.exe
        
        C:\Windows\system32\Caienjfd.exe
        36⤵
        Executes dropped EXE
        
        PID:4960
        
        C:\Windows\SysWOW64\Cidjbmcp.exe
        
        C:\Windows\system32\Cidjbmcp.exe
        37⤵
        Executes dropped EXE
        
        PID:3124
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        38⤵
        Executes dropped EXE
        
        PID:3500
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        39⤵
        Executes dropped EXE
        
        PID:4092
        
        C:\Windows\SysWOW64\Djfcaohp.exe
        
        C:\Windows\system32\Djfcaohp.exe
        40⤵
        Executes dropped EXE
        
        PID:1948
        
        C:\Windows\SysWOW64\Dapkni32.exe
        
        C:\Windows\system32\Dapkni32.exe
        41⤵
        Executes dropped EXE
        
        PID:3972
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        42⤵
        Executes dropped EXE
        
        PID:552
        
        C:\Windows\SysWOW64\Dikpbl32.exe
        
        C:\Windows\system32\Dikpbl32.exe
        43⤵
        Executes dropped EXE
        
        PID:2584
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        44⤵
        Executes dropped EXE
        
        PID:2380
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4264
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2028
        
        C:\Windows\SysWOW64\Djmibn32.exe
        
        C:\Windows\system32\Djmibn32.exe
        47⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Eagaoh32.exe
        
        C:\Windows\system32\Eagaoh32.exe
        48⤵
        Executes dropped EXE
        
        PID:2748
        
        C:\Windows\SysWOW64\Efdjgo32.exe
        
        C:\Windows\system32\Efdjgo32.exe
        49⤵
        Executes dropped EXE
        
        PID:632
        
        C:\Windows\SysWOW64\Emnbdioi.exe
        
        C:\Windows\system32\Emnbdioi.exe
        50⤵
        Executes dropped EXE
        
        PID:4836
        
        C:\Windows\SysWOW64\Eplnpeol.exe
        
        C:\Windows\system32\Eplnpeol.exe
        51⤵
        Executes dropped EXE
        
        PID:312
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        52⤵
        Executes dropped EXE
        
        PID:2708
        
        C:\Windows\SysWOW64\Efhcbodf.exe
        
        C:\Windows\system32\Efhcbodf.exe
        53⤵
        Executes dropped EXE
        
        PID:1532
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        54⤵
        Executes dropped EXE
        
        PID:3684
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        55⤵
        Executes dropped EXE
        
        PID:4372
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:760
        
        C:\Windows\SysWOW64\Edopabqn.exe
        
        C:\Windows\system32\Edopabqn.exe
        57⤵
        Executes dropped EXE
        
        PID:3600
        
        C:\Windows\SysWOW64\Filiii32.exe
        
        C:\Windows\system32\Filiii32.exe
        58⤵
        Executes dropped EXE
        
        PID:1788
        
        C:\Windows\SysWOW64\Fdamgb32.exe
        
        C:\Windows\system32\Fdamgb32.exe
        59⤵
        Executes dropped EXE
        
        PID:568
        
        C:\Windows\SysWOW64\Fkkeclfh.exe
        
        C:\Windows\system32\Fkkeclfh.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3984
        
        C:\Windows\SysWOW64\Hkjjlhle.exe
        
        C:\Windows\system32\Hkjjlhle.exe
        61⤵
        Executes dropped EXE
        
        PID:3700
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4288
        
        C:\Windows\SysWOW64\Iqmidndd.exe
        
        C:\Windows\system32\Iqmidndd.exe
        63⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Iggaah32.exe
        
        C:\Windows\system32\Iggaah32.exe
        64⤵
        Executes dropped EXE
        
        PID:3676
        
        C:\Windows\SysWOW64\Iqpfjnba.exe
        
        C:\Windows\system32\Iqpfjnba.exe
        65⤵
        Executes dropped EXE
        
        PID:2852
        
        C:\Windows\SysWOW64\Ihgnkkbd.exe
        
        C:\Windows\system32\Ihgnkkbd.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2976
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        67⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\Jglklggl.exe
        
        C:\Windows\system32\Jglklggl.exe
        68⤵
        Modifies registry class
        
        PID:4600
        
        C:\Windows\SysWOW64\Jbaojpgb.exe
        
        C:\Windows\system32\Jbaojpgb.exe
        69⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Jgogbgei.exe
        
        C:\Windows\system32\Jgogbgei.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5200
        
        C:\Windows\SysWOW64\Jjmcnbdm.exe
        
        C:\Windows\system32\Jjmcnbdm.exe
        71⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        72⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Jgadgf32.exe
        
        C:\Windows\system32\Jgadgf32.exe
        73⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5396
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        75⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5488
        
        C:\Windows\SysWOW64\Kqnbkl32.exe
        
        C:\Windows\system32\Kqnbkl32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5536
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        78⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        79⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Kgjgne32.exe
        
        C:\Windows\system32\Kgjgne32.exe
        80⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        81⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        82⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Kgopidgf.exe
        
        C:\Windows\system32\Kgopidgf.exe
        83⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Kniieo32.exe
        
        C:\Windows\system32\Kniieo32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5836
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        85⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Leenhhdn.exe
        
        C:\Windows\system32\Leenhhdn.exe
        86⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5956
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        88⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Lbkkgl32.exe
        
        C:\Windows\system32\Lbkkgl32.exe
        89⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        90⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        91⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        92⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        93⤵
        Drops file in System32 directory
        
        PID:5232
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4956
        
        C:\Windows\SysWOW64\Mahnhhod.exe
        
        C:\Windows\system32\Mahnhhod.exe
        95⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Mjpbam32.exe
        
        C:\Windows\system32\Mjpbam32.exe
        96⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Mhdckaeo.exe
        
        C:\Windows\system32\Mhdckaeo.exe
        97⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        98⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        99⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        100⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        101⤵
        Modifies registry class
        
        PID:5904
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        102⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6064
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        104⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Njiegl32.exe
        
        C:\Windows\system32\Njiegl32.exe
        105⤵
        Drops file in System32 directory
        
        PID:5328
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        106⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        107⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        108⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        109⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        110⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        111⤵
        Drops file in System32 directory
        
        PID:1608
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        112⤵
        Modifies registry class
        
        PID:1656
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        113⤵
        Drops file in System32 directory
        
        PID:5128
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        114⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        115⤵
        Drops file in System32 directory
        
        PID:5632
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        116⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        117⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        118⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        119⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        120⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1512
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        122⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        123⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        124⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        125⤵
        Modifies registry class
        
        PID:6200
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        126⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        127⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Cbeapmll.exe
        
        C:\Windows\system32\Cbeapmll.exe
        128⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        129⤵
        Drops file in System32 directory
        
        PID:6384
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        130⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        131⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        132⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        133⤵
        Drops file in System32 directory
        
        PID:6560
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        134⤵
        Drops file in System32 directory
        
        PID:6608
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        135⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        136⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6736
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        138⤵
        Modifies registry class
        
        PID:6780
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        139⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        140⤵
        Drops file in System32 directory
        
        PID:6872
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        141⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        142⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        143⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        144⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        145⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        146⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        147⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        148⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        149⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        150⤵
        Drops file in System32 directory
        
        PID:6312
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        151⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6440
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6508
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        154⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        155⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        156⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        157⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        158⤵
        Modifies registry class
        
        PID:6868
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        159⤵
        Drops file in System32 directory
        
        PID:6940
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        160⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        161⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        162⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        163⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        164⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6500
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        166⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        167⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        168⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        169⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        170⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        171⤵
        Drops file in System32 directory
        
        PID:7008
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        172⤵
        Drops file in System32 directory
        
        PID:7096
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        173⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        174⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        175⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        176⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        177⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        178⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        179⤵
        
        PID:380
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        180⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        181⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        182⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        183⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        184⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        185⤵
        Drops file in System32 directory
        
        PID:6764
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        186⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        187⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7040
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        188⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6524
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        190⤵
        
        PID:384
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        191⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        192⤵
        Drops file in System32 directory
        
        PID:4420
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        193⤵
        Modifies registry class
        
        PID:6912
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        194⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        195⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        196⤵
        Modifies registry class
        
        PID:6904
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        197⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        198⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        199⤵
        Drops file in System32 directory
        
        PID:7264
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        200⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7340
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        202⤵
        Drops file in System32 directory
        
        PID:7388
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        203⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7508
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        205⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        206⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        207⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7736
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        209⤵
        Drops file in System32 directory
        
        PID:7780
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        210⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        211⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        212⤵
        Modifies registry class
        
        PID:7916
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        213⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        214⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8064
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        216⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        217⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        218⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7256
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        220⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        221⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        222⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        223⤵
        Modifies registry class
        
        PID:7532
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7604
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        225⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        226⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        227⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        228⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        229⤵
        Modifies registry class
        
        PID:7928
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        230⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        231⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        232⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        233⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        234⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        235⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        236⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        237⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        238⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        239⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        240⤵
        Modifies registry class
        
        PID:7924
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        241⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        242⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        243⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7204
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        244⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        245⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7792
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        247⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        248⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        249⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        250⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        251⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        252⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        253⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        254⤵
        Modifies registry class
        
        PID:1852
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        255⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        256⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        257⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        258⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        259⤵
        Modifies registry class
        
        PID:7596
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        260⤵
        Modifies registry class
        
        PID:3200
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        261⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        262⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        263⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        264⤵
        Drops file in System32 directory
        
        PID:8372
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        265⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        266⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        267⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8568
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        269⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8688
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        271⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        272⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        273⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        274⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        275⤵
        Drops file in System32 directory
        
        PID:8896
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        276⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        277⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        278⤵
        Modifies registry class
        
        PID:9028
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        279⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        280⤵
        Modifies registry class
        
        PID:9120
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        281⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        282⤵
        Drops file in System32 directory
        
        PID:9212
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        283⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        284⤵
        
        PID:3268
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2008
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        286⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        287⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        288⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        289⤵
        Drops file in System32 directory
        
        PID:8512
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        290⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        291⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        292⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        293⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        294⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        295⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        296⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        297⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        298⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        299⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        300⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        301⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        302⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        303⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        304⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        305⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        306⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        307⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        308⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        309⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        310⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        311⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        312⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        313⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        314⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        315⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        316⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        317⤵
        Drops file in System32 directory
        
        PID:4924
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        318⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        319⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        320⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        321⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        322⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8724
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        324⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        325⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        326⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        327⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        328⤵
        
        PID:936
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        329⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        330⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        331⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        332⤵
        Drops file in System32 directory
        
        PID:4648
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        333⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        334⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        335⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1936
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        336⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        337⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        338⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8908
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        340⤵
        Drops file in System32 directory
        
        PID:8968
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        341⤵
        Drops file in System32 directory
        
        PID:9092
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        342⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        343⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        344⤵
        Drops file in System32 directory
        
        PID:1552
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        345⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        346⤵
        Drops file in System32 directory
        
        PID:8412
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        347⤵
        Modifies registry class
        
        PID:3052
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        348⤵
        Drops file in System32 directory
        
        PID:8700
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        349⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        350⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        351⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        352⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        353⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        354⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        355⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        356⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        357⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        358⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        359⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        360⤵
        Modifies registry class
        
        PID:9300
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        361⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        362⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        363⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        364⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        365⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        366⤵
        Modifies registry class
        
        PID:9588
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        367⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        368⤵
        Modifies registry class
        
        PID:9712
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        369⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        370⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        371⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        372⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        373⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        374⤵
        Drops file in System32 directory
        
        PID:9992
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10044
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10116
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        377⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        378⤵
        Modifies registry class
        
        PID:10224
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        379⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        380⤵
        Drops file in System32 directory
        
        PID:444
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        381⤵
        Drops file in System32 directory
        
        PID:9388
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        382⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9456
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        384⤵
        
        PID:876
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        385⤵
        Modifies registry class
        
        PID:4048
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        386⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        387⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        388⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        389⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        390⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        391⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        392⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        393⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        394⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        395⤵
        Modifies registry class
        
        PID:2380
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        396⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:752
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        397⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        398⤵
        Modifies registry class
        
        PID:10096
        
        C:\Windows\SysWOW64\Ggmmlamj.exe
        
        C:\Windows\system32\Ggmmlamj.exe
        399⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        400⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        401⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        402⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        403⤵
        Drops file in System32 directory
        
        PID:9316
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:760
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        405⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        406⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        407⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        408⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2124
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        410⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        411⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        412⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        413⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        414⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        415⤵
        Modifies registry class
        
        PID:1308
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        416⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        417⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        418⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        419⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        420⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        421⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        422⤵
        Drops file in System32 directory
        
        PID:9484
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        423⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        424⤵
        
        PID:568
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        425⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        426⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        427⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        428⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        429⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4368
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        430⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        431⤵
        
        PID:364
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        432⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        433⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        434⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        435⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        436⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        437⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        438⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10128
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        439⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        440⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9308
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        441⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        442⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        443⤵
        
        PID:748
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        444⤵
        
        PID:332
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        445⤵
        Modifies registry class
        
        PID:5404
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        446⤵
        Modifies registry class
        
        PID:5468
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        447⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        448⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        449⤵
        
        PID:8
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        450⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        451⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        452⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3628
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        453⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        454⤵
        Modifies registry class
        
        PID:5360
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5856
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        456⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        457⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        458⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        459⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        460⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        461⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        462⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6092
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        463⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        464⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Bpqjjjjl.exe
        
        C:\Windows\system32\Bpqjjjjl.exe
        465⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        466⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Babcil32.exe
        
        C:\Windows\system32\Babcil32.exe
        467⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        468⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        469⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        470⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Bphqji32.exe
        
        C:\Windows\system32\Bphqji32.exe
        471⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Bfaigclq.exe
        
        C:\Windows\system32\Bfaigclq.exe
        472⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Bmladm32.exe
        
        C:\Windows\system32\Bmladm32.exe
        473⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Bpjmph32.exe
        
        C:\Windows\system32\Bpjmph32.exe
        474⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5068
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        475⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Cdhffg32.exe
        
        C:\Windows\system32\Cdhffg32.exe
        476⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        477⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Cgiohbfi.exe
        
        C:\Windows\system32\Cgiohbfi.exe
        478⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        479⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        480⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        481⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Dkkaiphj.exe
        
        C:\Windows\system32\Dkkaiphj.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5904
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        483⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        484⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Dnljkk32.exe
        
        C:\Windows\system32\Dnljkk32.exe
        485⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Ddfbgelh.exe
        
        C:\Windows\system32\Ddfbgelh.exe
        486⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5992
        
        C:\Windows\SysWOW64\Dickplko.exe
        
        C:\Windows\system32\Dickplko.exe
        487⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Ddhomdje.exe
        
        C:\Windows\system32\Ddhomdje.exe
        488⤵
        Modifies registry class
        
        PID:6332
        
        C:\Windows\SysWOW64\Dalofi32.exe
        
        C:\Windows\system32\Dalofi32.exe
        489⤵
        Drops file in System32 directory
        
        PID:5520
        
        C:\Windows\SysWOW64\Daollh32.exe
        
        C:\Windows\system32\Daollh32.exe
        490⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Dcphdqmj.exe
        
        C:\Windows\system32\Dcphdqmj.exe
        491⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Ejjaqk32.exe
        
        C:\Windows\system32\Ejjaqk32.exe
        492⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Epdime32.exe
        
        C:\Windows\system32\Epdime32.exe
        493⤵
        Modifies registry class
        
        PID:5336
        
        C:\Windows\SysWOW64\Ecbeip32.exe
        
        C:\Windows\system32\Ecbeip32.exe
        494⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Enhifi32.exe
        
        C:\Windows\system32\Enhifi32.exe
        495⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\Epffbd32.exe
        
        C:\Windows\system32\Epffbd32.exe
        496⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Ecdbop32.exe
        
        C:\Windows\system32\Ecdbop32.exe
        497⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Ejojljqa.exe
        
        C:\Windows\system32\Ejojljqa.exe
        498⤵
        Modifies registry class
        
        PID:4104
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        499⤵
        Modifies registry class
        
        PID:6384
        
        C:\Windows\SysWOW64\Egbken32.exe
        
        C:\Windows\system32\Egbken32.exe
        500⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        501⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6532
        
        C:\Windows\SysWOW64\Eqkondfl.exe
        
        C:\Windows\system32\Eqkondfl.exe
        502⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6708
        
        C:\Windows\SysWOW64\Ecikjoep.exe
        
        C:\Windows\system32\Ecikjoep.exe
        503⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Edihdb32.exe
        
        C:\Windows\system32\Edihdb32.exe
        504⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Fjeplijj.exe
        
        C:\Windows\system32\Fjeplijj.exe
        505⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Fqphic32.exe
        
        C:\Windows\system32\Fqphic32.exe
        506⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1152
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        507⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Fkgillpj.exe
        
        C:\Windows\system32\Fkgillpj.exe
        508⤵
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        509⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        510⤵
        Drops file in System32 directory
        
        PID:5364
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        511⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Fgqgfl32.exe
        
        C:\Windows\system32\Fgqgfl32.exe
        512⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        513⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Fqikob32.exe
        
        C:\Windows\system32\Fqikob32.exe
        514⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Gcghkm32.exe
        
        C:\Windows\system32\Gcghkm32.exe
        515⤵
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Gkoplk32.exe
        
        C:\Windows\system32\Gkoplk32.exe
        516⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Gnmlhf32.exe
        
        C:\Windows\system32\Gnmlhf32.exe
        517⤵
        Modifies registry class
        
        PID:2680
        
        C:\Windows\SysWOW64\Gcjdam32.exe
        
        C:\Windows\system32\Gcjdam32.exe
        518⤵
        Drops file in System32 directory
        
        PID:6060
        
        C:\Windows\SysWOW64\Gjcmngnj.exe
        
        C:\Windows\system32\Gjcmngnj.exe
        519⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Gbkdod32.exe
        
        C:\Windows\system32\Gbkdod32.exe
        520⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Gqnejaff.exe
        
        C:\Windows\system32\Gqnejaff.exe
        521⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6656
        
        C:\Windows\SysWOW64\Gclafmej.exe
        
        C:\Windows\system32\Gclafmej.exe
        522⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6732
        
        C:\Windows\SysWOW64\Gndbie32.exe
        
        C:\Windows\system32\Gndbie32.exe
        523⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5740
        
        C:\Windows\SysWOW64\Gdnjfojj.exe
        
        C:\Windows\system32\Gdnjfojj.exe
        524⤵
        Modifies registry class
        
        PID:3252
        
        C:\Windows\SysWOW64\Gkhbbi32.exe
        
        C:\Windows\system32\Gkhbbi32.exe
        525⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Gnfooe32.exe
        
        C:\Windows\system32\Gnfooe32.exe
        526⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Hqdkkp32.exe
        
        C:\Windows\system32\Hqdkkp32.exe
        527⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Hccggl32.exe
        
        C:\Windows\system32\Hccggl32.exe
        528⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Hbdgec32.exe
        
        C:\Windows\system32\Hbdgec32.exe
        529⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1712
        
        C:\Windows\SysWOW64\Hebcao32.exe
        
        C:\Windows\system32\Hebcao32.exe
        530⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Hgapmj32.exe
        
        C:\Windows\system32\Hgapmj32.exe
        531⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Hjolie32.exe
        
        C:\Windows\system32\Hjolie32.exe
        532⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6832
        
        C:\Windows\SysWOW64\Haidfpki.exe
        
        C:\Windows\system32\Haidfpki.exe
        533⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Hchqbkkm.exe
        
        C:\Windows\system32\Hchqbkkm.exe
        534⤵
        Modifies registry class
        
        PID:7060
        
        C:\Windows\SysWOW64\Hkohchko.exe
        
        C:\Windows\system32\Hkohchko.exe
        535⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4376
        
        C:\Windows\SysWOW64\Hnmeodjc.exe
        
        C:\Windows\system32\Hnmeodjc.exe
        536⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Ibnjkbog.exe
        
        C:\Windows\system32\Ibnjkbog.exe
        537⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Ielfgmnj.exe
        
        C:\Windows\system32\Ielfgmnj.exe
        538⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Igjbci32.exe
        
        C:\Windows\system32\Igjbci32.exe
        539⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\Ijiopd32.exe
        
        C:\Windows\system32\Ijiopd32.exe
        540⤵
        Modifies registry class
        
        PID:5444
        
        C:\Windows\SysWOW64\Ibpgqa32.exe
        
        C:\Windows\system32\Ibpgqa32.exe
        541⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Iencmm32.exe
        
        C:\Windows\system32\Iencmm32.exe
        542⤵
        
        PID:408
        
        C:\Windows\SysWOW64\Ilhkigcd.exe
        
        C:\Windows\system32\Ilhkigcd.exe
        543⤵
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Ibbcfa32.exe
        
        C:\Windows\system32\Ibbcfa32.exe
        544⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Iholohii.exe
        
        C:\Windows\system32\Iholohii.exe
        545⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Ijmhkchl.exe
        
        C:\Windows\system32\Ijmhkchl.exe
        546⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Ibdplaho.exe
        
        C:\Windows\system32\Ibdplaho.exe
        547⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Icfmci32.exe
        
        C:\Windows\system32\Icfmci32.exe
        548⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Ilmedf32.exe
        
        C:\Windows\system32\Ilmedf32.exe
        549⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Inkaqb32.exe
        
        C:\Windows\system32\Inkaqb32.exe
        550⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Iajmmm32.exe
        
        C:\Windows\system32\Iajmmm32.exe
        551⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Ihceigec.exe
        
        C:\Windows\system32\Ihceigec.exe
        552⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Ijbbfc32.exe
        
        C:\Windows\system32\Ijbbfc32.exe
        553⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Jbijgp32.exe
        
        C:\Windows\system32\Jbijgp32.exe
        554⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Jehfcl32.exe
        
        C:\Windows\system32\Jehfcl32.exe
        555⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Jhfbog32.exe
        
        C:\Windows\system32\Jhfbog32.exe
        556⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Jjdokb32.exe
        
        C:\Windows\system32\Jjdokb32.exe
        557⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Jblflp32.exe
        
        C:\Windows\system32\Jblflp32.exe
        558⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Jdmcdhhe.exe
        
        C:\Windows\system32\Jdmcdhhe.exe
        559⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Jldkeeig.exe
        
        C:\Windows\system32\Jldkeeig.exe
        560⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Jbncbpqd.exe
        
        C:\Windows\system32\Jbncbpqd.exe
        561⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Jelonkph.exe
        
        C:\Windows\system32\Jelonkph.exe
        562⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Jjihfbno.exe
        
        C:\Windows\system32\Jjihfbno.exe
        563⤵
        Drops file in System32 directory
        
        PID:10868
        
        C:\Windows\SysWOW64\Jacpcl32.exe
        
        C:\Windows\system32\Jacpcl32.exe
        564⤵
        Modifies registry class
        
        PID:10908
        
        C:\Windows\SysWOW64\Jdalog32.exe
        
        C:\Windows\system32\Jdalog32.exe
        565⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Jlidpe32.exe
        
        C:\Windows\system32\Jlidpe32.exe
        566⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Jogqlpde.exe
        
        C:\Windows\system32\Jogqlpde.exe
        567⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Jddiegbm.exe
        
        C:\Windows\system32\Jddiegbm.exe
        568⤵
        Modifies registry class
        
        PID:11108
        
        C:\Windows\SysWOW64\Koimbpbc.exe
        
        C:\Windows\system32\Koimbpbc.exe
        569⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Keceoj32.exe
        
        C:\Windows\system32\Keceoj32.exe
        570⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Khabke32.exe
        
        C:\Windows\system32\Khabke32.exe
        571⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Kkpnga32.exe
        
        C:\Windows\system32\Kkpnga32.exe
        572⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10456
        
        C:\Windows\SysWOW64\Mepnaf32.exe
        
        C:\Windows\system32\Mepnaf32.exe
        573⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Mohbjkgp.exe
        
        C:\Windows\system32\Mohbjkgp.exe
        574⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Mddkbbfg.exe
        
        C:\Windows\system32\Mddkbbfg.exe
        575⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Mojopk32.exe
        
        C:\Windows\system32\Mojopk32.exe
        576⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Medglemj.exe
        
        C:\Windows\system32\Medglemj.exe
        577⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Nkapelka.exe
        
        C:\Windows\system32\Nkapelka.exe
        578⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Nchhfild.exe
        
        C:\Windows\system32\Nchhfild.exe
        579⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Nefdbekh.exe
        
        C:\Windows\system32\Nefdbekh.exe
        580⤵
        Modifies registry class
        
        PID:11072
        
        C:\Windows\SysWOW64\Ndlacapp.exe
        
        C:\Windows\system32\Ndlacapp.exe
        581⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Nlcidopb.exe
        
        C:\Windows\system32\Nlcidopb.exe
        582⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Napameoi.exe
        
        C:\Windows\system32\Napameoi.exe
        583⤵
        Drops file in System32 directory
        
        PID:6572
        
        C:\Windows\SysWOW64\Nlefjnno.exe
        
        C:\Windows\system32\Nlefjnno.exe
        584⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Nfnjbdep.exe
        
        C:\Windows\system32\Nfnjbdep.exe
        585⤵
        Modifies registry class
        
        PID:7164
        
        C:\Windows\SysWOW64\Ohncdobq.exe
        
        C:\Windows\system32\Ohncdobq.exe
        586⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Ocdgahag.exe
        
        C:\Windows\system32\Ocdgahag.exe
        587⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Ohqpjo32.exe
        
        C:\Windows\system32\Ohqpjo32.exe
        588⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Ocfdgg32.exe
        
        C:\Windows\system32\Ocfdgg32.exe
        589⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4612
        
        C:\Windows\SysWOW64\Omcbkl32.exe
        
        C:\Windows\system32\Omcbkl32.exe
        590⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Obpkcc32.exe
        
        C:\Windows\system32\Obpkcc32.exe
        591⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6280
        
        C:\Windows\SysWOW64\Pdngpo32.exe
        
        C:\Windows\system32\Pdngpo32.exe
        592⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6688
        
        C:\Windows\SysWOW64\Pmeoqlpl.exe
        
        C:\Windows\system32\Pmeoqlpl.exe
        593⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10716
        
        C:\Windows\SysWOW64\Podkmgop.exe
        
        C:\Windows\system32\Podkmgop.exe
        594⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6648
        
        C:\Windows\SysWOW64\Pbbgicnd.exe
        
        C:\Windows\system32\Pbbgicnd.exe
        595⤵
        Modifies registry class
        
        PID:10884
        
        C:\Windows\SysWOW64\Pdqcenmg.exe
        
        C:\Windows\system32\Pdqcenmg.exe
        596⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Pmhkflnj.exe
        
        C:\Windows\system32\Pmhkflnj.exe
        597⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Pofhbgmn.exe
        
        C:\Windows\system32\Pofhbgmn.exe
        598⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Pfppoa32.exe
        
        C:\Windows\system32\Pfppoa32.exe
        599⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Pecpknke.exe
        
        C:\Windows\system32\Pecpknke.exe
        600⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Pmjhlklg.exe
        
        C:\Windows\system32\Pmjhlklg.exe
        601⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Pbgqdb32.exe
        
        C:\Windows\system32\Pbgqdb32.exe
        602⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\Piaiqlak.exe
        
        C:\Windows\system32\Piaiqlak.exe
        603⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Pokanf32.exe
        
        C:\Windows\system32\Pokanf32.exe
        604⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Pfeijqqe.exe
        
        C:\Windows\system32\Pfeijqqe.exe
        605⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\Piceflpi.exe
        
        C:\Windows\system32\Piceflpi.exe
        606⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Pkabbgol.exe
        
        C:\Windows\system32\Pkabbgol.exe
        607⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6156
        
        C:\Windows\SysWOW64\Pcijce32.exe
        
        C:\Windows\system32\Pcijce32.exe
        608⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Qfgfpp32.exe
        
        C:\Windows\system32\Qfgfpp32.exe
        609⤵
        Drops file in System32 directory
        
        PID:6988
        
        C:\Windows\SysWOW64\Qifbll32.exe
        
        C:\Windows\system32\Qifbll32.exe
        610⤵
        Drops file in System32 directory
        
        PID:856
        
        C:\Windows\SysWOW64\Qppkhfec.exe
        
        C:\Windows\system32\Qppkhfec.exe
        611⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Qfjcep32.exe
        
        C:\Windows\system32\Qfjcep32.exe
        612⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Qihoak32.exe
        
        C:\Windows\system32\Qihoak32.exe
        613⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Abpcja32.exe
        
        C:\Windows\system32\Abpcja32.exe
        614⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6392
        
        C:\Windows\SysWOW64\Akihcfid.exe
        
        C:\Windows\system32\Akihcfid.exe
        615⤵
        Drops file in System32 directory
        
        PID:10692
        
        C:\Windows\SysWOW64\Acppddig.exe
        
        C:\Windows\system32\Acppddig.exe
        616⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10812
        
        C:\Windows\SysWOW64\Aealll32.exe
        
        C:\Windows\system32\Aealll32.exe
        617⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\Amhdmi32.exe
        
        C:\Windows\system32\Amhdmi32.exe
        618⤵
        
        PID:11052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abpcja32.exe

Filesize
488KB

MD5
780eb10ae4785068e4192a0f0e68ea13

SHA1
4dac373930b088d0cebee800aa720a3ed94a7e66

SHA256
c186f25858b2fbb89401f501e25a097e8c512aae2150b6c8163919875604e060

SHA512
f00b83cbb4d5a2021b74012de23d5e7ee5a69f77477d5791d0ed8989eb9903b01f086fe691a18d9d251c8f61478df38280cf852b2f93d469f3739ddaa80e693d

Download Submit
C:\Windows\SysWOW64\Adkgje32.exe

Filesize
488KB

MD5
f728cb305c0545e1a2a66e704d07d705

SHA1
31b9d4cdfbc353695f86997b519113e64dbe3cf2

SHA256
0aa503d35b21c397263ab07766821c0a5d5a1e755e41ffd423be47b8af16c3fe

SHA512
108a1a7ee7c13d889654b17d5c1fd0988312f61e6ebeda505c7021a7a2ca51957bbaefd6b6763ca98222db43a4a8251d72b9df2b6210b89b3c9ea50da024303c

Download Submit
C:\Windows\SysWOW64\Aijnep32.exe

Filesize
488KB

MD5
7719a8e80619f468ca4827079b33d774

SHA1
409e750f97d08c2ab360e0f686620ddad21dd6ee

SHA256
717c6d66cd8b92ea17000a45d5b9664b3665e52353da1e6e05bb6bd90a1d37bf

SHA512
7e2c537d95466f512edb27e747ae7e18d6c8a149bbcebc2fa9e6e61eae96f756ce181db1395831d7a33252efa1dda0867958a6b4e03c2b54c31b5f76fa191c89

Download Submit
C:\Windows\SysWOW64\Ajjjocap.exe

Filesize
488KB

MD5
a85159f65d178034abef12dba0820e40

SHA1
d2bde7c1e4fec069f12f18a66d1c57a43f2c91f8

SHA256
00182e5ed64587affeba4797b838836539643e112935d26e51336ba3d3971f3c

SHA512
e2f1e7560c43f4233cf37f6823c478ca5cdbe230687dcb90f2caf38e0ac24b59405d6e31999d0703e4acfc8be54e524b3a7461128a618798b6b85cb30c7093e1

Download Submit
C:\Windows\SysWOW64\Aqoiqn32.exe

Filesize
488KB

MD5
532de16f9aea3abcf1f443a97deff97f

SHA1
958d135b739d91479570a8e71b17c51af6993ae2

SHA256
fdd7fe932022d20f64f905b7cff94149e67ab5c571feac4cd998b4f9b24454c2

SHA512
bc50d01cec25d49e963813890d1c3073db0b93c3ce29603907931403062bf55bf6cd69c969eb2e6ae24e6f917ded138a41292cc22a52266d25f9ab86bffdd4e4

Download Submit
C:\Windows\SysWOW64\Bfedoc32.exe

Filesize
488KB

MD5
8ca4478af9da4a507d8e9ad7533e7965

SHA1
9fc657ad85ee31dd77b06bf5416cb254232063ec

SHA256
83f5f2d9bf95b186c303ec9eea56f7413ce0deaa34b269414f2de99339b1d095

SHA512
63550a77f3335a9239d13db9ba5e1b283a6c7101c1ed4ca02d30089f0e5243d3ffd5b51d50ec650cac2bb9f84d8623f2f9dea4d65e0bc560d54003ec1118be3e

Download Submit
C:\Windows\SysWOW64\Bfjnjcni.exe

Filesize
488KB

MD5
345c2fd1ac1957ddd3e1a342a1538155

SHA1
6848f94e8e7c093f29de6e3af55aba91acd6e2bb

SHA256
17933b9cb66cb9742b36777142b43c9471489a20aaa11b8ee82282784df583e4

SHA512
646daa40238c0a3d0088913c2a5fb1df283c723da2d9c45eb23560aa81be3cb72351fc637c44e3beb83c8bfb885628d1d12c6a12c18722929da5ea6fc66136ff

Download Submit
C:\Windows\SysWOW64\Bfqkddfd.exe

Filesize
488KB

MD5
68e3c423a540b11ddbf4c51f4f41e87f

SHA1
c511db28b1cf683a6e4a70edcfb1778f223f6691

SHA256
ebb4dff617be4b4c987a091fbb5f5b85275d6fe5972e7decd660bcd96a2cd8d0

SHA512
823332b5e2d7d1638cd3da4c225790c117416691b372dec8fbf6af0d1ce68e2adbbf1433757b6e3c4b767ad169f9bda88aee6cc6efa1b66fb9939c4dfd81d834

Download Submit
C:\Windows\SysWOW64\Bkgeainn.exe

Filesize
488KB

MD5
6f2075e2d3e582742da7f004c9474922

SHA1
869a25f2f18d1d616300c69e021060739e419b83

SHA256
7dbf7b2f8a3f1882b54e330d5ccee2f22482bea10623eb05b3efefd997fd20bc

SHA512
316454a6651b797be7b45b2538c95ed55194b155bee06f10c5c00931cb7797ab47461b692ff47a74c7caf7db21633ec6adfb52cb3fac9b5103ab26755f8d8174

Download Submit
C:\Windows\SysWOW64\Bpnihiio.exe

Filesize
488KB

MD5
2a586d5ec0169f53c62b9fdbf64c7fd8

SHA1
2d89e3c5829e7a61a87b0251c344a1cd94d6e5a3

SHA256
df0b252ed08adede7e7994eccae04f02b9567f611748040458f17586d1e6aee9

SHA512
b5d4a7e8d78320f693cea01bdd7ab72d6bc791364ee3665a0dc15e5e84cf17b741c8f32aa0fa72b39572e64dfd3c2e81812de2ea151b0b1a4a6c95c284dae322

Download Submit
C:\Windows\SysWOW64\Bqdblmhl.exe

Filesize
488KB

MD5
5d6631d8f2678c8c9ae01b867b312199

SHA1
964d339a819c4f14e3f8629001673b0fa3be6086

SHA256
591c1bdf685bd4c5bf7e93b50a3daf092a072581d00a1566004807e0ef854c95

SHA512
7ce30e5b4a3ccf3c5ef57484646bd6c249c62f38eee49dc3c287a69f0bf8de5b8df0e4d1428ce04c091c0eeba4b8cc491f17fffe039f4f4f39bd6b77539198b4

Download Submit
C:\Windows\SysWOW64\Caienjfd.exe

Filesize
488KB

MD5
452136150bec9c60f95d3176637b7cc1

SHA1
489f2ab102cf0c61e6fa300c7e83f760606c9e21

SHA256
7196ff1ca7a33d1621ab3df725fd22577f9b0db394f7acd11d235922be750854

SHA512
30b4ac71d9bb072322129a4566bcd986c277e07052c11cb2870c4c90af7150f475d3640e5653fdd911c226585d9194e8514ac75650101941809b2e942515ed5a

Download Submit
C:\Windows\SysWOW64\Eiaoid32.exe

Filesize
488KB

MD5
90212605ed8c74c18a01ae263ec9c97d

SHA1
1fb2dd54d7b9d09dc72dab8787bcfa6b788f5edb

SHA256
c527d2fa49d2601b04cc6813a753d8ee563e913b0b699bba09a01c6ed1564d65

SHA512
52b2866e35620adb4d5ef5c67351a08cf2c8d3f7c5067a14fa4f8cccd6b9c1f1f3a0272a31b47eef0273f4bc7b62da213293d24945ff017ddd4477d13610c43a

Download Submit
C:\Windows\SysWOW64\Emmdom32.exe

Filesize
488KB

MD5
bf18b6f8732865f3bf77a57a37fca5d7

SHA1
3ed2446e30311802136223678a46f1ac1b686e72

SHA256
6f1b303e8ff26d65b921f40ef3efb0bd381181897f8e315252acee1a730e8742

SHA512
62fe77f3e66f660d9053b1cf2428ab52a1fc00b7209fafcf646fe406dbf24033579147651bc076b47230638b3c02f1492d4e8fb02037d64761b9633d9b13df0a

Download Submit
C:\Windows\SysWOW64\Fkkeclfh.exe

Filesize
488KB

MD5
0c7babbae41e4f0b971f7d01c22f88e7

SHA1
4f5ff2719ae1531f3509aa00ee37a135ead46ef2

SHA256
5d9d011f4f19229633028db226eddf38f4e44047b65b6707b753860da843097b

SHA512
9e7e526c9acb35cb17ddec613ef0d2b1f0b2699afb0af6a2dd6e8ff644e5d365ca0c18bc1f39f3315a3949fc3db940fb7157c883fbdf352b03eb340346c97c45

Download Submit
C:\Windows\SysWOW64\Fneggdhg.exe

Filesize
488KB

MD5
11927d68f4c6f78934e68796f697a16c

SHA1
c74ffe5dfa1c131cb82da8ee67d243710bca29e4

SHA256
49ac2d855cf4816eef52e29e1a7714999de749a3dae26efef3f915a8d6139f2b

SHA512
d5031a18616fe3f35a9abb1b07781c9cfdfcd1fe19360d89454fccd7a64e09ce3b54a45c3fb3ff70aa390d40f42f9cd7ad8fc7a4158b698c48b1f49b1fdbd613

Download Submit
C:\Windows\SysWOW64\Glengm32.exe

Filesize
488KB

MD5
e292c25aa643893e8e753cc00b35987a

SHA1
9b5238d852b3465a0bb780aaaf12a4fd280fcdc0

SHA256
7f21fc2e9586b385622a89315c06e0219f6f2feb0a3221df2c1d350e6c868926

SHA512
4125568dd7315d8660fb6452a3cd00c796a0241d8916445138ca022feb6a39f1e11907d312b900cf84be633db811598c49af61a469dc42f91b53aa87b5d7cfed

Download Submit
C:\Windows\SysWOW64\Hfhgkmpj.exe

Filesize
488KB

MD5
d26a757e7a9f43dd95be87a96c0d234f

SHA1
337159916559a43d7184a4a76da895e177e8744f

SHA256
637c341d05addd06556c959dd866ab58af1f9ea1348b6e65f3f22124ff29d22d

SHA512
e51237c6e8732ae4bb6d55644b23d2481c8377c854d6acfbdcfe478f79f16acdad47e22c167295a8ae02ebaa1ae9bf4fe195bd00c4e7181e934418f31e6f2fd7

Download Submit
C:\Windows\SysWOW64\Ibkpcg32.exe

Filesize
488KB

MD5
3c74eeedf93f8e88d1ddc6f12ca06d8c

SHA1
2c17cc6eee732e4c44a2833b9d7ba4455a6d7428

SHA256
51c27a5526a710d65ba01fd742073b7bc61ec0b0cb9238eee1f0c6190be96b2e

SHA512
70ced77cd5f4e51232183d019c42ca9b77f03a8a093583b42bbecfd4090e51d54f65bba3ad5b70f1d89659afa8da8e7551ca29f420351797e18467c7a99d72e0

Download Submit
C:\Windows\SysWOW64\Ibpiogmp.exe

Filesize
488KB

MD5
0c145f021d4396ed60685f10798722a2

SHA1
def8e86a82d9f61e8e5b720b14db86fed71fbf7b

SHA256
991a6968eed372c2883ea340e2c2fe38b6bd851a4b93f660787beb92ccc6d130

SHA512
5f7d43c92293845f7e0bc282f84872fe0e2524ba73645e9efa342596e761967d30b845b2d094aaddd5823bc837104e51b71dce1d251c198ed4dc43572dee1ed3

Download Submit
C:\Windows\SysWOW64\Ifbbig32.exe

Filesize
488KB

MD5
69eb8a1ff6de7b4139916539b678a4ca

SHA1
6103491bd2233fbe5ce49400ce8ab31b48f1202b

SHA256
9d55afbab8520153ed293f6df9095190dde9f68e527f34d9f17e481924fdfb65

SHA512
8c4f66c4e39ef6ef8709e0070b935c1683b54e7de54d8958cf5df6ebbd538cd7d54539de9a86745cee59e23390ba8ffa1a45d1057b2d4d5e39fe99c4209604e1

Download Submit
C:\Windows\SysWOW64\Ifdonfka.exe

Filesize
488KB

MD5
23eb689c20551ec381e8876c782c87cb

SHA1
11123e760438d38fc34a35c21b9ea28c5a357d64

SHA256
5b6de7179eaa1179593f8e92a8f630ba6b237a3c2eceae193d11f3058b5f104c

SHA512
fa426190ffe2c7600061c1242092773eabe3febc2feae358e4d1601642f5128968d17f02736d275911785213fd721bcea096dd73bf927b88bc6c4a1962ba7dc1

Download Submit
C:\Windows\SysWOW64\Ifomll32.exe

Filesize
488KB

MD5
3eab20f97a2bc219fa7cab33e49e4060

SHA1
2d0b9ceb4f5d2329c0cfe5fe56ff71c8aaebffdd

SHA256
9d7ae61f1df7c4359ef59a408a3d8146edbb14b3834f7ef194e4429bda0048fb

SHA512
36dd15c056755b0a94c531143e57f64bfe032ed0d06cbe76c7550cad01a8ebfa86e33c47b3901d777bcd62b6893e19fb1ca4db203a920852c70932b3b4a38f54

Download Submit
C:\Windows\SysWOW64\Igfkfo32.exe

Filesize
488KB

MD5
6373fb4957a2921859aed136cddbc0f8

SHA1
7c4c3dfe5abca3a74bbcdacdc6091c01ec26f250

SHA256
52eaa5e71bbe21f09c288f77ced9efcc17cb67f7266e137321a908dc57c52330

SHA512
01615687e70c03d127c27d339796d769cde919921b055812b2505f286fbd063966edfe4791f822dacb31c9ed13e462aadc10377e1704698adb764b8327baf2cb

Download Submit
C:\Windows\SysWOW64\Iigdfa32.exe

Filesize
488KB

MD5
032db901ca7fb88b16df6bb77a8f822c

SHA1
c64420aa739bb6a8df6b49a095d7ad1586ec6f11

SHA256
6eb5b7527ddc63e6b86e7b655890eb50b27d0cd05705625e898447571215ec0e

SHA512
c9bc84a060bb1240c3ab89db50204c6dc3da9a1f2ebbe9835ed4c50e7a333ae9f1b6c7c34647a19f455fda15a00c957872ec915fd7871d688b4f255856e8f678

Download Submit
C:\Windows\SysWOW64\Ioambknl.exe

Filesize
488KB

MD5
7b7f0472540c493797035d7d9993ee89

SHA1
26f5ed0b292f1611e9e4669828399fe3285e7642

SHA256
47f76f4601fcf917fa6a06013aced531196d37e9c7fc992e706061ddadaa5f65

SHA512
c1e42e4241caf13e30f5b12b7467556603b6f151e96406e4b1232347419991d43899d007ba380fa4e121936dbc8d9f4deeb2211a397acc730c37b314055be12f

Download Submit
C:\Windows\SysWOW64\Iohjlmeg.exe

Filesize
488KB

MD5
1eeeda28694e65ec73c0d99e8cbb16db

SHA1
685ee4448c5457a336089843f28007fb1b1b1fea

SHA256
9c2676b4af9ab9e9406c326fe4e89a814a2184a18f997b471937fe43bc3be70a

SHA512
62c7ba160bd89a9fa52f3bd0773dd9d42411a2e6dfb982728cd6d35f1bf267bff1542c4673a93e5fef0eabb00c01f41344d0afe946c48c7d392862c8df9ccb77

Download Submit
C:\Windows\SysWOW64\Iokgal32.exe

Filesize
488KB

MD5
991c6df9f8c78d9d178a5a1d40bb4d76

SHA1
4b01d0c524f3d9f8cf087cc6436fc188c60e47b2

SHA256
34771198605dcb4e90a5bdb206e37732a6ecd595769091726cf10cecdf707fe9

SHA512
0e404f28bc1f2e68d45beaf80dc6e5d552e737fc3edc6e849f62f4b569549b9206d21bc8f5c228bfab0908feb218c94d6693abe29480586473115dc1b0621db5

Download Submit
C:\Windows\SysWOW64\Ioopml32.exe

Filesize
488KB

MD5
69bd1a8b8673a69c811d72f32f9de2fa

SHA1
b0a89f4d6d6fd69e0cabaf23eb0d0de11f75d447

SHA256
40b827a964ada900b40a9c510ca8c67636acf05634df40ad359124cd6e6479e8

SHA512
17b682f96fea0fdc999b5895a2f9420e114fe8a92ea39501599f7f4dd776456480a9174a1cb93fa8181ad196e342d4af9aa04767f7999454d3588c56e5a145ae

Download Submit
C:\Windows\SysWOW64\Jbaojpgb.exe

Filesize
488KB

MD5
4a8caaafb973312e2aced362a5f007e7

SHA1
6fac730969345ea50733b449afff957ee135871a

SHA256
bb2d63cb6826c009d59285a0835f0792941399e18933ec37c32341aa09e97dd1

SHA512
4dce263a98e0e2b1129bc0b7b4cf17f115ad41da754e9fbb5744e9700c1a57d07234d229b7f6c66df7ec66d58267f4cb55bb87aa4d8fab1c1f490e9d00406067

Download Submit
C:\Windows\SysWOW64\Jnnpdg32.exe

Filesize
488KB

MD5
97ff45f862a7bea89c968ccc45dead87

SHA1
e1b495cbdd60229ea1b572e4e74fa9bdb858c062

SHA256
7e904d5a71776d6e4db6fb30c86e7f4f6e05dbb2351f3599f165243089b92c49

SHA512
feccd4057ca4549ccf342f3b00a681e84e3f6858da292ec4e694bde38be4dd40bcd89b1471afffa7f97dc1cb5dc037dd71c99dafc452f1a7d07f746c96d37f20

Download Submit
C:\Windows\SysWOW64\Kcejco32.exe

Filesize
488KB

MD5
ef5641cf01ecfe0305e77f4ca3a0b382

SHA1
e3795ae9e79505ba18ed179e6980957c3f9676f2

SHA256
b6cfff27251f862a0ddbf54ce24f2b08237f782a3054901ae903dd2d8042501b

SHA512
f35846c2631f57b90f48537d3c65e4086e5314c52da451435e62b830227593684b3ecacd37d290c560b090a6bb0ec9b29bd090ba240c5779173b5450335476c3

Download Submit
C:\Windows\SysWOW64\Kgamnded.exe

Filesize
488KB

MD5
511f2a730939d6e1ba8708c46c240ca7

SHA1
c46232899d3657a4444ef95946290d112e7c99b2

SHA256
54529721fd912353fd94a5b8cc84f1296de4c82c976c81de2e61adc0c8ff8a51

SHA512
da3bf44f963d2f920aee5f65527a828a16032eb890854b693b2f5e40de19ac94ea54e97c55c375c2949dbd77d0caf0daa56ac45cc37ce767d08862352375860a

Download Submit
C:\Windows\SysWOW64\Kiejmi32.exe

Filesize
488KB

MD5
402a55de5de55731fbb66a30e0f0cb23

SHA1
c958ddb0aff294dfdf1a486ec82eba63bb749529

SHA256
163f28a4419e3786ade276a14a1c3ad951c186a87148a94057046837dcfff679

SHA512
68ac65b5caacdce437d8577c1eb5535a8d7d08f9b5d9d2a5a4c6989160421250fe016cd9b8184ca89131deb3c5e8141eaa25f861cb7a04e9922f6064f3371b1b

Download Submit
C:\Windows\SysWOW64\Kqbdldnq.exe

Filesize
488KB

MD5
4e482a0232b9ce7e04603fc56faec8c2

SHA1
d2f3cc27e477b301a42b001ac0856d42e763e1cc

SHA256
eb5c113e4b21fca374c0ff8d1aee408701397e9c440994c25747d1b94590875f

SHA512
037b6d0793236d75f2750215e79dd0b917588659d52fca9a4e1ac5194ae9f908dd8142e111242aed728b3369ea4d3e4f1256bb348664c5897e1f69bf661524d4

Download Submit
C:\Windows\SysWOW64\Ljilqnlm.exe

Filesize
488KB

MD5
1e76433b1e3d4437be6189395527976a

SHA1
5a87e70818ea113c5db6df9617c8402f59ce6b4c

SHA256
d6b12f2855d211bd7e5a8ff0f64ea153f6dd729ee9e60122092155f1eecdf649

SHA512
859aa6063af93bfa2fd3d9bf4b2ab7a1c36128942be1bdd74405ba7726997ab15c1f92a8056adc1f025de4443e1e6c32730f689517ba01ab4f5e0a4a787b1596

Download Submit
C:\Windows\SysWOW64\Lldfjh32.exe

Filesize
488KB

MD5
63de7ccd6b61d830a69d3ed7141cd15d

SHA1
71984bdde8ad1b89b6be0402c3a89fc3f8cee7d2

SHA256
4280068d36405bc05bfae30f05b8afa99e4c382b4bd06c1b0d3d73c446724f4c

SHA512
42286d99edc22b0f4f61982927657e979ab35b5ed120a6962998c38e990810b22d005b65dcf1a3189a4922d2c470dc4dad5281f0704265302e2581df1a51f6d1

Download Submit
C:\Windows\SysWOW64\Lnnbqnjn.exe

Filesize
488KB

MD5
c4a531cd6ca64b3dbf163ab906b820c2

SHA1
abad71bb8999bdc3f79843b153f3ed4937413f60

SHA256
dbc33b376fc3cfc3e1a46ea11301d8d4d0043c7895c4c59a9b436dd69054d1a6

SHA512
b0d5818fd0671016dd68118d9ea522c6219a3baea804aa522bc65989d1f207d3f44eef837fec8e13a460ec53a86ae876646a8cf9104e639f4a6e976f9fd1aaf1

Download Submit
C:\Windows\SysWOW64\Lqojclne.exe

Filesize
488KB

MD5
ad126bf36a40e13e664aa8ad05db94b9

SHA1
cd253eaea783093a59ba7af719d7b34926209680

SHA256
d42988f525dd15cc41fe48beacdbc7067184b4bec95003721f7cad7eade1d336

SHA512
65b6f1fadfcc8d6503e699724a04720de3ece69ad644429d0356c98b0509bdb199496cb27ca4db96cc2bd5fd596c8429c9fa06ae1bfdda7b388bfca5acf70f4c

Download Submit
C:\Windows\SysWOW64\Midfokpm.exe

Filesize
488KB

MD5
55b5e9bf143d95bb66e52c254b2d30f4

SHA1
79deb25bec02696aaa7da28baa44a0ef33ec3b3d

SHA256
b530efffbd4dd55f65e41a0eeabda7e388b0d61deaf752dc7e84ff5a3e8a5179

SHA512
aa04fc89bf9189b43144e62e1e3be76cb32272dcbe1863f4a408a7025de83e91660907eb26cac38e13b7fa71d3ce06354594e19e038dd2fb6632d9dedcec1c1b

Download Submit
C:\Windows\SysWOW64\Midfokpm.exe

Filesize
320KB

MD5
78712f04f85fe292f0dcdc17ac9c74f4

SHA1
7818a490ce13c01d7c2ceff1b839c191037bdf8a

SHA256
cfc0010176fa753ef5e0812bdc853db5cab53205e4cdec6aa7fa267b0b93db12

SHA512
c68bd93190e95194d917b9392b3af92a619cdfc4c65ca349087640bb1774e7f3f97f5137fc430c2cecd380d81d16ce393ac36382f76ce51735139fa9cd1d505a

Download Submit
C:\Windows\SysWOW64\Mjpbam32.exe

Filesize
488KB

MD5
6c43e0981963600ac9998960d3298671

SHA1
6cedca50ab16da175abb186acf4c89258a5553d9

SHA256
d3f1c4ca3c90cdf17ee5e682667a55368cfc0212bbbfdc0e0cc3c5a1209b8649

SHA512
08f41e82b54b8c0ad4c7c105a31515275e245c54b19b63478de5bef2c32bb82e8927de6751016b42141ab80980d0905841d01a4318b9f086679b2aa25adefdf1

Download Submit
C:\Windows\SysWOW64\Mkjnfkma.exe

Filesize
488KB

MD5
60359ef66e6cdf68b5f51c5c3187d6eb

SHA1
8b22e1a3c42f8c3abea803e82e9e575444d234e5

SHA256
6b8e098417ed34d544be6a6a12babc0890edde03b40e86b1a79eb79cc390ea28

SHA512
c02ba4e461398a8887e8fc0368cf75c4a11a55099a8790a88bfc389113aa1d6a532b730fa6883e3b9fa17f7c525beba3617a908154d845cbf28920a92b9fa69e

Download Submit
C:\Windows\SysWOW64\Nbadcpbh.exe

Filesize
488KB

MD5
80f3721077d2fb2997a350f13c0ff2ab

SHA1
023b7aec34a55d9977536b1f295b37f89a4206bb

SHA256
8014efbe4c26d4837e123bca45677473c3daf6c6ebb268e3fed4ff76e0d52ebd

SHA512
717252eb06babb7cd9b5e20b24c645220532604349a766e3572b97ad90a3618f2b651b35197f4e27c2f1d1bb97f222bce247981fb80ec9c681bfa9ef53e8866d

Download Submit
C:\Windows\SysWOW64\Ocamjm32.exe

Filesize
488KB

MD5
a5756e270723f7c6ac0c0071247be2b6

SHA1
9b96c69e39b5ec38727b0e65749649c06e952a3b

SHA256
8f114dd8c5c9829e221cbe07059f8400f51f78febd778842c199203a708e4c20

SHA512
97bf3bc7f17306d9a6857df1a5b428b96fc3b55126c139e1d43244093e56052086eb991e39365d9a3c1d944fa0ce16aeacc95d3950d5caad60fdae0e97d8ba75

Download Submit
C:\Windows\SysWOW64\Ocdjpmac.exe

Filesize
488KB

MD5
f3284119febb997d03647b170c7c934a

SHA1
2cbd0e2488ef53f13db03013131bfcc262cd8e13

SHA256
47dd5077f7f61c4e44352e906210d7face0dc09249e3b700750afbdc989f3e6f

SHA512
365457cb9942ee44501f5678695030f38c08522b5f0a53e921774a309602676fc137a8b972360ffb61fcce122dd163142fb8b9e3f2a40a2c7a1bdf76d231e6af

Download Submit
C:\Windows\SysWOW64\Ocffempp.exe

Filesize
488KB

MD5
de3a43c8d23fd5903d2021ba80dd5e42

SHA1
fb4c8c681076af0ad59bd4ebd319ade307d313f7

SHA256
fa9602861949f3542fecaa0c14ecf9292df23247b8c8635bcb6f04ab97371997

SHA512
34d78a476d63fd03463877081a2c3545543558be01a08043ec38dad11728cd1d9b2f814875517ac00f47a587e0e16cf445bbc56400c6275c36e2bf85f6c01959

Download Submit
C:\Windows\SysWOW64\Oidofh32.exe

Filesize
488KB

MD5
32abf92aab2700ac63a514cb6cd23895

SHA1
3ae333674e2de2e9164eea72078cbe0b2c2a9531

SHA256
8a344a5530ab4a205db10a9a642e02abcb7ec959e175ae26969876622a06db7b

SHA512
633fcff525cb85f353a04d5d0cb9aa4abe789bfcea652d11ff6de148ace1d31daeac64cf7d568701ef310e5628a0b63ee5805e154473c3f737986da2aa2623e4

Download Submit
C:\Windows\SysWOW64\Oiihahme.exe

Filesize
488KB

MD5
ea3408e48324880f5c257ec87abd167c

SHA1
eb08ce6d4426b305e597ccd48154158da6947271

SHA256
3eca8649a8feee43a11b5e99bf5060b9edc5feb08170093d7b49e64ada4b4612

SHA512
22f4dfa2030b8338860199934a85d570fffd6c43ce7b1c5b26be3f0796a09a6d5928903f1146e98860e5852e99368c16da0155d46a98c0f30ff334aefb5d4f64

Download Submit
C:\Windows\SysWOW64\Pcicklnn.exe

Filesize
488KB

MD5
fbe27b91791a4cd047ad7dcb371459a7

SHA1
946b084f2a3b4119e0dd78cbdcb7c9a62b3aa5f9

SHA256
f42f0b8aa85774c94865059bd1045090227cde180630e304206a9e0c21e1baca

SHA512
41f3d3837b35b01e2595397cc95ec0975f7180838d63fb5e1a7e8977acfc02286355cd66abf8f24a524952c49f6ec6e52858f57be9c18f0e7bffab1c7c60892e

Download Submit
C:\Windows\SysWOW64\Pedbahod.exe

Filesize
488KB

MD5
1396e93d041e0596e54b17d8ef1cb1d1

SHA1
67ac2ed6d2df3144c4c8156ba057b5483f5eae46

SHA256
93988dcd82d1a1773e2527af22c8d35786090e111ada30a1833c4e41ad6db8ee

SHA512
58d02b7a56b7e31dcd628276f505acbfba007881b185cbdbe2a25f2fce516c1e6dda5b1620a99001e46c65ea33aea5b353d4afcc5659b991774823d696834d8a

Download Submit
C:\Windows\SysWOW64\Phjenbhp.exe

Filesize
488KB

MD5
dbe7e628317ff1f30afbe847e72986f0

SHA1
b661de59041004fe976b0aba5d33ce914cebb409

SHA256
d636590ed6b50fcb04fc908167179a75a69a3b85b017fab7e9646982e749b33d

SHA512
5e9348bda6a670b6f4df79df1e6347652dd15d0a9972068be5f293e0892d6bdfb027223d152d00a7635bfebc22e3b53f5ff5de1926babcf90d86d56348807ee7

Download Submit
C:\Windows\SysWOW64\Pofjpl32.exe

Filesize
488KB

MD5
457e28c3e2eb2f52581f8690df0fcdd5

SHA1
9f3b3d6f37d519c898c0d61004096c9b937b7f5d

SHA256
9c2f861c78433f79044e38eb7974c6dd3dfab83e53a922f25080321745bf5521

SHA512
e8ffb3b9783adf36c9dc41f1beb83a3037d1e7759852b43e548183543beb9d94210e4590650bee74faab1b79731edf321ed91f62e5e90196db6f66843d7a5a26

Download Submit
C:\Windows\SysWOW64\Ppamophb.exe

Filesize
488KB

MD5
7e1da2ad15109437261c214a12f6afee

SHA1
eb91fedbc4e8304d791227b7614a651991b3b109

SHA256
0e3caaad3704eadc9cf983c0e6bd33f2f5db790eaae8d40ab09818ed3ec1868f

SHA512
63f2a5035fd96c6d73b3b0ac5bf456c9c9a58ce275eb880751a54418ff78be90308db8a0d41ef8515968253e01f17154674969e9a2d1fc670d647a25aa3e02eb

Download Submit
memory/8-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/312-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/552-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/568-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/632-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/760-395-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/876-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/932-205-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1296-75-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1388-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1532-380-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1552-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1552-461-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1564-722-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1564-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1624-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1756-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1788-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1948-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2008-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2008-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2020-726-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2020-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2028-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-198-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2352-37-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2380-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2384-21-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2404-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2404-647-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2584-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2708-375-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2748-351-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2804-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2808-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2888-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2928-52-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3124-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3128-209-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3128-725-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3500-291-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3600-405-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3684-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3692-163-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3692-719-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3700-455-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3712-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3812-158-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3972-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3984-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4032-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4032-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4092-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4124-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4124-433-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4256-732-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4256-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4264-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4288-460-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4356-736-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4356-233-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4372-389-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4472-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4476-77-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4504-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4516-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4516-720-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4676-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4676-721-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4692-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4836-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4872-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4884-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4884-592-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4960-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4996-463-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5108-792-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5108-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads