c67524abce6494585f816939788f4014a6cd9d0266a22af8d0d0547aec5bbd42

Analysis

max time kernel
150s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c67524abce6494585f816939788f4014a6cd9d0266a22af8d0d0547aec5bbd42.exe
Size

64KB
MD5

c48f4ab1862dd13de98aac39b81a8964
SHA1

0c2e3867ec17f4ab32838042055a38463482ffd4
SHA256

c67524abce6494585f816939788f4014a6cd9d0266a22af8d0d0547aec5bbd42
SHA512

96c7892d6a101c8a450406d542c1dd0fa628679a217e7f6548ea91fb87156ba2751dfac4ee61b866ded6955c56620c7f59d146a01116ace842f04d75212d7961
SSDEEP

1536:QKw/hzDAPsIj/Ji5iv4Cr5RVrWyprPFW2iwTbW:z+h5FCdRRXtFW2VTbW

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmdnbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eonehbjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkeaqi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilmmni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnadagbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Paiogf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojllan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knlleepl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cqpbglno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efffmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fibojhim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kckqbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eecdjmfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oaifpi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogcnmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caojpaij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hglaej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llpmoiof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohgoaehe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epcdqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbdlop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knbbep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnqfcbnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opeiadfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idebdcdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgkdbacp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcbdgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgqfdnah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cggimh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhpqaiji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpfcdojl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Codhnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knfeeimj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Flkdfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjehmfch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ingpmmgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfedoc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gifkpknp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohlqcagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aokkahlo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggeboaob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddadpdmn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcfahbpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qhjmdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcgffqei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkleeplq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Podmkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnfaohbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhjmdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjlmclqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afnnnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icfekc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngndaccj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgpcliao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoogfnnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Madjhb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfipef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebjcajjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pncgmkmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iplkpa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lopmii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmipdk32.exe

Executes dropped EXE 64 IoCs

pid	Process
2596	Njciko32.exe
2312	Nckndeni.exe
2520	Njefqo32.exe
1576	Odkjng32.exe
4452	Ojgbfocc.exe
2408	Ojllan32.exe
4644	Odapnf32.exe
1464	Ojoign32.exe
940	Oqhacgdh.exe
524	Pnlaml32.exe
4128	Pcijeb32.exe
3700	Pqmjog32.exe
1428	Pjeoglgc.exe
3840	Pcncpbmd.exe
840	Pncgmkmj.exe
232	Pfolbmje.exe
3668	Qmkadgpo.exe
1772	Qdbiedpa.exe
4532	Qcgffqei.exe
3528	Ajanck32.exe
3104	Adgbpc32.exe
4404	Afhohlbj.exe
364	Anogiicl.exe
4312	Agglboim.exe
4148	Acnlgp32.exe
3704	Ajhddjfn.exe
3464	Cjkjpgfi.exe
4084	Chokikeb.exe
1788	Cnicfe32.exe
3432	Chagok32.exe
2624	Cdhhdlid.exe
3064	Cjbpaf32.exe
416	Cegdnopg.exe
1564	Dfiafg32.exe
228	Danecp32.exe
3192	Dhhnpjmh.exe
4944	Dobfld32.exe
1832	Daqbip32.exe
2368	Dhkjej32.exe
4636	Dmgbnq32.exe
4804	Ddakjkqi.exe
1748	Dogogcpo.exe
2884	Dddhpjof.exe
3068	Doilmc32.exe
3128	Eecdjmfi.exe
2008	Egdqae32.exe
2492	Eajeon32.exe
4776	Ehdmlhcj.exe
4712	Eonehbjg.exe
320	Ealadnik.exe
4548	Egijmegb.exe
3948	Emcbio32.exe
892	Eejjjl32.exe
5112	Eglgbdep.exe
1420	Eaakpm32.exe
3896	Edpgli32.exe
3520	Egnchd32.exe
4808	Emhldnkj.exe
4756	Fojedapj.exe
2424	Fdfmlhna.exe
1808	Fkqeib32.exe
4384	Fhdfbfdh.exe
4872	Fonnop32.exe
2348	Fdkggg32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bjodjb32.exe	Biogppeg.exe
File opened for modification	C:\Windows\SysWOW64\Aonhghjl.exe	Aggpfkjj.exe
File created	C:\Windows\SysWOW64\Flkdfh32.exe	Enigke32.exe
File created	C:\Windows\SysWOW64\Mqfpckhm.exe	Mnhdgpii.exe
File created	C:\Windows\SysWOW64\Bhblllfo.exe	Bahdob32.exe
File opened for modification	C:\Windows\SysWOW64\Nhnlkfpp.exe	Nbadcpbh.exe
File opened for modification	C:\Windows\SysWOW64\Kkjeomld.exe	Knfeeimj.exe
File created	C:\Windows\SysWOW64\Mhjmpfcl.dll	Dfglfdkb.exe
File created	C:\Windows\SysWOW64\Npiiffqe.exe	Njmqnobn.exe
File opened for modification	C:\Windows\SysWOW64\Fojedapj.exe	Emhldnkj.exe
File opened for modification	C:\Windows\SysWOW64\Eibfck32.exe	Ejpfhnpe.exe
File created	C:\Windows\SysWOW64\Hnlonj32.dll	Jbdlop32.exe
File opened for modification	C:\Windows\SysWOW64\Leopnglc.exe	Lgkpdcmi.exe
File created	C:\Windows\SysWOW64\Ddqhja32.dll	Fkqeib32.exe
File created	C:\Windows\SysWOW64\Kjmmepfj.exe	Kilpmh32.exe
File opened for modification	C:\Windows\SysWOW64\Pnplfj32.exe	Pfiddm32.exe
File created	C:\Windows\SysWOW64\Hpmpjoao.dll	Mbognp32.exe
File created	C:\Windows\SysWOW64\Aokkahlo.exe	Akpoaj32.exe
File created	C:\Windows\SysWOW64\Algheg32.dll	Kdinljnk.exe
File opened for modification	C:\Windows\SysWOW64\Jepjhg32.exe	Jofalmmp.exe
File created	C:\Windows\SysWOW64\Johnamkm.exe	Jepjhg32.exe
File opened for modification	C:\Windows\SysWOW64\Mjlhgaqp.exe	Mcbpjg32.exe
File created	C:\Windows\SysWOW64\Hglaej32.exe	Hdmein32.exe
File opened for modification	C:\Windows\SysWOW64\Igchfiof.exe	Iqipio32.exe
File opened for modification	C:\Windows\SysWOW64\Jqdoem32.exe	Jnfcia32.exe
File created	C:\Windows\SysWOW64\Lppbkgcj.exe	Lhijijbg.exe
File created	C:\Windows\SysWOW64\Hkicaahi.exe	Hcblpdgg.exe
File opened for modification	C:\Windows\SysWOW64\Doilmc32.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Abbcakoc.dll	Nchjdo32.exe
File opened for modification	C:\Windows\SysWOW64\Lnjnqh32.exe	Lgqfdnah.exe
File created	C:\Windows\SysWOW64\Ijdgcpaf.dll	Ohjlgefb.exe
File created	C:\Windows\SysWOW64\Idkbkl32.exe	Ibmeoq32.exe
File created	C:\Windows\SysWOW64\Kfqgab32.exe	Klkcdj32.exe
File opened for modification	C:\Windows\SysWOW64\Flinkojm.exe	Fbajbi32.exe
File created	C:\Windows\SysWOW64\Dbdplc32.dll	Lknojl32.exe
File created	C:\Windows\SysWOW64\Jnpfop32.exe	Jgenbfoa.exe
File created	C:\Windows\SysWOW64\Omcjep32.exe	Njpdnedf.exe
File opened for modification	C:\Windows\SysWOW64\Dhhnpjmh.exe	Danecp32.exe
File created	C:\Windows\SysWOW64\Bmfooa32.dll	Hkehkocf.exe
File created	C:\Windows\SysWOW64\Madjhb32.exe	Mnfnlf32.exe
File opened for modification	C:\Windows\SysWOW64\Hpfcdojl.exe	Hnhghcki.exe
File created	C:\Windows\SysWOW64\Lfojmmbg.dll	Peahgl32.exe
File opened for modification	C:\Windows\SysWOW64\Ckebcg32.exe	Chfegk32.exe
File opened for modification	C:\Windows\SysWOW64\Eaakpm32.exe	Eglgbdep.exe
File created	C:\Windows\SysWOW64\Mbognp32.exe	Mifcejnj.exe
File created	C:\Windows\SysWOW64\Dleglm32.dll	Ophjiaql.exe
File created	C:\Windows\SysWOW64\Hgiepjga.exe	Hpomcp32.exe
File created	C:\Windows\SysWOW64\Hiiggoaf.exe	Hcpojd32.exe
File opened for modification	C:\Windows\SysWOW64\Lcggio32.exe	Lnjnqh32.exe
File created	C:\Windows\SysWOW64\Lnjgfb32.exe	Lfbped32.exe
File created	C:\Windows\SysWOW64\Igfkfo32.exe	Ifdonfka.exe
File opened for modification	C:\Windows\SysWOW64\Pjbkgfej.exe	Ppjgoaoj.exe
File opened for modification	C:\Windows\SysWOW64\Afnnnd32.exe	Aqoiqn32.exe
File created	C:\Windows\SysWOW64\Iepaaico.exe	Hoaojp32.exe
File opened for modification	C:\Windows\SysWOW64\Lfbped32.exe	Lcdciiec.exe
File created	C:\Windows\SysWOW64\Ofkhal32.dll	Bhkfkmmg.exe
File created	C:\Windows\SysWOW64\Eekgliip.dll	Cacckp32.exe
File created	C:\Windows\SysWOW64\Iigdfa32.exe	Ioopml32.exe
File created	C:\Windows\SysWOW64\Dakacjdb.exe	Cidjbmcp.exe
File opened for modification	C:\Windows\SysWOW64\Jnpfop32.exe	Jgenbfoa.exe
File opened for modification	C:\Windows\SysWOW64\Bhmbqm32.exe	Bpfkpp32.exe
File opened for modification	C:\Windows\SysWOW64\Ojgbfocc.exe	Odkjng32.exe
File created	C:\Windows\SysWOW64\Danecp32.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Hkckeo32.exe	Hdicienl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6320	5640	WerFault.exe	667

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oileggkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfgllk32.dll"	Hoaojp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aooold32.dll"	Lckiihok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnokgcbe.dll"	Ojfcdnjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfnkkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Plhnda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnbokg32.dll"	Ggahedjn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Khmknk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Illddp32.dll"	Lkchelci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngndaccj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cacckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mflfak32.dll"	Eaakpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jndamj32.dll"	Hofmfmhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbkbod32.dll"	Kelalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbiejoaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkibak32.dll"	Edpgli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibcllpfj.dll"	Jeqbpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpmpjoao.dll"	Mbognp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aknbkjfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgcail32.dll"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Biogppeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hglppijc.dll"	Ijcahd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obonfmck.dll"	Kinmcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lafnnj32.dll"	Knhakh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhghfqcd.dll"	Jiokfpph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjhfpa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ejdocm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqlelp32.dll"	Llpmoiof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Diicml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iomoenej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmqgabec.dll"	Dhomfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kghjhemo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmeoam32.dll"	Kkjeomld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qlgpod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Apaadpng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkleeplq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mbognp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ggbook32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kljibbol.dll"	Bfendmoc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnkkjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcjppk32.dll"	Hpfcdojl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kqbkfkal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lflpengd.dll"	Jgkdbacp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idefqiag.dll"	Lgbloglj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ghpendjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jkmgblok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djhpgofm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jglklggl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgkdbacp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofkhal32.dll"	Bhkfkmmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gahjgj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Igfkfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hncfnebg.dll"	Gpcmga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihbdplfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkicaahi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lahoec32.dll"	Bgelgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmfooa32.dll"	Hkehkocf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgjgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhpfqcln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdpcal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khddfdcl.dll"	Ealadnik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Icfekc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jleijb32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 2596	4192	c67524abce6494585f816939788f4014a6cd9d0266a22af8d0d0547aec5bbd42.exe	88
PID 4192 wrote to memory of 2596	4192	c67524abce6494585f816939788f4014a6cd9d0266a22af8d0d0547aec5bbd42.exe	88
PID 4192 wrote to memory of 2596	4192	c67524abce6494585f816939788f4014a6cd9d0266a22af8d0d0547aec5bbd42.exe	88
PID 2596 wrote to memory of 2312	2596	Njciko32.exe	89
PID 2596 wrote to memory of 2312	2596	Njciko32.exe	89
PID 2596 wrote to memory of 2312	2596	Njciko32.exe	89
PID 2312 wrote to memory of 2520	2312	Nckndeni.exe	90
PID 2312 wrote to memory of 2520	2312	Nckndeni.exe	90
PID 2312 wrote to memory of 2520	2312	Nckndeni.exe	90
PID 2520 wrote to memory of 1576	2520	Njefqo32.exe	91
PID 2520 wrote to memory of 1576	2520	Njefqo32.exe	91
PID 2520 wrote to memory of 1576	2520	Njefqo32.exe	91
PID 1576 wrote to memory of 4452	1576	Odkjng32.exe	92
PID 1576 wrote to memory of 4452	1576	Odkjng32.exe	92
PID 1576 wrote to memory of 4452	1576	Odkjng32.exe	92
PID 4452 wrote to memory of 2408	4452	Ojgbfocc.exe	94
PID 4452 wrote to memory of 2408	4452	Ojgbfocc.exe	94
PID 4452 wrote to memory of 2408	4452	Ojgbfocc.exe	94
PID 2408 wrote to memory of 4644	2408	Ojllan32.exe	95
PID 2408 wrote to memory of 4644	2408	Ojllan32.exe	95
PID 2408 wrote to memory of 4644	2408	Ojllan32.exe	95
PID 4644 wrote to memory of 1464	4644	Odapnf32.exe	96
PID 4644 wrote to memory of 1464	4644	Odapnf32.exe	96
PID 4644 wrote to memory of 1464	4644	Odapnf32.exe	96
PID 1464 wrote to memory of 940	1464	Ojoign32.exe	97
PID 1464 wrote to memory of 940	1464	Ojoign32.exe	97
PID 1464 wrote to memory of 940	1464	Ojoign32.exe	97
PID 940 wrote to memory of 524	940	Oqhacgdh.exe	98
PID 940 wrote to memory of 524	940	Oqhacgdh.exe	98
PID 940 wrote to memory of 524	940	Oqhacgdh.exe	98
PID 524 wrote to memory of 4128	524	Pnlaml32.exe	99
PID 524 wrote to memory of 4128	524	Pnlaml32.exe	99
PID 524 wrote to memory of 4128	524	Pnlaml32.exe	99
PID 4128 wrote to memory of 3700	4128	Pcijeb32.exe	101
PID 4128 wrote to memory of 3700	4128	Pcijeb32.exe	101
PID 4128 wrote to memory of 3700	4128	Pcijeb32.exe	101
PID 3700 wrote to memory of 1428	3700	Pqmjog32.exe	102
PID 3700 wrote to memory of 1428	3700	Pqmjog32.exe	102
PID 3700 wrote to memory of 1428	3700	Pqmjog32.exe	102
PID 1428 wrote to memory of 3840	1428	Pjeoglgc.exe	103
PID 1428 wrote to memory of 3840	1428	Pjeoglgc.exe	103
PID 1428 wrote to memory of 3840	1428	Pjeoglgc.exe	103
PID 3840 wrote to memory of 840	3840	Pcncpbmd.exe	104
PID 3840 wrote to memory of 840	3840	Pcncpbmd.exe	104
PID 3840 wrote to memory of 840	3840	Pcncpbmd.exe	104
PID 840 wrote to memory of 232	840	Pncgmkmj.exe	105
PID 840 wrote to memory of 232	840	Pncgmkmj.exe	105
PID 840 wrote to memory of 232	840	Pncgmkmj.exe	105
PID 232 wrote to memory of 3668	232	Pfolbmje.exe	107
PID 232 wrote to memory of 3668	232	Pfolbmje.exe	107
PID 232 wrote to memory of 3668	232	Pfolbmje.exe	107
PID 3668 wrote to memory of 1772	3668	Qmkadgpo.exe	108
PID 3668 wrote to memory of 1772	3668	Qmkadgpo.exe	108
PID 3668 wrote to memory of 1772	3668	Qmkadgpo.exe	108
PID 1772 wrote to memory of 4532	1772	Qdbiedpa.exe	109
PID 1772 wrote to memory of 4532	1772	Qdbiedpa.exe	109
PID 1772 wrote to memory of 4532	1772	Qdbiedpa.exe	109
PID 4532 wrote to memory of 3528	4532	Qcgffqei.exe	110
PID 4532 wrote to memory of 3528	4532	Qcgffqei.exe	110
PID 4532 wrote to memory of 3528	4532	Qcgffqei.exe	110
PID 3528 wrote to memory of 3104	3528	Ajanck32.exe	111
PID 3528 wrote to memory of 3104	3528	Ajanck32.exe	111
PID 3528 wrote to memory of 3104	3528	Ajanck32.exe	111
PID 3104 wrote to memory of 4404	3104	Adgbpc32.exe	112

C:\Users\Admin\AppData\Local\Temp\c67524abce6494585f816939788f4014a6cd9d0266a22af8d0d0547aec5bbd42.exe
"C:\Users\Admin\AppData\Local\Temp\c67524abce6494585f816939788f4014a6cd9d0266a22af8d0d0547aec5bbd42.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\Njciko32.exe
  C:\Windows\system32\Njciko32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\SysWOW64\Nckndeni.exe
    C:\Windows\system32\Nckndeni.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Windows\SysWOW64\Njefqo32.exe
      C:\Windows\system32\Njefqo32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2520
    - - C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1576
      - C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:940
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:524
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1428
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3840
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:840
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:232
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        23⤵
        Executes dropped EXE
        
        PID:4404
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        24⤵
        Executes dropped EXE
        
        PID:364
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        25⤵
        Executes dropped EXE
        
        PID:4312
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        26⤵
        Executes dropped EXE
        
        PID:4148
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        27⤵
        Executes dropped EXE
        
        PID:3704
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        28⤵
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        29⤵
        Executes dropped EXE
        
        PID:4084
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        30⤵
        Executes dropped EXE
        
        PID:1788
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        31⤵
        Executes dropped EXE
        
        PID:3432
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        32⤵
        Executes dropped EXE
        
        PID:2624
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3064
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        34⤵
        Executes dropped EXE
        
        PID:416
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1564
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:228
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        37⤵
        Executes dropped EXE
        
        PID:3192
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        38⤵
        Executes dropped EXE
        
        PID:4944
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        39⤵
        Executes dropped EXE
        
        PID:1832
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2368
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        41⤵
        Executes dropped EXE
        
        PID:4636
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        42⤵
        Executes dropped EXE
        
        PID:4804
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        43⤵
        Executes dropped EXE
        
        PID:1748
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2884
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        45⤵
        Executes dropped EXE
        
        PID:3068
        
        C:\Windows\SysWOW64\Eecdjmfi.exe
        
        C:\Windows\system32\Eecdjmfi.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3128
        
        C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        47⤵
        Executes dropped EXE
        
        PID:2008
        
        C:\Windows\SysWOW64\Eajeon32.exe
        
        C:\Windows\system32\Eajeon32.exe
        48⤵
        Executes dropped EXE
        
        PID:2492
        
        C:\Windows\SysWOW64\Ehdmlhcj.exe
        
        C:\Windows\system32\Ehdmlhcj.exe
        49⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\Eonehbjg.exe
        
        C:\Windows\system32\Eonehbjg.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4712
        
        C:\Windows\SysWOW64\Ealadnik.exe
        
        C:\Windows\system32\Ealadnik.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:320
        
        C:\Windows\SysWOW64\Egijmegb.exe
        
        C:\Windows\system32\Egijmegb.exe
        52⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\SysWOW64\Emcbio32.exe
        
        C:\Windows\system32\Emcbio32.exe
        53⤵
        Executes dropped EXE
        
        PID:3948
        
        C:\Windows\SysWOW64\Eejjjl32.exe
        
        C:\Windows\system32\Eejjjl32.exe
        54⤵
        Executes dropped EXE
        
        PID:892
        
        C:\Windows\SysWOW64\Eglgbdep.exe
        
        C:\Windows\system32\Eglgbdep.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5112
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1420
        
        C:\Windows\SysWOW64\Edpgli32.exe
        
        C:\Windows\system32\Edpgli32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3896
        
        C:\Windows\SysWOW64\Egnchd32.exe
        
        C:\Windows\system32\Egnchd32.exe
        58⤵
        Executes dropped EXE
        
        PID:3520
        
        C:\Windows\SysWOW64\Emhldnkj.exe
        
        C:\Windows\system32\Emhldnkj.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4808
        
        C:\Windows\SysWOW64\Fojedapj.exe
        
        C:\Windows\system32\Fojedapj.exe
        60⤵
        Executes dropped EXE
        
        PID:4756
        
        C:\Windows\SysWOW64\Fdfmlhna.exe
        
        C:\Windows\system32\Fdfmlhna.exe
        61⤵
        Executes dropped EXE
        
        PID:2424
        
        C:\Windows\SysWOW64\Fkqeib32.exe
        
        C:\Windows\system32\Fkqeib32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1808
        
        C:\Windows\SysWOW64\Fhdfbfdh.exe
        
        C:\Windows\system32\Fhdfbfdh.exe
        63⤵
        Executes dropped EXE
        
        PID:4384
        
        C:\Windows\SysWOW64\Fonnop32.exe
        
        C:\Windows\system32\Fonnop32.exe
        64⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SysWOW64\Fdkggg32.exe
        
        C:\Windows\system32\Fdkggg32.exe
        65⤵
        Executes dropped EXE
        
        PID:2348
        
        C:\Windows\SysWOW64\Fgjccb32.exe
        
        C:\Windows\system32\Fgjccb32.exe
        66⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Fnckpmql.exe
        
        C:\Windows\system32\Fnckpmql.exe
        67⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\Gdncmghi.exe
        
        C:\Windows\system32\Gdncmghi.exe
        68⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Gochjpho.exe
        
        C:\Windows\system32\Gochjpho.exe
        69⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Gempgj32.exe
        
        C:\Windows\system32\Gempgj32.exe
        70⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\Ghklce32.exe
        
        C:\Windows\system32\Ghklce32.exe
        71⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Goedpofl.exe
        
        C:\Windows\system32\Goedpofl.exe
        72⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Gadqlkep.exe
        
        C:\Windows\system32\Gadqlkep.exe
        73⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Gdbmhf32.exe
        
        C:\Windows\system32\Gdbmhf32.exe
        74⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Gkleeplq.exe
        
        C:\Windows\system32\Gkleeplq.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Gafmaj32.exe
        
        C:\Windows\system32\Gafmaj32.exe
        76⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Ghpendjj.exe
        
        C:\Windows\system32\Ghpendjj.exe
        77⤵
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Gkobjpin.exe
        
        C:\Windows\system32\Gkobjpin.exe
        78⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Gahjgj32.exe
        
        C:\Windows\system32\Gahjgj32.exe
        79⤵
        Modifies registry class
        
        PID:5496
        
        C:\Windows\SysWOW64\Ggeboaob.exe
        
        C:\Windows\system32\Ggeboaob.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5540
        
        C:\Windows\SysWOW64\Hakgmjoh.exe
        
        C:\Windows\system32\Hakgmjoh.exe
        81⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Hdicienl.exe
        
        C:\Windows\system32\Hdicienl.exe
        82⤵
        Drops file in System32 directory
        
        PID:5628
        
        C:\Windows\SysWOW64\Hkckeo32.exe
        
        C:\Windows\system32\Hkckeo32.exe
        83⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Hoogfnnb.exe
        
        C:\Windows\system32\Hoogfnnb.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5708
        
        C:\Windows\SysWOW64\Hhgloc32.exe
        
        C:\Windows\system32\Hhgloc32.exe
        85⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Hkehkocf.exe
        
        C:\Windows\system32\Hkehkocf.exe
        86⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        87⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        88⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Hbbmmi32.exe
        
        C:\Windows\system32\Hbbmmi32.exe
        89⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        90⤵
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Hdbfodfa.exe
        
        C:\Windows\system32\Hdbfodfa.exe
        91⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Hkmnln32.exe
        
        C:\Windows\system32\Hkmnln32.exe
        92⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Inkjhi32.exe
        
        C:\Windows\system32\Inkjhi32.exe
        93⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Idebdcdo.exe
        
        C:\Windows\system32\Idebdcdo.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5128
        
        C:\Windows\SysWOW64\Ikokan32.exe
        
        C:\Windows\system32\Ikokan32.exe
        95⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Ifdonfka.exe
        
        C:\Windows\system32\Ifdonfka.exe
        96⤵
        Drops file in System32 directory
        
        PID:5244
        
        C:\Windows\SysWOW64\Igfkfo32.exe
        
        C:\Windows\system32\Igfkfo32.exe
        97⤵
        Modifies registry class
        
        PID:5328
        
        C:\Windows\SysWOW64\Iomcgl32.exe
        
        C:\Windows\system32\Iomcgl32.exe
        98⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Ifgldfio.exe
        
        C:\Windows\system32\Ifgldfio.exe
        99⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Ioopml32.exe
        
        C:\Windows\system32\Ioopml32.exe
        100⤵
        Drops file in System32 directory
        
        PID:5536
        
        C:\Windows\SysWOW64\Iigdfa32.exe
        
        C:\Windows\system32\Iigdfa32.exe
        101⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Ioambknl.exe
        
        C:\Windows\system32\Ioambknl.exe
        102⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Ifleoe32.exe
        
        C:\Windows\system32\Ifleoe32.exe
        103⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Iijaka32.exe
        
        C:\Windows\system32\Iijaka32.exe
        104⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Jkhngl32.exe
        
        C:\Windows\system32\Jkhngl32.exe
        105⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        106⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        107⤵
        Modifies registry class
        
        PID:6008
        
        C:\Windows\SysWOW64\Joffnk32.exe
        
        C:\Windows\system32\Joffnk32.exe
        108⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Jbdbjf32.exe
        
        C:\Windows\system32\Jbdbjf32.exe
        109⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\Jiokfpph.exe
        
        C:\Windows\system32\Jiokfpph.exe
        110⤵
        Modifies registry class
        
        PID:5248
        
        C:\Windows\SysWOW64\Jkmgblok.exe
        
        C:\Windows\system32\Jkmgblok.exe
        111⤵
        Modifies registry class
        
        PID:5344
        
        C:\Windows\SysWOW64\Jbgoof32.exe
        
        C:\Windows\system32\Jbgoof32.exe
        112⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Jiaglp32.exe
        
        C:\Windows\system32\Jiaglp32.exe
        113⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Jkodhk32.exe
        
        C:\Windows\system32\Jkodhk32.exe
        114⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Kelalp32.exe
        
        C:\Windows\system32\Kelalp32.exe
        115⤵
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        116⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Knefeffd.exe
        
        C:\Windows\system32\Knefeffd.exe
        117⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Keonap32.exe
        
        C:\Windows\system32\Keonap32.exe
        118⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Khmknk32.exe
        
        C:\Windows\system32\Khmknk32.exe
        119⤵
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Kfnkkb32.exe
        
        C:\Windows\system32\Kfnkkb32.exe
        120⤵
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Klkcdj32.exe
        
        C:\Windows\system32\Klkcdj32.exe
        121⤵
        Drops file in System32 directory
        
        PID:5520
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        122⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Khbdikip.exe
        
        C:\Windows\system32\Khbdikip.exe
        123⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6052
        
        C:\Windows\SysWOW64\Kefdbo32.exe
        
        C:\Windows\system32\Kefdbo32.exe
        125⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        127⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\Lidmhmnp.exe
        
        C:\Windows\system32\Lidmhmnp.exe
        128⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Lnqeqd32.exe
        
        C:\Windows\system32\Lnqeqd32.exe
        129⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Lhijijbg.exe
        
        C:\Windows\system32\Lhijijbg.exe
        130⤵
        Drops file in System32 directory
        
        PID:3796
        
        C:\Windows\SysWOW64\Lppbkgcj.exe
        
        C:\Windows\system32\Lppbkgcj.exe
        131⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Lbnngbbn.exe
        
        C:\Windows\system32\Lbnngbbn.exe
        132⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Lihfcm32.exe
        
        C:\Windows\system32\Lihfcm32.exe
        133⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Lpbopfag.exe
        
        C:\Windows\system32\Lpbopfag.exe
        134⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        135⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Llipehgk.exe
        
        C:\Windows\system32\Llipehgk.exe
        136⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Loglacfo.exe
        
        C:\Windows\system32\Loglacfo.exe
        137⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Mhppji32.exe
        
        C:\Windows\system32\Mhppji32.exe
        138⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Mpghkf32.exe
        
        C:\Windows\system32\Mpghkf32.exe
        139⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Mbedga32.exe
        
        C:\Windows\system32\Mbedga32.exe
        140⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Mibijk32.exe
        
        C:\Windows\system32\Mibijk32.exe
        141⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Mbjnbqhp.exe
        
        C:\Windows\system32\Mbjnbqhp.exe
        142⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Mhgfkg32.exe
        
        C:\Windows\system32\Mhgfkg32.exe
        143⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Mblkhq32.exe
        
        C:\Windows\system32\Mblkhq32.exe
        144⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Mifcejnj.exe
        
        C:\Windows\system32\Mifcejnj.exe
        145⤵
        Drops file in System32 directory
        
        PID:6616
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        146⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6656
        
        C:\Windows\SysWOW64\Nhlpfgbb.exe
        
        C:\Windows\system32\Nhlpfgbb.exe
        147⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Npchgdcd.exe
        
        C:\Windows\system32\Npchgdcd.exe
        148⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Nbadcpbh.exe
        
        C:\Windows\system32\Nbadcpbh.exe
        149⤵
        Drops file in System32 directory
        
        PID:6792
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        150⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        151⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Nebmekoi.exe
        
        C:\Windows\system32\Nebmekoi.exe
        152⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Npgabc32.exe
        
        C:\Windows\system32\Npgabc32.exe
        153⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        154⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Nchjdo32.exe
        
        C:\Windows\system32\Nchjdo32.exe
        155⤵
        Drops file in System32 directory
        
        PID:7060
        
        C:\Windows\SysWOW64\Nlqomd32.exe
        
        C:\Windows\system32\Nlqomd32.exe
        156⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Ohgoaehe.exe
        
        C:\Windows\system32\Ohgoaehe.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7144
        
        C:\Windows\SysWOW64\Ocmconhk.exe
        
        C:\Windows\system32\Ocmconhk.exe
        158⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        159⤵
        Drops file in System32 directory
        
        PID:6216
        
        C:\Windows\SysWOW64\Oenlqi32.exe
        
        C:\Windows\system32\Oenlqi32.exe
        160⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        161⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        162⤵
        Modifies registry class
        
        PID:6420
        
        C:\Windows\SysWOW64\Ophjiaql.exe
        
        C:\Windows\system32\Ophjiaql.exe
        163⤵
        Drops file in System32 directory
        
        PID:6496
        
        C:\Windows\SysWOW64\Pjpobg32.exe
        
        C:\Windows\system32\Pjpobg32.exe
        164⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Ppjgoaoj.exe
        
        C:\Windows\system32\Ppjgoaoj.exe
        165⤵
        Drops file in System32 directory
        
        PID:6644
        
        C:\Windows\SysWOW64\Pjbkgfej.exe
        
        C:\Windows\system32\Pjbkgfej.exe
        166⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Pjehmfch.exe
        
        C:\Windows\system32\Pjehmfch.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6788
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        168⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Pflibgil.exe
        
        C:\Windows\system32\Pflibgil.exe
        169⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Podmkm32.exe
        
        C:\Windows\system32\Podmkm32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4048
        
        C:\Windows\SysWOW64\Pgkelj32.exe
        
        C:\Windows\system32\Pgkelj32.exe
        171⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Plhnda32.exe
        
        C:\Windows\system32\Plhnda32.exe
        172⤵
        Modifies registry class
        
        PID:7044
        
        C:\Windows\SysWOW64\Qljjjqlc.exe
        
        C:\Windows\system32\Qljjjqlc.exe
        173⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        174⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        175⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Ajeadd32.exe
        
        C:\Windows\system32\Ajeadd32.exe
        176⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\Aqoiqn32.exe
        
        C:\Windows\system32\Aqoiqn32.exe
        177⤵
        Drops file in System32 directory
        
        PID:4348
        
        C:\Windows\SysWOW64\Afnnnd32.exe
        
        C:\Windows\system32\Afnnnd32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:492
        
        C:\Windows\SysWOW64\Bogcgj32.exe
        
        C:\Windows\system32\Bogcgj32.exe
        179⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Bfqkddfd.exe
        
        C:\Windows\system32\Bfqkddfd.exe
        180⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Biogppeg.exe
        
        C:\Windows\system32\Biogppeg.exe
        181⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6600
        
        C:\Windows\SysWOW64\Bjodjb32.exe
        
        C:\Windows\system32\Bjodjb32.exe
        182⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        183⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Bfedoc32.exe
        
        C:\Windows\system32\Bfedoc32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6936
        
        C:\Windows\SysWOW64\Bmomlnjk.exe
        
        C:\Windows\system32\Bmomlnjk.exe
        185⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Bifmqo32.exe
        
        C:\Windows\system32\Bifmqo32.exe
        186⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Cqpbglno.exe
        
        C:\Windows\system32\Cqpbglno.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6192
        
        C:\Windows\SysWOW64\Cjhfpa32.exe
        
        C:\Windows\system32\Cjhfpa32.exe
        188⤵
        Modifies registry class
        
        PID:6316
        
        C:\Windows\SysWOW64\Ccqkigkp.exe
        
        C:\Windows\system32\Ccqkigkp.exe
        189⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\Caghhk32.exe
        
        C:\Windows\system32\Caghhk32.exe
        190⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Cfcqpa32.exe
        
        C:\Windows\system32\Cfcqpa32.exe
        191⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Cidjbmcp.exe
        
        C:\Windows\system32\Cidjbmcp.exe
        192⤵
        Drops file in System32 directory
        
        PID:6756
        
        C:\Windows\SysWOW64\Dakacjdb.exe
        
        C:\Windows\system32\Dakacjdb.exe
        193⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Dcjnoece.exe
        
        C:\Windows\system32\Dcjnoece.exe
        194⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        195⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Dhhfedil.exe
        
        C:\Windows\system32\Dhhfedil.exe
        196⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Diicml32.exe
        
        C:\Windows\system32\Diicml32.exe
        197⤵
        Modifies registry class
        
        PID:4216
        
        C:\Windows\SysWOW64\Dapkni32.exe
        
        C:\Windows\system32\Dapkni32.exe
        198⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Djhpgofm.exe
        
        C:\Windows\system32\Djhpgofm.exe
        199⤵
        Modifies registry class
        
        PID:6768
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        200⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6312
        
        C:\Windows\SysWOW64\Dfoplpla.exe
        
        C:\Windows\system32\Dfoplpla.exe
        202⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Dinmhkke.exe
        
        C:\Windows\system32\Dinmhkke.exe
        203⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Daediilg.exe
        
        C:\Windows\system32\Daediilg.exe
        204⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Dhomfc32.exe
        
        C:\Windows\system32\Dhomfc32.exe
        205⤵
        Modifies registry class
        
        PID:4788
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        206⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Emlenj32.exe
        
        C:\Windows\system32\Emlenj32.exe
        207⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Edemkd32.exe
        
        C:\Windows\system32\Edemkd32.exe
        208⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Ejpfhnpe.exe
        
        C:\Windows\system32\Ejpfhnpe.exe
        209⤵
        Drops file in System32 directory
        
        PID:6980
        
        C:\Windows\SysWOW64\Eibfck32.exe
        
        C:\Windows\system32\Eibfck32.exe
        210⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        211⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7292
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        213⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Edjgfcec.exe
        
        C:\Windows\system32\Edjgfcec.exe
        214⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Efhcbodf.exe
        
        C:\Windows\system32\Efhcbodf.exe
        215⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Ejdocm32.exe
        
        C:\Windows\system32\Ejdocm32.exe
        216⤵
        Modifies registry class
        
        PID:7492
        
        C:\Windows\SysWOW64\Eangpgcl.exe
        
        C:\Windows\system32\Eangpgcl.exe
        217⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Edmclccp.exe
        
        C:\Windows\system32\Edmclccp.exe
        218⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        219⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7692
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        221⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        222⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        223⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Fibojhim.exe
        
        C:\Windows\system32\Fibojhim.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7864
        
        C:\Windows\SysWOW64\Ggilil32.exe
        
        C:\Windows\system32\Ggilil32.exe
        225⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        226⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        227⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Gpcmga32.exe
        
        C:\Windows\system32\Gpcmga32.exe
        228⤵
        Modifies registry class
        
        PID:8052
        
        C:\Windows\SysWOW64\Ggnedlao.exe
        
        C:\Windows\system32\Ggnedlao.exe
        229⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        230⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        231⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Gklnjj32.exe
        
        C:\Windows\system32\Gklnjj32.exe
        232⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        233⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Ghpocngo.exe
        
        C:\Windows\system32\Ghpocngo.exe
        234⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        235⤵
        Modifies registry class
        
        PID:7588
        
        C:\Windows\SysWOW64\Gnlgleef.exe
        
        C:\Windows\system32\Gnlgleef.exe
        236⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Gahcmd32.exe
        
        C:\Windows\system32\Gahcmd32.exe
        237⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        238⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        239⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        240⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        241⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Hnaqgd32.exe
        
        C:\Windows\system32\Hnaqgd32.exe
        242⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Hpomcp32.exe
        
        C:\Windows\system32\Hpomcp32.exe
        243⤵
        Drops file in System32 directory
        
        PID:7368
        
        C:\Windows\SysWOW64\Hgiepjga.exe
        
        C:\Windows\system32\Hgiepjga.exe
        244⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7560
        
        C:\Windows\SysWOW64\Haoimcgg.exe
        
        C:\Windows\system32\Haoimcgg.exe
        246⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        247⤵
        Drops file in System32 directory
        
        PID:7852
        
        C:\Windows\SysWOW64\Hglaej32.exe
        
        C:\Windows\system32\Hglaej32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8032
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        249⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Hpdfnolo.exe
        
        C:\Windows\system32\Hpdfnolo.exe
        250⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        251⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        252⤵
        Drops file in System32 directory
        
        PID:7992
        
        C:\Windows\SysWOW64\Hpfcdojl.exe
        
        C:\Windows\system32\Hpfcdojl.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7392
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        254⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Ijogmdqm.exe
        
        C:\Windows\system32\Ijogmdqm.exe
        255⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        256⤵
        Drops file in System32 directory
        
        PID:8004
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        257⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Inmpcc32.exe
        
        C:\Windows\system32\Inmpcc32.exe
        258⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        259⤵
        Modifies registry class
        
        PID:8272
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        260⤵
        Modifies registry class
        
        PID:8308
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        261⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        262⤵
        Drops file in System32 directory
        
        PID:8404
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        263⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        264⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Iqbbpm32.exe
        
        C:\Windows\system32\Iqbbpm32.exe
        265⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Jglklggl.exe
        
        C:\Windows\system32\Jglklggl.exe
        266⤵
        Modifies registry class
        
        PID:8572
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        267⤵
        Drops file in System32 directory
        
        PID:8620
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        268⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Jjmcnbdm.exe
        
        C:\Windows\system32\Jjmcnbdm.exe
        269⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Jbdlop32.exe
        
        C:\Windows\system32\Jbdlop32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8736
        
        C:\Windows\SysWOW64\Jqglkmlj.exe
        
        C:\Windows\system32\Jqglkmlj.exe
        271⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Jjopcb32.exe
        
        C:\Windows\system32\Jjopcb32.exe
        272⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8868
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        274⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        275⤵
        Modifies registry class
        
        PID:8952
        
        C:\Windows\SysWOW64\Jdgafjpn.exe
        
        C:\Windows\system32\Jdgafjpn.exe
        276⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        277⤵
        Drops file in System32 directory
        
        PID:9044
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        278⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        279⤵
        Drops file in System32 directory
        
        PID:9136
        
        C:\Windows\SysWOW64\Kghjhemo.exe
        
        C:\Windows\system32\Kghjhemo.exe
        280⤵
        Modifies registry class
        
        PID:9180
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7724
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        282⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Kgjgne32.exe
        
        C:\Windows\system32\Kgjgne32.exe
        283⤵
        Modifies registry class
        
        PID:8300
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        284⤵
        Modifies registry class
        
        PID:8376
        
        C:\Windows\SysWOW64\Kaehljpj.exe
        
        C:\Windows\system32\Kaehljpj.exe
        285⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        286⤵
        Drops file in System32 directory
        
        PID:8508
        
        C:\Windows\SysWOW64\Kjmmepfj.exe
        
        C:\Windows\system32\Kjmmepfj.exe
        287⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        288⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        289⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        290⤵
        Modifies registry class
        
        PID:8788
        
        C:\Windows\SysWOW64\Knkekn32.exe
        
        C:\Windows\system32\Knkekn32.exe
        291⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        292⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        293⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        294⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        295⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        296⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        297⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        298⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Lgkpdcmi.exe
        
        C:\Windows\system32\Lgkpdcmi.exe
        299⤵
        Drops file in System32 directory
        
        PID:8544
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        300⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        301⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        302⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9104
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        304⤵
        Modifies registry class
        
        PID:8304
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        305⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        306⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        307⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        308⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        309⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        310⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8448
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        312⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        313⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        314⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9312
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        316⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        317⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        318⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        319⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        320⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        321⤵
        Drops file in System32 directory
        
        PID:9596
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        322⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        323⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        324⤵
        Modifies registry class
        
        PID:9728
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        325⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        326⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        327⤵
        Drops file in System32 directory
        
        PID:9860
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        328⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        329⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        330⤵
        Drops file in System32 directory
        
        PID:9984
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        331⤵
        Modifies registry class
        
        PID:10032
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10068
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        333⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        334⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        335⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8496
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9304
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        338⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9468
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        340⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9608
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9668
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        343⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        344⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        345⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        346⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        347⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        348⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        349⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        350⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        351⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        352⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        353⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        354⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9548
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        356⤵
        Modifies registry class
        
        PID:9676
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        357⤵
        Modifies registry class
        
        PID:9788
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        358⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10016
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        360⤵
        Drops file in System32 directory
        
        PID:10096
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        361⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        362⤵
        Drops file in System32 directory
        
        PID:7960
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        363⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        364⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        365⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        366⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        367⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        368⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        369⤵
        Modifies registry class
        
        PID:9540
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1256
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        371⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        372⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        373⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        374⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        375⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        376⤵
        Drops file in System32 directory
        
        PID:9900
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9496
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        378⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        379⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        380⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        381⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        382⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        383⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        384⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        385⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        386⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        387⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        388⤵
        Drops file in System32 directory
        
        PID:10688
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        389⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        390⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        391⤵
        Drops file in System32 directory
        
        PID:10812
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        392⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        393⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        394⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        395⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        396⤵
        Modifies registry class
        
        PID:11028
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        397⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        398⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        399⤵
        Modifies registry class
        
        PID:11172
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        400⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        401⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11256
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10272
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        403⤵
        Modifies registry class
        
        PID:10316
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        404⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        405⤵
        Drops file in System32 directory
        
        PID:10488
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        406⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        407⤵
        Drops file in System32 directory
        
        PID:10640
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10656
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        409⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3308
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        411⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4412
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        412⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        413⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        414⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1632
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        415⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        416⤵
        Modifies registry class
        
        PID:10936
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4128
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        418⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        419⤵
        Modifies registry class
        
        PID:2280
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        420⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        421⤵
        Drops file in System32 directory
        
        PID:11064
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        422⤵
        Drops file in System32 directory
        
        PID:3668
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        423⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        424⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        425⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        426⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        427⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        428⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        429⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        430⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        431⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        432⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1556
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        433⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        434⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        435⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        436⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        437⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        438⤵
        Drops file in System32 directory
        
        PID:4632
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        439⤵
        Drops file in System32 directory
        
        PID:3068
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        440⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        441⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        442⤵
        Modifies registry class
        
        PID:5112
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        443⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        444⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        445⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        446⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5240
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        448⤵
        Modifies registry class
        
        PID:1808
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        449⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        450⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1940
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        451⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        452⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        453⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        454⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        455⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        456⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        457⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        458⤵
        Drops file in System32 directory
        
        PID:1576
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        459⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        460⤵
        Drops file in System32 directory
        
        PID:5928
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        461⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        462⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        463⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        464⤵
        
        PID:524
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        465⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        466⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        467⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        468⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        469⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        470⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        471⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        472⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        473⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        474⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        475⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        476⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        477⤵
        
        PID:776
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        478⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5256
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        479⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        480⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2060
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        481⤵
        Drops file in System32 directory
        
        PID:5600
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        482⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        483⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        484⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        485⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5792
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        486⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5980
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        487⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        488⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        489⤵
        
        PID:320
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        490⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        491⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        492⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        493⤵
        Modifies registry class
        
        PID:1100
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        494⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        495⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        496⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        497⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5776
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        498⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5184
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        499⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        500⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        501⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        502⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        503⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        504⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        505⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        506⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        507⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6552
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        508⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        509⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        510⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        511⤵
        Drops file in System32 directory
        
        PID:6700
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        512⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        513⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        514⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        515⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        516⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        517⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11192
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        518⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        519⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        520⤵
        Modifies registry class
        
        PID:10392
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        521⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        522⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        523⤵
        Drops file in System32 directory
        
        PID:1688
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        524⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5696
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        525⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        526⤵
        Drops file in System32 directory
        
        PID:6168
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        527⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        528⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        529⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        530⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        531⤵
        Modifies registry class
        
        PID:6968
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        532⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        533⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        534⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        535⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7120
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        536⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        537⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        538⤵
        Drops file in System32 directory
        
        PID:5936
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        539⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        540⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5580
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        541⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        542⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        543⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        544⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        545⤵
        Drops file in System32 directory
        
        PID:6280
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        546⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        547⤵
        Modifies registry class
        
        PID:11012
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        548⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        549⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        550⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        551⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        552⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        553⤵
        Drops file in System32 directory
        
        PID:6492
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        554⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        555⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        556⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:460
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        557⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        558⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        559⤵
        Modifies registry class
        
        PID:10564
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        560⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        561⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        562⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        563⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        564⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        565⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        566⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        567⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        568⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 400
        569⤵
        Program crash
        
        PID:6320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5640 -ip 5640
1⤵
PID:5764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acnlgp32.exe

Filesize
64KB

MD5
47bb3688557d19289c04dfb94ede9c1a

SHA1
56959d8b101699575585de8c89fd639ba6e5ee94

SHA256
d378c4c1787c12bef105fe9d401ff109c5d004a68c6be6c759180084645a12fe

SHA512
b06a774121bc40cd1fb16622b3f8924a46109f051e3199fa5fb989fa1576bd430f0330ac739c6ef51bee356a53598d52ae5c3d87cc2c78abedbafa899166660d

Download Submit
C:\Windows\SysWOW64\Adfgdpmi.exe

Filesize
64KB

MD5
8ed33f89accbbbc9504ab84fdf9f0ad8

SHA1
72a9047ac7bef46aa1cba751c1f90c66c5ef200a

SHA256
84b6152705b4fc8a967acb87ef17955073bef20a03bf3c29256ec100f1e007ae

SHA512
3bbfb58ce74bd1799080d192997017b2a4b7eca81e913ad9da426274f810856646d7e9e65e530f9ba3c51aa6e7610f946b6811ae9e5ac5676972e8f1f27970a9

Download Submit
C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
64KB

MD5
f47d2dcdc642fb66328a87cdf99d916b

SHA1
84f7bfa33bc59083141d51c0885193e09b63bd37

SHA256
0bbddf4ec9b4a4d20cf28be1f78b9862a470dd81f38ad9e8bc4d499b0a471cca

SHA512
964974f1c75c2a54060baa6db6024d754311e61e9c941868bbfddadd784e380cdbcc6328ebc1f473301411a32f800eb28aa81fa644e79e25bf6f0fd83829736a

Download Submit
C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
64KB

MD5
eeae82e04b53bcb9009beb0294c4db26

SHA1
11728c737e4968b77de13be0ed43f64c6cca38d5

SHA256
7463db5c1350a641be96d82626ad6dbc6515a8ff82eab3d592ff48e4092c9516

SHA512
4b80b00484c89e5e5139ae8b27976c14411f6fb252b34203e656031e8b927a406560180bd4d5d7a10a5dd205ca8611da70e1cf74fc112170145aaab8a11b7ed9

Download Submit
C:\Windows\SysWOW64\Afnnnd32.exe

Filesize
64KB

MD5
e20f08edd6935ef9453eff90c1ee816b

SHA1
4f28c32ededd84b7a87daa2060504bd9f6776d8f

SHA256
ea53c1b72a60d42d19763bd540584c42cd6698d8c2f977500b5bc118e5aa56a1

SHA512
510371a546cdc82d420673a48ca57a8233d7612fa99ff42e97007008a790d289a885b6c85d750d2a446e737090bc99014d9960b4a43e470b8c5ec39076814139

Download Submit
C:\Windows\SysWOW64\Agglboim.exe

Filesize
64KB

MD5
abf5b9329b617d46a3bd388113a0a8aa

SHA1
b6d354b9ad634e67b37945b75dd7d23fe22d198d

SHA256
96b1515506d18c5be74546b2b6094c3391a2ca0683c79c69561434df3f10a187

SHA512
c13509261baff8977e808c0e8c1e641294c0cf1bad47794517f8272fa2fda46ad20f7956b95a63e36b37a0eef5bb48dca318e49fc4cfd3459ced91fcd6db7b42

Download Submit
C:\Windows\SysWOW64\Ajanck32.exe

Filesize
64KB

MD5
dd5d7ff68d79b7616b3491f989414e3d

SHA1
d5657f53773dd5a4d452f637c220b51ace260b70

SHA256
1e4396a6d74874aa65d024a0e6f30fc42339d14140cdb8d8a7ee05c6407c0f07

SHA512
008f5e4fd39d002fdaf5b1efd3fe781c819709aeebc0dc07a42863b7e25cf0ca9e8a53262ae73aa79761b2a3a0ed367de889c74c11d4f0f1d74b47573ad75fa8

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
64KB

MD5
c8b2a4ee3bbc677c79f1e189bd2b3191

SHA1
1a71d150a9a78baef894ec7b2cff82cc61d30466

SHA256
9371f1889bfe984b4e50c5a6771678782b05bab4a5b47ffe962ab4d160b8309e

SHA512
79bf2f2130e9f01ccf3332395ee4b3c8f61b5dfa1eafcdd3c7464886699e8cf1858cf300f66a0fc5ab96ffc54d1b6f067cd3c90213ce5da88a239c3bcb627367

Download Submit
C:\Windows\SysWOW64\Anogiicl.exe

Filesize
64KB

MD5
d0c036a50a7122e3590a2beecfc86e3d

SHA1
05434be825700a3ea0272f24e02226fe00c5de09

SHA256
3ef97bba54c4275e10076225105bd200ffc3cb496510346a60a77880770a78e5

SHA512
d1fca9ff108a923413a17ed5e95202b77c06ac548faafca4495aa4ef9ca586c719432f2aa4c3780edb9ff5426a29d43764fe932b28c8a5d24dd85bd608ae4abd

Download Submit
C:\Windows\SysWOW64\Apodoq32.exe

Filesize
64KB

MD5
2275c2d9b387212263980cdb62382343

SHA1
3f511318e748c0da4e1a44cdd46bfc0ccaadf652

SHA256
ba6258776577e20f90d1df1489ae10794b3f2e43560f3639d9765ef126c134cf

SHA512
a7f28306813bdf1ea2438f1d4c59b5e0b8060cd69b568485edd58114547505079e67f7539f095cbf195260804d6f8f05d0765d6c6e1227296916264d5045817a

Download Submit
C:\Windows\SysWOW64\Bifmqo32.exe

Filesize
64KB

MD5
c5d13a2aa1662f8cab9790eb9cfdce03

SHA1
385cc991a44fd504ac82ca024ac8d1963bacd876

SHA256
75ac51a1930c6069deb737885d6cf2c49b4f35dffecb1050cc022eb0ddeb6a7c

SHA512
14d1d2b2a5c77e025dca15fce5fa6dbc32c7db4d9c6891e61cd4ff6dac19dce55dc24aa487be514761cc9c9835a7b3cbb47cea1216555bc0f9c228a25c3ccb79

Download Submit
C:\Windows\SysWOW64\Caghhk32.exe

Filesize
64KB

MD5
37b65aaf4c4ef81ac699062dae92473d

SHA1
5e1a94d7dda8b69954de77b8e3737becb1ecb620

SHA256
d03ef155452d0cc2e6e1b95e6a7f5821594e1d610cc3f79f7ceb05173233f0ce

SHA512
fb181c1f83e3ce03f240d2b0e6d89c9ded5f48ba601d57f730d3735424f8896c12e28de936091b8e4d803c25ebccacf7e211e9cc24ff747edb4a473e13ef4e6d

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
64KB

MD5
c7117d65ef1cd8ce10045e64dca09b89

SHA1
a6b0460c7f1469a6a5cc93cb00406b785d28d963

SHA256
0a990931795a002e7603301d3eaedeac59109a1488bb57d070d14a4832979436

SHA512
700a6ec4d31b551bf0a6de3d53cd8f855d26c9a3612ac86d8c918cf14677e0cbaf8239cb4bd1e8177b2a154eea930853fcb92e2b560a394762c5e83089d78ba4

Download Submit
C:\Windows\SysWOW64\Chagok32.exe

Filesize
64KB

MD5
4f76949cb077a5bc454e29e175840668

SHA1
7db819040de798236aeef8eadb21d6069c931256

SHA256
3cc7a9d61f904d8155fadd5c5e8c0aead842d86d86a7066b5411e690df5ceae1

SHA512
f8c3889c5239d901805fbf6749bad2b40689d182d2be7fb11149c2f69b0814468abd263de10b5c6c174b6f8a0f21c632d7874161be4851eab4e1e9e91eba8a3c

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
64KB

MD5
6a5ad8355304b6642fe9900a38e58175

SHA1
102d90da30f6a44d4532ce3a18b07d752a0a2e09

SHA256
4c99d628a81595af4d06f62dfedc0d437b7da79e7a3544688b88a624d9612a00

SHA512
aa3e8bd0d57bd9bd67984c920062c0c64602ac9fdc073c031afd81524d92e87822679eedc528987142a832d7bbfb0782e6fe27cfcaabe28a23c5f1d331549b1a

Download Submit
C:\Windows\SysWOW64\Cjbpaf32.exe

Filesize
64KB

MD5
863c3db9c218c3e98e252e6d36b76a7a

SHA1
759d1a0c638399838dc502f0e986efbea28d0742

SHA256
732043448244a5c4430915828e48b81f58ccbf8be480fc08735b3fec07102f1a

SHA512
0903768bc13b837aace26e20743347cca80d42482b00a541aa6ec813e453363e3b08176e5a7d5f80638eb4b60a5a40e0eddfd4a4d16f89106608de3209b97101

Download Submit
C:\Windows\SysWOW64\Cjkjpgfi.exe

Filesize
64KB

MD5
4fe72f8d5a16bfbd84877a4dcc10a299

SHA1
0bf55b9329dfd3237f743d034765a1971ce1d64b

SHA256
91d2b68dfbd5ec4cb5ff2dc190f6cbfcff032b134792c1f5029679d21a48a779

SHA512
b4729c9864e5f3d46dfca8e8ff2b66b6095695fb9160555e643853668ee1c3af16b0b331ba3e90ee116d74c97241dd7e16fd4fb76970e0ca781e5c1f476e2546

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
64KB

MD5
3fee6dd851955d33d4e68db09f587c38

SHA1
6e1631f0a352d4ab61ab5ec4daca2879c68931a1

SHA256
389f2ef7cb87038d890c866fe05079e4617e6bd0a4460729700826b577014c93

SHA512
369da2bd1bfef4d65821ccc423153e0882b551c37a56f7063011af30f58d000a340f47ebc51d9b06960a120ff4a0e0da12d8fa4166a5aa748d77964e8cfc5744

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
64KB

MD5
5137d7ad4d9167b4c35c0c0538cfc534

SHA1
3603c7ec3cbd562f479bb299f89b367f6d75f7ad

SHA256
cf03710a13de36a978b355600f6f513cd98b5ae94611e209a0a8adb9a2a071ba

SHA512
57a58f26158db3b6958635dc4c3d5926f672f6d3ab70bbdd8827f4d994c0ab487adad830b7befd83f86abe9e367abe31b229e51aba89b1461e2cd27dbc6d9113

Download Submit
C:\Windows\SysWOW64\Dfglfdkb.exe

Filesize
64KB

MD5
35a95b8fa5bd626dd854ca7227c626d2

SHA1
0066404ccf18069aa5f9a1cedd7febcdbcd828ab

SHA256
4dbd82ea32322cf89661e5384336379ef37c046724f259aa9e606020abb0ff04

SHA512
92e25862faf7459f0111595138daf4bf2385297982a84e9a8b353121a0507cf8a402ba8f226a2bfbea71bf47a1d6675a417a64fdeb15dc7669c540c9a5aa6d1b

Download Submit
C:\Windows\SysWOW64\Eidlnd32.exe

Filesize
64KB

MD5
3bd7a6e7b199d0d8730859ad3bf6c97c

SHA1
4c2ead96868fe7fac95890c45e11c86f2b4ce841

SHA256
f0997bfd66a24f3ac43936ac90e924fbb476d34bc6f004c002f0a6d9181e8d8c

SHA512
8d500a972f96d0034a95e153615388cd628f50dd8aeb49bc1273317e2ba697e8ed92950a0aea91790478c06ca4474a3a1ccfa05f1b94f7ef977961b6d3836803

Download Submit
C:\Windows\SysWOW64\Fhdfbfdh.exe

Filesize
64KB

MD5
c09bd94a8894204c295a1d736ca12886

SHA1
1d192d9bc09796d9c4926dc8f2841ea6933fb199

SHA256
be976d7acee66fd628eaf14752c380bb73e7c9594028463f43b17a5e8a8824fc

SHA512
28aecdeb13451c96cbe3018bc049f21570f0e0c514d73b22cf79805fe7537130c3035dede4518d867f25ae00736a6334efbee639a5148d6172b1407ba50d6706

Download Submit
C:\Windows\SysWOW64\Fhmigagd.exe

Filesize
64KB

MD5
219fae7dcedba47ba02c168d1deb6059

SHA1
0734f3eda4f91c0499550ae63afa3f8ec568b2e7

SHA256
5f8eadd64fe3272ff39cbad8e24a7f1f6c16fb9a52ce465d417fb93c01b1216c

SHA512
0a1cf49da7c92fac3c581eaa61159e8617c18f82f69c38b8abded030cf65ff1cc045b028ab7b572255517b541084eeae386b2ff0c397cb31442644c154cfc652

Download Submit
C:\Windows\SysWOW64\Fibojhim.exe

Filesize
64KB

MD5
5008446e444f58685f5116bd7b77d6bd

SHA1
50cf6c5bea9d2b028d4b6887cebdee896739a72d

SHA256
2940a0b40c207e415bfa971ba1cb62eed58f715ef8e4327c17f5d4879353b6f1

SHA512
e8ee8a3c4c179c06c7f849c1052237b636bac366cedf2aee340099bb2444f7295d2f03880fe618231aa82a6630851a9a2a3939f69f81d0a8d007b6900fc55641

Download Submit
C:\Windows\SysWOW64\Hkmnln32.exe

Filesize
64KB

MD5
e7b49683e685f18a1034916fd79f74bc

SHA1
a0b1df33c69e74bff9cd47b6d81b72ea202aca6b

SHA256
d98f12c10ef4fdb72dc9b6abf9788ee959fd9e36afdeec0c6d5a882bc44e203f

SHA512
105588b8f4653031df95d46289436864ee197ac3fa62f2c9fb4bbbc806aa624c3ef312e3efe782549ae19e5a54c00304a1b330d5a4044e9d04ce20855397296c

Download Submit
C:\Windows\SysWOW64\Kdinljnk.exe

Filesize
64KB

MD5
21e18f8ab5cb58dea43fc4620b95f210

SHA1
ad24a5d79951cd6c9640981bd4a633a799b998a5

SHA256
87e3e5c1aa81d99fd5b8b53320dd01c2db25da95e533a662c88b3172e60ce410

SHA512
00ee0806a512e29d8bc37db8f438a50594507c3d29992cd07cd789e0db4e09dcab30ee9cbaaeb7450f9e89c76f2b6f518c003fd81e98007f834da011e31ccfd8

Download Submit
C:\Windows\SysWOW64\Kdmqmc32.exe

Filesize
64KB

MD5
776bdd9257cd225573e139937c07a6a5

SHA1
4346fef46304f0314021df64d27f30c10bde841b

SHA256
106ef605525f44cf0fe4ea03cb18f3dbe4896b7a02b140a9f5376fcdd8c14328

SHA512
c1c1f6ef69c4271ec69397e92747b876815a21cb73ca1cad828a1ad56d7463f7c4a0955ad7b2563dcbc8309ca71e7de59250652486405fc4fa843af2e773e19a

Download Submit
C:\Windows\SysWOW64\Kelalp32.exe

Filesize
64KB

MD5
8f945cc36c5ee0bd80d9c299a2c47807

SHA1
dac0a70cc02ce9a2b9b840b977f27832a62fafde

SHA256
ee6b344b0745bdcfb77288521ea6cfda56f8381cb195f564042d54b304772cfa

SHA512
628a369ef0ed12820b99c0ba2d6cf0f21827bcd033d277d52f4fb6d3c22fe3393706027d23025f4acd1b04f20929bf4afe33b19177395882bb1cc3f723e299d1

Download Submit
C:\Windows\SysWOW64\Khmknk32.exe

Filesize
64KB

MD5
371a67dbaac9c9c570603a1190de96e3

SHA1
f1b8759d8e44e6ff62beae53856194ffa185612f

SHA256
c4b4cacb05cd355ec0984b0a945378ad7a4c1e8d0808083d4b06d8e0876014c4

SHA512
3990db5852c7f07bf391c6c5a5b0c8d47a3c4438d68508bf20f7d08bc0cc0cad00527e209a40ea1508abe68d959da3606e91420c7763afa26face04c06254d8d

Download Submit
C:\Windows\SysWOW64\Kkjeomld.exe

Filesize
64KB

MD5
e060de0e37a2a254cdfd8f2b478d761d

SHA1
b7dac6af45fb972da57fdf4f9512010f420707eb

SHA256
955cb0f72d34f8d0dc0b684f754a0cf835ad78c7f2a9a75b333038032ad8f70b

SHA512
6a975f9a7d068bf8ae8c798ed1b80564c62f35db7072524a66a439fa68bf07002dd88651684605bed0c1d42d7b31ddaaa54011166fca8014e6690ffbbf2c9206

Download Submit
C:\Windows\SysWOW64\Kqphfe32.exe

Filesize
64KB

MD5
bb68a09c87de8cb8fc94a2370ed7e128

SHA1
646d8635fc69675c35006eafd9d08c208aa02485

SHA256
f87504ec5984f8a047fca4c6fb7be15f1b7951ffd13c28839ee89e8835b2a79b

SHA512
fd4e80f36b3d67a00d7a69b85378b6e88d5333ab9783e0d88a92c31ef89eebf5c876b579e3f980496ef7d6b05d7fd4545408b828b935fea02e00ec68ee6b49f8

Download Submit
C:\Windows\SysWOW64\Mnkggfkb.exe

Filesize
64KB

MD5
b0312ba1406750814a21f051af50ec3e

SHA1
0c17ab5c8f62615d089b8f2b9350ab6f8bb5c7c7

SHA256
68a04134462a5000274a4b94c4cf10184d3c65273171681aebc113aae197ea7e

SHA512
b4b42123980cb80c5ae59f62485e070fb6dd10338c34e9a9587ffdadadcb8eb3f6ba019d48e3099dc9d0862d0b046c42bd7360538e0fa27cc2707af28f9e225b

Download Submit
C:\Windows\SysWOW64\Mqkiok32.exe

Filesize
64KB

MD5
c93db6b45b84ce561e94698f0482925e

SHA1
138a7b555137afc5c2e58b8f4da1e1e9c16ecc7d

SHA256
2aa4e04d2a4576c58e3d1857f94da8b7d1eaa4b38f589173aeb3d35830cdf996

SHA512
87bc87e993ceef1219a60da48f2c0a7d5e1696ec29ce6df3edb3806a39ba5511b3ca3071664c2b86fe7b43be7d01f4d094e05a04fc1f77b5873437dfe282be3a

Download Submit
C:\Windows\SysWOW64\Nckndeni.exe

Filesize
64KB

MD5
3fd46549132d9e704587b4ca277a8b64

SHA1
8d9fab57acf2ee0ecdbb32bb279f6455b794c639

SHA256
24e254ae510f2412a31ee3ff1076c1f617eea72bfd6be1804b502d8196d7f89d

SHA512
a1e072afa75031a47913511cdc3c0c1d51b71e1a9984bc2de06be8417251b62e02f52a8f64afe21ac2a179975129b8f6f6e3856e587762a5ce3adfe6c1c279ca

Download Submit
C:\Windows\SysWOW64\Njciko32.exe

Filesize
64KB

MD5
472699a268d703d7c94846e63f591ac2

SHA1
6e51e07c214e5ef164d6c6f3c45cb09a28c28bcc

SHA256
204998038a5e24c487590f5d8adb69d88a7bcb95dea735f2cdb789f7abc48f89

SHA512
5f58dbd7aab5a305e6448cfa2db351bb4970bcefa616e24d9fdaaac13344dc5af179429f41849efdd0ea4ef1f951ef59f59d4aa93377ff62e7ea11c45f6e4d73

Download Submit
C:\Windows\SysWOW64\Njefqo32.exe

Filesize
64KB

MD5
3bd041c238f306725fd8359f200b0d4a

SHA1
ebc3f61f75d1459678e116eae95b329b45e4ac1a

SHA256
2e84859cad0fc63671d351017c148a24b8aae70ca14c216fb62f36b63b5eab03

SHA512
af4a097927e0b15a5018009ffe7002ab14d1d9363498946c63b74812fe466cb93e78c7a9fe190f3c951c0781064065ab3834c9db02c4e7526ef3852344c220d5

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
64KB

MD5
4059153db1d061d7f3c45413c05dc296

SHA1
9a6658fc80627f39635637a22e28f0b653ab666b

SHA256
71ede4cac8e241f252421cad87d2c94c37c5c86fdf3b75eeab3c09deb1b01657

SHA512
2cf40b39777c74aafbe69dc1d37ea1775fa7e10263315325592c83e9bca135c77a60d7c90d238111d847607637dd502fa908f480410eed16e6017e03becf2e66

Download Submit
C:\Windows\SysWOW64\Odkjng32.exe

Filesize
64KB

MD5
af3bdecd3d3dafceb0c4018965fdccdd

SHA1
d71728b578ce60aa568890159520f62e4af56367

SHA256
d914bdf6c576478cc1fa31bb3398d88bb58ca34b75fb363dbefcadc1ace8f811

SHA512
7b5676725f256cf9271939aac72f6442947be53d7a1d955bedc63eedeeb67db7afcaf7436b07a674374ded760c803167b643c187195281fed82c0ddf4395cd8b

Download Submit
C:\Windows\SysWOW64\Ohlqcagj.exe

Filesize
64KB

MD5
3faa4dfae74fc2aa18ca6befca45e679

SHA1
3b9f573d86fa7830669f304cd83346f43cd7af9c

SHA256
21ce15943c5f9321271e0f3c0ba8132da709056aa4c29c2c5b889d741dfdc7f5

SHA512
cc35ddf3d573f1e23a2ea46409a48e15479ad2b44bcfbd8253da98be753b16d2b2fe151bb3f18521ace523cba9417fcabaa44465976075e1262b20b8e50a7d8c

Download Submit
C:\Windows\SysWOW64\Ojgbfocc.exe

Filesize
64KB

MD5
dd265a17f3c3bfb71fdefc1c99f0a972

SHA1
1dcb1ed0ed8e8db14e4c475fcb2b477486e62315

SHA256
66121a0e0fae6ebeef601bbe491f5fd5f08bb7c03d5fb312b01af4e28f22dcda

SHA512
4bfd7d65bef4b92778cb73e4a9027fb2f419f6c98e552e2d35adcefc7554b581c2e77e6561de4ae1b2444522a0b270a48930ccea9b6600f4b2b23f2627f4e7ef

Download Submit
C:\Windows\SysWOW64\Ojllan32.exe

Filesize
64KB

MD5
71950ace84191e20a446ef8856be9573

SHA1
3a7a8301d0a18335c6a943b992b5f82bd70c4abf

SHA256
241c0900c56dee319188fa0a79e3c4f1c48305d187b596670d876cfac4a2c133

SHA512
e272cecc1e6dd1701c12d15066c7e11d31b892ec92fa151fc5fd216ec5d6143496c2bdd0b9f0eaea0824f28c77e0cd2b54f6ea5fd15ae91f6b4440ec76af525a

Download Submit
C:\Windows\SysWOW64\Ojoign32.exe

Filesize
64KB

MD5
734245d58915f840fe6e32ee1d247b04

SHA1
b6c5b6d6b25ec26f533fabcd69a4c6256fc2212e

SHA256
5f0c2a0f3066802cbf35934ddcf9b22b155f2704e973eb29fcb6fe1cfe135a6d

SHA512
1768813a4e761d8717e25299bcb35f479a5ddec9895647f6c1300a70db94064c2bcdbe46f83b891db74928114ae991b6d7f3704a23d9d6255c402788941d06f2

Download Submit
C:\Windows\SysWOW64\Oqhacgdh.exe

Filesize
64KB

MD5
657bb2880ea2bf24b669c0362691f0b7

SHA1
aae40b0f10275058b387c41991838539d04f0a31

SHA256
299555952c75e64aca3169afc141d1e60bd40b73c46aa5f948734865cef43d21

SHA512
341a5d51aaef007ea812d2d1696046b61cae6896d33dfa53847f15f6d5d20e299ce573281d0f103bfe4e75ad4df84a61321a463517a7a6f909a6e4c13eb2bfcb

Download Submit
C:\Windows\SysWOW64\Pcijeb32.exe

Filesize
64KB

MD5
8d959be8c08784670c43a96d736b3ff6

SHA1
002e3f56b735787c57f1309ad529b99ab795344b

SHA256
0eca4a494d153d39e83fdc9b71cbbfc72d83075a076811d5c1c89db7a40b6175

SHA512
83576731894b587f8e2d9a1c463618fef90e1af880363a12a1b3ea0abd17fab406505dc4f6f845b6069a4568d9dc86f4f8e0945fa9d99075dbc66dc07a595738

Download Submit
C:\Windows\SysWOW64\Pcncpbmd.exe

Filesize
64KB

MD5
6ef0368e9014759bd9e977ff293ea980

SHA1
8601f1f4a8df6eba43104d232a48c804491c0972

SHA256
d104e783d825bc0942e0a13fb07e91a8539e38de830a3ae6e7ede82c2634a094

SHA512
009fbf51db13d0f5352b4266dc9f08e5d8a84890fe5ec3ab40dbfb032b9ce16fff1ee557d95cfa54e2d134aa4c528ed8f0912d75a7556bd1dd6270c40420c74c

Download Submit
C:\Windows\SysWOW64\Pfolbmje.exe

Filesize
64KB

MD5
54deb1d60858022925237c051c0b2c25

SHA1
2902619a17507ab972e8a6edc143c961553d9e63

SHA256
9c0e00d490e036d426c8771ce722afb2494248bbb44e7cf077040cfdc853a20e

SHA512
0351e1090d6f347450bbc9319807c8528cbb3ba3a2f82cd7e5e266aca241b35e14926b1cdf68f488cacad4cf9389f5904e6d4268a7ad6879f02c0d2ac558ffaa

Download Submit
C:\Windows\SysWOW64\Pjeoglgc.exe

Filesize
64KB

MD5
4d054e8cf61a827d0fcd924db2e0d5c4

SHA1
eede39b2736b60fbf96609e94fa9eb90e9ac762f

SHA256
3de75d66fbf0b55ffe0af4a04c4aad33e3e4b6530c16e4bdb7173ea7d1a33950

SHA512
c4135fe2bbd32aee6889c8bdf7e373fb9ead9a27fca2ca8bf616c475669f675c1b04fda5e4f0a5bfcebae2a4e16da4091969e5013e9f40e5d9af733a0e12734d

Download Submit
C:\Windows\SysWOW64\Pncgmkmj.exe

Filesize
64KB

MD5
af000e7fe80be61c0ea94e121bcf22d1

SHA1
c5f1c9ed28955572edc65e357d9513ea5a41bf22

SHA256
02a8e24480ce0c85eec801c5759bb0225c1c69bdb59c82c66094db02ed4af9c5

SHA512
7ce5daddb8077f55f24bf9d5cecbc3b776b72aa38bd8762fe22cb1b9126b52a5d7f60d07e4993bd9ae530164a5d1cdebeee096d09863b578bb02051103788c1e

Download Submit
C:\Windows\SysWOW64\Pnlaml32.exe

Filesize
64KB

MD5
746c43ffa40357feff06b2e6b63d2f66

SHA1
ddcd8ca3b5766b9a4203b10550c92a94e95822b1

SHA256
f6d104416522e6a34f3bb2fc331263e1f0c9a517f11e624cb1c01a67be7145c4

SHA512
5bc988eebfa65a4f74714a687fcbe467f9d410cda59c742f695d0791a908d71898d8ce0ce465ba650a81e168a8e7b253dcb31e761137478fe5a112194fc74949

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
64KB

MD5
2cdad1f2f914017b18d54667bed0d6ac

SHA1
917378d507fa34954363a9f6d9814ac40d2b636b

SHA256
f7369eff01ed9e313e6ac3bd997d0423a0b5e5f856a774c5392dcbb9910ec4e0

SHA512
a6ad311df1c82ee58226d3b594257fe4b195a45b040ac152cd8c4c0986dfb532dc6f89c07b1ddc4c0e97044e0d75234ba3c806e25fcdddcd57e86df89141b3ab

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
64KB

MD5
49672fd461303e2ef3058166ce4b8bfd

SHA1
3def4cd1acd81965bb43ebc667fc3a5c35a6f400

SHA256
d77a41e8b1282150a023d10f4c5b519609916b813e21ed80e71238dc369fe893

SHA512
4c08a919cbc741009bee3724026abfad47353e2fdaf9fc1e5fab10cf7857285d003318a6ee65803ffc4a781a3eeb0a0f7751832dc3ebbbd609e5646307087cd0

Download Submit
C:\Windows\SysWOW64\Qdbiedpa.exe

Filesize
64KB

MD5
c38dad41db142d7b7e6a8381213c7e70

SHA1
d07500398e8acfd354732c201707b65c512a8ba9

SHA256
27bf82925188a47bf84a51df38fbb7e9139396b6c7e92baac67291e760c6cd89

SHA512
0dcfae59fff723e16e6db2cf9f7672c01c241e37ab891a14f9be665462045dafa71133a279f5854aa2ad5a3a7dda921d5ae73740c70f7f064404defb6fbe5a1a

Download Submit
C:\Windows\SysWOW64\Qljjjqlc.exe

Filesize
64KB

MD5
da954b869736cabf62937d48525edff6

SHA1
47b56de53e4f1482f9708ad01782d97dfb844793

SHA256
7f1407401d144942cf0ba5634ff34ee1a0d74836fca87d5612c9290df1ce1664

SHA512
f0ed0546932d02046f00c6bab703e3896597eca1eef25aae0dbc647acbd2e10825463cf6e51e23fd70d9891eef56bc400645ac6e6b9b4553ba5af9b16671f5ff

Download Submit
C:\Windows\SysWOW64\Qmkadgpo.exe

Filesize
64KB

MD5
1a4b826567575b9f06771e30843b90d4

SHA1
acf54412e87fc3e1c449461c701df05a037b8d4c

SHA256
9c19b34758a8e8f1a6735dfc0c937fdcac549d8a8952d3f28cadd415f250892c

SHA512
ed71bb66f0fb25b406a6dfb87b43611a7f5e801e8d1653ac4863a9399cd6508d0b9e76bf9596852f041ebd2257e9e4266af5d5b69fe0a21478d4f78ef62db153

Download Submit
memory/228-295-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/232-134-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/232-222-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/364-201-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/416-282-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/524-81-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/524-169-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/840-126-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/840-213-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/940-71-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/940-160-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1428-108-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1428-196-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1464-63-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1464-151-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1564-289-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1576-31-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1576-115-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1772-238-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1772-153-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1788-255-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1832-314-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2312-16-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2312-97-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2368-320-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2408-133-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2408-48-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2520-107-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2520-23-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2596-88-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2596-8-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2624-267-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3064-276-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3104-266-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3104-180-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3192-301-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3432-257-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3432-326-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3464-230-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3464-307-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3528-258-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3528-171-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3668-148-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3700-103-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3704-227-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3840-121-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4084-244-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4128-90-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4128-178-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4148-218-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4192-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4192-79-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4312-205-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4312-288-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4404-192-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4404-275-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4452-124-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4452-39-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4532-248-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4532-162-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4636-331-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4644-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4644-143-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4944-308-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads