8f8321257bacf513930903950379afbb5d1454ce24b5ce103270e5c60071aa1e

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f8321257bacf513930903950379afbb5d1454ce24b5ce103270e5c60071aa1e.exe
Size

435KB
MD5

4c38aa1927e9bc27e447ddb7c89166ad
SHA1

aee871ad179cab7232d8e1e888c1c1e4ffd1286e
SHA256

8f8321257bacf513930903950379afbb5d1454ce24b5ce103270e5c60071aa1e
SHA512

f7fb570268bda2bbb009f12b3c66f7d24a7883eedba2a1925b2a534bb51b4a02b383bce94030e63a24df413f59cf87d4c0cb49670f192acce4555340380f7c17
SSDEEP

6144:9HjXeAwbWGRdA6sQc/Yp7TVX3J/1awbWGRdA6sQc/Y+mjwjOx5H:9ebWGRdA6sQhPbWGRdA6sQvjpxN

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dafbne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifjodl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ligqhc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npfkgjdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bajjli32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fllpbldb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndokbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibojncfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mibpda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqbdjfln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldjhpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maohkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpnchp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmegbjgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bahmfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmeobkq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qceiaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clbceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fomhdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojjolnaq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odapnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceoibflm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnonbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clbceo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obdkma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocegdjij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdhfhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekacmjgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mglack32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndfqbhia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqknig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffimfqgm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dafbne32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecandfpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clkndpag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlgmpogj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiefcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbpgbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceaehfjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjghpn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajkhdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlgmpogj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onmhgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffimfqgm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmhhehlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmknaell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpgfooop.exe

Executes dropped EXE 64 IoCs

pid	Process
3208	Iffmccbi.exe
1408	Iidipnal.exe
5060	Ibmmhdhm.exe
2292	Imbaemhc.exe
2576	Ibojncfj.exe
4480	Iiibkn32.exe
3212	Idofhfmm.exe
3776	Iabgaklg.exe
4168	Ibccic32.exe
4848	Imihfl32.exe
5024	Jiphkm32.exe
1380	Jjpeepnb.exe
1672	Jmnaakne.exe
2056	Jdhine32.exe
3228	Jpojcf32.exe
4596	Jbmfoa32.exe
4904	Jdmcidam.exe
4996	Kmegbjgn.exe
1280	Kpccnefa.exe
3608	Kmgdgjek.exe
3616	Kdaldd32.exe
4640	Kmjqmi32.exe
4328	Kdcijcke.exe
1620	Kknafn32.exe
1912	Kmlnbi32.exe
3320	Kgdbkohf.exe
2268	Kibnhjgj.exe
404	Kkbkamnl.exe
1480	Lmqgnhmp.exe
976	Lcmofolg.exe
4692	Liggbi32.exe
2220	Laopdgcg.exe
3484	Lgkhlnbn.exe
3764	Lijdhiaa.exe
4948	Laalifad.exe
4496	Lcbiao32.exe
3260	Ldaeka32.exe
3160	Ljnnch32.exe
2188	Lddbqa32.exe
452	Lgbnmm32.exe
1388	Mjqjih32.exe
1296	Mahbje32.exe
3528	Mgekbljc.exe
4200	Mjcgohig.exe
1484	Majopeii.exe
4116	Mdiklqhm.exe
4356	Mjeddggd.exe
2924	Mnapdf32.exe
832	Mpolqa32.exe
3980	Mgidml32.exe
2904	Mjhqjg32.exe
4748	Maohkd32.exe
3236	Mglack32.exe
2852	Mjjmog32.exe
2436	Maaepd32.exe
2860	Mdpalp32.exe
744	Njljefql.exe
4988	Nacbfdao.exe
2768	Nceonl32.exe
3648	Nklfoi32.exe
464	Nafokcol.exe
1368	Nddkgonp.exe
4528	Nkncdifl.exe
3216	Nnmopdep.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Jbmfoa32.exe	Jpojcf32.exe
File opened for modification	C:\Windows\SysWOW64\Nggqoj32.exe	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Oponmilc.exe	Nfjjppmm.exe
File created	C:\Windows\SysWOW64\Ocnjidkf.exe	Oponmilc.exe
File opened for modification	C:\Windows\SysWOW64\Pbpjhp32.exe	Pkfblfab.exe
File created	C:\Windows\SysWOW64\Njkdbljm.dll	Ekemhj32.exe
File created	C:\Windows\SysWOW64\Hfqlnm32.exe	Hcbpab32.exe
File created	C:\Windows\SysWOW64\Ekphijkm.dll	Pclgkb32.exe
File opened for modification	C:\Windows\SysWOW64\Bfdodjhm.exe	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Mmnbeadp.dll	Bapiabak.exe
File opened for modification	C:\Windows\SysWOW64\Majopeii.exe	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Gpnkgo32.dll	Mgidml32.exe
File created	C:\Windows\SysWOW64\Hipnbb32.dll	Nqpego32.exe
File created	C:\Windows\SysWOW64\Pkceffcd.exe	Peimil32.exe
File opened for modification	C:\Windows\SysWOW64\Ehgqln32.exe	Eeidoc32.exe
File created	C:\Windows\SysWOW64\Fkalchij.exe	Fdgdgnbm.exe
File opened for modification	C:\Windows\SysWOW64\Gbbkaako.exe	Gkhbdg32.exe
File created	C:\Windows\SysWOW64\Kiljkifg.dll	Mlcifmbl.exe
File created	C:\Windows\SysWOW64\Hdoemjgn.dll	Pnonbk32.exe
File opened for modification	C:\Windows\SysWOW64\Fllpbldb.exe	Febgea32.exe
File created	C:\Windows\SysWOW64\Oggacefk.dll	Fakdpb32.exe
File created	C:\Windows\SysWOW64\Fooeif32.exe	Flqimk32.exe
File created	C:\Windows\SysWOW64\Dbfmkjoa.dll	Gfgjgo32.exe
File created	C:\Windows\SysWOW64\Ibqpimpl.exe	Ipbdmaah.exe
File opened for modification	C:\Windows\SysWOW64\Leihbeib.exe	Lbjlfi32.exe
File created	C:\Windows\SysWOW64\Geegicjl.dll	Mglack32.exe
File created	C:\Windows\SysWOW64\Pnbbbabh.exe	Pkceffcd.exe
File created	C:\Windows\SysWOW64\Cddecc32.exe	Ceaehfjj.exe
File created	C:\Windows\SysWOW64\Hfgefhai.dll	Hcmgfbhd.exe
File created	C:\Windows\SysWOW64\Jmhale32.exe	Ibcmom32.exe
File opened for modification	C:\Windows\SysWOW64\Kdgljmcd.exe	Klqcioba.exe
File opened for modification	C:\Windows\SysWOW64\Pmannhhj.exe	Pnonbk32.exe
File created	C:\Windows\SysWOW64\Bjagjhnc.exe	Bgcknmop.exe
File created	C:\Windows\SysWOW64\Jiphogop.dll	Iabgaklg.exe
File created	C:\Windows\SysWOW64\Bghhihab.dll	Njcpee32.exe
File created	C:\Windows\SysWOW64\Onmhgb32.exe	Okolkg32.exe
File opened for modification	C:\Windows\SysWOW64\Pjkombfj.exe	Pcagphom.exe
File opened for modification	C:\Windows\SysWOW64\Ehimanbq.exe	Eekaebcm.exe
File created	C:\Windows\SysWOW64\Ainpbi32.dll	Gmoeoidl.exe
File opened for modification	C:\Windows\SysWOW64\Klimip32.exe	Kmfmmcbo.exe
File opened for modification	C:\Windows\SysWOW64\Ldanqkki.exe	Lljfpnjg.exe
File opened for modification	C:\Windows\SysWOW64\Pqknig32.exe	Olmeci32.exe
File created	C:\Windows\SysWOW64\Acjclpcf.exe	Adgbpc32.exe
File created	C:\Windows\SysWOW64\Calhnpgn.exe	Cnnlaehj.exe
File opened for modification	C:\Windows\SysWOW64\Pcagphom.exe	Pabkdmpi.exe
File opened for modification	C:\Windows\SysWOW64\Baocghgi.exe	Bopgjmhe.exe
File opened for modification	C:\Windows\SysWOW64\Fbpnkama.exe	Flceckoj.exe
File opened for modification	C:\Windows\SysWOW64\Mmnldp32.exe	Mibpda32.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Ibhblqpo.dll	Mjqjih32.exe
File opened for modification	C:\Windows\SysWOW64\Anbkio32.exe	Ahhblemi.exe
File opened for modification	C:\Windows\SysWOW64\Doqpak32.exe	Clbceo32.exe
File opened for modification	C:\Windows\SysWOW64\Pqbdjfln.exe	Pmfhig32.exe
File created	C:\Windows\SysWOW64\Pkfblfab.exe	Peljol32.exe
File created	C:\Windows\SysWOW64\Fnhfnh32.dll	Ceoibflm.exe
File opened for modification	C:\Windows\SysWOW64\Nddkgonp.exe	Nafokcol.exe
File created	C:\Windows\SysWOW64\Qnjnnj32.exe	Qjoankoi.exe
File created	C:\Windows\SysWOW64\Qmmnjfnl.exe	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Mogqfgka.dll	Bjfaeh32.exe
File opened for modification	C:\Windows\SysWOW64\Cfpnph32.exe	Cdabcm32.exe
File opened for modification	C:\Windows\SysWOW64\Nnaikd32.exe	Nggqoj32.exe
File opened for modification	C:\Windows\SysWOW64\Jcbihpel.exe	Jmhale32.exe
File created	C:\Windows\SysWOW64\Igjnojdk.dll	Pcijeb32.exe
File opened for modification	C:\Windows\SysWOW64\Dhocqigp.exe	Deagdn32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11300	11040	WerFault.exe	554

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eeidoc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agglboim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqdoboli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jholncde.dll"	Mgfqmfde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiclgb32.dll"	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geegicjl.dll"	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhaebcen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffimfqgm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kedoge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgllfjld.dll"	Pjkombfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Abpcon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jplfcpin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bapolp32.dll"	Deanodkh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejckel32.dll"	Jmknaell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Miemjaci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqpego32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Obfhba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbkamqmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdkldb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Miemjaci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmgdgjek.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhpjkojk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clhkicgk.dll"	Ghopckpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfembo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibojncfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpccnefa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpdobeck.dll"	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cklaknjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ingbah32.dll"	Lebkhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npfkgjdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nfjjppmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmnaakne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqffpbnb.dll"	Odbgim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onmhgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmjlcj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Flceckoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghopckpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfbploob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gomakdcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kibnhjgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aanjpk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdkcmdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmmfbg32.dll"	Lbabgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olfdahne.dll"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kahdohfm.dll"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpijnqkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmpgldhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lbabgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nghjpm32.dll"	Gkhbdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdgdjjem.dll"	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Okloegjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpaqkn32.dll"	Edbklofb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fllpbldb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jijjfldq.dll"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgmliida.dll"	Pkaiqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffimfqgm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 3208	2044	8f8321257bacf513930903950379afbb5d1454ce24b5ce103270e5c60071aa1e.exe	85
PID 2044 wrote to memory of 3208	2044	8f8321257bacf513930903950379afbb5d1454ce24b5ce103270e5c60071aa1e.exe	85
PID 2044 wrote to memory of 3208	2044	8f8321257bacf513930903950379afbb5d1454ce24b5ce103270e5c60071aa1e.exe	85
PID 3208 wrote to memory of 1408	3208	Iffmccbi.exe	86
PID 3208 wrote to memory of 1408	3208	Iffmccbi.exe	86
PID 3208 wrote to memory of 1408	3208	Iffmccbi.exe	86
PID 1408 wrote to memory of 5060	1408	Iidipnal.exe	87
PID 1408 wrote to memory of 5060	1408	Iidipnal.exe	87
PID 1408 wrote to memory of 5060	1408	Iidipnal.exe	87
PID 5060 wrote to memory of 2292	5060	Ibmmhdhm.exe	88
PID 5060 wrote to memory of 2292	5060	Ibmmhdhm.exe	88
PID 5060 wrote to memory of 2292	5060	Ibmmhdhm.exe	88
PID 2292 wrote to memory of 2576	2292	Imbaemhc.exe	89
PID 2292 wrote to memory of 2576	2292	Imbaemhc.exe	89
PID 2292 wrote to memory of 2576	2292	Imbaemhc.exe	89
PID 2576 wrote to memory of 4480	2576	Ibojncfj.exe	90
PID 2576 wrote to memory of 4480	2576	Ibojncfj.exe	90
PID 2576 wrote to memory of 4480	2576	Ibojncfj.exe	90
PID 4480 wrote to memory of 3212	4480	Iiibkn32.exe	91
PID 4480 wrote to memory of 3212	4480	Iiibkn32.exe	91
PID 4480 wrote to memory of 3212	4480	Iiibkn32.exe	91
PID 3212 wrote to memory of 3776	3212	Idofhfmm.exe	92
PID 3212 wrote to memory of 3776	3212	Idofhfmm.exe	92
PID 3212 wrote to memory of 3776	3212	Idofhfmm.exe	92
PID 3776 wrote to memory of 4168	3776	Iabgaklg.exe	93
PID 3776 wrote to memory of 4168	3776	Iabgaklg.exe	93
PID 3776 wrote to memory of 4168	3776	Iabgaklg.exe	93
PID 4168 wrote to memory of 4848	4168	Ibccic32.exe	94
PID 4168 wrote to memory of 4848	4168	Ibccic32.exe	94
PID 4168 wrote to memory of 4848	4168	Ibccic32.exe	94
PID 4848 wrote to memory of 5024	4848	Imihfl32.exe	95
PID 4848 wrote to memory of 5024	4848	Imihfl32.exe	95
PID 4848 wrote to memory of 5024	4848	Imihfl32.exe	95
PID 5024 wrote to memory of 1380	5024	Jiphkm32.exe	96
PID 5024 wrote to memory of 1380	5024	Jiphkm32.exe	96
PID 5024 wrote to memory of 1380	5024	Jiphkm32.exe	96
PID 1380 wrote to memory of 1672	1380	Jjpeepnb.exe	97
PID 1380 wrote to memory of 1672	1380	Jjpeepnb.exe	97
PID 1380 wrote to memory of 1672	1380	Jjpeepnb.exe	97
PID 1672 wrote to memory of 2056	1672	Jmnaakne.exe	98
PID 1672 wrote to memory of 2056	1672	Jmnaakne.exe	98
PID 1672 wrote to memory of 2056	1672	Jmnaakne.exe	98
PID 2056 wrote to memory of 3228	2056	Jdhine32.exe	99
PID 2056 wrote to memory of 3228	2056	Jdhine32.exe	99
PID 2056 wrote to memory of 3228	2056	Jdhine32.exe	99
PID 3228 wrote to memory of 4596	3228	Jpojcf32.exe	100
PID 3228 wrote to memory of 4596	3228	Jpojcf32.exe	100
PID 3228 wrote to memory of 4596	3228	Jpojcf32.exe	100
PID 4596 wrote to memory of 4904	4596	Jbmfoa32.exe	101
PID 4596 wrote to memory of 4904	4596	Jbmfoa32.exe	101
PID 4596 wrote to memory of 4904	4596	Jbmfoa32.exe	101
PID 4904 wrote to memory of 4996	4904	Jdmcidam.exe	102
PID 4904 wrote to memory of 4996	4904	Jdmcidam.exe	102
PID 4904 wrote to memory of 4996	4904	Jdmcidam.exe	102
PID 4996 wrote to memory of 1280	4996	Kmegbjgn.exe	103
PID 4996 wrote to memory of 1280	4996	Kmegbjgn.exe	103
PID 4996 wrote to memory of 1280	4996	Kmegbjgn.exe	103
PID 1280 wrote to memory of 3608	1280	Kpccnefa.exe	104
PID 1280 wrote to memory of 3608	1280	Kpccnefa.exe	104
PID 1280 wrote to memory of 3608	1280	Kpccnefa.exe	104
PID 3608 wrote to memory of 3616	3608	Kmgdgjek.exe	105
PID 3608 wrote to memory of 3616	3608	Kmgdgjek.exe	105
PID 3608 wrote to memory of 3616	3608	Kmgdgjek.exe	105
PID 3616 wrote to memory of 4640	3616	Kdaldd32.exe	106

C:\Users\Admin\AppData\Local\Temp\8f8321257bacf513930903950379afbb5d1454ce24b5ce103270e5c60071aa1e.exe
"C:\Users\Admin\AppData\Local\Temp\8f8321257bacf513930903950379afbb5d1454ce24b5ce103270e5c60071aa1e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\Iffmccbi.exe
  C:\Windows\system32\Iffmccbi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Windows\SysWOW64\Iidipnal.exe
    C:\Windows\system32\Iidipnal.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Windows\SysWOW64\Ibmmhdhm.exe
      C:\Windows\system32\Ibmmhdhm.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5060
    - - C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2292
      - C:\Windows\SysWOW64\Ibojncfj.exe
        
        C:\Windows\system32\Ibojncfj.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3776
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4168
        
        C:\Windows\SysWOW64\Imihfl32.exe
        
        C:\Windows\system32\Imihfl32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\SysWOW64\Jiphkm32.exe
        
        C:\Windows\system32\Jiphkm32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1380
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1280
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3608
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        23⤵
        Executes dropped EXE
        
        PID:4640
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        24⤵
        Executes dropped EXE
        
        PID:4328
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        25⤵
        Executes dropped EXE
        
        PID:1620
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        26⤵
        Executes dropped EXE
        
        PID:1912
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        27⤵
        Executes dropped EXE
        
        PID:3320
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2268
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        29⤵
        Executes dropped EXE
        
        PID:404
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        30⤵
        Executes dropped EXE
        
        PID:1480
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        31⤵
        Executes dropped EXE
        
        PID:976
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        32⤵
        Executes dropped EXE
        
        PID:4692
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        33⤵
        Executes dropped EXE
        
        PID:2220
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        34⤵
        Executes dropped EXE
        
        PID:3484
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        35⤵
        Executes dropped EXE
        
        PID:3764
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        36⤵
        Executes dropped EXE
        
        PID:4948
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        37⤵
        Executes dropped EXE
        
        PID:4496
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        38⤵
        Executes dropped EXE
        
        PID:3260
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3160
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        40⤵
        Executes dropped EXE
        
        PID:2188
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        41⤵
        Executes dropped EXE
        
        PID:452
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1388
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1296
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3528
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4200
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        46⤵
        Executes dropped EXE
        
        PID:1484
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        47⤵
        Executes dropped EXE
        
        PID:4116
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4356
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2924
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        50⤵
        Executes dropped EXE
        
        PID:832
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3980
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        52⤵
        Executes dropped EXE
        
        PID:2904
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4748
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3236
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2852
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        56⤵
        Executes dropped EXE
        
        PID:2436
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        57⤵
        Executes dropped EXE
        
        PID:2860
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        58⤵
        Executes dropped EXE
        
        PID:744
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        59⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        60⤵
        Executes dropped EXE
        
        PID:2768
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        61⤵
        Executes dropped EXE
        
        PID:3648
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:464
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        63⤵
        Executes dropped EXE
        
        PID:1368
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        64⤵
        Executes dropped EXE
        
        PID:4528
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        65⤵
        Executes dropped EXE
        
        PID:3216
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        66⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        67⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3276
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        69⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        70⤵
        Drops file in System32 directory
        
        PID:3460
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        71⤵
        Drops file in System32 directory
        
        PID:540
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        72⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        73⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1072
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        74⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        75⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        76⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        77⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        78⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        79⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        80⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        81⤵
        Modifies registry class
        
        PID:4672
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        82⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        83⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:544
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        85⤵
        Modifies registry class
        
        PID:2728
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2160
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        87⤵
        Modifies registry class
        
        PID:5032
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        88⤵
        Modifies registry class
        
        PID:1596
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        89⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        90⤵
        Drops file in System32 directory
        
        PID:4572
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3356
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        92⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        93⤵
        Modifies registry class
        
        PID:2252
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        94⤵
        Modifies registry class
        
        PID:1000
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        95⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        96⤵
        Drops file in System32 directory
        
        PID:2288
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        97⤵
        Drops file in System32 directory
        
        PID:3152
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        98⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        99⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        100⤵
        Drops file in System32 directory
        
        PID:1780
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        101⤵
        Drops file in System32 directory
        
        PID:1400
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        102⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        103⤵
        Drops file in System32 directory
        
        PID:4216
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        104⤵
        Drops file in System32 directory
        
        PID:1516
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        105⤵
        Modifies registry class
        
        PID:2780
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        106⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        107⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        108⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        109⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        110⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        111⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        112⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        113⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        114⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        115⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        116⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        117⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        118⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        119⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        120⤵
        Modifies registry class
        
        PID:5696
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        121⤵
        Drops file in System32 directory
        
        PID:5736
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        122⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        123⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        124⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        125⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        126⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        127⤵
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        128⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6080
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        130⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        131⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        132⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        133⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5336
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        135⤵
        Modifies registry class
        
        PID:5384
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        136⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        137⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5616
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5684
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        140⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        141⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        142⤵
        Modifies registry class
        
        PID:5900
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        143⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        144⤵
        Drops file in System32 directory
        
        PID:6028
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        145⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        146⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5252
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        148⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        149⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        150⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        151⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5808
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5920
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        154⤵
        Modifies registry class
        
        PID:6020
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6120
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        156⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5408
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        158⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        159⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        160⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        161⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        162⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        163⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        164⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        165⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        166⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        167⤵
        Modifies registry class
        
        PID:5960
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5340
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        169⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        170⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        171⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        172⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        173⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        174⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6324
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        176⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        177⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        178⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        179⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6528
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        181⤵
        Modifies registry class
        
        PID:6568
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        182⤵
        Modifies registry class
        
        PID:6608
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        183⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        184⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6732
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        186⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        187⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        188⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        189⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        190⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6940
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        191⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        192⤵
        Drops file in System32 directory
        
        PID:7024
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        193⤵
        Drops file in System32 directory
        
        PID:7068
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        194⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        195⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        196⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        197⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        198⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6432
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        200⤵
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        201⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        202⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        203⤵
        Drops file in System32 directory
        
        PID:6720
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6784
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        205⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        206⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        207⤵
        Drops file in System32 directory
        
        PID:6996
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        208⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7160
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        210⤵
        Drops file in System32 directory
        
        PID:6236
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        211⤵
        Drops file in System32 directory
        
        PID:6384
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        212⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        213⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6684
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        215⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6832
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        216⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        217⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        218⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        219⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6344
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        220⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        221⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        222⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        223⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        224⤵
        Modifies registry class
        
        PID:6444
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        225⤵
        Modifies registry class
        
        PID:6896
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        226⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        227⤵
        Modifies registry class
        
        PID:6340
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        228⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        229⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        230⤵
        Modifies registry class
        
        PID:7324
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        231⤵
        Drops file in System32 directory
        
        PID:7388
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        232⤵
        Modifies registry class
        
        PID:7436
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        233⤵
        Drops file in System32 directory
        
        PID:7484
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7528
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        235⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        236⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        237⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        238⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        239⤵
        Drops file in System32 directory
        
        PID:7744
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7784
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        241⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        242⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        243⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        244⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8004
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        246⤵
        Drops file in System32 directory
        
        PID:8052
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        247⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        248⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        249⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        250⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        251⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        252⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        253⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        254⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        255⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        256⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        257⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        258⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        259⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        260⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8068
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        262⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        263⤵
        Drops file in System32 directory
        
        PID:7128
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        264⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        265⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        266⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        267⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        268⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        269⤵
        Drops file in System32 directory
        
        PID:7944
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        270⤵
        Drops file in System32 directory
        
        PID:8076
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        271⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7420
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        273⤵
        Modifies registry class
        
        PID:7588
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        274⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        275⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        276⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        277⤵
        Modifies registry class
        
        PID:7476
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        278⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        279⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        280⤵
        Modifies registry class
        
        PID:7472
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7808
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        282⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        283⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        284⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        285⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        286⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        287⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8368
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        289⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        290⤵
        Drops file in System32 directory
        
        PID:8456
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        291⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        292⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        293⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8632
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        295⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        296⤵
        Modifies registry class
        
        PID:8720
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        297⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        298⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        299⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        300⤵
        Modifies registry class
        
        PID:8888
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        301⤵
        Drops file in System32 directory
        
        PID:8936
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        302⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        303⤵
        Drops file in System32 directory
        
        PID:9016
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        304⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        305⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        306⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        307⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8012
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        309⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        310⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8400
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        312⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        313⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        314⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        315⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        316⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        317⤵
        Modifies registry class
        
        PID:8864
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        318⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        319⤵
        Drops file in System32 directory
        
        PID:8992
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        320⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        321⤵
        Modifies registry class
        
        PID:9128
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        322⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        323⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        324⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        325⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        326⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        327⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        328⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8972
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        330⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        331⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        332⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        333⤵
        Modifies registry class
        
        PID:8448
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        334⤵
        Modifies registry class
        
        PID:8620
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        335⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        336⤵
        Drops file in System32 directory
        
        PID:8932
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        337⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        338⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        339⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        340⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        341⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        342⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9024
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        344⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8532
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        346⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        347⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        348⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        349⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        350⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9436
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        352⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        353⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        354⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        355⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        356⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9640
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        357⤵
        Drops file in System32 directory
        
        PID:9680
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        358⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        359⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        360⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9844
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        362⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        363⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        364⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        365⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        366⤵
        Modifies registry class
        
        PID:10064
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        367⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10140
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        369⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        370⤵
        Drops file in System32 directory
        
        PID:10224
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9252
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        372⤵
        Drops file in System32 directory
        
        PID:9304
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        373⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3264
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        375⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9544
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        377⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        378⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        379⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        380⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        381⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        382⤵
        Drops file in System32 directory
        
        PID:9984
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10052
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10124
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        385⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        386⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        387⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        388⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        389⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        390⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        391⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        392⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9828
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        393⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        394⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        395⤵
        Drops file in System32 directory
        
        PID:10164
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        396⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9232
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        397⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        398⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        399⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        400⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        401⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        402⤵
        Drops file in System32 directory
        
        PID:9676
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        403⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        404⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        405⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        406⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        407⤵
        Modifies registry class
        
        PID:10348
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        408⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        409⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        410⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        411⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        412⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        413⤵
        Modifies registry class
        
        PID:10620
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10672
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        415⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        416⤵
        Drops file in System32 directory
        
        PID:10760
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        417⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        418⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        419⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10928
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        421⤵
        Modifies registry class
        
        PID:10972
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        422⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        423⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        424⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11096
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        425⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        426⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        427⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        428⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        429⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10332
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        430⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        431⤵
        Drops file in System32 directory
        
        PID:10472
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        432⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10536
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        433⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        434⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        435⤵
        Drops file in System32 directory
        
        PID:10736
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10816
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        437⤵
        Modifies registry class
        
        PID:10884
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        438⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        439⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        440⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        441⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11120
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        442⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        443⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        444⤵
        Modifies registry class
        
        PID:10372
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        445⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        446⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        447⤵
        Drops file in System32 directory
        
        PID:10788
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        448⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        449⤵
        Modifies registry class
        
        PID:11012
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        450⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        451⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11252
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        452⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        453⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        454⤵
        Drops file in System32 directory
        
        PID:10688
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10964
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        456⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        457⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        458⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        459⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        460⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3828
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        461⤵
        Drops file in System32 directory
        
        PID:10728
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        462⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3852
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        463⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        464⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11040 -s 404
        465⤵
        Program crash
        
        PID:11300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 11040 -ip 11040
1⤵
PID:11276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bapiabak.exe

Filesize
435KB

MD5
509acaea918a8fdc47c6e8fc61362335

SHA1
1b64797f35acbea081acbba22d2e650f21fb5adc

SHA256
21163e956898cef6295ae7959306fdc62a9cf6f086ab8a325c16ab0a3d8c15f0

SHA512
0d364081378ed675388c94c531df1cb57039ad3836bc1ad4cef5f94e92184bdf1706d3128ae4170231805456c76c8896e01d751437cd8377e3957b4f2c4ecddf

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
435KB

MD5
a3df2d9c7d993df720f4c7f893a72b79

SHA1
cdf4e4b7e5843090a6387b54fe048d8cda4ff8d2

SHA256
917e27f4d08e6f8cbfe7493938c182d6adfb0bf6602540b1fcc9de6931259a56

SHA512
b257625e32506b9e0a3fa1e4b25f558469742cd55f9594c9aa191d5588ab542a3a373a57eeea80746fd6ec1d861ebe946e4fef5f84e9acdf01c6ed721ba6c7aa

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
435KB

MD5
96f942dbe792d01bd59456a00eee97ae

SHA1
9b2ac8ff7b1d444f29ecf2d045ed6c3394bad640

SHA256
113647bff9af4efff4782e5d707001d8ac6d5c7b0d21a5780f3f0f5b8d8324d8

SHA512
bfa172c91781b05c97f7549fba69f49037937fac2a971eb945fb0a50667f882bc8af54565f51dd0b2f235bbc441039d07f209d7d0b8e08f31e3ec4fbe4202c51

Download Submit
C:\Windows\SysWOW64\Dmgbnq32.exe

Filesize
435KB

MD5
62e2d8601cdc5c92b0497be39f73bf0e

SHA1
6370ad69b4c6eb51aab73655333cc99f3e921c52

SHA256
a5ba9782e9228c9aa19c2a08f1792b53f9533a8f778802f5e18d9194c54d1676

SHA512
3638fd97452240c0e530a728f9b28df11df38e8f3e6f3c26b366d3cd5fc98d4016e267e06434cce1cbe20b1d60b0b87430c82271267fe9cffc124378ce052f46

Download Submit
C:\Windows\SysWOW64\Eekaebcm.exe

Filesize
435KB

MD5
8cecce4cb8a98814f8f18f1d031c7d55

SHA1
b9d849c31f5e9501fd1ac670db2fa3f48efc99bc

SHA256
7bb4aeae39aafacb373f238eda9b45e8d5727c812bfcc7c1a082aaaadfce8199

SHA512
c92a987009b9b182ca4454f7c55bfc26b592cc818ccc53689523e34e74f34975edd3767de580d51cc3f5d976ea63985c62e5c669c04b08bfaafc8cefd8ec5b25

Download Submit
C:\Windows\SysWOW64\Ehljfnpn.exe

Filesize
435KB

MD5
6d413c4560b235859d370b66cf77577d

SHA1
66f8424a2d090bee30bf7fa43e5a8dcec1ccc0b7

SHA256
a16b2eeacf93c5ca599160e5e12a3b347eed963edf98da1b0f0581c535821c1a

SHA512
57c7eba7ce7d2f0d63840a85270b0e88751c247577b64c84f2a649629f7ebab89c080b068a15c15d102178c86eef88193aae489454558c016b656a33a6c843d4

Download Submit
C:\Windows\SysWOW64\Ffimfqgm.exe

Filesize
435KB

MD5
44aa65f07301d5501dc7f8f24c6979cd

SHA1
c3f88884122ef967606211baa6d87cf7b25621ee

SHA256
bc7afbc58a507d7176722b798f93d2f408f4077d8dbfbcbfb4a5bbe6da75cbe2

SHA512
3451fbe909ac4a69152edc20b0c46769ee7de94ad22254e640f52fec3bfb67d94d0012761ddc6dd0bfab2d3b54398f132bd336f45be15c5f59c6b8d65da9eb71

Download Submit
C:\Windows\SysWOW64\Fkmchi32.exe

Filesize
435KB

MD5
4f3417a3d93bd22ea7d499a97d58a1e4

SHA1
a018c6fd364e360e2e5a5ea05c705ad564e00a8e

SHA256
5d9f68879a48fc3701d12d7dea0e10f8e7b66bfaa003f58eeca190ce175bb120

SHA512
3057915cfcc9d2910593ad097ad245ba362dc3f58cd09d0e9e4d9d5e0f838ab7db5b492c85759941bcefede53598595295538f06daa77a0a8b52c563734b88f3

Download Submit
C:\Windows\SysWOW64\Iabgaklg.exe

Filesize
435KB

MD5
469a33b25318550a27bfd286bdf439ba

SHA1
3c2c359cda6533b529cab7ad9851a6e8d0a5477e

SHA256
f7e4f9eefcdc952927ee7ec4d0e946a08a362e1748d367b9b1b09a116a438799

SHA512
50a59784e7365f83d1552e662d4eec516193a4516836e893fe7b0f066a5ed4f7257fa763c6016ea694b5c2341e1f41921e22e12d24facca3ec4f7fc1b136ed46

Download Submit
C:\Windows\SysWOW64\Ibccic32.exe

Filesize
435KB

MD5
3e12da2ade2c91da10f0f7c5baf5c2ac

SHA1
585f42c241aa81d16c918ea81e8dbef59bcf40a8

SHA256
f224a3590106db620467b97f006b8cfb909a7469734727915dfb490b262a1edf

SHA512
1a4b9ac94010dcd9042eff9c469061f3eca3f1f0fdae1609d46e1b5b90a53a80a565b5d052d5c9c4cab60db5b30eb6968874a5f71557dad3bb115bb2372a0d93

Download Submit
C:\Windows\SysWOW64\Ibmmhdhm.exe

Filesize
435KB

MD5
0d76e0d048a8e1c82564208e317c95c4

SHA1
460f4db1140ccece16b4364c9d441be393ae2575

SHA256
75cc05502b0a9e71d66593d9394908761df2e5b3f056293b354c1f9e0e95fd98

SHA512
bd9b3b3bd0bfa2cbf876c46483afd3aeac8f2a75f5a4b7ba81fbcd770a75c880092e45af23b6865e4c85dd0f07897a7ee56a4ad5c21574d1d84052b4cdd3a50e

Download Submit
C:\Windows\SysWOW64\Ibojncfj.exe

Filesize
435KB

MD5
d9c151dacf207e88542dadb60f4328f6

SHA1
a643045f8f27ce3fa1e0feea72216de4415768d4

SHA256
7b5725742abbb0afc82aad5985c9dffa4645ed3722352fdd6023e6768eb2409e

SHA512
0c0f571f1b2bd11d0bec207b3313f3d31b78b8c81e2c435794794097c6e588379eb6fe80f1b0cfa5e8e68e8e39320189bc93b5a30c76eb101b37d5f2416f3495

Download Submit
C:\Windows\SysWOW64\Idofhfmm.exe

Filesize
435KB

MD5
f83a1bc68baee066f9f59dde33e31623

SHA1
e69ab14722ac81348035ec0d4a05cd4bbf4aad46

SHA256
4a372229067bee7c979969280cd659adb0626d6c7e409501f3ca36b7f286c4b6

SHA512
f80dd844f98d982fed434b93e7ce9f18af9d0942c7d0c09c8df21407d2fdacadfc96bf81a6e474d2b33393ebecca2fa53f9f3663e776772f04fb7634cacbceb4

Download Submit
C:\Windows\SysWOW64\Iefioj32.exe

Filesize
435KB

MD5
1d3f7f8ae2a8a1f6704e88642bfdbc75

SHA1
9eb05e32732abcf1cf9cfcfaa2a50f7f6f9f4c92

SHA256
aa1c763bd413b8477038cf754bb994dbc6923f349a9cacca65c5977c1a75cdb7

SHA512
0a34b4208d611e487380c209f4df47be89fabb40a63bc2576350fe499fff3a55330f15bcf8659e08c5eba53d5c65259413598482ae2eac750d92716baa7b63c0

Download Submit
C:\Windows\SysWOW64\Iffmccbi.exe

Filesize
435KB

MD5
d714becd393593ea7c85de3c5bd75a28

SHA1
ac75890e9ff44d3fbb11b57b7803c04bd8e5a1d9

SHA256
5e3efba1f15dacf7f619b3f0d2212b5ec6fd122772047ba3590fe3b152f74086

SHA512
7c0b6ed03e9de8a0cbba2d9b27ece2ad4b73d2c32e2d4eca4db7543f83f4842850d30b777f2884c9dbb96fb5cc52132b4b1cc9028de1ac9020ee69b8ddd7cb42

Download Submit
C:\Windows\SysWOW64\Iidipnal.exe

Filesize
435KB

MD5
8d29bd98d8fb98c19c69a3c96682e75a

SHA1
58f470eb361d792d749c146a61feb0f5e88ee07e

SHA256
5767e7c96f2638b067a062e8c6780240f0148507b987c9c95da713dd482f1acc

SHA512
3d4f600671ef875a7a49fa8a2c29fd2bb5646904f86b8d5b6635fe478d2c140d7e3f3f081b7a5c72319156c8a2dcac78031c987a5b6a17713da4b4168aee3e2f

Download Submit
C:\Windows\SysWOW64\Iiibkn32.exe

Filesize
435KB

MD5
932e197ca973a150e3477ecc45e861fd

SHA1
3e6d83531ad92a6c78f1fcf0b7204518d81a8161

SHA256
da05832fcf6bdacb80f1b4f32824aeb3e0623b3370e653dce8cff74404137cf0

SHA512
3fb13125922f838f8af9afacf93f128a835543ff926f9761570d8a12b28d9be471edf95ac1dbe2b037bc83b40018437ca0cb1260feefa38fa4a7534997e779dd

Download Submit
C:\Windows\SysWOW64\Imbaemhc.exe

Filesize
435KB

MD5
93cfa840ffdfd1792c5eae085ed9b430

SHA1
b92599698eceaf17a7e3f8ae2a15fb6143653be8

SHA256
70095451af7abe114150f75d02265f59b49f660b59a579256f0e4b2c89e75d59

SHA512
7d123c3a5af52677eccd56133ad22d50a2e8724a7ebd5677332c8176525c723542d40023c71d3f5b2fb1a6b9fe4357a64d8f83b6a164f39b7878f3a3cadca2cf

Download Submit
C:\Windows\SysWOW64\Imihfl32.exe

Filesize
435KB

MD5
5a859d2b2fd7f760a8af0147c5048801

SHA1
31714d4fcbb054eecf81f1263d1d9c7306291bd5

SHA256
817c91f4e645233d3f3fa77a9c49c6c4397dd3514c47abb909433c8f9e24dfa1

SHA512
b56e5ef0809564e0374555b51e6208f2a3bfe98c06a3944cc159058f6dbbc60004e297ba4a61cc07cdad144b1f6b76c6f08c71b9427364f0b59bc6d1f101cddc

Download Submit
C:\Windows\SysWOW64\Jbmfoa32.exe

Filesize
435KB

MD5
18a325f9ec891c774e546d8b4e2b3f57

SHA1
cb70a11caeb19746d750880b205d0b639b6a95b7

SHA256
a6aef7521a1e14b7c9c8db4574b214b2374d4c8de9c8250531ea68ad0a4f70ee

SHA512
329267b53bd0e231f99e4032d102859b16dce7737e3078f763a59bbcf5c27397111bbff1a4e89cef1ede0de49ff9aba5bc9d40a4acadb34edf6d0b89d755cdf2

Download Submit
C:\Windows\SysWOW64\Jdhine32.exe

Filesize
435KB

MD5
788e7862a8d9aeeabe8f13140cad0230

SHA1
61d61e09165b9b77cc9bb3281039d6f10f09ae27

SHA256
2ccee859e0a3157cf7349097d5466a2436b144af9a5e94b23ae33bf38bf6d23d

SHA512
cc66841aade0993298c95d6bd87726b8dbc19c9e3ec186c14176c05103763260669e4d9bc816484f8110025e4b0d0af2bced07e5d20f56a5e6b9985432f8d8f3

Download Submit
C:\Windows\SysWOW64\Jdmcidam.exe

Filesize
435KB

MD5
eed55e14fc36b79949a1807203cd7ac6

SHA1
408f45107d320a8e81bce0fc04548b2ab6659871

SHA256
88c2b0ff4eb90684802ea563ba59b8f630b6d9579af46e0ab42f3a6a34041211

SHA512
9d61159f9bc91497b47c74445d9f921fa280b54aab64bff149f5bfdb86f394c1db3e134cf0c970c7b6845df5b5cb124e7f507c2a17ecb16c8e394b4a17dc3727

Download Submit
C:\Windows\SysWOW64\Jiphkm32.exe

Filesize
435KB

MD5
f92834bc64839a38a2019bd77764cb17

SHA1
a9648699b395e75cba8c905455c7d000d3be13a5

SHA256
089498b3110a30a9abca95665c0e6ab134741ad323eff178208b16bfcb26f9b2

SHA512
323dfb6e48004aeb38749e0512b1a492f4c3fd59814c893e80a7a57499f31ea49dba207321c2c10385cceb9865adb43d6b2ad5520df9c00e18539d6855023762

Download Submit
C:\Windows\SysWOW64\Jjpeepnb.exe

Filesize
435KB

MD5
b2432032264a8262d639501816ac71b1

SHA1
ec40c193ed504de4ba1d9b43390ac64bf9017a1c

SHA256
1f491d79e2065b7e2e37216827d5083b05e20e8839f979ec86c7e2cba8aa3505

SHA512
377bd945e7af5a4ae2acd75f187a111f29614a794d4ceece44c9a8f1f53252c75e5660fb01b9880b63725e3e59ed02271f99b7ba507aa0cf1e20eb34f8594b7c

Download Submit
C:\Windows\SysWOW64\Jmnaakne.exe

Filesize
435KB

MD5
71982ceaab9e3ab5b120379010cdada8

SHA1
9c57b2cc43cb0b3319eeeb45c95121340275dcd4

SHA256
1d005afe84d788c5128d0f5f270e8e04eb13ff1a575485fd27969b050226ddd5

SHA512
6eb38d47b2c28ce24306ddf19e64cab3e7d6fed6c292d7784aea4ac420dee0787ce7c9452bc29597a9b94a65380539258daac722eff7881d5585c2f053453336

Download Submit
C:\Windows\SysWOW64\Jpojcf32.exe

Filesize
435KB

MD5
870f4bfbca38f0d0d5902cf6854a7a11

SHA1
01ed562c7cbe56a3e02e83801e74ff817985758f

SHA256
ea78d3abab4f7cd9916140059e0b6e657dec95a212cbb77eead65914255e484f

SHA512
1f25e5fddeb0726ca957e86e9ad2cf65f6b69b679ae250a63e16cec9cab145bd08703d4cfaef7e8f8f50231a5a1e93cddbeec52c3df3dd3ce2d56e98e85fabaf

Download Submit
C:\Windows\SysWOW64\Kdaldd32.exe

Filesize
435KB

MD5
17e65a2c21423f92a1c3c9ace2aa8cc3

SHA1
6fb6e18eb8feb193546c6b995a44faa1c6cd30ba

SHA256
fc5b380998ecd952f5d91f197e8d3d975909a52095ea22a00feda4b585b1a9ea

SHA512
0b91cbe4aead579b830bffb9bdbaac4380fed8f7b3df94a9f6e4c22db33604130643ad8349e8120f81bdf8fe3784dd41e47d6d63dc83b4175b5caa9190898399

Download Submit
C:\Windows\SysWOW64\Kdcijcke.exe

Filesize
435KB

MD5
fda2c866aa9cc11a112b6a7df087bbcb

SHA1
763f228b9528eb8d5a8af0e78192a17d4524395b

SHA256
536bbb5a14632c54f0721d6aca6f58f1598e68f97c0216b21dbf303f982a6cb7

SHA512
0df9ad2ed65dc0178237c4efdb6f5ea8f542bbaac4806631ec20f498abff1bea6453e00400bd336d9295b8ffa5dfeb94957da439bdc3399a279847662ab2935b

Download Submit
C:\Windows\SysWOW64\Kgdbkohf.exe

Filesize
435KB

MD5
1760ff82a80383eebc6c409fe5f1fa66

SHA1
f4891d59750f320737604542a8d897e5490943dc

SHA256
3cbe90c5bce2ff69b881974d9ea74560f94b9a5b3ea4eb6b997e5a18254d2cf3

SHA512
1516dbb3ab945dbb75481b747fb69121fb407e319f97acfb6a5c3be59d8c9e4cc765180cc66fb52a43d2a5e6903bdf7e8a9f023bf8981b93ff0aef853600b801

Download Submit
C:\Windows\SysWOW64\Kibnhjgj.exe

Filesize
435KB

MD5
6505dcd12f76366366d460b4dd4e8f05

SHA1
379ebd7e17f21e642f669fccb2ed977e162ff8d2

SHA256
80eb94507f1cc234671b4c6abc5876787dbca2a6561cb3efa883b37bc4e7ed56

SHA512
4a45433b4662ead10001961ba7b4fb8bcd4bfb9a61e4a063501611e1ce27d021e6e78204c38ddcf725eecae572b4c89df8696b74cd5d9a1dcbde72d3e72abf61

Download Submit
C:\Windows\SysWOW64\Kkbkamnl.exe

Filesize
435KB

MD5
b5827c0c311252f2c2a5c40f84dfd29d

SHA1
b4c268272ea76c917e16766c04bd439cf330f3e2

SHA256
22b8399f287fb7c00b71f5d50602955794f641b346d7bec1289ce8ab11eb3f22

SHA512
7870e673e03b2b1142e886407d27a13a4c8b8f5df87787b8285573b3c9bfd3f7bbb9148e5d6faa5783cbb5fed16786601ddbae291c609e1d451978824cd9c3e6

Download Submit
C:\Windows\SysWOW64\Kknafn32.exe

Filesize
435KB

MD5
b39c2657dd80050324119957b9a890f9

SHA1
4e9e4d35dd19b74f92e0d5f1fff837bbbd0c6b4a

SHA256
70645fd158275f958ad2cd76e67da8f2fd57c1ca92d8617a6bd41061f9601a10

SHA512
cd02cbe5ef24a99600747192b1e14556e37a068e9a2ac7b2936c1641c1da68ced959da41dd1427bd48280c9ac96d29f9070c58e7373402caf6926033121634a2

Download Submit
C:\Windows\SysWOW64\Kmegbjgn.exe

Filesize
435KB

MD5
0ffd4dbc9a931a9fd8775e38d8ea6ebf

SHA1
6cfe6200dd310d9a06daed88c9d0c1468e1bb193

SHA256
cae8d754151ee00e19ed3997c974ca91d87be043121f2a568a01dba816a5c5c7

SHA512
f908d106c96766f04343c60055e2c6319a9ee0e8b15ce5a49abf41949a945a56800caa9b619657be47c81620b27eca66bb82c8e918c6c154b75214f4d9cd4f34

Download Submit
C:\Windows\SysWOW64\Kmgdgjek.exe

Filesize
435KB

MD5
01a00ae2d511b4202ccc7528422726e2

SHA1
1e0a8f69834d27318c832286b5e0aeb711e00daf

SHA256
d8994622cd946c53eb74edd1e5a87d941293f8e0bc16def5a0cb1c72568dfe19

SHA512
b25a57a8fd8d092ce9f8f85c9d4fb8fabb22d70a8ae90f18e5e1edfa841a5134db64176aa0d5dc225d1daf9fe41386595139fd9593919fdb9d58c824f0528900

Download Submit
C:\Windows\SysWOW64\Kmjqmi32.exe

Filesize
435KB

MD5
ac89be109626fe8290b66183b0dcd5b8

SHA1
40984408fb7eaea2ed9de85668cc2151b449e589

SHA256
2b07b9e62749c71755ebc8b3e3f090fd537935daf6d5053e7d1d6c331d17c084

SHA512
22df3af859a17f48f3b266a20575359d3dbf5c8ef3f185b3539f99770d141aed371d7da24008f1604a83539f7b688ad98dc57cdc414ee83262d95b2ab6f4f606

Download Submit
C:\Windows\SysWOW64\Kmlnbi32.exe

Filesize
435KB

MD5
f16a43ac8b73d1adea3c3231deedfcdd

SHA1
ca4790ac9b7c454b32bdb1a29457c155807113ce

SHA256
7b0ae3147d81cb7c2e2306ba03673fce83e10fe2090f6288e888c751750472e0

SHA512
dc7a9e50fb58a45aa5049f049e14343358dd5938f11e5294425c954e20f63f0b972c22880a4bb3f68b6b8253b35b57690d7056d4bbb9cf6dc529c76ab664e6e5

Download Submit
C:\Windows\SysWOW64\Kpccnefa.exe

Filesize
435KB

MD5
9fb900ceba8077fc20ce2021d1a72c09

SHA1
4df12336cf0faa675dfe25582fce610511ab058c

SHA256
33a31c2c45f89c8160f1f032b8b3e3c741dc9c184bc275626bcb4bba2fcff236

SHA512
b795e7119f95ab992ab6027d996d4189acc560054cdec7caf83818fbf6fe369b8df84e7195f289c535d7b0588c326a023ae4c2e7986f60a3e2b3aabc59afd8b3

Download Submit
C:\Windows\SysWOW64\Laopdgcg.exe

Filesize
435KB

MD5
5b0c595ef4fea3ddcc27816ba4931b95

SHA1
04f8b48118e57b42dfb9a9ea4c9bd7bc959e42f6

SHA256
f73707373268ee45e0442f644fba9d03922fe6b10cee657420aa3c3b4cf2e887

SHA512
63854d76ce35326a940d828ed013c5e43f474b2bbb7105a541d96ff4e3ed6c3ed925e91ab6c0409675db57bfd92bc246fa4ae96e87eecae81b9ac3dfa0b38daa

Download Submit
C:\Windows\SysWOW64\Lcmofolg.exe

Filesize
435KB

MD5
8596c739b6fcce7cbd4ffc24efc3c9e7

SHA1
ea215bdd97cdc221d559068f3953017e56f22cf0

SHA256
e3868c1d66c7b976783dad4edf5730923b818d03d5fc148b5ee125204e744d52

SHA512
7ff76b6ddaee78c8aa3667bc26828dab2ec7b84888c9d45d16aed42a224624dc484d15240fa93a577a026072b0b19ee7c2be9be44f7cae1c1100fa64444f5210

Download Submit
C:\Windows\SysWOW64\Liggbi32.exe

Filesize
435KB

MD5
5760ae4ab67b3c78fff4904405c13aa1

SHA1
c5ddf6a17428da07011d4f6df532a39059cf8241

SHA256
54f3a65ebf47800086942f464d7fbb88060405055a5555e7548e74da91fcaa0a

SHA512
911602857139d69aa6780a4e039711904ed353f900a5ad0a6a7d0f855dce8c4c3ea7fd510e074ef9886bbd8675d6bd94e2252a2ef159b18a05536ace09443862

Download Submit
C:\Windows\SysWOW64\Ljnnch32.exe

Filesize
435KB

MD5
050e1d59d9646e710b1862283a6a8b8d

SHA1
0dee75922aba7b7a7ded2e5e67d9e9e25493c78a

SHA256
fa6e0d12b5540d3d74f690527c051440ee0ca860eb769926c0f6320e7675f373

SHA512
6a8cc8188666c49a93ab10be5b118d5a876f34ee4d0b0c7f8e8fdb62727ce8ab67f8e2a7754afa3f953a81ea369ef90d8730f2acdaa968b6da4386b901b6b972

Download Submit
C:\Windows\SysWOW64\Lmqgnhmp.exe

Filesize
435KB

MD5
40cf5bee674ab7e2d64cbb44c44d40e7

SHA1
b7ebe6b7b27eb0f10b067d167b8700ed355584f7

SHA256
3e6dd0369722ecf48bb128afc4a25bb67ffa792666111a2b533853b8dc865a93

SHA512
5c392a6f19f5641cc46d123b49cdf140ef528167f76e1fd75fe745a750c9a2aa64d8b0b5b92d35dc1418c6413cdb7c4d0a2956df388c028d1bea351981d7630b

Download Submit
C:\Windows\SysWOW64\Mahbje32.exe

Filesize
435KB

MD5
3ad067d7be7ed2a030470d8c04cdc10a

SHA1
acd8dffb2e0f6defbc15f132e0fd485a5b2c783f

SHA256
3c965f6d59e1a31625c40e6aa1daabc2d74d553628a541a8f49bf521b78150f9

SHA512
703e2d8d03754a064117976119d8cb22ef68e3fdc5e31fe2fc9fa038389e5d03e9c8221903b4c55f23fb6df2273592e721a089ba11ae4880f99fe1d21b22bfb7

Download Submit
C:\Windows\SysWOW64\Mgfqmfde.exe

Filesize
435KB

MD5
ec480cabc6860b7655b93d92e730f046

SHA1
fa371ef9ecc58d2fda7bf32f0fd1494f9e175f19

SHA256
4d1aea6341665b8cbc503d697b1dfd98806290035b9f3c371261e270a2bd4050

SHA512
e2ce50924a3edfe8129ac928be94c649055409c3a12097467f6f64da79ce7371fa9af4f1f4760bf10423b4240dc8b6401025f30bcff59ec0b6f1695701ed8017

Download Submit
C:\Windows\SysWOW64\Mmpijp32.exe

Filesize
435KB

MD5
3c7faa39dc7aad7dbbc62a42acc408fe

SHA1
3c109651bdf2d8fbbe5ed8263a0e9fac75d0d97a

SHA256
4de58f9b35bf4f8cb9e7ec3a6383676acf4554d3919fd7acac3c667662e70337

SHA512
d3e97858deba222273f9c6f709673967501abc7d4c41ac2fd85ae3b03a370f31dc1b0455415eab446e92df4255deb0c3dfefc1fd6cc6f7d4b2f7d4b79652bc65

Download Submit
C:\Windows\SysWOW64\Mpolqa32.exe

Filesize
435KB

MD5
2ba285e6c9af75c643e7c4a8af75daaa

SHA1
dd585b4758d1ea6b13ac250a42f9fcfa949d57e4

SHA256
ff1f7200e983c3996d0e08c4f35831bf796386ca5ed5fc91a8ca05d878b4b495

SHA512
3bb382b381a61a32c6a8c210376b654c538dfa8c8a21131a0d2bbe108ea40e453c66a81ee853b3eb08e6aa902b717048e2a92fc0b79952e2b984bdf974316ff1

Download Submit
C:\Windows\SysWOW64\Nafokcol.exe

Filesize
384KB

MD5
a03be1475340723befac11c4d6f62fde

SHA1
eaf6615eff1f59cb2b79595609489a19901ebca9

SHA256
22f5c7e4c01b146e58c612fb85915eb0f4201612cab3a522f19af26334b9df13

SHA512
6a8912be062ec42d8e08205c3bd51c9be96268a1b04c0687b92e50dd14f74a3b391ab31ed87606ccd1077e49baf314a6c2b9a56ec77b7d8b0cf60f4759c2cdd3

Download Submit
C:\Windows\SysWOW64\Njcpee32.exe

Filesize
435KB

MD5
ca94af6e09ed4077f9844c537dc0ce1d

SHA1
cb28a706414d55a6bf762347d6b40618e49e3c5a

SHA256
028f5d071559580ed91cceeb248bf5eb95122a26b6810d3ec5292e8938c32c7d

SHA512
b95b4cbfb6b9b4f23957a4ae4d6f572816e2c32a0cba41bbff69c6ae0bfa82d2dcf345c7551ac581709e40bc7ed5272ede712a7dad23b7c2fc59bc061a589636

Download Submit
C:\Windows\SysWOW64\Njljefql.exe

Filesize
435KB

MD5
bc993003fd797b3686abc9dabf444050

SHA1
d4f68b99a3f21abd546e65c48a4e5def4eaae459

SHA256
d43521c3cf076fbe388c35aee31e9141bf59c73735c3ab8850ae1a9bf523548f

SHA512
e10fe99d3502247f04f25376f57d01f1f4ca91411c2041c60d862687a6c60a080e80ab3e431b54ed63659d08010255749ee16685e84cf46dfedf7280c4166868

Download Submit
C:\Windows\SysWOW64\Nnmopdep.exe

Filesize
435KB

MD5
30b7ecb83342e7dd7d5fb5a712419bdf

SHA1
9f800bc465be7d9c00cfe694a44f3f2b54ddc24e

SHA256
cf028a360b8883bb0ef122aadc14c4e59021a5202e1819db610d0d6d15cdae10

SHA512
24c44d056dc7ce5979c4ca524eb065abfff0e535b3121c061075b8424b780d13edc988f595dfb90cc01c9c5cc470349f47b34b8f846f8e06ac3e81f66e222890

Download Submit
C:\Windows\SysWOW64\Ocnjidkf.exe

Filesize
435KB

MD5
859bcfe03ded6759baf69e535193d6e2

SHA1
f26662c5b9bf6f8df389de0b5d0841acdff67dd0

SHA256
b9fcb13aadd64bc89a3c56a9553ab6d47e2d8b3a675b06ab96c8dd8049e59849

SHA512
b2516709e78f61d0af00f455e243c79dad38a705ddbbf64cb68540a0db77673b51741a36002ff4b9913d2e36965e440db6ec253bb9c95666d26bdd8bff0c38fd

Download Submit
C:\Windows\SysWOW64\Onfbfc32.exe

Filesize
435KB

MD5
cc54086216fc26d72aada4d522063bbc

SHA1
8ba4e8a3a802baabadcae9d8a51c19e47ed69757

SHA256
dc8d713b50589cf1f04346ac699c27e110720d79805bf11fd48b974ae3efaa57

SHA512
0012d4f1116d8c477e39622701e365a5885578b244093cf43b0eab276e41fdb37c046ab1ec785ff55bc86ec7cc3e2662af5b971a22206c711051484f87c613b4

Download Submit
C:\Windows\SysWOW64\Pmannhhj.exe

Filesize
435KB

MD5
5e1900bcc616b584aaf041376cd857c2

SHA1
5db0dce9de6ae2dc346895cef163dcf91dab4cb8

SHA256
3be57be2c19870ff567c0d26cf646b6f8b2f316d324ea005ff9b6460fe6ece65

SHA512
e41e83fde2792df3303b9ecee480489868a740ab2261a5c66cf7a4d7ac7639fef491fd58cba251b181def50f3931660742e12a0d7ad763468c403352ac2f0e57

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
435KB

MD5
62cda736d3ec9e782c0d54720937b2ca

SHA1
b46575ce3fa9c7111e1cc6f4dbc209b5ea88cb59

SHA256
14030a18df7a4f3f83b035b0ef424f503dc89401172562e2d5d4b3e51122cf79

SHA512
c2d5f7a08f31bf1ebfbbe3ae56863bf8a459c8b6903c7973bb1a9b3e7706b7f9fecce66cb7e23839822f8544d73ac89959001e66fc13d24a5949fd5f20ffe75b

Download Submit
memory/404-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/452-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/464-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/744-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/832-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/976-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1280-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1296-321-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1368-437-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1380-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1388-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1408-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1480-237-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1484-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1620-197-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1672-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1912-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2044-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2044-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2056-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2220-261-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2268-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2292-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2436-396-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2576-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2768-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2852-389-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2860-401-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2904-371-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2924-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3160-297-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3208-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3212-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3228-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3236-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3260-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3320-209-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3484-267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3528-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3608-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3616-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3648-425-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3764-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3776-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3852-3058-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3980-366-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4116-345-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4168-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4200-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4328-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4356-351-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4480-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4496-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4596-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4640-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4692-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4748-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4848-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4904-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4948-279-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4988-417-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4996-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5024-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5060-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10372-3076-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10596-3075-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10604-3087-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10640-3074-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10680-3086-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10728-3059-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10788-3073-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10816-3084-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10832-3072-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10868-3061-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10952-3082-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10964-3065-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11028-3081-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11120-3079-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11164-3064-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads