7e45301f67476f33ba66f08289884eece5ff4b8c27c57387122f4a878681c534

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e45301f67476f33ba66f08289884eece5ff4b8c27c57387122f4a878681c534.exe
Size

224KB
MD5

33f646c5658b75f2556e00bf50255c82
SHA1

0b87e57990cff993580398a9e127f7cf82ed9f01
SHA256

7e45301f67476f33ba66f08289884eece5ff4b8c27c57387122f4a878681c534
SHA512

a0ffc54d1af11659b2363a1c40eaadff728d469969af52abebd7156ea4b6b0b1860cf6d896c694a03730b080232cc10b9baff8059d7464c07b4de5acff6f231a
SSDEEP

3072:UlIvf1+xc9Uts7iVpgzL20WKFcp9jRV5C/8qy4p2Y7YWlt63cp9jRV5q:mI6csHgzL2V4cpC0L4AY7YWT63cpq

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijcahd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjdebfnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmeandma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfihbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laiipofp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eigonjcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljceqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Monjjgkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcjjhdjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qcnjijoe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccblbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oeehkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmigoagp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bemqih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jngbjd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mibpda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amaqjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkhpdcab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcbdgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmbjcljl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ieccbbkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncianepl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhkikq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qachgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqojclne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Leihbeib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqknig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddgibkpc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iogopi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocihgnam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iikhfg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjpobg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emehdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgiiiidd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amlogfel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqgedh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ieagmcmq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlbejloe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfjapcii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndhmhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odoogi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banjnm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmbmibhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnfjbdmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbddfmgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mldhfpib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jqhafffk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojhpimhp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkhngl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnkbcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgkmgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfnoqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcikgacl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlpeff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iahlcaol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcclncbh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfhdlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojbacd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pddhbipj.exe

Executes dropped EXE 64 IoCs

pid	Process
2772	Iikhfg32.exe
2036	Icplcpgo.exe
3004	Jimekgff.exe
1540	Jbeidl32.exe
3304	Jefbfgig.exe
4776	Jbjcolha.exe
2164	Jlbgha32.exe
2140	Jeklag32.exe
3396	Kboljk32.exe
1820	Kpbmco32.exe
2656	Klimip32.exe
3208	Kebbafoj.exe
2524	Kpgfooop.exe
1640	Kipkhdeq.exe
2576	Kpjcdn32.exe
3420	Kefkme32.exe
4548	Kmncnb32.exe
3608	Kdgljmcd.exe
3456	Leihbeib.exe
3476	Lpnlpnih.exe
4524	Lfhdlh32.exe
3968	Lmbmibhb.exe
3900	Liimncmf.exe
1248	Lpcfkm32.exe
2008	Lljfpnjg.exe
3268	Mibpda32.exe
4560	Mlcifmbl.exe
4484	Menjdbgj.exe
4972	Ndokbi32.exe
2792	Nngokoej.exe
1632	Njnpppkn.exe
2700	Ndcdmikd.exe
3460	Njqmepik.exe
5036	Ncianepl.exe
4508	Njciko32.exe
4864	Ndhmhh32.exe
368	Ojgbfocc.exe
4880	Ocpgod32.exe
2564	Olhlhjpd.exe
4416	Ojllan32.exe
3408	Oqfdnhfk.exe
3676	Ofcmfodb.exe
1604	Ojaelm32.exe
2892	Pqknig32.exe
3252	Pgefeajb.exe
3428	Pmannhhj.exe
4812	Pfjcgn32.exe
3108	Pnakhkol.exe
2976	Pqpgdfnp.exe
1532	Pgioqq32.exe
3084	Pncgmkmj.exe
5052	Pqbdjfln.exe
4980	Pfolbmje.exe
1112	Pmidog32.exe
4520	Pcbmka32.exe
2712	Pjmehkqk.exe
3152	Qqfmde32.exe
2240	Qgqeappe.exe
1528	Qjoankoi.exe
4356	Qddfkd32.exe
1876	Ajanck32.exe
3472	Aqkgpedc.exe
3832	Afhohlbj.exe
4108	Ambgef32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Mibijk32.exe	Molelb32.exe
File opened for modification	C:\Windows\SysWOW64\Doilmc32.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Fnaokmco.exe	Fnobem32.exe
File created	C:\Windows\SysWOW64\Nhkikq32.exe	Naaqofgj.exe
File created	C:\Windows\SysWOW64\Dnbbhnma.dll	Ajbmdn32.exe
File created	C:\Windows\SysWOW64\Jlkipgpe.exe	Jjlmclqa.exe
File created	C:\Windows\SysWOW64\Anhejhfp.dll	Jpcapp32.exe
File created	C:\Windows\SysWOW64\Ajanck32.exe	Qddfkd32.exe
File created	C:\Windows\SysWOW64\Bfkedibe.exe	Beihma32.exe
File opened for modification	C:\Windows\SysWOW64\Jmbhoeid.exe	Jekqmhia.exe
File opened for modification	C:\Windows\SysWOW64\Jlgoek32.exe	Jocnlg32.exe
File created	C:\Windows\SysWOW64\Fbplml32.exe	Figgdg32.exe
File opened for modification	C:\Windows\SysWOW64\Ilibdmgp.exe	Ihmfco32.exe
File created	C:\Windows\SysWOW64\Bfjnjcni.exe	Bjcmebie.exe
File created	C:\Windows\SysWOW64\Nelfeo32.exe	Napjdpcn.exe
File created	C:\Windows\SysWOW64\Ehbnigjj.exe	Enmjlojd.exe
File created	C:\Windows\SysWOW64\Jgadgf32.exe	Jbdlop32.exe
File created	C:\Windows\SysWOW64\Koodbl32.exe	Kegpifod.exe
File created	C:\Windows\SysWOW64\Qpcecb32.exe	Qobhkjdi.exe
File created	C:\Windows\SysWOW64\Kofljo32.dll	Nckkfp32.exe
File created	C:\Windows\SysWOW64\Opeemh32.dll	Eagaoh32.exe
File created	C:\Windows\SysWOW64\Kkpbin32.exe	Jcikgacl.exe
File opened for modification	C:\Windows\SysWOW64\Qpeahb32.exe	Qpcecb32.exe
File created	C:\Windows\SysWOW64\Acnlgp32.exe	Afjlnk32.exe
File opened for modification	C:\Windows\SysWOW64\Jgfdmlcm.exe	Jpkphjeb.exe
File opened for modification	C:\Windows\SysWOW64\Poajkgnc.exe	Pcjiff32.exe
File created	C:\Windows\SysWOW64\Ojhpimhp.exe	Oanokhdb.exe
File opened for modification	C:\Windows\SysWOW64\Qhhpop32.exe	Pmblagmf.exe
File created	C:\Windows\SysWOW64\Ocdnln32.exe	Nmjfodne.exe
File created	C:\Windows\SysWOW64\Oahicipe.dll	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Pkjpfdin.dll	Inmgmijo.exe
File created	C:\Windows\SysWOW64\Abcgjd32.dll	Lhmmjbkf.exe
File opened for modification	C:\Windows\SysWOW64\Qhmqdemc.exe	Qachgk32.exe
File created	C:\Windows\SysWOW64\Mgeakekd.exe	Monjjgkb.exe
File opened for modification	C:\Windows\SysWOW64\Lckboblp.exe	Lplfcf32.exe
File created	C:\Windows\SysWOW64\Mfbaalbi.exe	Mljmhflh.exe
File opened for modification	C:\Windows\SysWOW64\Jeklag32.exe	Jlbgha32.exe
File created	C:\Windows\SysWOW64\Oocddono.exe	Ohgoaehe.exe
File created	C:\Windows\SysWOW64\Fkikinpo.dll	Doagjc32.exe
File created	C:\Windows\SysWOW64\Jpkphjeb.exe	Jnkcogno.exe
File opened for modification	C:\Windows\SysWOW64\Bkgeainn.exe	Bdmmeo32.exe
File created	C:\Windows\SysWOW64\Neiqnh32.dll	Bnkbcj32.exe
File opened for modification	C:\Windows\SysWOW64\Laiipofp.exe	Lllagh32.exe
File created	C:\Windows\SysWOW64\Bbaclegm.exe	Bdlfjh32.exe
File created	C:\Windows\SysWOW64\Caqpkjcl.exe	Cpljehpo.exe
File created	C:\Windows\SysWOW64\Edogedqq.dll	Bmomlnjk.exe
File created	C:\Windows\SysWOW64\Pagpdj32.dll	Ealkjh32.exe
File opened for modification	C:\Windows\SysWOW64\Ojgbfocc.exe	Ndhmhh32.exe
File created	C:\Windows\SysWOW64\Lmhqnncg.dll	Cpleig32.exe
File created	C:\Windows\SysWOW64\Fdamgb32.exe	Fmgejhgn.exe
File opened for modification	C:\Windows\SysWOW64\Fbplml32.exe	Figgdg32.exe
File opened for modification	C:\Windows\SysWOW64\Nnkpnclp.exe	Neclenfo.exe
File created	C:\Windows\SysWOW64\Aolblopj.exe	Adfnofpd.exe
File opened for modification	C:\Windows\SysWOW64\Cildom32.exe	Ccblbb32.exe
File created	C:\Windows\SysWOW64\Qoecnk32.dll	Kboljk32.exe
File created	C:\Windows\SysWOW64\Mieced32.dll	Mbighjdd.exe
File created	C:\Windows\SysWOW64\Lommhphi.dll	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Fonahn32.dll	Fkqeib32.exe
File opened for modification	C:\Windows\SysWOW64\Adikdfna.exe	Aajohjon.exe
File created	C:\Windows\SysWOW64\Pmannhhj.exe	Pgefeajb.exe
File created	C:\Windows\SysWOW64\Hdoemjgn.dll	Pgefeajb.exe
File created	C:\Windows\SysWOW64\Bochmn32.exe	Alelqb32.exe
File opened for modification	C:\Windows\SysWOW64\Pmbegqjk.exe	Pfccogfc.exe
File created	C:\Windows\SysWOW64\Bkfpfg32.dll	Ihdafkdg.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10680	10588	WerFault.exe	817

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aoalgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edhakj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Naaqofgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcbdgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akcjcnpe.dll"	Enmjlojd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpldbefn.dll"	Ojnfihmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deiljq32.dll"	Banjnm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jkhngl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpjgaoqm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fganqbgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcegclgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edionhpn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amlogfel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljqhkckn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pqpgdfnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hknfelnj.dll"	Dqpfmlce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehfnmfki.dll"	Ajanck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Idebdcdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hehkga32.dll"	Nabfjpak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmgagk32.dll"	Mmfkhmdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hlkfbocp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfpqiega.dll"	Mljmhflh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kefkme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlcifmbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Apggckbf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Miofjepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahaceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgogbi32.dll"	Lckboblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lckboblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Himnbjpd.dll"	Hfipbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjdipffl.dll"	Jkhngl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikdkai32.dll"	Bfchidda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjlgklif.dll"	Bfjnjcni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bklfgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncianepl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohgoaehe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Okchnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbnhoj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Menjdbgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocljjj32.dll"	Ncianepl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iacngdgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acilajpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lankbigo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfdhbpg.dll"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mhfppabl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Edmclccp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlgdjg32.dll"	Ipoheakj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfjfecno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dglkoeio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bbaclegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfddbh32.dll"	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klgmcn32.dll"	Jnifigpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enpfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hghoeqmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmigoagp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdggmekl.dll"	Hbbmmi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgbdcgld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fhflnpoi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 2772	412	7e45301f67476f33ba66f08289884eece5ff4b8c27c57387122f4a878681c534.exe	90
PID 412 wrote to memory of 2772	412	7e45301f67476f33ba66f08289884eece5ff4b8c27c57387122f4a878681c534.exe	90
PID 412 wrote to memory of 2772	412	7e45301f67476f33ba66f08289884eece5ff4b8c27c57387122f4a878681c534.exe	90
PID 2772 wrote to memory of 2036	2772	Iikhfg32.exe	91
PID 2772 wrote to memory of 2036	2772	Iikhfg32.exe	91
PID 2772 wrote to memory of 2036	2772	Iikhfg32.exe	91
PID 2036 wrote to memory of 3004	2036	Icplcpgo.exe	92
PID 2036 wrote to memory of 3004	2036	Icplcpgo.exe	92
PID 2036 wrote to memory of 3004	2036	Icplcpgo.exe	92
PID 3004 wrote to memory of 1540	3004	Jimekgff.exe	93
PID 3004 wrote to memory of 1540	3004	Jimekgff.exe	93
PID 3004 wrote to memory of 1540	3004	Jimekgff.exe	93
PID 1540 wrote to memory of 3304	1540	Jbeidl32.exe	94
PID 1540 wrote to memory of 3304	1540	Jbeidl32.exe	94
PID 1540 wrote to memory of 3304	1540	Jbeidl32.exe	94
PID 3304 wrote to memory of 4776	3304	Jefbfgig.exe	95
PID 3304 wrote to memory of 4776	3304	Jefbfgig.exe	95
PID 3304 wrote to memory of 4776	3304	Jefbfgig.exe	95
PID 4776 wrote to memory of 2164	4776	Jbjcolha.exe	96
PID 4776 wrote to memory of 2164	4776	Jbjcolha.exe	96
PID 4776 wrote to memory of 2164	4776	Jbjcolha.exe	96
PID 2164 wrote to memory of 2140	2164	Jlbgha32.exe	97
PID 2164 wrote to memory of 2140	2164	Jlbgha32.exe	97
PID 2164 wrote to memory of 2140	2164	Jlbgha32.exe	97
PID 2140 wrote to memory of 3396	2140	Jeklag32.exe	99
PID 2140 wrote to memory of 3396	2140	Jeklag32.exe	99
PID 2140 wrote to memory of 3396	2140	Jeklag32.exe	99
PID 3396 wrote to memory of 1820	3396	Kboljk32.exe	100
PID 3396 wrote to memory of 1820	3396	Kboljk32.exe	100
PID 3396 wrote to memory of 1820	3396	Kboljk32.exe	100
PID 1820 wrote to memory of 2656	1820	Kpbmco32.exe	101
PID 1820 wrote to memory of 2656	1820	Kpbmco32.exe	101
PID 1820 wrote to memory of 2656	1820	Kpbmco32.exe	101
PID 2656 wrote to memory of 3208	2656	Klimip32.exe	103
PID 2656 wrote to memory of 3208	2656	Klimip32.exe	103
PID 2656 wrote to memory of 3208	2656	Klimip32.exe	103
PID 3208 wrote to memory of 2524	3208	Kebbafoj.exe	104
PID 3208 wrote to memory of 2524	3208	Kebbafoj.exe	104
PID 3208 wrote to memory of 2524	3208	Kebbafoj.exe	104
PID 2524 wrote to memory of 1640	2524	Kpgfooop.exe	105
PID 2524 wrote to memory of 1640	2524	Kpgfooop.exe	105
PID 2524 wrote to memory of 1640	2524	Kpgfooop.exe	105
PID 1640 wrote to memory of 2576	1640	Kipkhdeq.exe	106
PID 1640 wrote to memory of 2576	1640	Kipkhdeq.exe	106
PID 1640 wrote to memory of 2576	1640	Kipkhdeq.exe	106
PID 2576 wrote to memory of 3420	2576	Kpjcdn32.exe	107
PID 2576 wrote to memory of 3420	2576	Kpjcdn32.exe	107
PID 2576 wrote to memory of 3420	2576	Kpjcdn32.exe	107
PID 3420 wrote to memory of 4548	3420	Kefkme32.exe	108
PID 3420 wrote to memory of 4548	3420	Kefkme32.exe	108
PID 3420 wrote to memory of 4548	3420	Kefkme32.exe	108
PID 4548 wrote to memory of 3608	4548	Kmncnb32.exe	109
PID 4548 wrote to memory of 3608	4548	Kmncnb32.exe	109
PID 4548 wrote to memory of 3608	4548	Kmncnb32.exe	109
PID 3608 wrote to memory of 3456	3608	Kdgljmcd.exe	110
PID 3608 wrote to memory of 3456	3608	Kdgljmcd.exe	110
PID 3608 wrote to memory of 3456	3608	Kdgljmcd.exe	110
PID 3456 wrote to memory of 3476	3456	Leihbeib.exe	111
PID 3456 wrote to memory of 3476	3456	Leihbeib.exe	111
PID 3456 wrote to memory of 3476	3456	Leihbeib.exe	111
PID 3476 wrote to memory of 4524	3476	Lpnlpnih.exe	112
PID 3476 wrote to memory of 4524	3476	Lpnlpnih.exe	112
PID 3476 wrote to memory of 4524	3476	Lpnlpnih.exe	112
PID 4524 wrote to memory of 3968	4524	Lfhdlh32.exe	113

C:\Users\Admin\AppData\Local\Temp\7e45301f67476f33ba66f08289884eece5ff4b8c27c57387122f4a878681c534.exe
"C:\Users\Admin\AppData\Local\Temp\7e45301f67476f33ba66f08289884eece5ff4b8c27c57387122f4a878681c534.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\Iikhfg32.exe
  C:\Windows\system32\Iikhfg32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\Icplcpgo.exe
    C:\Windows\system32\Icplcpgo.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\SysWOW64\Jimekgff.exe
      C:\Windows\system32\Jimekgff.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3004
    - - C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1540
      - C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2140
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3396
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1820
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3420
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3608
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3968
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        24⤵
        Executes dropped EXE
        
        PID:3900
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        25⤵
        Executes dropped EXE
        
        PID:1248
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        26⤵
        Executes dropped EXE
        
        PID:2008
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3268
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4560
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4484
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        30⤵
        Executes dropped EXE
        
        PID:4972
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        31⤵
        Executes dropped EXE
        
        PID:2792
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        32⤵
        Executes dropped EXE
        
        PID:1632
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        33⤵
        Executes dropped EXE
        
        PID:2700
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        34⤵
        Executes dropped EXE
        
        PID:3460
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5036
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        36⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4864
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        38⤵
        Executes dropped EXE
        
        PID:368
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        39⤵
        Executes dropped EXE
        
        PID:4880
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2564
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        41⤵
        Executes dropped EXE
        
        PID:4416
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        42⤵
        Executes dropped EXE
        
        PID:3408
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        43⤵
        Executes dropped EXE
        
        PID:3676
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        44⤵
        Executes dropped EXE
        
        PID:1604
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2892
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3252
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        47⤵
        Executes dropped EXE
        
        PID:3428
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        48⤵
        Executes dropped EXE
        
        PID:4812
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        49⤵
        Executes dropped EXE
        
        PID:3108
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2976
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        51⤵
        Executes dropped EXE
        
        PID:1532
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        52⤵
        Executes dropped EXE
        
        PID:3084
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        53⤵
        Executes dropped EXE
        
        PID:5052
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        54⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        55⤵
        Executes dropped EXE
        
        PID:1112
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        56⤵
        Executes dropped EXE
        
        PID:4520
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        57⤵
        Executes dropped EXE
        
        PID:2712
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        58⤵
        Executes dropped EXE
        
        PID:3152
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2240
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        60⤵
        Executes dropped EXE
        
        PID:1528
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4356
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1876
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        63⤵
        Executes dropped EXE
        
        PID:3472
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3832
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        65⤵
        Executes dropped EXE
        
        PID:4108
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        66⤵
        Drops file in System32 directory
        
        PID:684
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        67⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        68⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        69⤵
        Drops file in System32 directory
        
        PID:4180
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        70⤵
        Modifies registry class
        
        PID:4040
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3216
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        72⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        73⤵
        Drops file in System32 directory
        
        PID:1860
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        74⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        75⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        76⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        77⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        78⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        79⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        80⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        81⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        82⤵
        Drops file in System32 directory
        
        PID:5424
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        83⤵
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        84⤵
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        85⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        86⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        87⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        88⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5724
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        90⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        91⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        92⤵
        Modifies registry class
        
        PID:5852
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        93⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        94⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        95⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        96⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        97⤵
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        98⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        99⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        100⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        101⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        102⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        103⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        104⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5512
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        106⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Ehapfiem.exe
        
        C:\Windows\system32\Ehapfiem.exe
        107⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Edhakj32.exe
        
        C:\Windows\system32\Edhakj32.exe
        108⤵
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Eaonjngh.exe
        
        C:\Windows\system32\Eaonjngh.exe
        109⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Egnchd32.exe
        
        C:\Windows\system32\Egnchd32.exe
        110⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Fknicb32.exe
        
        C:\Windows\system32\Fknicb32.exe
        111⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Fkqeib32.exe
        
        C:\Windows\system32\Fkqeib32.exe
        112⤵
        Drops file in System32 directory
        
        PID:6032
        
        C:\Windows\SysWOW64\Fnobem32.exe
        
        C:\Windows\system32\Fnobem32.exe
        113⤵
        Drops file in System32 directory
        
        PID:6096
        
        C:\Windows\SysWOW64\Fnaokmco.exe
        
        C:\Windows\system32\Fnaokmco.exe
        114⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Gekcaj32.exe
        
        C:\Windows\system32\Gekcaj32.exe
        115⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Gkjhoq32.exe
        
        C:\Windows\system32\Gkjhoq32.exe
        116⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        117⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        118⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Hghoeqmp.exe
        
        C:\Windows\system32\Hghoeqmp.exe
        119⤵
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        120⤵
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Hkehkocf.exe
        
        C:\Windows\system32\Hkehkocf.exe
        121⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Hbpphi32.exe
        
        C:\Windows\system32\Hbpphi32.exe
        122⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        123⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Hbbmmi32.exe
        
        C:\Windows\system32\Hbbmmi32.exe
        124⤵
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Hgoeep32.exe
        
        C:\Windows\system32\Hgoeep32.exe
        125⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Iohjlmeg.exe
        
        C:\Windows\system32\Iohjlmeg.exe
        126⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Idebdcdo.exe
        
        C:\Windows\system32\Idebdcdo.exe
        127⤵
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Inmgmijo.exe
        
        C:\Windows\system32\Inmgmijo.exe
        128⤵
        Drops file in System32 directory
        
        PID:5912
        
        C:\Windows\SysWOW64\Iomcgl32.exe
        
        C:\Windows\system32\Iomcgl32.exe
        129⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Ighhln32.exe
        
        C:\Windows\system32\Ighhln32.exe
        130⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\Ibnligoc.exe
        
        C:\Windows\system32\Ibnligoc.exe
        131⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Jkhngl32.exe
        
        C:\Windows\system32\Jkhngl32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5752
        
        C:\Windows\SysWOW64\Jfnbdecg.exe
        
        C:\Windows\system32\Jfnbdecg.exe
        133⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Jnifigpa.exe
        
        C:\Windows\system32\Jnifigpa.exe
        134⤵
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Jecofa32.exe
        
        C:\Windows\system32\Jecofa32.exe
        135⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\Jnkcogno.exe
        
        C:\Windows\system32\Jnkcogno.exe
        136⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Jpkphjeb.exe
        
        C:\Windows\system32\Jpkphjeb.exe
        137⤵
        Drops file in System32 directory
        
        PID:5500
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        138⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Jblijebc.exe
        
        C:\Windows\system32\Jblijebc.exe
        139⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Kldmckic.exe
        
        C:\Windows\system32\Kldmckic.exe
        140⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Kfjapcii.exe
        
        C:\Windows\system32\Kfjapcii.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6160
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        142⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Kbpbed32.exe
        
        C:\Windows\system32\Kbpbed32.exe
        143⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Kijjbofj.exe
        
        C:\Windows\system32\Kijjbofj.exe
        144⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Kbbokdlk.exe
        
        C:\Windows\system32\Kbbokdlk.exe
        145⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Kimghn32.exe
        
        C:\Windows\system32\Kimghn32.exe
        146⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Kpgodhkd.exe
        
        C:\Windows\system32\Kpgodhkd.exe
        147⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Khbdikip.exe
        
        C:\Windows\system32\Khbdikip.exe
        148⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Kbghfc32.exe
        
        C:\Windows\system32\Kbghfc32.exe
        149⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Lnnikdnj.exe
        
        C:\Windows\system32\Lnnikdnj.exe
        150⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Lnqeqd32.exe
        
        C:\Windows\system32\Lnqeqd32.exe
        151⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Lbnngbbn.exe
        
        C:\Windows\system32\Lbnngbbn.exe
        152⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Lflgmqhd.exe
        
        C:\Windows\system32\Lflgmqhd.exe
        153⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Mlnipg32.exe
        
        C:\Windows\system32\Mlnipg32.exe
        154⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Molelb32.exe
        
        C:\Windows\system32\Molelb32.exe
        155⤵
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Mibijk32.exe
        
        C:\Windows\system32\Mibijk32.exe
        156⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6880
        
        C:\Windows\SysWOW64\Mhicpg32.exe
        
        C:\Windows\system32\Mhicpg32.exe
        158⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Nemcjk32.exe
        
        C:\Windows\system32\Nemcjk32.exe
        159⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Nlglfe32.exe
        
        C:\Windows\system32\Nlglfe32.exe
        160⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Noehba32.exe
        
        C:\Windows\system32\Noehba32.exe
        161⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Nlihle32.exe
        
        C:\Windows\system32\Nlihle32.exe
        162⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Nhpiafnm.exe
        
        C:\Windows\system32\Nhpiafnm.exe
        163⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Ohgoaehe.exe
        
        C:\Windows\system32\Ohgoaehe.exe
        164⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6172
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        165⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Oenlqi32.exe
        
        C:\Windows\system32\Oenlqi32.exe
        166⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Olgemcli.exe
        
        C:\Windows\system32\Olgemcli.exe
        167⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Ogmijllo.exe
        
        C:\Windows\system32\Ogmijllo.exe
        168⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Ogpepl32.exe
        
        C:\Windows\system32\Ogpepl32.exe
        169⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Ollnhb32.exe
        
        C:\Windows\system32\Ollnhb32.exe
        170⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Pjpobg32.exe
        
        C:\Windows\system32\Pjpobg32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3568
        
        C:\Windows\SysWOW64\Pfgogh32.exe
        
        C:\Windows\system32\Pfgogh32.exe
        172⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        173⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Ppopjp32.exe
        
        C:\Windows\system32\Ppopjp32.exe
        174⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        175⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        176⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        177⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        178⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        179⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Afelhf32.exe
        
        C:\Windows\system32\Afelhf32.exe
        180⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Acilajpk.exe
        
        C:\Windows\system32\Acilajpk.exe
        181⤵
        Modifies registry class
        
        PID:6344
        
        C:\Windows\SysWOW64\Amaqjp32.exe
        
        C:\Windows\system32\Amaqjp32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6468
        
        C:\Windows\SysWOW64\Afjeceml.exe
        
        C:\Windows\system32\Afjeceml.exe
        183⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Amcmpodi.exe
        
        C:\Windows\system32\Amcmpodi.exe
        184⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Acnemi32.exe
        
        C:\Windows\system32\Acnemi32.exe
        185⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Aodfajaj.exe
        
        C:\Windows\system32\Aodfajaj.exe
        186⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Ajjjocap.exe
        
        C:\Windows\system32\Ajjjocap.exe
        187⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Bqdblmhl.exe
        
        C:\Windows\system32\Bqdblmhl.exe
        188⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Bmkcqn32.exe
        
        C:\Windows\system32\Bmkcqn32.exe
        189⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Bcelmhen.exe
        
        C:\Windows\system32\Bcelmhen.exe
        190⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Bfchidda.exe
        
        C:\Windows\system32\Bfchidda.exe
        191⤵
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Bgbdcgld.exe
        
        C:\Windows\system32\Bgbdcgld.exe
        192⤵
        Modifies registry class
        
        PID:4616
        
        C:\Windows\SysWOW64\Bmomlnjk.exe
        
        C:\Windows\system32\Bmomlnjk.exe
        193⤵
        Drops file in System32 directory
        
        PID:6716
        
        C:\Windows\SysWOW64\Bqkill32.exe
        
        C:\Windows\system32\Bqkill32.exe
        194⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Bciehh32.exe
        
        C:\Windows\system32\Bciehh32.exe
        195⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Bjcmebie.exe
        
        C:\Windows\system32\Bjcmebie.exe
        196⤵
        Drops file in System32 directory
        
        PID:6240
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        197⤵
        Modifies registry class
        
        PID:6496
        
        C:\Windows\SysWOW64\Cflkpblf.exe
        
        C:\Windows\system32\Cflkpblf.exe
        198⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Cmfclm32.exe
        
        C:\Windows\system32\Cmfclm32.exe
        199⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        200⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        201⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        202⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        203⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Cibmlmeb.exe
        
        C:\Windows\system32\Cibmlmeb.exe
        204⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        205⤵
        Drops file in System32 directory
        
        PID:6812
        
        C:\Windows\SysWOW64\Cjaifp32.exe
        
        C:\Windows\system32\Cjaifp32.exe
        206⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Dcjnoece.exe
        
        C:\Windows\system32\Dcjnoece.exe
        207⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        208⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Dpqodfij.exe
        
        C:\Windows\system32\Dpqodfij.exe
        209⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Dhhfedil.exe
        
        C:\Windows\system32\Dhhfedil.exe
        210⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Diicml32.exe
        
        C:\Windows\system32\Diicml32.exe
        211⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        212⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Dhjckcgi.exe
        
        C:\Windows\system32\Dhjckcgi.exe
        213⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Dmglcj32.exe
        
        C:\Windows\system32\Dmglcj32.exe
        214⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Dhlpqc32.exe
        
        C:\Windows\system32\Dhlpqc32.exe
        215⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Djmibn32.exe
        
        C:\Windows\system32\Djmibn32.exe
        216⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Eagaoh32.exe
        
        C:\Windows\system32\Eagaoh32.exe
        217⤵
        Drops file in System32 directory
        
        PID:7672
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        218⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Ealkjh32.exe
        
        C:\Windows\system32\Ealkjh32.exe
        219⤵
        Drops file in System32 directory
        
        PID:7756
        
        C:\Windows\SysWOW64\Eigonjcj.exe
        
        C:\Windows\system32\Eigonjcj.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7800
        
        C:\Windows\SysWOW64\Edmclccp.exe
        
        C:\Windows\system32\Edmclccp.exe
        221⤵
        Modifies registry class
        
        PID:7844
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7884
        
        C:\Windows\SysWOW64\Edopabqn.exe
        
        C:\Windows\system32\Edopabqn.exe
        223⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Fmgejhgn.exe
        
        C:\Windows\system32\Fmgejhgn.exe
        224⤵
        Drops file in System32 directory
        
        PID:7968
        
        C:\Windows\SysWOW64\Fdamgb32.exe
        
        C:\Windows\system32\Fdamgb32.exe
        225⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        226⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        227⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        228⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Fibojhim.exe
        
        C:\Windows\system32\Fibojhim.exe
        229⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Fdhcgaic.exe
        
        C:\Windows\system32\Fdhcgaic.exe
        230⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        231⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Fhflnpoi.exe
        
        C:\Windows\system32\Fhflnpoi.exe
        232⤵
        Modifies registry class
        
        PID:7356
        
        C:\Windows\SysWOW64\Gpaqbbld.exe
        
        C:\Windows\system32\Gpaqbbld.exe
        233⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        234⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        235⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        236⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        237⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        238⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        239⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        240⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Hjedffig.exe
        
        C:\Windows\system32\Hjedffig.exe
        241⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Hhfedm32.exe
        
        C:\Windows\system32\Hhfedm32.exe
        242⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Hncmmd32.exe
        
        C:\Windows\system32\Hncmmd32.exe
        243⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        244⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Hglaej32.exe
        
        C:\Windows\system32\Hglaej32.exe
        245⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7352
        
        C:\Windows\SysWOW64\Hdpbon32.exe
        
        C:\Windows\system32\Hdpbon32.exe
        247⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Ihphkl32.exe
        
        C:\Windows\system32\Ihphkl32.exe
        248⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7668
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7792
        
        C:\Windows\SysWOW64\Ihdafkdg.exe
        
        C:\Windows\system32\Ihdafkdg.exe
        251⤵
        Drops file in System32 directory
        
        PID:7872
        
        C:\Windows\SysWOW64\Ijfnmc32.exe
        
        C:\Windows\system32\Ijfnmc32.exe
        252⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        253⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Iqbbpm32.exe
        
        C:\Windows\system32\Iqbbpm32.exe
        254⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        255⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        256⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Jbdlop32.exe
        
        C:\Windows\system32\Jbdlop32.exe
        257⤵
        Drops file in System32 directory
        
        PID:7680
        
        C:\Windows\SysWOW64\Jgadgf32.exe
        
        C:\Windows\system32\Jgadgf32.exe
        258⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        259⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        260⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        261⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        262⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        263⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Kiggbhda.exe
        
        C:\Windows\system32\Kiggbhda.exe
        264⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Kkfcndce.exe
        
        C:\Windows\system32\Kkfcndce.exe
        265⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Kndojobi.exe
        
        C:\Windows\system32\Kndojobi.exe
        266⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        267⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        268⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7340
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        270⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        271⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8328
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        273⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        274⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        275⤵
        Modifies registry class
        
        PID:8456
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        276⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        277⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        278⤵
        Drops file in System32 directory
        
        PID:8580
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        279⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        280⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        281⤵
        Modifies registry class
        
        PID:8708
        
        C:\Windows\SysWOW64\Mnlnbl32.exe
        
        C:\Windows\system32\Mnlnbl32.exe
        282⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        283⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        284⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        285⤵
        Drops file in System32 directory
        
        PID:8880
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        286⤵
        Modifies registry class
        
        PID:8924
        
        C:\Windows\SysWOW64\Mnphmkji.exe
        
        C:\Windows\system32\Mnphmkji.exe
        287⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        288⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9052
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        290⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        291⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9144
        
        C:\Windows\SysWOW64\Nhkikq32.exe
        
        C:\Windows\system32\Nhkikq32.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9188
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        293⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        294⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        295⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        296⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        297⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Nhpbfpka.exe
        
        C:\Windows\system32\Nhpbfpka.exe
        298⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Nojjcj32.exe
        
        C:\Windows\system32\Nojjcj32.exe
        299⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        300⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        301⤵
        Modifies registry class
        
        PID:8732
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        302⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        303⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        304⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        305⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        306⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        307⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        308⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        309⤵
        Drops file in System32 directory
        
        PID:8308
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        310⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        311⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        312⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        313⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        314⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        315⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        316⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        317⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        318⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Alnmjjdb.exe
        
        C:\Windows\system32\Alnmjjdb.exe
        319⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Akamff32.exe
        
        C:\Windows\system32\Akamff32.exe
        320⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        321⤵
        Drops file in System32 directory
        
        PID:9172
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        322⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        323⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        324⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5040
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        326⤵
        Drops file in System32 directory
        
        PID:8464
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        327⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        328⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        329⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        330⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9276
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        332⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        333⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        334⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        335⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9492
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        337⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        338⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        339⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        340⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        341⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        342⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9824
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        344⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        345⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        346⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        347⤵
        Drops file in System32 directory
        
        PID:10012
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        348⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        349⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        350⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        351⤵
        Modifies registry class
        
        PID:10180
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        352⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        353⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9304
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        355⤵
        Drops file in System32 directory
        
        PID:9360
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        356⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:32
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        358⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4380
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        360⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        361⤵
        
        PID:808
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        362⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        363⤵
        
        PID:636
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        364⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        365⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        366⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9672
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        368⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        369⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        370⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        371⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        372⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10052
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        373⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        374⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        375⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        376⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        377⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        378⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        379⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        380⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        381⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        382⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        383⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        384⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        385⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        386⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        387⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        388⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        389⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        390⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        391⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        392⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10068
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        393⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        394⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        395⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        396⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        397⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        398⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        399⤵
        Drops file in System32 directory
        
        PID:3004
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        400⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        401⤵
        Drops file in System32 directory
        
        PID:2368
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        402⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        403⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        404⤵
        
        PID:916
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        405⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        406⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        407⤵
        Modifies registry class
        
        PID:2752
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        408⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        409⤵
        Drops file in System32 directory
        
        PID:2976
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        410⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        411⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        412⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2536
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        413⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        414⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        415⤵
        Modifies registry class
        
        PID:5084
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2712
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        417⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        418⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        419⤵
        
        PID:8
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        420⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        421⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        422⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        423⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        424⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        425⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        426⤵
        Modifies registry class
        
        PID:2404
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        427⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        428⤵
        Drops file in System32 directory
        
        PID:2028
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        429⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        430⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        431⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5496
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        432⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        433⤵
        Drops file in System32 directory
        
        PID:5212
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        434⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        435⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5952
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        437⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        438⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        439⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        440⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        441⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        442⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        443⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        444⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        445⤵
        Modifies registry class
        
        PID:1708
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        446⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        447⤵
        Drops file in System32 directory
        
        PID:4804
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        448⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        449⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        450⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        451⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        452⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5844
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        453⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        454⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        455⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        456⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        457⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        458⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        459⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        460⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        461⤵
        Modifies registry class
        
        PID:2156
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        462⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        463⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        464⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        465⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5640
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        466⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        467⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        468⤵
        Modifies registry class
        
        PID:5592
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        469⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        470⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5024
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        471⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        472⤵
        Modifies registry class
        
        PID:9708
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        473⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        474⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4592
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        475⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        476⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        477⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        478⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        479⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        480⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5780
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        481⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        482⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        484⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        485⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        486⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        487⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        488⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        489⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        490⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        491⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        492⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        493⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        494⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        495⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        496⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        497⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        498⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        499⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        500⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        501⤵
        Drops file in System32 directory
        
        PID:2024
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        502⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5636
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        503⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        504⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        505⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        506⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        507⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        508⤵
        
        PID:964
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        509⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        510⤵
        Drops file in System32 directory
        
        PID:3996
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        511⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        512⤵
        Drops file in System32 directory
        
        PID:4276
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        513⤵
        Drops file in System32 directory
        
        PID:6648
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        514⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        515⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        516⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        517⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        518⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3272
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        519⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        520⤵
        Modifies registry class
        
        PID:6784
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        521⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        522⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        523⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        524⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        525⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        526⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        527⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        528⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        529⤵
        Drops file in System32 directory
        
        PID:5220
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        530⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        531⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6780
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        532⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        533⤵
        Modifies registry class
        
        PID:6688
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        534⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        535⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        536⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        537⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        538⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        539⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        540⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        541⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        542⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        543⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        544⤵
        
        PID:848
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        545⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        546⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        547⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        548⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        549⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        550⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        551⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        552⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5076
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        553⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        554⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        555⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        556⤵
        Modifies registry class
        
        PID:4616
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        557⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        558⤵
        Drops file in System32 directory
        
        PID:5468
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        559⤵
        Modifies registry class
        
        PID:6472
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        560⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        561⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        562⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        563⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        564⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        565⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        566⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        567⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        568⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        569⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6804
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        570⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        571⤵
        Modifies registry class
        
        PID:6456
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        572⤵
        Modifies registry class
        
        PID:7724
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        573⤵
        Drops file in System32 directory
        
        PID:7332
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        574⤵
        
        PID:332
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        575⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        576⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        577⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        578⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        579⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        580⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6276
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        581⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        582⤵
        Modifies registry class
        
        PID:6624
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        583⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        584⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        585⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        586⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        587⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        588⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        589⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        590⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        591⤵
        Modifies registry class
        
        PID:6744
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        592⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        593⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        594⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        595⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        596⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        597⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        598⤵
        Modifies registry class
        
        PID:7556
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        599⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        600⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        601⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        602⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        603⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        604⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        605⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        606⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        607⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        608⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        609⤵
        Modifies registry class
        
        PID:7216
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        610⤵
        Drops file in System32 directory
        
        PID:1796
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        611⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        612⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7784
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        613⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8012
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        614⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        615⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        616⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7248
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        617⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        618⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        619⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8024
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        620⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        621⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        622⤵
        Drops file in System32 directory
        
        PID:8160
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        623⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        624⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        625⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        626⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        627⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        628⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        629⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        630⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        631⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        632⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        633⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        634⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7748
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        635⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        636⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        637⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7576
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        638⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        639⤵
        Drops file in System32 directory
        
        PID:9772
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        640⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7392
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        641⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        642⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        643⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        644⤵
        Drops file in System32 directory
        
        PID:7868
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        645⤵
        Modifies registry class
        
        PID:7680
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        646⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        647⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        648⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        649⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        650⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        651⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        652⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7836
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        653⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        654⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        655⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        656⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        657⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        658⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        659⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        660⤵
        Drops file in System32 directory
        
        PID:8556
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        661⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7940
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        662⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        663⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        664⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        665⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        666⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        667⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        668⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        669⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        670⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        671⤵
        Drops file in System32 directory
        
        PID:3860
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        672⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        673⤵
        Modifies registry class
        
        PID:8968
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        674⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        675⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        676⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        677⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        678⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8204
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        679⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        680⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        681⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        682⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        683⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        684⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        685⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        686⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        687⤵
        Modifies registry class
        
        PID:8552
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        688⤵
        Drops file in System32 directory
        
        PID:8940
        
        C:\Windows\SysWOW64\Pmbegqjk.exe
        
        C:\Windows\system32\Pmbegqjk.exe
        689⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Qbonoghb.exe
        
        C:\Windows\system32\Qbonoghb.exe
        690⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Qjffpe32.exe
        
        C:\Windows\system32\Qjffpe32.exe
        691⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Qmdblp32.exe
        
        C:\Windows\system32\Qmdblp32.exe
        692⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        693⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        694⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8216
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        695⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Qikbaaml.exe
        
        C:\Windows\system32\Qikbaaml.exe
        696⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        697⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        698⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Aimogakj.exe
        
        C:\Windows\system32\Aimogakj.exe
        699⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Apggckbf.exe
        
        C:\Windows\system32\Apggckbf.exe
        700⤵
        Modifies registry class
        
        PID:8652
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        701⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        702⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Aalmimfd.exe
        
        C:\Windows\system32\Aalmimfd.exe
        703⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        704⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Bigbmpco.exe
        
        C:\Windows\system32\Bigbmpco.exe
        705⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        706⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8988
        
        C:\Windows\SysWOW64\Bdlfjh32.exe
        
        C:\Windows\system32\Bdlfjh32.exe
        707⤵
        Drops file in System32 directory
        
        PID:8724
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        708⤵
        Modifies registry class
        
        PID:9108
        
        C:\Windows\SysWOW64\Bfmolc32.exe
        
        C:\Windows\system32\Bfmolc32.exe
        709⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        710⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Bbdpad32.exe
        
        C:\Windows\system32\Bbdpad32.exe
        711⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Bfaigclq.exe
        
        C:\Windows\system32\Bfaigclq.exe
        712⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        713⤵
        Drops file in System32 directory
        
        PID:10368
        
        C:\Windows\SysWOW64\Caqpkjcl.exe
        
        C:\Windows\system32\Caqpkjcl.exe
        714⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        715⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10456
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        716⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        717⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        718⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10588 -s 400
        719⤵
        Program crash
        
        PID:10680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 10588 -ip 10588
1⤵
PID:10652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaiqcnhg.exe

Filesize
224KB

MD5
156652fa5864f970d2ee646fff6dfd3a

SHA1
20a5c2cd7f001af6f4955538cb17428de8781cbb

SHA256
2917ca77832cdaff4ea4e95d2482e00d52e7e7e804a404172c0ab03f35abf327

SHA512
813715325be9b6725a33e716d1ac7c606f8bea1d4ece21c58d3628526da11360e3c711d06605b841353465b943ff4b50a539b9f06e87231b4a7258eacfbc2740

Download Submit
C:\Windows\SysWOW64\Acilajpk.exe

Filesize
224KB

MD5
25a1c0c8f7ff3f0253fdfe72b3891727

SHA1
dbf6e04e9a7fbea2d7747f74b85fc6910df67263

SHA256
b356a7d06e706a5ba4080d795cf0fe4ada11616a9f0aca83d9ba5cc7dfe513a6

SHA512
bb1d925ef042e462577410ed2485a577c8224f27cea18f56c50f195d9a34a89f7656f88697db73822640a497114d6890f472aa67294a03b101ef1bde94337afd

Download Submit
C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
224KB

MD5
6960fc605865f5fa2512d16242536cab

SHA1
26da99c55a767580259e4971e3c35b647c7bba5a

SHA256
1c7894c3dd7d023af2706450222029c9f62a969d13d54232790d863abd96286f

SHA512
604bcd5667a7e1ff142063e7060530ca0dfce9f2e5be27d145a4fbce7ad3b29e6ef8c858b9c0318163df863c3848588031a4579672a4147d42b18edf25b3fa0f

Download Submit
C:\Windows\SysWOW64\Caqpkjcl.exe

Filesize
224KB

MD5
33595db048c2b2ef7c4b7a55d5ca4319

SHA1
114a810e98d4760e9615a8bdfc1fd2657c4d6436

SHA256
b1387497a3d6d8f86e6c52193550631985372333439c263a4aa580f5ed258e85

SHA512
5005b5cabd364a2044c0ea640962b794c8c4398a86dd80dce23fbd9c777df78a40f9c545d7d3d4c2ea67ab13bb89952ad7973ea3a8083e9bd671920668d9e898

Download Submit
C:\Windows\SysWOW64\Cibmlmeb.exe

Filesize
192KB

MD5
628548a0fc01fdd986aa7ebbc71be3b0

SHA1
67d4cdedd999c7409c0a01972ea5aed09796622a

SHA256
9f7be96b23831ecd31a918784f3b011679c71dfe1d074b97d030b74208130f2d

SHA512
0ca9de541b73d91178764201a82c15df302621fcf05404c3ae2e9cb9a52795dc1730a0969942c1b49c82360bccd6499cf6d668b484aea999d1cbcc75cb1e98ba

Download Submit
C:\Windows\SysWOW64\Dhlpqc32.exe

Filesize
224KB

MD5
4d62a48bae140f770f26deb56d129a06

SHA1
0cd6b8cbba27f4740211f9667f5162d706424f8d

SHA256
d180f2518be384188544f723841d6a0e26aab701a41bf7fd7762d449bc2c90f4

SHA512
49080d4f86471cb92fa162db20992ff43f37506651059d55ef909f2ee4bc58192adc93747663c6f4447b210b14fef23019901ea4b5505f45a9b6075516ec8170

Download Submit
C:\Windows\SysWOW64\Dhmgki32.exe

Filesize
224KB

MD5
6e38047211a7d04c4ee5bfbb5dfd0d41

SHA1
294168f28a7e944489c131f8a70fccb9ec434b3a

SHA256
fe712b618aa8f5676c6e48c515ac9904aff50953d1beeeae8c697356b8f06f18

SHA512
1494c2f0d2e0db1519fb097ab472a0a52d228102f86dd1c7143abac9a09920acd916ce3b531d8cbaaa2f8af5baf6a359bac95d52efa65deed8a2fdce691fc226

Download Submit
C:\Windows\SysWOW64\Efffmo32.exe

Filesize
224KB

MD5
e9a1395ace27fe7de137af4a6302975e

SHA1
0012cfc364b42ec5b6d067006c4170b407c4e2b0

SHA256
b66d6ed4102fd695937bb1b87e25df0029a07d82dc856f0571d1885bf54d2ccb

SHA512
c9e7b2fddafc16b69d368b7d90c8887cc024057374eea8b742801b277ee7c4d1dc564b93c1ea8eb6207365e7c4b978a0db3dae59f64506f6314df3d84e2e7212

Download Submit
C:\Windows\SysWOW64\Egnchd32.exe

Filesize
224KB

MD5
9e56839d40113dec2e0f2d3c924a604a

SHA1
fe8f05cc86f47b99252ce2eef1fdc4d0ce5ce293

SHA256
f41b8960689783df943272a0bc23f2bb91f88455586d8ccdc377aa9b4a123085

SHA512
0014e9db4787d9d73c2d319f1391aeef8b4efff33319019944618ed2ee891a23e490db6d2becd034ff49cf34b85536261c978fc281fdd7418fe11a460bc92065

Download Submit
C:\Windows\SysWOW64\Eigonjcj.exe

Filesize
224KB

MD5
e3eacb340921de9dc5a31e1f70e47de6

SHA1
88f4b8637b047d47e752142a698167ffbad315a8

SHA256
c9050060307d7cee1c3f3537b99f89224ebe01d5f8dfa09f2181aff5d1335ad8

SHA512
8c6588d156e60d89cc6938e6f97e7089989355895383bae7d263a4b3236951c04360147cdad16e7d0d6b48c72eb3b4a058a434db5526dfd8ca02e7582375c6b1

Download Submit
C:\Windows\SysWOW64\Fibojhim.exe

Filesize
224KB

MD5
f0f52dd928a22ba5f8a017790ba351a9

SHA1
6bb347b99d98197fab629bba8b2b8a5c8eff7397

SHA256
68f8b30b39c3fb18e9229b7cc5e38fbcc23d0535f725ae6f5b67a87a77558d4e

SHA512
be74df75ad9a9ecf131f021835ad44c58e5cd17af41dd50dfe1f386af0f38b440003a72cc4edddcdc1539dc4dbf14541a8c68b3dd05d9ab8d0fd48ff5cd240c5

Download Submit
C:\Windows\SysWOW64\Fnaokmco.exe

Filesize
64KB

MD5
3050800af2ab5deebdb278e8374af31b

SHA1
46c368d91e0ddd52b223b44a10d4b088dfc89dd1

SHA256
a479e1df9bf2610845bcfc01d13e675f56b7d20a280b06f39c81b5446669c19e

SHA512
594292cd1d7a12b153711e7b545d4fe02528cf91830d1c3f58dec55fa1cd7f8d0d5752857c4db50c496bf5f0a15cd68917b3be71514250b78474ce3568bbe7fa

Download Submit
C:\Windows\SysWOW64\Gbnhoj32.exe

Filesize
224KB

MD5
9ac4ce669d1028f18d7d3fed3c23bd98

SHA1
48ec0801d60d16210adc8911c7c0ff7cb4df6083

SHA256
b0ee160e5d46521d5ab7e1f89e61e73979711b9d119dbf08eadcdd767d6ca705

SHA512
a5bd109fe81512c6034ab60721a4806045d19772f06ce6612e0a49eb8c5a36cda202458fc071e599025d61dddfc67cc0af6b87f45fe0ca66158816d27622310f

Download Submit
C:\Windows\SysWOW64\Gpaqbbld.exe

Filesize
224KB

MD5
4dad718b8b1621145a563f085b6e1a4a

SHA1
f917201fa76b17ca2be15cbeb5793db6a3354e73

SHA256
5f834913b7df80e8bfd67b65f5c534809cb99690fe6eb969df5bbfbac913ef9e

SHA512
850f6b1fca2449bb481268829d4fe2f98b3a7134b147f8ffd2be2275d8f358250c2fdb3d54ce32e33368f5e537867681b040fba50bddbf326aa1ddaff9d836e8

Download Submit
C:\Windows\SysWOW64\Gpfjma32.exe

Filesize
224KB

MD5
4730c21964d5631e0c3f08fd5e64435d

SHA1
7b1027e5a9d7272acf67fe30f1c61d61ffdaade0

SHA256
602592b05db6831d3fb69823a2375848e40417dbae9a87709d8fed1fc65b8349

SHA512
22197468bda42c353af9f997d824d64aa4422c7458f9604514428c7ad5b70c9b4127a0fd7628fff816aafcc7a44f148d9a9943700b1291a22f8db4db66f6d9c2

Download Submit
C:\Windows\SysWOW64\Hdpbon32.exe

Filesize
224KB

MD5
e08389bbc819a25b60831d6435f59f18

SHA1
6478ecbe9f79b82fbad77566e61bad2ad4be1604

SHA256
8aca6f2f3c91f5b6f914acf706346363a9ffa6e13a52b172985f16989fa7dba9

SHA512
fc96ad9d4b98063737a01c9dbd5c5db788e94c5c2f7a92e7a0f054166080b96cae4ae897155a31746edc71c5975b2ff57331e00e1b78b288d4cb1e9f6cb3d321

Download Submit
C:\Windows\SysWOW64\Hihibbjo.exe

Filesize
224KB

MD5
d3fc772103cff988ef13aca3c7dbf8e9

SHA1
a056d36602ed19f45c6ff1082ad4f6533b468b3b

SHA256
e62188a28be532f7ef31c8e91146d6ecc5c3cd71a91a421ff16a3d858c26526d

SHA512
d0bf8ed65e78351f875a7d519acc4b36b64ea88321d6e6872b6a59ae4122aa45d4b87f5010784749609302b74b8da789694255d12743a1b35fbdb4488f7b1f59

Download Submit
C:\Windows\SysWOW64\Hjedffig.exe

Filesize
224KB

MD5
362d9d9448293f5077d40fcdf08bba3c

SHA1
74a7f097c235e7f31f90151bfe99e7773aba1d70

SHA256
158ddf157638f7fa771f7106fbc3dd05e10e9cb8c1ba027b50960ea908ec3f6a

SHA512
157dadae639cf7f8e889e7cc410af156df1c93fda836f6cf9923dc788c7cef94b920791187be5bb48bc6b3ea75b9cd4cc3869a933de269f0ecd121e4cc016f9b

Download Submit
C:\Windows\SysWOW64\Ibnligoc.exe

Filesize
224KB

MD5
e03a34831b77fe594abaeb3e23757140

SHA1
f2a0ddd2b195b3d7445f1bbcddf2f500ce83df0b

SHA256
714fd0a4e056fdd03033ff6190c2a3624711fe9a544c3a6806207f31ed178f78

SHA512
7e23d6c66b25cb6c35c64d0e29127e1ff1bcc580d40629fa63bf5e7cfbf9ee0a9260caa6569dda250ef0706c8e618f1df2738ea6d4188fb25230e99fb432a9cd

Download Submit
C:\Windows\SysWOW64\Icplcpgo.exe

Filesize
224KB

MD5
dc00d89a61f41a4fc75a8de63c7953b7

SHA1
990e4d8e338ce00b0715458ad73ac1119a95ad79

SHA256
3221b13034b1203236dbe6879f54d44201d065b21b55661783b38a4d5931e655

SHA512
85a7ab2b1bc58cfe6cfa81760b25f8a27f6cbaa09ab7b185ef1d30882ccde02f2d52312d1b0cb69cd8268d50cfebbaea9b79607f17371b6c66b899981d99962d

Download Submit
C:\Windows\SysWOW64\Iikhfg32.exe

Filesize
224KB

MD5
f4160f300d4ad531e39da557f9468b71

SHA1
ac44c6d52457e48fdd6416f1404c507ba00f0078

SHA256
2b9fb47d3dc6256bde608ef27923b9879531f23cfc0684e05768ab955e6b1339

SHA512
d38ea809350d3d82261870f32f0343e1ddaead2b9e9c4fdb862eb84741ae8164deae00a3ba88588ba2d2573446c4571a51c1738c209da4e6742d3dfb9aa09ecd

Download Submit
C:\Windows\SysWOW64\Ijcahd32.exe

Filesize
224KB

MD5
b4fc43462044cadcdb1e173e98ffcae2

SHA1
ccad483d48b0fc3c24ceb8d08f705e3c8de1114e

SHA256
db8b7bf6e78f8cfe30aa76586ca87f82289067e7abfd58888edc779206669f4f

SHA512
88da044368fe900eb5740a8216eaaff07b661feb91e5ca98919f28f4bab320df51c564c154bc19f522fa4e2eba8d7670b60df6d55ec762beb200a258c965e6ac

Download Submit
C:\Windows\SysWOW64\Jbeidl32.exe

Filesize
224KB

MD5
4627750598538c54474da394a9943a4e

SHA1
e6e8665f9893b2003271d02ecbe7d75816d795f5

SHA256
efc42d01659559e897e1e796f501fa72f69730779be5ce26a729f4e379e707a6

SHA512
bf805f26613cc0aca12b0949f3de718de890c70353ea1bcd01e7db5186e440d9af231e83db844565a80b8deb097eec74014e6865b10f4f282043115cc624c566

Download Submit
C:\Windows\SysWOW64\Jbjcolha.exe

Filesize
224KB

MD5
2534868d54bff4c4c29dca70912a8f82

SHA1
865a345857be324819c49409f32a7aad855bd2a5

SHA256
6846e361ab5c719cdaf8ee7bd1157586510866f9f4b7ae7d20c25ccae91d9179

SHA512
8c74f6a9114fc11f4d84d70c0f958c01de7129ee638906641e2054f5ee6c9a888a78345fc0c24b8300756e42c47b0d7066b815d659d49a3b3ad7b1440f7e1def

Download Submit
C:\Windows\SysWOW64\Jefbfgig.exe

Filesize
224KB

MD5
69cb5df85e3b30f525151b959fe5a1e6

SHA1
85fa53e00a81d994ad076874b9f0361bf504855c

SHA256
47270059baac01437ad795598af4fb5cc2f7c825d1b7e5578032581c33f4fc78

SHA512
9e230c0ad1caf3301c8342141f36bcb1a276402b41f3f5a8cb29a9b1c5595cbbc42ce69a1a230e647b65f7de5ea695edf46abed62e1db1bccc0ac17ed6d44675

Download Submit
C:\Windows\SysWOW64\Jeklag32.exe

Filesize
224KB

MD5
f5c850fc505ddb737208b371884f5ae0

SHA1
0c886b3b767a390674d06533d569ac20c3df1231

SHA256
607ffbd75785b303ec01408b6e80a6545d50383f56727f90f41a97303cbb27dc

SHA512
6365e32f79e49db15e9b2546463439a80a4694100d01bb014fa6e4ad80d8c184c0d82734db89807f93edfa171d588e7f8adff37ebd2fc018e8bb1fee73ba8cd3

Download Submit
C:\Windows\SysWOW64\Jimekgff.exe

Filesize
224KB

MD5
649f096cad06d9caf4bf120752b38818

SHA1
600478e5287b8f9198c500f8a986c07373052718

SHA256
04d88548f790666c824fea7e3670fb9837138ddfc3844252c87b24c562703233

SHA512
b6e7648ac03e7f4e380dc5f50fbc4557982efb640509a76838e56765bcf539c992dd73e4b5671672499354aa95bcd5f44bfe58133b640c9a70071aaec909f021

Download Submit
C:\Windows\SysWOW64\Jlbgha32.exe

Filesize
224KB

MD5
596f4cdc409907a590b5e3bf4079c482

SHA1
f1449978a2581d59cb91239aeda33243dad14492

SHA256
35f54fe85d13d3c52efe0d7b702f5938593a0d819fc4f66bb6e7db780d7ea67a

SHA512
605129db0e4e5981e2d1fb1af237227c9234e9de7034a734900bb26b665a2adf4f134a252619906161a643ea068fed43db2320496d854d8754af3f051c72f58f

Download Submit
C:\Windows\SysWOW64\Jnfcia32.exe

Filesize
224KB

MD5
0db3ba10a91f3a04a0b5b8f0cec04602

SHA1
01eaa70b4284bd9d2d0bf6f60630397f3dcb008d

SHA256
d3eed865187643a9663e85d0fbc1188f62305b8c220b8ffd4448c298740dab76

SHA512
b86c78bd6984311fda5ffead2971fd0cf4340630eecedbdaff48e80833380869e7fb3c3ee28bc38df59a6fd31f63f5cb2ce1c849cc95380b09b3678404153664

Download Submit
C:\Windows\SysWOW64\Jpkphjeb.exe

Filesize
224KB

MD5
b7fdf2718cd777536649a1b761e4e9d6

SHA1
b054ab05ea9612631a35b89895c024290dccdeb8

SHA256
34b70f59cd500f175a908147f30cefb00451dec7c34ba708fbda335b4a4c879e

SHA512
269d4ac66f3defbe207f5c1322b87d7e56f77aaa4865264290446be229a2df1357c18946cae241b886e3f6fc1ade698674680a75faf7b36f578e1bae9ccf2e5a

Download Submit
C:\Windows\SysWOW64\Kboljk32.exe

Filesize
224KB

MD5
3cef95afe123600b5813c437a9c04221

SHA1
2f3af7ad6d2316dec55299d1ecc1b7b0076050e9

SHA256
1b2fdc09ca04d585ca1a6002c961194df69cbe6c8a5c1b001895090a3dcddaba

SHA512
8d14c8e345570caaa4b6f0a1b7b8b632d23224b85d625c91f1cbe6437eebdc6ce5c24231cebdaea8a6f9cc901eabe5e83f73ba9b8c35d665e763771526c95a84

Download Submit
C:\Windows\SysWOW64\Kdgljmcd.exe

Filesize
224KB

MD5
8c9c1f31ffa16d17609454c3bbc1dae0

SHA1
08641ecf894724622407863b68fce05f0a79b362

SHA256
5e5d55150dfd67a34e7334c7643f27333541fc6f953f674841a952de6440706f

SHA512
234793560962e4033cd9bcc5995fe98ef362649d523dc60f3dac9ed73005044d2647e9325b34e109e0599c33014e59facd30f1fae7ed89bdf79c82fec49c87ba

Download Submit
C:\Windows\SysWOW64\Kebbafoj.exe

Filesize
224KB

MD5
ff31a0c4e7b3863147baa5cf16c763b7

SHA1
25f6eead1c2dce828eec333a07e7b0ddbcf7b73a

SHA256
e47629cce033f90bd03594cd73ee5fb89eec29d1df6ed41488070570d60df694

SHA512
f160ba40662e34dc16c25187806422dc3c16b47f39b047fc6412b5959b27df291551c15fa239e2097daa381a5b7be5ea886bb7db8e7337f9f57373ebf7d06c9a

Download Submit
C:\Windows\SysWOW64\Kefkme32.exe

Filesize
224KB

MD5
d11f34d33366b079c3fce97c1f6d9de9

SHA1
8a89376ba17530e71eb3d856189bcfc15ea6eeca

SHA256
1e9850a016d495d83e07c238507fb2c4fd5fc85cd5d3adf6da418ab8e0892fa2

SHA512
feb3e77c1b1ab004dcfc230f5421c19e5ecaba88b3eb7f519ff45be333d7b745d115edfd437cdbb03353d234000f28ec1cf3fc7d1fb456d8a868d74c9043ba78

Download Submit
C:\Windows\SysWOW64\Kinmcg32.exe

Filesize
224KB

MD5
713c8ccb9cc4ff48a0212886fab46455

SHA1
09d29827503d16b3dca550cb1e867567bbcee66b

SHA256
e42667ee62f8db1af354ff7dcc9bc1f280da7f93d4448c7c40caea2b5b087a50

SHA512
26988bf2d62df5a9f8c7b122682fbe141fe89866863b62a7074d733ba2db34f0b896d8f3b28d76cf6323f700daca3588e6423c58a610f1b74c713879d0d45138

Download Submit
C:\Windows\SysWOW64\Kipkhdeq.exe

Filesize
183KB

MD5
a22841b604d0f80899575104c4786d51

SHA1
2d8078b215fd0c2c7ee1d0a7bbe081bd6baf0b68

SHA256
5fb9ffe67d1392b10873cc05cbbc1f002b99bfd469581977a644d67af456a292

SHA512
b72ae473aec732fe28bbed1c016691a18a579ddde296956f4580331bec0823d4f538d7bac8038506d64b06a4d98c64fed9fdf2db52ca7428d31231d2354f6ad8

Download Submit
C:\Windows\SysWOW64\Kipkhdeq.exe

Filesize
224KB

MD5
fae2a871fd9774bc90645f91b4bdb815

SHA1
13ef9078e80135ae8d19234027da7aa1dcd3ab78

SHA256
efdec0e61bd72caa966be4c64b95866d77f22f8a21f3bd67494e2bddf4251195

SHA512
8840cd2b3d9e01132dd4b68f206c2b62657fa776ddb8a1220815a040a3032fc705651f3583da2e776c2ed2d1845531f273054a7d2890ecda9848419f6b48e7ec

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
224KB

MD5
cf5f9347fd34c65cd8636640ff344701

SHA1
ed574e90822012a2c0471f7e5d1e393e3a49d0b5

SHA256
a1614818e293a2fa7b4d0ab13500dd0d1951d289e42a52551916ebb8d1546ac6

SHA512
82cba9ef938ed7803fae3144fbe59694638231a78d62264a4efa82c43bcef8b31d290a13fe9b27ea49d9a2502a4c6fd655533934fff930c4258947e2440f9a5b

Download Submit
C:\Windows\SysWOW64\Kmdlffhj.exe

Filesize
224KB

MD5
a69b878e8b41c1881c2f1db7eaf6acfb

SHA1
32ef3945f0aac55e7538b4d633f0b75424def02f

SHA256
e999b0e475ab589b08c68c4728f4711eb02d62b332497be9098bb0c6533adb43

SHA512
1a90f2f12523b9b366a240bd459de8a12af79432eee704a9f06f3684ea271cb7143c6acd37adaa79af0538e056077369f24f6a7daa22bc63dbfcdd4bb25fa11a

Download Submit
C:\Windows\SysWOW64\Kmncnb32.exe

Filesize
224KB

MD5
b1feb91b8a965ad616e2c7ce8b298ad8

SHA1
3714ef01aea62a99f36171e27492a3beb1f247c3

SHA256
f8aa4a498e1e65a4cd098023bcd6cadef8bbf1153c28926a1377774c4e7b362e

SHA512
1c8b6aa15bcbc2eeb2186c0e1a7c5a306f8a42516cfa0af5c8762e18877b030240186e273f95861bdd6e720265473dc7224f6964fb00db7fffa38b26ba6f8be1

Download Submit
C:\Windows\SysWOW64\Kpbmco32.exe

Filesize
224KB

MD5
bcdbd55831959d016e3d48edd4adf470

SHA1
65e6a82663d594fc9a979e39664febd795d816dd

SHA256
be6ba8157e6f14f9b85d58d0a0cf9a4174826a3874b11562e056dbeabd72f271

SHA512
d51def03814366e3c1504feae6b86d7b748ffabccc7098a50b28678c73b70cd06929a857c5b473d29a6ca8fc8e55729a72ec3215cebc8779efabe1b953edbbef

Download Submit
C:\Windows\SysWOW64\Kpgfooop.exe

Filesize
224KB

MD5
b035f0b544da2fbb71e229f323dfc084

SHA1
61f75b051a32f01a4040b50c6f87919abf73f11a

SHA256
002458f577c53812a57bf9c7100170ef6d511f5163cb10161fdb0f7ead914985

SHA512
12017235a40b806927fff7e516c48efef4f4eeb8026254042ee559c69290905b13ef3dde4a30723b5538e06811f4bf147a3c5d0c63d157678051b469ef099b6a

Download Submit
C:\Windows\SysWOW64\Kpjcdn32.exe

Filesize
224KB

MD5
e450a553d4cc90ec825c4929fc385b4f

SHA1
8d2263d5778bac0ea180d4ba7b524425f1d472c5

SHA256
bcc3fdea8e5b3b74de541b6569d254dda0f9a5cb798c0e27fa97c87e3dbaee44

SHA512
27f9d61e673744940cfe1cb769572323a7fe5dca55302e4bb84b42007d9b76651cecaa0656c45b5ea1ed844aae5eb82fa996747b53b90416e8f2a36e3527b696

Download Submit
C:\Windows\SysWOW64\Leihbeib.exe

Filesize
224KB

MD5
0116fd6c60f29dc333979346161979c5

SHA1
a364860b035123993b23de69c9b302f524163234

SHA256
a9c94075f4874453a710dc07a51b979d1ca34afa9307ac36caa2ce5d3fae8980

SHA512
c7c54d90ed3bc560c8a8c9ad5797571b421850fdeb5a49e8b1cde65886c6f8052a1360155c94fb7f829149b5722799e7480c0fcc16ed5ea228d81733778e65cd

Download Submit
C:\Windows\SysWOW64\Lfhdlh32.exe

Filesize
224KB

MD5
f31303f00613b0b8efd426f6a6affcaf

SHA1
10e5e4c93174c6a226e986e8aabbd9e1c2f50285

SHA256
953c2a00290368c6fb871fbbd34a7ee24bd9423e0f486f4d39e9b7b1749014b6

SHA512
1400de86b53134d9daabc4c3f755e760196226ff90b653f8f725b324bcb0f64a2a99f492685a591a30f8cdca733074cacb58e65df7387a728812a944304f015f

Download Submit
C:\Windows\SysWOW64\Lhmmjbkf.exe

Filesize
224KB

MD5
bcdbffb4f7df5b8cdaf513af10e11bd9

SHA1
44dc3da8dd43bb3d87f6cf655f783884bbc3d203

SHA256
39617e3163fe370a9e270469bcc352b13d4fc230450bcaa7afa14ce3bc6e1cac

SHA512
f8a99a6698f4bb020fec872058948ea77d96fc81b2d743e94b7ac6e48d32c3159c977951bab383a6014550caf77b7f6fb1d9014451b097c6e4b6b16b569feddc

Download Submit
C:\Windows\SysWOW64\Lihpif32.exe

Filesize
224KB

MD5
0eff7d473fa70f4158ec6f36a969b496

SHA1
dc35be490350f51cb6902be13f3a7d46d4375490

SHA256
9e2be2b2dcd5250fbcffefdff34824aaef18668f1eda2e1eb4fe5c1f8b9ce4b8

SHA512
83b77022d36ce388cc0041f886fe3b5b7e6a00cbc52b52552c2771be077421630f18086099b2d837f0bade5482d094c719e746ee7d2c45e50125fefdc85d410d

Download Submit
C:\Windows\SysWOW64\Liimncmf.exe

Filesize
224KB

MD5
da72f7f3fe22d64d706e1807fca243fc

SHA1
c0a3afb33107e20a5e2f2729e24dffd3603c72a5

SHA256
44b565ea88c707d86f9e2d933d898fba751ab1daf328a5b7f2f0cde5e5848f70

SHA512
4a336caa7ef55f9d7b19362fc2eb8ce19fa69e32aadcd52d67e411a9923e8da735d4a85e132ecde3ebd381c58b7e43ed4519540f46fe0c4a0a8258891dab0d7e

Download Submit
C:\Windows\SysWOW64\Lljfpnjg.exe

Filesize
224KB

MD5
c956afe55dc5dbf7bb13010dc9d64b12

SHA1
280deca954efdd9377d9d5f875280949c28f3801

SHA256
2a46aa5ad64a3c1fcd41cb40fb27bffbac43baa02876eacd28c8ff44924656ba

SHA512
62c99b6d11f7eb93a8944cf0b0d032177b1e9c72f31fdecc6bf56c43bb164880e01731872ff5074c1a2318bf88cbc144cdeec1c29962f0537adbf3106d21787a

Download Submit
C:\Windows\SysWOW64\Lmbmibhb.exe

Filesize
224KB

MD5
8d24b8edf876f3f853613e4ae68a7f7e

SHA1
b55e642835e7180f39436a3e8cf41104bbcb9908

SHA256
d0cd663fd7ebb49ec733d78f21cc61cb279aa07241bae9a0a27d25703162ba29

SHA512
97133f8795b1e5632a366e282ede2d0aeb0f1e28eb572e9a3094c121cc1fcb28b456f655453ea0cf28c09083f4e7942d1d7c56556089edc179511907af63573f

Download Submit
C:\Windows\SysWOW64\Lpcfkm32.exe

Filesize
224KB

MD5
b3c70ed96307d10e2b20a61c97364c56

SHA1
c7b48bf72202256631698f832f4390f610560a4e

SHA256
fc7eec5866afd16db7476e5e374f4f2249e64e36efd9536ca63dbfa4cd7d8e1c

SHA512
37efd803385e8081aa6d6078d6cfbe43541ecb41889a655d3e815ae7bc541bf242c6aee6d8bbb28a734eeb991445105d37cad1667b13bd85937c688a26384b4f

Download Submit
C:\Windows\SysWOW64\Lpnlpnih.exe

Filesize
224KB

MD5
9de1232f38e015a2b7adf195d24ae6c7

SHA1
b3ad043ae55d59a9e8c823b79341d60dc009cd65

SHA256
5e00da1b2d1ffeb83816e92a29cb8a73a10c22fac6d5846120b673a926efe83d

SHA512
c8e5ed8a2a85b1f69e959ab6881bdd60229041cb2ab022d8086d442b2b305c7195947fb1222fd562a82803c635041c973e3a8d18daee43686949be485c566b60

Download Submit
C:\Windows\SysWOW64\Menjdbgj.exe

Filesize
224KB

MD5
e7da6139ed0c219cf0eeafa4ecdb7e2d

SHA1
bd5defa927311f8852183df339489abd8457c129

SHA256
e3e6d0d61f8ca82a4af7d7ca0b355664750197897c5e49d04630ebcf180f3be9

SHA512
7f7c40e0c81c6e85c101006c351a204b54b04891953daf5235cad59dddb7194f34d125807107590a139e0296d3ae4c74abb50e1f1d7a2fabb96ea53dafc495c7

Download Submit
C:\Windows\SysWOW64\Mibpda32.exe

Filesize
224KB

MD5
6ef1fad0bb2f95b29956f58f0d4e0df0

SHA1
e1555f78f40f38e30666f4eb28a6bb1c0a434f56

SHA256
5a141ef470e605fa4a09b936896363ebb72d7389c0f8747ee1fa5a2ef30418cf

SHA512
c985479052b3856daab478046e014e78abe52d5b96ffcd72d66a087a9976cbbc7da6b28801124feae597f3580018721344aad1dab87f9a2fac93c1f82fffe1dc

Download Submit
C:\Windows\SysWOW64\Miofjepg.exe

Filesize
224KB

MD5
0c862b4d8b1cda1a5f22a7a63495353e

SHA1
720c79a1e4d6cc06063f10fc45dcf16b9bbcd5fb

SHA256
a4d44d2dcc9f5da8eb0bbe2466577070b944f1b10399ff61e014a0d6c01c9a25

SHA512
78709a66400660869692a09b578cdc8f2a3ff7a5484ef4ceee8737e8f573bfb8fc5230d8a165c4fc93edbe22aa58ff2798a29187b517781b2f9524fe153ab398

Download Submit
C:\Windows\SysWOW64\Mlcifmbl.exe

Filesize
224KB

MD5
4db48c904cd52ad6f85127e7238260dc

SHA1
e31653bf86f2c41ab4cc88391ec019e48c022570

SHA256
5d5e59bb94d8acf2b0e61b397cbc582ab5664e7b6ad7b948903edbcbf4caa130

SHA512
4f0a62edcd873609b6cfca5ca1f2b010112008422f32a7e851505a3557a3c25d2fc00cb74c32d165c0f1e6e66a086df6d321a0201d008693d752d0268ba9edbb

Download Submit
C:\Windows\SysWOW64\Ncqlkemc.exe

Filesize
224KB

MD5
69d6d1a4c45beaa281003bd06300d464

SHA1
188f7dd96fcf7af8060af372bb489d8ee5de96ec

SHA256
48e5afeae784981dc7a9f94c8db129dd85a79fa99dc8f32df7be4d30402a9b62

SHA512
5562dcde57152de7770661b599c97329d2654e2742c2b74bdbfcbc306d82365dd41a7a35666e85b9e316d64deb5a297a10fb12ea55c7a7be9f73ddd9cac26066

Download Submit
C:\Windows\SysWOW64\Ndcdmikd.exe

Filesize
224KB

MD5
f4c2b3b147e57f92e958da5ca3541476

SHA1
f4a101e3f4dbb91e213d1c52e68de59023a4a381

SHA256
4c707ea0cf97ff6b4da6e93826b6a3b8dacf7d076003d9df12d2b69cfc74ceda

SHA512
3222080476fec7f77a0e151789822e32e89f19b9c8fe1f753a79f0978608fd7f7a84f7afc0125aa5b62e3a241fa9b249ceade893c8280a8a3d7d741235d02e6b

Download Submit
C:\Windows\SysWOW64\Ndokbi32.exe

Filesize
224KB

MD5
e16b85500591366c5b823518f257a8e2

SHA1
9c618820a7bdd1513a31cd0049953d100eec5414

SHA256
b19875143c2cc296bfabff2911ef9dc0e446cd8099c652583929889cdf20310e

SHA512
431e440535fd43f8aa0cea5da879eac684accb131ead311a4425828fd7a83ee92381e351a0aa7e1a33800d5ced50ed4bc80d3042c1aa3a620821d7adc15ec5a8

Download Submit
C:\Windows\SysWOW64\Njnpppkn.exe

Filesize
224KB

MD5
4a6d06107599769b5594cfed5052bf3a

SHA1
385d6b2c45c359cc6ca951ee0ae0fb5d8730b943

SHA256
347f1453f8a83e021d4c8b1ac2b057deafda31de7bde244657e234cd76d0e685

SHA512
2d2aa9d8006c7801c7e7b9628dbb1e9defe79fe604967a22f75393ccb77f48b1592e1649345ae52bddc7532812d61a7c50f5a8dd737aec6f62b701907c24dde5

Download Submit
C:\Windows\SysWOW64\Nlihle32.exe

Filesize
224KB

MD5
6a69db3a35d9149b89f007a916f94558

SHA1
1ef99d204015e23f534d3a0f9f03dabf8bc80242

SHA256
8a4dd572f5d0fd4f05ad4ae618ecb9cb787b1778182abeac763ca8028ea2b415

SHA512
43e8e8bd89845310f7bc202efdf31220ee42c40c23bd5eda82e006dd8deb4cb793dc5c7bb4da15f9144f3c70030cff67174fcce927d4ff75395f8fec86ee0f28

Download Submit
C:\Windows\SysWOW64\Nngokoej.exe

Filesize
224KB

MD5
a79ed7beb886f58557d61c25dc3d1497

SHA1
8d022199b4844a60c8bcce94bff40216c2567207

SHA256
0f35d963e9d2687ae2a43b8907a8983934feec2bc6a8a35e2a2770dedb197b62

SHA512
7eb352256f1df16152cf2c79d6367586e30599d4855047b3366a43a454ea8ef4ae98d3a3f2acb074faeb036c59b4c1303ba68c8ef08f22f1a1ae47bae13ec270

Download Submit
C:\Windows\SysWOW64\Odalmibl.exe

Filesize
224KB

MD5
a578e5f57e72f05564e2370e93d8e69e

SHA1
7364150f0b87e0948038d6fe57149dbad1d04688

SHA256
2d04162df33208b59fbf054c60e48e904a94960790a24974e11471c9dc24355d

SHA512
f952ab7618c5d325fb1f44f05e61830a2f8ab0ed4fe53f43efdbe8c29ed4cf837a2b68f7e6d7d90af1b7d91c5655db8c01538285834190962380bbfd12df999b

Download Submit
C:\Windows\SysWOW64\Ogpepl32.exe

Filesize
224KB

MD5
3bd882c2503bfed765c3338d682f3240

SHA1
073f40d18264b66d89f53fe154b61eb098c2bc3d

SHA256
c7b329b43cc2afa8a42f05061f8ee2867e7c734699140da31cfad5cda52988ff

SHA512
6675afc069083525b5837c1ea72ed2d8e6c0ff6acf7ab691b62ee05925c594e7e41a456a6a13c9b258f643e7402c0157f665b38b7d6ad7a86e9cc120efee1203

Download Submit
C:\Windows\SysWOW64\Ohgoaehe.exe

Filesize
224KB

MD5
65fe8e65e1bc5b38b1308302e3b7718e

SHA1
990fe95f3f058c5e392ba7d8a0fccd5324ca4047

SHA256
e7c05a7bc92eb15b60f3baf126a631cc159e582f268a617a81d62fde3ed205b8

SHA512
2207afeb4a7af3546a31b6df74f0d2edf0a338286ddcf87fa685f42a2cfd28088b5cc11edf526004cabcfc9996f7f077ef497358d248f605d8f413de95dcc5d1

Download Submit
C:\Windows\SysWOW64\Ojhpimhp.exe

Filesize
224KB

MD5
9d7b1d389ac36ef1a44bfa266f508982

SHA1
116bbfc466ea51bbf93351f13b4026c859fb5a01

SHA256
55e65bf68cb41204de02050219df09db799e8382e4dfd0da9f98b7586621ab0a

SHA512
b87d21504975b03aae6f39a292ed4a60eb372c89d683544e4e25aa3a3cf2193c391e891c4101d5f4ab840130f3a03ac078f848c9c97cc870a494f12ad1eaf10a

Download Submit
C:\Windows\SysWOW64\Onmfimga.exe

Filesize
224KB

MD5
0561f516f3d0f4601abdc81f14d7be9d

SHA1
426ff208f96fe54c9eeaf02d230842f878a19632

SHA256
0db570293f57efd97ac28cb10fa98797c1724a67d64e69daa3913593e1076433

SHA512
267c5e6495a29b81ee0a0b9dd0f053310e2951f59314b22424712d8095b47d9a210842714b99b292be5d98f6036cb87eeb8e8a7f0e5b6b4195f023a0e59186e4

Download Submit
C:\Windows\SysWOW64\Pfgogh32.exe

Filesize
224KB

MD5
4b1d9dc113150f44dbae6cec5f2bf44a

SHA1
54201860b213c8f029f726f620a1a77f945a4121

SHA256
ef9d3cfe67ca6dfbfb427c53df28fc583e32a953a0250961f3467539e85966b2

SHA512
4f81c10405538fad0228f482bdd534e3cea2349d4cca98c8fc34b4f5a78fc383ecf1e49f4f66d262da8eba386025b4a048c27618fb5beb135c87ef482705d2b0

Download Submit
C:\Windows\SysWOW64\Ppopjp32.exe

Filesize
224KB

MD5
3327608fa7345e079a9eedf618aca80a

SHA1
4d19bdf6e9e9fa928628d7e070cf8866e82f26f5

SHA256
8524ce065a8c8ce7d1ffc3de740bce694d15e013ca121b97b2f27ac6ffb6b67c

SHA512
866677e7286a4d91f571e29de7a6440a14a1ca60e88a184d0750d9c9f1b0cab4c709794c4f90fca45f3eb2f70bb3ade53bd653c42f445b4e4608a66971be013c

Download Submit
C:\Windows\SysWOW64\Qadoba32.exe

Filesize
224KB

MD5
45070a7f73f80267d518a4409d9a9a75

SHA1
47ff4dd16ed689dddadf8f39a408765b633da71e

SHA256
ce5a1644fec832cc07926789477b450bcd07d06391091622ca3ebc2f8d59908d

SHA512
412e4cef7e321bf549e029fc7fcc0e85399b5723edf92a1512bdda18bd097d1cb71da0c8f5df74134c0ca74e8668ff4bfb90b67153da9ae6cac9d3b92cfe4542

Download Submit
C:\Windows\SysWOW64\Qcbfakec.exe

Filesize
224KB

MD5
a16f2371878d7a989024fcbe56fd92cf

SHA1
07f532650f6967fd689e5d18a878bc17ce88e8ed

SHA256
70ede994b8d206cb928f54b491e5122883267c7c43876620c0dc7c51131d4298

SHA512
3377a2a289ec47959a2425a5266cc4d1ab4ccb2399512dd41d9307117860455d0dc1555c7f0e8d19c4fccd6e70ea84b24f825ef70e147514a4eee26f5c0bb91d

Download Submit
memory/368-306-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/412-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/412-5-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1248-205-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1540-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1540-149-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1604-346-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1632-266-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1640-260-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1640-116-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1820-233-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1820-81-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2008-206-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2008-287-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2036-98-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2036-17-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2140-65-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2140-216-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2164-57-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2164-207-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2524-115-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2564-315-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2576-174-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2656-90-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2656-243-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2700-334-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2700-269-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2772-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2772-9-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2792-321-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2792-251-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3004-107-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3004-25-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3208-103-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3268-294-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3268-217-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3304-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3304-185-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3396-72-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3396-224-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3408-328-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3420-150-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3456-190-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3460-345-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3460-275-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3476-191-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3608-169-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3676-335-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3900-203-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3968-200-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4416-326-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4484-235-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4484-308-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4508-291-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4524-194-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4548-158-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4560-225-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4560-301-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4776-204-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4776-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4864-295-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4880-309-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4972-250-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5036-281-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads