af70a99953c16de9ae992e574fb16c47841d8831cad4158e09e48e8e40af24f6

Analysis

max time kernel
144s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af70a99953c16de9ae992e574fb16c47841d8831cad4158e09e48e8e40af24f6.exe
Size

223KB
MD5

fcc90ce95732b621027c01e18bd91280
SHA1

571e8177eaafc7e02c7d515fd115bed6bcce5c89
SHA256

af70a99953c16de9ae992e574fb16c47841d8831cad4158e09e48e8e40af24f6
SHA512

ba6ec6258ce43d7cd2a47233a5532b730cd039a232eea56a67a51d7edd4d0fceda9d36de442581b751520dab3973c2384d1ca727e38da05224bddab2dfe9cf3f
SSDEEP

3072:/zYu+x/wqBzRjVAURfE+HcdpgZiT0PMCU080SrXSx8A6WoG:/zYuwndjRs+HcdeZpMCU080SOx8RTG

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljilqnlm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laffpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldipha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nabfjpak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohfami32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhkdof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iajdgcab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gaamlecg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kecabifp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qkjgegae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfngdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdmoohbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jehhaaci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oiihahme.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afghneoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llmhaold.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjfnedho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oacoqnci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kflide32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlkfbocp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mehjol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbddfmgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Licfngjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkqgno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afceko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlnipg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhlgfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjmmepfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knalji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pocpfphe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnfihkqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kppici32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdfoio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhlgfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbdlop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lijlof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Halaloif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bflham32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgknhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfjjga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpomcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lihpif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckmehb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amfhgj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmdfgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdmoohbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbdcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqaffn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nclikl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dahmfpap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpjjac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plkpcfal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdopjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmmbbejp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffclcgfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjfbjdnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iohejo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agimkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Biogppeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbddfmgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Leenhhdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbpbed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ihdafkdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ondljl32.exe

Executes dropped EXE 64 IoCs

pid	Process
860	Jnkcogno.exe
4560	Jkodhk32.exe
4512	Jehhaaci.exe
3484	Jblijebc.exe
2264	Kppici32.exe
4760	Kgknhl32.exe
3624	Kbpbed32.exe
4040	Klifnj32.exe
5076	Keakgpko.exe
316	Kechmoil.exe
3420	Knlleepl.exe
856	Lfealaol.exe
2904	Lejnmncd.exe
3176	Lfjjga32.exe
412	Lbqklb32.exe
3044	Likcilhh.exe
1952	Mojhgbdl.exe
4344	Mlnipg32.exe
2232	Mbhamajc.exe
644	Mhdjehhj.exe
1396	Mehjol32.exe
5084	Moaogand.exe
5048	Mleoafmn.exe
4668	Nemcjk32.exe
3408	Nhlpfgbb.exe
8	Neppokal.exe
4440	Nebmekoi.exe
4028	Nlleaeff.exe
3388	Ngaionfl.exe
2364	Npjnhc32.exe
2968	Neffpj32.exe
2840	Ncjginjn.exe
3452	Opogbbig.exe
4680	Oghppm32.exe
2536	Ohjlgefb.exe
4644	Oocddono.exe
3772	Oiihahme.exe
4372	Ocamjm32.exe
4964	Oepifi32.exe
4572	Oljaccjf.exe
2796	Ocdjpmac.exe
660	Ojnblg32.exe
4272	Ppmcdq32.exe
1756	Pjehmfch.exe
4836	Pcmlfl32.exe
776	Ppamophb.exe
4996	Pfnegggi.exe
896	Qgnbaj32.exe
4764	Qcdbfk32.exe
964	Qlmgopjq.exe
696	Ajqgidij.exe
536	Aompak32.exe
4048	Afghneoo.exe
2876	Amaqjp32.exe
3116	Ackigjmh.exe
4808	Ajeadd32.exe
2344	Aobilkcl.exe
3552	Aflaie32.exe
4688	Aqaffn32.exe
1748	Aglnbhal.exe
2768	Amhfkopc.exe
2816	Bcbohigp.exe
3056	Bgnkhg32.exe
2460	Biogppeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Amhfkopc.exe	Aglnbhal.exe
File opened for modification	C:\Windows\SysWOW64\Ombcji32.exe	Oaifpi32.exe
File opened for modification	C:\Windows\SysWOW64\Feqeog32.exe	Ehbnigjj.exe
File opened for modification	C:\Windows\SysWOW64\Bflham32.exe	Afceko32.exe
File created	C:\Windows\SysWOW64\Djklmo32.exe	Dhlpqc32.exe
File opened for modification	C:\Windows\SysWOW64\Fipkjb32.exe	Ffaong32.exe
File opened for modification	C:\Windows\SysWOW64\Jblijebc.exe	Jehhaaci.exe
File created	C:\Windows\SysWOW64\Jmppfooc.dll	Ohjlgefb.exe
File created	C:\Windows\SysWOW64\Obkahddl.exe	Noaeqjpe.exe
File created	C:\Windows\SysWOW64\Pcbdcf32.exe	Pilpfm32.exe
File opened for modification	C:\Windows\SysWOW64\Ehhpla32.exe	Epagkd32.exe
File opened for modification	C:\Windows\SysWOW64\Akcjkfij.exe	Ahenokjf.exe
File opened for modification	C:\Windows\SysWOW64\Oeheqm32.exe	Nccokk32.exe
File created	C:\Windows\SysWOW64\Kkpdnm32.dll	Pcbdcf32.exe
File created	C:\Windows\SysWOW64\Jdgafjpn.exe	Jnmijq32.exe
File created	C:\Windows\SysWOW64\Icfekc32.exe	Ilmmni32.exe
File opened for modification	C:\Windows\SysWOW64\Kcpahpmd.exe	Kqbdldnq.exe
File created	C:\Windows\SysWOW64\Honmnc32.dll	Obkahddl.exe
File created	C:\Windows\SysWOW64\Dflmlj32.exe	Dihlbf32.exe
File opened for modification	C:\Windows\SysWOW64\Ncabfkqo.exe	Nabfjpak.exe
File created	C:\Windows\SysWOW64\Nekhop32.dll	Okedcjcm.exe
File created	C:\Windows\SysWOW64\Bjnmpl32.exe	Bohibc32.exe
File created	C:\Windows\SysWOW64\Codhnb32.exe	Cijpahho.exe
File opened for modification	C:\Windows\SysWOW64\Klpakj32.exe	Ibjqaf32.exe
File created	C:\Windows\SysWOW64\Ifhahnbj.dll	Giinpa32.exe
File created	C:\Windows\SysWOW64\Cmncbodd.dll	Ohkbbn32.exe
File opened for modification	C:\Windows\SysWOW64\Afkknogn.exe	Akffafgg.exe
File created	C:\Windows\SysWOW64\Fffhifdk.exe	Fdglmkeg.exe
File created	C:\Windows\SysWOW64\Fideeaco.exe	Fffhifdk.exe
File opened for modification	C:\Windows\SysWOW64\Papfgbmg.exe	Pkenjh32.exe
File created	C:\Windows\SysWOW64\Oiihahme.exe	Oocddono.exe
File opened for modification	C:\Windows\SysWOW64\Emnbdioi.exe	Ejpfhnpe.exe
File created	C:\Windows\SysWOW64\Ackekpfe.dll	Adkgje32.exe
File opened for modification	C:\Windows\SysWOW64\Adhdjpjf.exe	Aokkahlo.exe
File created	C:\Windows\SysWOW64\Cjjcfabm.exe	Cfogeb32.exe
File opened for modification	C:\Windows\SysWOW64\Maiccajf.exe	Mnkggfkb.exe
File opened for modification	C:\Windows\SysWOW64\Mjahlgpf.exe	Mgclpkac.exe
File opened for modification	C:\Windows\SysWOW64\Mbhamajc.exe	Mlnipg32.exe
File opened for modification	C:\Windows\SysWOW64\Lqbncb32.exe	Lkeekk32.exe
File created	C:\Windows\SysWOW64\Nemcjk32.exe	Mleoafmn.exe
File opened for modification	C:\Windows\SysWOW64\Dikpbl32.exe	Dhjckcgi.exe
File created	C:\Windows\SysWOW64\Epikpo32.exe	Ecbjkngo.exe
File created	C:\Windows\SysWOW64\Gcqpalio.dll	Halaloif.exe
File opened for modification	C:\Windows\SysWOW64\Kcidmkpq.exe	Jlolpq32.exe
File created	C:\Windows\SysWOW64\Memicmfo.dll	Bjfjka32.exe
File created	C:\Windows\SysWOW64\Fpbfpack.dll	Jbaojpgb.exe
File opened for modification	C:\Windows\SysWOW64\Jcgnbaeo.exe	Jlmfeg32.exe
File created	C:\Windows\SysWOW64\Ncabfkqo.exe	Nabfjpak.exe
File opened for modification	C:\Windows\SysWOW64\Mlbkap32.exe	Mehcdfch.exe
File created	C:\Windows\SysWOW64\Okcajg32.dll	Fggocmhf.exe
File created	C:\Windows\SysWOW64\Pedlgbkh.exe	Pcepkfld.exe
File created	C:\Windows\SysWOW64\Knienl32.dll	Ebommi32.exe
File created	C:\Windows\SysWOW64\Ijagjini.dll	Eiieicml.exe
File created	C:\Windows\SysWOW64\Ohfami32.exe	Oeheqm32.exe
File created	C:\Windows\SysWOW64\Ejldilhc.dll	Jblijebc.exe
File opened for modification	C:\Windows\SysWOW64\Lfealaol.exe	Knlleepl.exe
File created	C:\Windows\SysWOW64\Pilpfm32.exe	Pbbgicnd.exe
File created	C:\Windows\SysWOW64\Bcfahbpo.exe	Bmlilh32.exe
File created	C:\Windows\SysWOW64\Hqbdnnae.dll	Kgknhl32.exe
File opened for modification	C:\Windows\SysWOW64\Fphnlcdo.exe	Fmjaphek.exe
File opened for modification	C:\Windows\SysWOW64\Mbgjbkfg.exe	Mlmbfqoj.exe
File created	C:\Windows\SysWOW64\Gmigpf32.dll	Qhkdof32.exe
File created	C:\Windows\SysWOW64\Okedcjcm.exe	Oidhlb32.exe
File created	C:\Windows\SysWOW64\Afkknogn.exe	Akffafgg.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8948	5180	WerFault.exe	666

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcmlfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkbogk32.dll"	Aompak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laahglpp.dll"	Ghkeio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kilpmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhbhmhpf.dll"	Naaqofgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pkgcea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Idbodn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmakeiil.dll"	Nlkngo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oaqbkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aojefobm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibclmgdb.dll"	Cobkhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmhand32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejldilhc.dll"	Jblijebc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oghppm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npbgmepl.dll"	Bfhadc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ghpocngo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nefped32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcepkfld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Heffebak.dll"	Iacngdgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pebndcpg.dll"	Hhiajmod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpecpgjp.dll"	Nognnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijcjmmil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jokkgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffclcgfn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmbfbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcgnbaeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oaqbkn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgbdcgld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jkomneim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajpqnneo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbiipkjk.dll"	Maggnali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Laqhhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phganm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amdcghbo.dll"	Ifomll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghpocngo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dphefd32.dll"	Jkjcbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phahglpk.dll"	Bohibc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bpgjpb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cadlbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eigonjcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfbped32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Halaloif.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pchlpfjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iehjdl32.dll"	Lddgmbpb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mccokj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljalni32.dll"	Cfigpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djcoai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecgcfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jllokajf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlolpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncloojfj.dll"	Pbbgicnd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqaffn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Neppokal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gacjadad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jllokajf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckjfdocc.dll"	Nqcejcha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efcagd32.dll"	Mnpabe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkobmnka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkkahahf.dll"	Neppokal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiobodkp.dll"	Aobilkcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpafph32.dll"	Bgbdcgld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjedffig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pehbea32.dll"	Ccdnjp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icdheded.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 860	264	af70a99953c16de9ae992e574fb16c47841d8831cad4158e09e48e8e40af24f6.exe	87
PID 264 wrote to memory of 860	264	af70a99953c16de9ae992e574fb16c47841d8831cad4158e09e48e8e40af24f6.exe	87
PID 264 wrote to memory of 860	264	af70a99953c16de9ae992e574fb16c47841d8831cad4158e09e48e8e40af24f6.exe	87
PID 860 wrote to memory of 4560	860	Jnkcogno.exe	88
PID 860 wrote to memory of 4560	860	Jnkcogno.exe	88
PID 860 wrote to memory of 4560	860	Jnkcogno.exe	88
PID 4560 wrote to memory of 4512	4560	Jkodhk32.exe	89
PID 4560 wrote to memory of 4512	4560	Jkodhk32.exe	89
PID 4560 wrote to memory of 4512	4560	Jkodhk32.exe	89
PID 4512 wrote to memory of 3484	4512	Jehhaaci.exe	90
PID 4512 wrote to memory of 3484	4512	Jehhaaci.exe	90
PID 4512 wrote to memory of 3484	4512	Jehhaaci.exe	90
PID 3484 wrote to memory of 2264	3484	Jblijebc.exe	91
PID 3484 wrote to memory of 2264	3484	Jblijebc.exe	91
PID 3484 wrote to memory of 2264	3484	Jblijebc.exe	91
PID 2264 wrote to memory of 4760	2264	Kppici32.exe	92
PID 2264 wrote to memory of 4760	2264	Kppici32.exe	92
PID 2264 wrote to memory of 4760	2264	Kppici32.exe	92
PID 4760 wrote to memory of 3624	4760	Kgknhl32.exe	93
PID 4760 wrote to memory of 3624	4760	Kgknhl32.exe	93
PID 4760 wrote to memory of 3624	4760	Kgknhl32.exe	93
PID 3624 wrote to memory of 4040	3624	Kbpbed32.exe	94
PID 3624 wrote to memory of 4040	3624	Kbpbed32.exe	94
PID 3624 wrote to memory of 4040	3624	Kbpbed32.exe	94
PID 4040 wrote to memory of 5076	4040	Klifnj32.exe	96
PID 4040 wrote to memory of 5076	4040	Klifnj32.exe	96
PID 4040 wrote to memory of 5076	4040	Klifnj32.exe	96
PID 5076 wrote to memory of 316	5076	Keakgpko.exe	97
PID 5076 wrote to memory of 316	5076	Keakgpko.exe	97
PID 5076 wrote to memory of 316	5076	Keakgpko.exe	97
PID 316 wrote to memory of 3420	316	Kechmoil.exe	98
PID 316 wrote to memory of 3420	316	Kechmoil.exe	98
PID 316 wrote to memory of 3420	316	Kechmoil.exe	98
PID 3420 wrote to memory of 856	3420	Knlleepl.exe	99
PID 3420 wrote to memory of 856	3420	Knlleepl.exe	99
PID 3420 wrote to memory of 856	3420	Knlleepl.exe	99
PID 856 wrote to memory of 2904	856	Lfealaol.exe	101
PID 856 wrote to memory of 2904	856	Lfealaol.exe	101
PID 856 wrote to memory of 2904	856	Lfealaol.exe	101
PID 2904 wrote to memory of 3176	2904	Lejnmncd.exe	102
PID 2904 wrote to memory of 3176	2904	Lejnmncd.exe	102
PID 2904 wrote to memory of 3176	2904	Lejnmncd.exe	102
PID 3176 wrote to memory of 412	3176	Lfjjga32.exe	103
PID 3176 wrote to memory of 412	3176	Lfjjga32.exe	103
PID 3176 wrote to memory of 412	3176	Lfjjga32.exe	103
PID 412 wrote to memory of 3044	412	Lbqklb32.exe	104
PID 412 wrote to memory of 3044	412	Lbqklb32.exe	104
PID 412 wrote to memory of 3044	412	Lbqklb32.exe	104
PID 3044 wrote to memory of 1952	3044	Likcilhh.exe	105
PID 3044 wrote to memory of 1952	3044	Likcilhh.exe	105
PID 3044 wrote to memory of 1952	3044	Likcilhh.exe	105
PID 1952 wrote to memory of 4344	1952	Mojhgbdl.exe	106
PID 1952 wrote to memory of 4344	1952	Mojhgbdl.exe	106
PID 1952 wrote to memory of 4344	1952	Mojhgbdl.exe	106
PID 4344 wrote to memory of 2232	4344	Mlnipg32.exe	108
PID 4344 wrote to memory of 2232	4344	Mlnipg32.exe	108
PID 4344 wrote to memory of 2232	4344	Mlnipg32.exe	108
PID 2232 wrote to memory of 644	2232	Mbhamajc.exe	109
PID 2232 wrote to memory of 644	2232	Mbhamajc.exe	109
PID 2232 wrote to memory of 644	2232	Mbhamajc.exe	109
PID 644 wrote to memory of 1396	644	Mhdjehhj.exe	110
PID 644 wrote to memory of 1396	644	Mhdjehhj.exe	110
PID 644 wrote to memory of 1396	644	Mhdjehhj.exe	110
PID 1396 wrote to memory of 5084	1396	Mehjol32.exe	111

C:\Users\Admin\AppData\Local\Temp\af70a99953c16de9ae992e574fb16c47841d8831cad4158e09e48e8e40af24f6.exe
"C:\Users\Admin\AppData\Local\Temp\af70a99953c16de9ae992e574fb16c47841d8831cad4158e09e48e8e40af24f6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:264
- C:\Windows\SysWOW64\Jnkcogno.exe
  C:\Windows\system32\Jnkcogno.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\SysWOW64\Jkodhk32.exe
    C:\Windows\system32\Jkodhk32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Windows\SysWOW64\Jehhaaci.exe
      C:\Windows\system32\Jehhaaci.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4512
    - - C:\Windows\SysWOW64\Jblijebc.exe
        
        C:\Windows\system32\Jblijebc.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3484
      - C:\Windows\SysWOW64\Kppici32.exe
        
        C:\Windows\system32\Kppici32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\SysWOW64\Kbpbed32.exe
        
        C:\Windows\system32\Kbpbed32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Windows\SysWOW64\Klifnj32.exe
        
        C:\Windows\system32\Klifnj32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\SysWOW64\Kechmoil.exe
        
        C:\Windows\system32\Kechmoil.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:316
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3420
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:856
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2904
        
        C:\Windows\SysWOW64\Lfjjga32.exe
        
        C:\Windows\system32\Lfjjga32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:412
        
        C:\Windows\SysWOW64\Likcilhh.exe
        
        C:\Windows\system32\Likcilhh.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3044
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Windows\SysWOW64\Mlnipg32.exe
        
        C:\Windows\system32\Mlnipg32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4344
        
        C:\Windows\SysWOW64\Mbhamajc.exe
        
        C:\Windows\system32\Mbhamajc.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Windows\SysWOW64\Mhdjehhj.exe
        
        C:\Windows\system32\Mhdjehhj.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:644
        
        C:\Windows\SysWOW64\Mehjol32.exe
        
        C:\Windows\system32\Mehjol32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Windows\SysWOW64\Moaogand.exe
        
        C:\Windows\system32\Moaogand.exe
        23⤵
        Executes dropped EXE
        
        PID:5084
        
        C:\Windows\SysWOW64\Mleoafmn.exe
        
        C:\Windows\system32\Mleoafmn.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5048
        
        C:\Windows\SysWOW64\Nemcjk32.exe
        
        C:\Windows\system32\Nemcjk32.exe
        25⤵
        Executes dropped EXE
        
        PID:4668
        
        C:\Windows\SysWOW64\Nhlpfgbb.exe
        
        C:\Windows\system32\Nhlpfgbb.exe
        26⤵
        Executes dropped EXE
        
        PID:3408
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:8
        
        C:\Windows\SysWOW64\Nebmekoi.exe
        
        C:\Windows\system32\Nebmekoi.exe
        28⤵
        Executes dropped EXE
        
        PID:4440
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        29⤵
        Executes dropped EXE
        
        PID:4028
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        30⤵
        Executes dropped EXE
        
        PID:3388
        
        C:\Windows\SysWOW64\Npjnhc32.exe
        
        C:\Windows\system32\Npjnhc32.exe
        31⤵
        Executes dropped EXE
        
        PID:2364
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        32⤵
        Executes dropped EXE
        
        PID:2968
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        33⤵
        Executes dropped EXE
        
        PID:2840
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        34⤵
        Executes dropped EXE
        
        PID:3452
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4680
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2536
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4644
        
        C:\Windows\SysWOW64\Oiihahme.exe
        
        C:\Windows\system32\Oiihahme.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3772
        
        C:\Windows\SysWOW64\Ocamjm32.exe
        
        C:\Windows\system32\Ocamjm32.exe
        39⤵
        Executes dropped EXE
        
        PID:4372
        
        C:\Windows\SysWOW64\Oepifi32.exe
        
        C:\Windows\system32\Oepifi32.exe
        40⤵
        Executes dropped EXE
        
        PID:4964
        
        C:\Windows\SysWOW64\Oljaccjf.exe
        
        C:\Windows\system32\Oljaccjf.exe
        41⤵
        Executes dropped EXE
        
        PID:4572
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        42⤵
        Executes dropped EXE
        
        PID:2796
        
        C:\Windows\SysWOW64\Ojnblg32.exe
        
        C:\Windows\system32\Ojnblg32.exe
        43⤵
        Executes dropped EXE
        
        PID:660
        
        C:\Windows\SysWOW64\Ppmcdq32.exe
        
        C:\Windows\system32\Ppmcdq32.exe
        44⤵
        Executes dropped EXE
        
        PID:4272
        
        C:\Windows\SysWOW64\Pjehmfch.exe
        
        C:\Windows\system32\Pjehmfch.exe
        45⤵
        Executes dropped EXE
        
        PID:1756
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4836
        
        C:\Windows\SysWOW64\Ppamophb.exe
        
        C:\Windows\system32\Ppamophb.exe
        47⤵
        Executes dropped EXE
        
        PID:776
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        48⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Qgnbaj32.exe
        
        C:\Windows\system32\Qgnbaj32.exe
        49⤵
        Executes dropped EXE
        
        PID:896
        
        C:\Windows\SysWOW64\Qljjjqlc.exe
        
        C:\Windows\system32\Qljjjqlc.exe
        50⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\Qcdbfk32.exe
        
        C:\Windows\system32\Qcdbfk32.exe
        51⤵
        Executes dropped EXE
        
        PID:4764
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        52⤵
        Executes dropped EXE
        
        PID:964
        
        C:\Windows\SysWOW64\Ajqgidij.exe
        
        C:\Windows\system32\Ajqgidij.exe
        53⤵
        Executes dropped EXE
        
        PID:696
        
        C:\Windows\SysWOW64\Aompak32.exe
        
        C:\Windows\system32\Aompak32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:536
        
        C:\Windows\SysWOW64\Afghneoo.exe
        
        C:\Windows\system32\Afghneoo.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4048
        
        C:\Windows\SysWOW64\Amaqjp32.exe
        
        C:\Windows\system32\Amaqjp32.exe
        56⤵
        Executes dropped EXE
        
        PID:2876
        
        C:\Windows\SysWOW64\Ackigjmh.exe
        
        C:\Windows\system32\Ackigjmh.exe
        57⤵
        Executes dropped EXE
        
        PID:3116
        
        C:\Windows\SysWOW64\Ajeadd32.exe
        
        C:\Windows\system32\Ajeadd32.exe
        58⤵
        Executes dropped EXE
        
        PID:4808
        
        C:\Windows\SysWOW64\Aobilkcl.exe
        
        C:\Windows\system32\Aobilkcl.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2344
        
        C:\Windows\SysWOW64\Aflaie32.exe
        
        C:\Windows\system32\Aflaie32.exe
        60⤵
        Executes dropped EXE
        
        PID:3552
        
        C:\Windows\SysWOW64\Aqaffn32.exe
        
        C:\Windows\system32\Aqaffn32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4688
        
        C:\Windows\SysWOW64\Aglnbhal.exe
        
        C:\Windows\system32\Aglnbhal.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1748
        
        C:\Windows\SysWOW64\Amhfkopc.exe
        
        C:\Windows\system32\Amhfkopc.exe
        63⤵
        Executes dropped EXE
        
        PID:2768
        
        C:\Windows\SysWOW64\Bcbohigp.exe
        
        C:\Windows\system32\Bcbohigp.exe
        64⤵
        Executes dropped EXE
        
        PID:2816
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        65⤵
        Executes dropped EXE
        
        PID:3056
        
        C:\Windows\SysWOW64\Biogppeg.exe
        
        C:\Windows\system32\Biogppeg.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2460
        
        C:\Windows\SysWOW64\Boipmj32.exe
        
        C:\Windows\system32\Boipmj32.exe
        67⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\Bfchidda.exe
        
        C:\Windows\system32\Bfchidda.exe
        68⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        69⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\Bqilgmdg.exe
        
        C:\Windows\system32\Bqilgmdg.exe
        70⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Bgbdcgld.exe
        
        C:\Windows\system32\Bgbdcgld.exe
        71⤵
        Modifies registry class
        
        PID:4204
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        72⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Bqkill32.exe
        
        C:\Windows\system32\Bqkill32.exe
        73⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Bciehh32.exe
        
        C:\Windows\system32\Bciehh32.exe
        74⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Bfhadc32.exe
        
        C:\Windows\system32\Bfhadc32.exe
        75⤵
        Modifies registry class
        
        PID:4968
        
        C:\Windows\SysWOW64\Bqmeal32.exe
        
        C:\Windows\system32\Bqmeal32.exe
        76⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\Bclang32.exe
        
        C:\Windows\system32\Bclang32.exe
        77⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        78⤵
        Drops file in System32 directory
        
        PID:1624
        
        C:\Windows\SysWOW64\Cmdfgm32.exe
        
        C:\Windows\system32\Cmdfgm32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2824
        
        C:\Windows\SysWOW64\Ccnncgmc.exe
        
        C:\Windows\system32\Ccnncgmc.exe
        80⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\Cflkpblf.exe
        
        C:\Windows\system32\Cflkpblf.exe
        81⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        82⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Cfogeb32.exe
        
        C:\Windows\system32\Cfogeb32.exe
        83⤵
        Drops file in System32 directory
        
        PID:3300
        
        C:\Windows\SysWOW64\Cjjcfabm.exe
        
        C:\Windows\system32\Cjjcfabm.exe
        84⤵
        
        PID:804
        
        C:\Windows\SysWOW64\Cadlbk32.exe
        
        C:\Windows\system32\Cadlbk32.exe
        85⤵
        Modifies registry class
        
        PID:5148
        
        C:\Windows\SysWOW64\Cfadkb32.exe
        
        C:\Windows\system32\Cfadkb32.exe
        86⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        87⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        88⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Cjomap32.exe
        
        C:\Windows\system32\Cjomap32.exe
        89⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Cmniml32.exe
        
        C:\Windows\system32\Cmniml32.exe
        90⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Cffmfadl.exe
        
        C:\Windows\system32\Cffmfadl.exe
        91⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Dmpfbk32.exe
        
        C:\Windows\system32\Dmpfbk32.exe
        92⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        93⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Dmbbhkjf.exe
        
        C:\Windows\system32\Dmbbhkjf.exe
        94⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Dhjckcgi.exe
        
        C:\Windows\system32\Dhjckcgi.exe
        95⤵
        Drops file in System32 directory
        
        PID:5596
        
        C:\Windows\SysWOW64\Dikpbl32.exe
        
        C:\Windows\system32\Dikpbl32.exe
        96⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        97⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Dhlpqc32.exe
        
        C:\Windows\system32\Dhlpqc32.exe
        98⤵
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        99⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Daediilg.exe
        
        C:\Windows\system32\Daediilg.exe
        100⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Dhomfc32.exe
        
        C:\Windows\system32\Dhomfc32.exe
        101⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Djmibn32.exe
        
        C:\Windows\system32\Djmibn32.exe
        102⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Emlenj32.exe
        
        C:\Windows\system32\Emlenj32.exe
        103⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        104⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Ejpfhnpe.exe
        
        C:\Windows\system32\Ejpfhnpe.exe
        105⤵
        Drops file in System32 directory
        
        PID:6044
        
        C:\Windows\SysWOW64\Emnbdioi.exe
        
        C:\Windows\system32\Emnbdioi.exe
        106⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Ejbbmnnb.exe
        
        C:\Windows\system32\Ejbbmnnb.exe
        107⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        108⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Efhcbodf.exe
        
        C:\Windows\system32\Efhcbodf.exe
        109⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Eigonjcj.exe
        
        C:\Windows\system32\Eigonjcj.exe
        110⤵
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        111⤵
        Drops file in System32 directory
        
        PID:5344
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        112⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        113⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        114⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Fmgejhgn.exe
        
        C:\Windows\system32\Fmgejhgn.exe
        115⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Fdamgb32.exe
        
        C:\Windows\system32\Fdamgb32.exe
        116⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        117⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        118⤵
        Drops file in System32 directory
        
        PID:5832
        
        C:\Windows\SysWOW64\Fphnlcdo.exe
        
        C:\Windows\system32\Fphnlcdo.exe
        119⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Fhofmq32.exe
        
        C:\Windows\system32\Fhofmq32.exe
        120⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        121⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        122⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Fpjjac32.exe
        
        C:\Windows\system32\Fpjjac32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5128
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        124⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Fmnkkg32.exe
        
        C:\Windows\system32\Fmnkkg32.exe
        125⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Fpmggb32.exe
        
        C:\Windows\system32\Fpmggb32.exe
        126⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Fggocmhf.exe
        
        C:\Windows\system32\Fggocmhf.exe
        127⤵
        Drops file in System32 directory
        
        PID:1888
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        128⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Fpodlbng.exe
        
        C:\Windows\system32\Fpodlbng.exe
        129⤵
        
        PID:996
        
        C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        130⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Gaopfe32.exe
        
        C:\Windows\system32\Gaopfe32.exe
        131⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        132⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5244
        
        C:\Windows\SysWOW64\Ghkeio32.exe
        
        C:\Windows\system32\Ghkeio32.exe
        134⤵
        Modifies registry class
        
        PID:3664
        
        C:\Windows\SysWOW64\Gilapgqb.exe
        
        C:\Windows\system32\Gilapgqb.exe
        135⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        136⤵
        Modifies registry class
        
        PID:5676
        
        C:\Windows\SysWOW64\Gdafnpqh.exe
        
        C:\Windows\system32\Gdafnpqh.exe
        137⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Gklnjj32.exe
        
        C:\Windows\system32\Gklnjj32.exe
        138⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        139⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Ghpocngo.exe
        
        C:\Windows\system32\Ghpocngo.exe
        140⤵
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        141⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Gahcmd32.exe
        
        C:\Windows\system32\Gahcmd32.exe
        142⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5224
        
        C:\Windows\SysWOW64\Hkpheidp.exe
        
        C:\Windows\system32\Hkpheidp.exe
        144⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Hpmpnp32.exe
        
        C:\Windows\system32\Hpmpnp32.exe
        145⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        146⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Hjedffig.exe
        
        C:\Windows\system32\Hjedffig.exe
        147⤵
        Modifies registry class
        
        PID:6100
        
        C:\Windows\SysWOW64\Hpomcp32.exe
        
        C:\Windows\system32\Hpomcp32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5936
        
        C:\Windows\SysWOW64\Hgiepjga.exe
        
        C:\Windows\system32\Hgiepjga.exe
        149⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Hncmmd32.exe
        
        C:\Windows\system32\Hncmmd32.exe
        150⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Hhiajmod.exe
        
        C:\Windows\system32\Hhiajmod.exe
        151⤵
        Modifies registry class
        
        PID:6240
        
        C:\Windows\SysWOW64\Hkgnfhnh.exe
        
        C:\Windows\system32\Hkgnfhnh.exe
        152⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Hpdfnolo.exe
        
        C:\Windows\system32\Hpdfnolo.exe
        153⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        154⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        155⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        156⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Idbodn32.exe
        
        C:\Windows\system32\Idbodn32.exe
        157⤵
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Ijogmdqm.exe
        
        C:\Windows\system32\Ijogmdqm.exe
        158⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Iddljmpc.exe
        
        C:\Windows\system32\Iddljmpc.exe
        159⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        160⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        161⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        162⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        163⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        164⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Ihdafkdg.exe
        
        C:\Windows\system32\Ihdafkdg.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6848
        
        C:\Windows\SysWOW64\Ikcmbfcj.exe
        
        C:\Windows\system32\Ikcmbfcj.exe
        166⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Iqpfjnba.exe
        
        C:\Windows\system32\Iqpfjnba.exe
        167⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Ikejgf32.exe
        
        C:\Windows\system32\Ikejgf32.exe
        168⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        169⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        170⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        171⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Jbaojpgb.exe
        
        C:\Windows\system32\Jbaojpgb.exe
        172⤵
        Drops file in System32 directory
        
        PID:7144
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5132
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        174⤵
        Modifies registry class
        
        PID:6220
        
        C:\Windows\SysWOW64\Jbdlop32.exe
        
        C:\Windows\system32\Jbdlop32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6264
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        176⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        177⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Jqiipljg.exe
        
        C:\Windows\system32\Jqiipljg.exe
        178⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        179⤵
        Modifies registry class
        
        PID:6532
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        180⤵
        Drops file in System32 directory
        
        PID:6616
        
        C:\Windows\SysWOW64\Jdgafjpn.exe
        
        C:\Windows\system32\Jdgafjpn.exe
        181⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        182⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        183⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Kjkpoq32.exe
        
        C:\Windows\system32\Kjkpoq32.exe
        184⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        185⤵
        Modifies registry class
        
        PID:7016
        
        C:\Windows\SysWOW64\Kjmmepfj.exe
        
        C:\Windows\system32\Kjmmepfj.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7088
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5636
        
        C:\Windows\SysWOW64\Kecabifp.exe
        
        C:\Windows\system32\Kecabifp.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6236
        
        C:\Windows\SysWOW64\Kkmioc32.exe
        
        C:\Windows\system32\Kkmioc32.exe
        189⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        190⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Leenhhdn.exe
        
        C:\Windows\system32\Leenhhdn.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6572
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        192⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        193⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Lalnmiia.exe
        
        C:\Windows\system32\Lalnmiia.exe
        194⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6976
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        196⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        197⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        198⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        199⤵
        Modifies registry class
        
        PID:6492
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1228
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6896
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        202⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Lijlof32.exe
        
        C:\Windows\system32\Lijlof32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7068
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        204⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        205⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        206⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        207⤵
        Drops file in System32 directory
        
        PID:7152
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        208⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        209⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        210⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        211⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        212⤵
        Drops file in System32 directory
        
        PID:6560
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        213⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        214⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        215⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        216⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        217⤵
        Modifies registry class
        
        PID:7356
        
        C:\Windows\SysWOW64\Nhkikq32.exe
        
        C:\Windows\system32\Nhkikq32.exe
        218⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Njiegl32.exe
        
        C:\Windows\system32\Njiegl32.exe
        219⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        220⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        221⤵
        Modifies registry class
        
        PID:7528
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        222⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        223⤵
        Modifies registry class
        
        PID:7612
        
        C:\Windows\SysWOW64\Nojjcj32.exe
        
        C:\Windows\system32\Nojjcj32.exe
        224⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        225⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        226⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        227⤵
        Modifies registry class
        
        PID:7788
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        228⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        229⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        230⤵
        Drops file in System32 directory
        
        PID:7928
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        231⤵
        Drops file in System32 directory
        
        PID:7972
        
        C:\Windows\SysWOW64\Oekiqccc.exe
        
        C:\Windows\system32\Oekiqccc.exe
        232⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        233⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        234⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        235⤵
        Drops file in System32 directory
        
        PID:8140
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        236⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        237⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Oafcqcea.exe
        
        C:\Windows\system32\Oafcqcea.exe
        238⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Ohpkmn32.exe
        
        C:\Windows\system32\Ohpkmn32.exe
        239⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        240⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7392
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        241⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Pchlpfjb.exe
        
        C:\Windows\system32\Pchlpfjb.exe
        242⤵
        Modifies registry class
        
        PID:7516
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        243⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        244⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        245⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        246⤵
        Modifies registry class
        
        PID:7808
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        247⤵
        Drops file in System32 directory
        
        PID:7872
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        248⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Pifnhpmi.exe
        
        C:\Windows\system32\Pifnhpmi.exe
        249⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        250⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        251⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        252⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7300
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        254⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        255⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        256⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Ahqddk32.exe
        
        C:\Windows\system32\Ahqddk32.exe
        257⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        258⤵
        Modifies registry class
        
        PID:7876
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        259⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        260⤵
        Drops file in System32 directory
        
        PID:8108
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        261⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Afinioip.exe
        
        C:\Windows\system32\Afinioip.exe
        262⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        263⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        264⤵
        Drops file in System32 directory
        
        PID:7644
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        265⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        266⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Acokhc32.exe
        
        C:\Windows\system32\Acokhc32.exe
        267⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7340
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        269⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        270⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        271⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        272⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7772
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        273⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        274⤵
        Drops file in System32 directory
        
        PID:7964
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        275⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        276⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        277⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        278⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        279⤵
        Modifies registry class
        
        PID:8356
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        280⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        281⤵
        Modifies registry class
        
        PID:8448
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        282⤵
        Drops file in System32 directory
        
        PID:8492
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        283⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        284⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        285⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        286⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Cbeapmll.exe
        
        C:\Windows\system32\Cbeapmll.exe
        287⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        288⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8776
        
        C:\Windows\SysWOW64\Ccdnjp32.exe
        
        C:\Windows\system32\Ccdnjp32.exe
        290⤵
        Modifies registry class
        
        PID:8848
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        291⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8932
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        293⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        294⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        295⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        296⤵
        Modifies registry class
        
        PID:9124
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        297⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        298⤵
        Drops file in System32 directory
        
        PID:7292
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        299⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        300⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        301⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        302⤵
        Modifies registry class
        
        PID:8484
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        303⤵
        Drops file in System32 directory
        
        PID:8544
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        304⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        305⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        306⤵
        Modifies registry class
        
        PID:8760
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        307⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        308⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        309⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        310⤵
        Drops file in System32 directory
        
        PID:9056
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        311⤵
        Drops file in System32 directory
        
        PID:9172
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        312⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        313⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        314⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        315⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        316⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        317⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        318⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        319⤵
        Drops file in System32 directory
        
        PID:8912
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        320⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        321⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1004
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        323⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        324⤵
        Drops file in System32 directory
        
        PID:8732
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        325⤵
        Drops file in System32 directory
        
        PID:9004
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        326⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        327⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        328⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        329⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        330⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9168
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        332⤵
        Drops file in System32 directory
        
        PID:9224
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        333⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        334⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        335⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        336⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        337⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        338⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        339⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        340⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        341⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        342⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        343⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        344⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        345⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        346⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        347⤵
        Modifies registry class
        
        PID:9896
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9936
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        349⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        350⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        351⤵
        Modifies registry class
        
        PID:10076
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        352⤵
        Drops file in System32 directory
        
        PID:10116
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        353⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        354⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        355⤵
        Modifies registry class
        
        PID:9220
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        356⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        357⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        358⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        359⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        360⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        361⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        362⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        363⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        364⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        365⤵
        Drops file in System32 directory
        
        PID:9932
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        366⤵
        Modifies registry class
        
        PID:10000
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        367⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        368⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        369⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        370⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        371⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        372⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        373⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        374⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9968
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        376⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        377⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        378⤵
        Drops file in System32 directory
        
        PID:9292
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        379⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        380⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        381⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        382⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        383⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        384⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        385⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        386⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        387⤵
        Modifies registry class
        
        PID:9972
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        388⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9260
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        390⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        391⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        392⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        393⤵
        Drops file in System32 directory
        
        PID:10376
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        394⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        395⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        396⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        397⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        398⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        399⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        400⤵
        Modifies registry class
        
        PID:10696
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        401⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        402⤵
        Drops file in System32 directory
        
        PID:10776
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        403⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        404⤵
        Drops file in System32 directory
        
        PID:10864
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        405⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        406⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        407⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        408⤵
        Modifies registry class
        
        PID:11044
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        409⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11132
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        411⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        412⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        413⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        414⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        415⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        416⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10480
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        418⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        419⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        420⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        421⤵
        Drops file in System32 directory
        
        PID:10804
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        422⤵
        Drops file in System32 directory
        
        PID:10848
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10936
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        424⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        425⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        426⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        427⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        428⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        429⤵
        Modifies registry class
        
        PID:10316
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        430⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10448
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        431⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        432⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10812
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        434⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        435⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        436⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        437⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        438⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        439⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        440⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        441⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        442⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        443⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        444⤵
        Modifies registry class
        
        PID:10252
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11272
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        446⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11364
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        448⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        449⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        450⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        451⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        452⤵
        Modifies registry class
        
        PID:11584
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        453⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        454⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        455⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        456⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        457⤵
        Drops file in System32 directory
        
        PID:11800
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        458⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        459⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        460⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11932
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        461⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        462⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        463⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        464⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        465⤵
        Modifies registry class
        
        PID:12124
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        466⤵
        
        PID:12168
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        467⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        468⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        469⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        470⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        471⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11608
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        473⤵
        Modifies registry class
        
        PID:11704
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        474⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        475⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        476⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        477⤵
        Modifies registry class
        
        PID:12004
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        478⤵
        Modifies registry class
        
        PID:12040
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        479⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        480⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12192
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        481⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        482⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        483⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        484⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        485⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        486⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11840
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        487⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        488⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        489⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        490⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        491⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        492⤵
        Modifies registry class
        
        PID:11488
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        493⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9024
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        494⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        495⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        496⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        497⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        498⤵
        Drops file in System32 directory
        
        PID:11948
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        499⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        500⤵
        
        PID:856
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        501⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11592
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        502⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        503⤵
        Drops file in System32 directory
        
        PID:8348
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        504⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        505⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4576
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        506⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11332
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        507⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        508⤵
        
        PID:412
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        509⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        510⤵
        Drops file in System32 directory
        
        PID:4312
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        511⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        512⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        513⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        514⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        515⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        516⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        517⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2816
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        518⤵
        Modifies registry class
        
        PID:1224
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        519⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4788
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        520⤵
        Drops file in System32 directory
        
        PID:632
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        521⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        522⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        523⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        524⤵
        Modifies registry class
        
        PID:9144
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        525⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        526⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Bfkbfd32.exe
        
        C:\Windows\system32\Bfkbfd32.exe
        527⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\Cibain32.exe
        
        C:\Windows\system32\Cibain32.exe
        528⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Cdjblf32.exe
        
        C:\Windows\system32\Cdjblf32.exe
        529⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Ddfbgelh.exe
        
        C:\Windows\system32\Ddfbgelh.exe
        530⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Ecbeip32.exe
        
        C:\Windows\system32\Ecbeip32.exe
        531⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Eajlhg32.exe
        
        C:\Windows\system32\Eajlhg32.exe
        532⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Fqbeoc32.exe
        
        C:\Windows\system32\Fqbeoc32.exe
        533⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        534⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\Gkalbj32.exe
        
        C:\Windows\system32\Gkalbj32.exe
        535⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Gjhfif32.exe
        
        C:\Windows\system32\Gjhfif32.exe
        536⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Hccggl32.exe
        
        C:\Windows\system32\Hccggl32.exe
        537⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Hnhkdd32.exe
        
        C:\Windows\system32\Hnhkdd32.exe
        538⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\Halaloif.exe
        
        C:\Windows\system32\Halaloif.exe
        539⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:11492
        
        C:\Windows\SysWOW64\Hejjanpm.exe
        
        C:\Windows\system32\Hejjanpm.exe
        540⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Hjfbjdnd.exe
        
        C:\Windows\system32\Hjfbjdnd.exe
        541⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6148
        
        C:\Windows\SysWOW64\Jdopjh32.exe
        
        C:\Windows\system32\Jdopjh32.exe
        542⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6764
        
        C:\Windows\SysWOW64\Kocphojh.exe
        
        C:\Windows\system32\Kocphojh.exe
        543⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Laffpi32.exe
        
        C:\Windows\system32\Laffpi32.exe
        544⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5556
        
        C:\Windows\SysWOW64\Lkqgno32.exe
        
        C:\Windows\system32\Lkqgno32.exe
        545⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5332
        
        C:\Windows\SysWOW64\Mdbnmbhj.exe
        
        C:\Windows\system32\Mdbnmbhj.exe
        546⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Mccokj32.exe
        
        C:\Windows\system32\Mccokj32.exe
        547⤵
        Modifies registry class
        
        PID:7192
        
        C:\Windows\SysWOW64\Namegfql.exe
        
        C:\Windows\system32\Namegfql.exe
        548⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\Noaeqjpe.exe
        
        C:\Windows\system32\Noaeqjpe.exe
        549⤵
        Drops file in System32 directory
        
        PID:8156
        
        C:\Windows\SysWOW64\Obkahddl.exe
        
        C:\Windows\system32\Obkahddl.exe
        550⤵
        Drops file in System32 directory
        
        PID:5136
        
        C:\Windows\SysWOW64\Pkholi32.exe
        
        C:\Windows\system32\Pkholi32.exe
        551⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Pbbgicnd.exe
        
        C:\Windows\system32\Pbbgicnd.exe
        552⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Pilpfm32.exe
        
        C:\Windows\system32\Pilpfm32.exe
        553⤵
        Drops file in System32 directory
        
        PID:5212
        
        C:\Windows\SysWOW64\Pcbdcf32.exe
        
        C:\Windows\system32\Pcbdcf32.exe
        554⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7636
        
        C:\Windows\SysWOW64\Pokanf32.exe
        
        C:\Windows\system32\Pokanf32.exe
        555⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Pmoagk32.exe
        
        C:\Windows\system32\Pmoagk32.exe
        556⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Pbljoafi.exe
        
        C:\Windows\system32\Pbljoafi.exe
        557⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\Amfhgj32.exe
        
        C:\Windows\system32\Amfhgj32.exe
        558⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7540
        
        C:\Windows\SysWOW64\Apgqie32.exe
        
        C:\Windows\system32\Apgqie32.exe
        559⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\Afceko32.exe
        
        C:\Windows\system32\Afceko32.exe
        560⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:624
        
        C:\Windows\SysWOW64\Bflham32.exe
        
        C:\Windows\system32\Bflham32.exe
        561⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8152
        
        C:\Windows\SysWOW64\Bbcignbo.exe
        
        C:\Windows\system32\Bbcignbo.exe
        562⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Bpgjpb32.exe
        
        C:\Windows\system32\Bpgjpb32.exe
        563⤵
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Clbdpc32.exe
        
        C:\Windows\system32\Clbdpc32.exe
        564⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Cmdmpe32.exe
        
        C:\Windows\system32\Cmdmpe32.exe
        565⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Cmgjee32.exe
        
        C:\Windows\system32\Cmgjee32.exe
        566⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Dmnpfd32.exe
        
        C:\Windows\system32\Dmnpfd32.exe
        567⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        568⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5180 -s 400
        569⤵
        Program crash
        
        PID:8948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5180 -ip 5180
1⤵
PID:6212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Alkijdci.exe

Filesize
223KB

MD5
0da3c1739002d7bfd7c8c059cafbe14b

SHA1
7120cf2b262606ea144884ed9e35d755e92b5bfc

SHA256
047079e37c3412c2751cbdbac7070d4a367a10de7d0e557da961a1d50d28a442

SHA512
be9f2e20c2f7fd2508cbca2f94fb21c28a272e49a923fd51676111abd21c86cd8f8b53cdf6cdbf0b103272ee05b5127184c2b8c738852a64c09a3d10a7cb0e28

Download Submit
C:\Windows\SysWOW64\Aomifecf.exe

Filesize
223KB

MD5
4b57e5d58bf0cfb939155334fe47f202

SHA1
f44761d44e9b3ea579d46889072efe9c2779cbd9

SHA256
68170e2d816c08be25dfe46419e257dff62f5357c1c82753aaa80ecb3610cb0f

SHA512
6310d01dc7bd1bd16a509ed53193c14d1d60f7cdbea1038edbcbfd2c8e2b0671497ea4c703e4f7984c0ba91cb704711e185a54d110727f19cc795647f2c0fe95

Download Submit
C:\Windows\SysWOW64\Ccdnjp32.exe

Filesize
223KB

MD5
2819f81df088a8282c5bff430380aca1

SHA1
da9279c31dbafa5926eec1a7b102fd4f4c15a336

SHA256
2c80a13cfe71d6a7acc2349a02b9221c91531b00a44334ade9d58992d6b73a18

SHA512
f2071170ca779dc859a87a2d25c88d6ebd5d2b377b22d70157fd1dca16ae8ad3181cbde8b47f07c9b6d3877693daab7814da62cf17f4045feeecd9f74e961d49

Download Submit
C:\Windows\SysWOW64\Dflmlj32.exe

Filesize
223KB

MD5
6ece673e8abb4f4be958231f249df5d0

SHA1
3cefe34494b5adb391e2c7b53e6e4439e30bb40b

SHA256
1ccc9fec8a5978748e8cb7c000d55733ad2bf9b8c73146151103d26cdd70fa14

SHA512
30b259a47e77054db4f988051b52b2a4990334790741f0b9955adac2764fce2a4ac683f218a2b3e2488dca7a743f6bdddfe83755613a4a060bd354eeaea3c1fa

Download Submit
C:\Windows\SysWOW64\Fpggamqc.exe

Filesize
223KB

MD5
f4346f243b5690adff93966cea8f4dbe

SHA1
3c27583c78fa10c2e93128e801a5cb921aeb3b67

SHA256
63e9a1fb6f6b0d89c4bbff7545f577614cb23f18d737e5dc44755c402d8e8770

SHA512
fe7008c8ade98af0ab2cf79460055457d67a4d0edb43205dc46cfe11c95511f14270ce43dd14222366f1ec299daa12255e47c9c19a05e1560849cf53dff44e05

Download Submit
C:\Windows\SysWOW64\Ggkiol32.exe

Filesize
223KB

MD5
b6d11a1b7a81c1f1c76554127053097b

SHA1
f33a03e3a378f6e876a2cbd598878974f0cefa8b

SHA256
c7de7b39764af2bc5cb0f56a12cb86a9e62f94a05baf7d5c6bcebe212a52daaf

SHA512
2e7747a55963f14cac702e019ebd97d50f9dc930465f0d012899d80db888843be942768ffc78b5f8388e0a326d05766e8a936dd899422a06d2a92be63034a27e

Download Submit
C:\Windows\SysWOW64\Hpmpnp32.exe

Filesize
223KB

MD5
7a2244a7f880f830f5de90854feff3d2

SHA1
e5957c6168514ce47d0a0aaa0688ff033a351b17

SHA256
cad4cedebdfb1380052baefb35744691c1cd0b00153f285d5d2c02b91f713787

SHA512
1d3e940e3b76e5622fcfd78f6f55781867138a54e86734cdd1bc0fbac00687e75deec7e31916c3da43c6ca64c88396fe2b1fb999418e679379904e94b079cee7

Download Submit
C:\Windows\SysWOW64\Ijegcm32.exe

Filesize
223KB

MD5
411ff07197eda4dd267496d84a771335

SHA1
35893c91685b89acad61c562bdacf31dcddb31a1

SHA256
c265fd9e50d58a5efbf97eb89835a44016d3da310167a6945c8ad8b8805a7b89

SHA512
5d8e34bdbf1684e51e46b0af818b05aba0341d3674555d277425b46d64cdf6760c369172d1047486b989aea00b17527673eba6e3ba7a6667f1c75d92379f2535

Download Submit
C:\Windows\SysWOW64\Jblijebc.exe

Filesize
223KB

MD5
afe69621f492e99fd1daf83fe9463e8d

SHA1
837896af7450945e71ff4360334a13223157777a

SHA256
6f7a20c7281778cb2352b8fe0199edca88d64c749219af2fb245020ffb0d33d5

SHA512
629c267b6e24c607afa0c9994e1e145fcdcfecf4c17b4030b96db06a5b00995135d5f5156b9ee398cfad54b815bd64c9def76115bdf8ab800c0a475779c62d11

Download Submit
C:\Windows\SysWOW64\Jehhaaci.exe

Filesize
223KB

MD5
27b32b6daf319ee09a6d1fe9ec091d60

SHA1
b8b1a886b8f7e69352d01c8ffa6c5e7b38e7ab40

SHA256
a6bf05c6a80f07a8953493936d717399f30f1831d8beed7202fa7ef3907d3ca4

SHA512
c685fe81fccf76aad6027226bf1cb64bd912f4ed2d657938a557a9bb3da909e056d63030687c5182e7e2c8db7f6ae4035e23ad5401eef545d9365d510b1b0b5d

Download Submit
C:\Windows\SysWOW64\Jkodhk32.exe

Filesize
223KB

MD5
f14b9956b849748b9c8be4c6c34f5655

SHA1
331c98df5c6ea2bae54a33a0061aea9b7bad2fdd

SHA256
36c7f1912c611879978010a20beef7437079ebdaa5c59b70587558ad05b46443

SHA512
c4df4ffc09446eba9fed48eaf6b3e04ef4c2558edef4bf8c2f309db36978d5a2334a74eb8413cde57e913a831d7acab974bdc2bc6271989ef4c6b4b6d2e7aec6

Download Submit
C:\Windows\SysWOW64\Jnkcogno.exe

Filesize
223KB

MD5
a4b689492c933b8956a9ab605f563352

SHA1
43ee77df786ddbb0db7ef54e13d3560c38eb2125

SHA256
34a2ace23b8f6de37342faf4cf01739af4878165c0e07d7d909bcaac09319257

SHA512
679a5a20f2cfafe90015ec3c7038b6920de2ddf8eb3484303f544c093d34c85c061fa7d0f6fddcab320a29db7c5e3353e94de0d8aa1727fde11051682b2a6acf

Download Submit
C:\Windows\SysWOW64\Kbpbed32.exe

Filesize
223KB

MD5
7c979a8fbff122ac1d1e876a5266e18e

SHA1
831bb56312f2a9a239a5adada0fde523ec6fad00

SHA256
05dfb342a69ec0380f33213e9a7aa730faa40fba98abff6a0a60f93392d38de7

SHA512
d5ec3590ecb8406491810b8983501a1dd5295bda88ce90ec161a5e31e743aca8b31e4a05310c47c18363072adcd89dad392b22c02ce2438f8592385a5d0b7aba

Download Submit
C:\Windows\SysWOW64\Keakgpko.exe

Filesize
223KB

MD5
0438aaecd4f89b2e3d0bc92752525c64

SHA1
f007379c70ce40db4761b8b3964481a7f6788895

SHA256
99dc14b170fb918cec8e8f101d6840106a6b6855007a9a751be72eff57a0c043

SHA512
03ecc88cf7df733f4ca0660e5c098738d9f36506c65cf2a32959a4ae2f96736b54e668a7f6a02ec3c9ec9d2163271630d6e87cd0752e5487aeed21f072ad8602

Download Submit
C:\Windows\SysWOW64\Kechmoil.exe

Filesize
223KB

MD5
610d11acde50bce33ba9c158e7db6c62

SHA1
82648b563628a873d37288069b45b5799b53b660

SHA256
dff0171feeae73be6d1c1125ac03cb73d81545e61007d0ff3975918b5f477668

SHA512
5a61ae8d7a22d811631b5f606a57184edf8686582848ed0d40562832783b73d853e3f912af8e984203c664c8962c1fbf1530ec367bfa3dc19d306ea1ac87381c

Download Submit
C:\Windows\SysWOW64\Kgknhl32.exe

Filesize
223KB

MD5
ca855969a6bfaf43f6f5d2ad89cf0a9d

SHA1
45b7fbf8a3dd52a9cc52659ab4639843a340a898

SHA256
1c26bd65ca3f644198ad1d79f0a0caefbb6b43082bf65296a6a7060b91b6fff6

SHA512
3e4a4a995b59206034c2347f28736dc404e13118c33880b67221c2517e0514c24a0a6f37d7e94b89f256d273be869f38b082452db60def686349099406d5638a

Download Submit
C:\Windows\SysWOW64\Klifnj32.exe

Filesize
223KB

MD5
b795eb3864b5eddda6abf3416ce2c316

SHA1
9227b3c7b27d0f7f0fc51d67e501108fd34ca2cb

SHA256
32c366e23df002f4c0156d15165a79856befe8f0d7e907dba93f2ca04f2a21bd

SHA512
75a08a17ad4585293328fc64eb7132ead38c26cff50540d652576241c3abc550ceb387f7755af0649fec95502f5b11ebe132235197c5d88cf48f6c863ff59ca2

Download Submit
C:\Windows\SysWOW64\Knlleepl.exe

Filesize
223KB

MD5
fd03283e7bb5e54c6b0a0cb815730c46

SHA1
712322d43c61a64548f796722b96972c36ee8a7d

SHA256
9e7ddd465649e5756f1f0b0981a6568ed6cac419a83a11a77445af9231fc5348

SHA512
89c7cdb260d5b4c430b7482588a7a138855c2e781d6c050be2ea6c042138e01231b6e7a1e51cacc954d014a7d92d6323f2ce29555110a43a9939dcc0ddc7b381

Download Submit
C:\Windows\SysWOW64\Kppici32.exe

Filesize
223KB

MD5
af27bd24fa043bb9c0d7afd5e239fc39

SHA1
5edc9e635c10ede457aff95a23211fb4a0ca0999

SHA256
d3fb5c1d398d75edf44431b722828a9341256c5f3dd54c6f93d3ca6f49098e46

SHA512
74dadaf892beb34c37b5b6efaae0181bea9ab738f2a8432d1bafb39887256a625d436d0227168201435c767981a1ead6e07ad79efe65c35114d6d844548a0b00

Download Submit
C:\Windows\SysWOW64\Lbqklb32.exe

Filesize
223KB

MD5
07f5107302fb7a71c3f500b9d8b48fd5

SHA1
9175194e2f7f5afaf93b7899166473b83b97a754

SHA256
4061b44be6e1a25c68d552b16181486a58dd6b3fd317bc02797b345aae68cd80

SHA512
db30940921aa5ed597fe1f4a01b4776dec512e80d0b99f1c3c289474d8de22e29a73c275e68d86486af3e02b84b952c28f5200cdf31b03bac873b847d1b543a0

Download Submit
C:\Windows\SysWOW64\Ldipha32.exe

Filesize
223KB

MD5
ce852ba3e23c8e922a99e3be20b2f31d

SHA1
302d2dc5a02077ca9aea16206c26e96690bd3f5b

SHA256
19495297888d737f00ac2519168bccf9d32190e3de0f72613da8b6b5acff994f

SHA512
62803a0319c13e4407242f0b8462fd3ab04a971c35580fcb490a36228b11a010f7c03b5ee0729457352f84fbbab1761a8ce56441197cb811dc610c754d17c9d7

Download Submit
C:\Windows\SysWOW64\Lejnmncd.exe

Filesize
223KB

MD5
2c85178108d4109a386e69d7c45b64c0

SHA1
80b750406657ff58706d4663ae3f725a65a7844c

SHA256
cff5f3357fa87be7b0fc5ed38795dd11ebd4a1aba21091cb2015072b17acdd13

SHA512
a39d419346856b913e7885cf7802c142db575656f118b1befc312e6809220678f00c215f573c2afc8f22261b136d2767c1239c52f2b38600cf7822ef35d362f1

Download Submit
C:\Windows\SysWOW64\Lfealaol.exe

Filesize
223KB

MD5
37bafc1f2aec741d6cfd98522e2ca85a

SHA1
a1e8602cbe5e877203feea6ce55050f4cdec31e3

SHA256
4cea6740bb006eb99d9dc08bfa2793f9e20e306e8b220ab7639972be45489e0d

SHA512
b125a528b757473ac10ea736f7b68a87248a3285980e9d5cc90d6f040376ee167e1b30a25c1fb771377458783b9a424571bba7aa438ae5a44a7062152829824d

Download Submit
C:\Windows\SysWOW64\Lfjjga32.exe

Filesize
223KB

MD5
fa2db64827957b43209cf536bdd2014c

SHA1
46011c714522a310d68594a9e82ca293847ea617

SHA256
2390f473625852eed54880d2b5e662260d206e75994925b1fde5ae5136d07b87

SHA512
391c80befe5c2c57b6abced848f288471146a1319567d1420e33c3a809b952d6f124660654ca1fd2b4e6432885a2e714a82cab3d88a4f0659f1a685619b839f5

Download Submit
C:\Windows\SysWOW64\Likcilhh.exe

Filesize
223KB

MD5
bccad15f071d9df0ffde1b55d33f073b

SHA1
6b828e5cabdf9fc57d2b3e08df37d362d545b8cb

SHA256
a0a5a85ad684b1871a1d2878cc14222b968a0f5430a4fe43c61340e62a6c31d6

SHA512
c502a30bd84a3f408c4063b987fa4116d208a755931ab6ad28793f60245b23e1905e9e2ed412bda47f70dd841c94226751e03f12294cb063f43c6b247cdd8ab4

Download Submit
C:\Windows\SysWOW64\Mbhamajc.exe

Filesize
223KB

MD5
2a0372cb110de7c8dba5676a09a9fc35

SHA1
127576dc88efdbfe49bcfda69594abb99cb412ef

SHA256
16565def9df1067feba8e756bd435742347196cc63a3b61b927ffef96002d2ef

SHA512
efc0ad14e0f75d0a686a4332eba22ab9eb1ce6687dc2421ae034ee98afe20fcf941ca6d7f89b7ea027eb2344c4c55314def44342870e88b32f9c855feb27b1d8

Download Submit
C:\Windows\SysWOW64\Mehjol32.exe

Filesize
223KB

MD5
ac971674fd18719748c184200aaacb4b

SHA1
a26c6da806eb62edfa40eb18c7b291923a1256a2

SHA256
73847614df3f4bb008b2184158670454171b46f28c521de4607e6b2c28dc0b74

SHA512
b2f1b316b638f434dd5722c664db5b5eeb3cbeb43909de5f4b2fbc8b21389fd996d6913746187c7f286ed0de7e46f2e091343fe9038ec8016d773e34bde7bf9d

Download Submit
C:\Windows\SysWOW64\Mhdjehhj.exe

Filesize
223KB

MD5
f007f501956759d26f27519b54c34a1a

SHA1
c69ae2abe341582dee836327bd7a87dfcc9aa249

SHA256
035084ef33d425477d8f117309e62cc6b56f288e01cd006bebcfde425b5cea8b

SHA512
c595b1983946667ebc8b3c0a65650ae4fb6b73060fee5ee6f23a9ee6b71d369a0cfc2e5f7faff6c2e3a9ff43cb253e3dbdbcd9029c17d1b2c9315edfc6d5cafc

Download Submit
C:\Windows\SysWOW64\Mleoafmn.exe

Filesize
223KB

MD5
864e346e07e696a6f5b4791b27e061d0

SHA1
34a8c0aa64f1387a723140081ff682cb67cf5d64

SHA256
dc0a0f69623c4186e53f47af23a7cca8ab3ac50b6a30b3f23c708f15a265f18c

SHA512
e04f2fa1e7ae7509addc0b71fad8df40aa78cc943862b1cce42d87dacf562df6fd9ae438944b8303e39575dc2ee01a3c6cf5800c3a936d05d692c6f96dce25f5

Download Submit
C:\Windows\SysWOW64\Mlnipg32.exe

Filesize
223KB

MD5
1630503adce239266b7fb6c7f8fd048a

SHA1
00402bae1050d513d3b6d39d904e12ac2015fa6c

SHA256
2c6139384414b5830bf5bdc003a16231ade6f258fa1044a0d2763d79d040c692

SHA512
f4e3c47a27553c847fee366b72a6e4cbbc372ac3127d98ae20f0081e6cc6bd5aab73b9c8549f8699936b7bcc5900dbb46032a746716804bc95426c949c17ed10

Download Submit
C:\Windows\SysWOW64\Moaogand.exe

Filesize
223KB

MD5
6f83baf082d19da36bf2070d02ebbea2

SHA1
93140f2a450a3c10f1f4f890c7c8345c20fa2f6a

SHA256
dcb6349ab8bd976ebf6a9932c92a5beef74fea415e61a9f3c0f8964b559fa6a6

SHA512
fab780850a862f1f5f1c9e9bb9a1026c2c00158f71c0bab1dd55e5f123fcbbff9762629fd61fe60d1e3b217bc9a564937006aab4d9ef6fbef246a723b63ee5dc

Download Submit
C:\Windows\SysWOW64\Mojhgbdl.exe

Filesize
223KB

MD5
0c9b8c8a74c39e2252f3b3d298b3fcec

SHA1
45427ff2f37f5f683e9e4aa2b7548a6f43b06b04

SHA256
5fadc48cbfde3c6336990e4297709bc06be18e9fdccb251d0b07b1ad9084e270

SHA512
7b1561a29629b21d446ea45004ca31dd04f7ffca583edac348c9bb19cc31131e563927da55198c9e9623b11adff35ddb2d7c21f85648b76f5f4c3419ebbcb455

Download Submit
C:\Windows\SysWOW64\Nccokk32.exe

Filesize
223KB

MD5
bd6b727ae686206966dd8f2d03c205cc

SHA1
daa0e276bfc0d62db74b37ee3091062db2fe7458

SHA256
30383da116bf5351808ae46e2d8920821a68038e3a2c741290156e8a18667165

SHA512
9ff9f5524e8b4a1dbc75500c6fa30f9f71fe37cb445c57a01fe76423ab32f88ee99dba2c4662447a69857c0608d18f1b4d6c12df2f7d87f03abd821abf635933

Download Submit
C:\Windows\SysWOW64\Ncjginjn.exe

Filesize
223KB

MD5
0d1e27fa983656bf5f4d2b9bbfa3dd94

SHA1
24648e8088778ab87b7760deb904a1f87687c1dc

SHA256
2c5a81defcc8f0cbfe650c39f664f03d4ed0d03f8d566d093ee49c5ed83c9a99

SHA512
fb32ee82c4b0619ab1916e85fac1915e1fab8b3656a008a6ab649a13626eb028b4bec42329ea93982558377f6dffac893a32d8504286dca454a8d9f2e49a9620

Download Submit
C:\Windows\SysWOW64\Nebmekoi.exe

Filesize
223KB

MD5
be62f79a92643bfc53c255e1861b0bd2

SHA1
2e7e501d15fbe0d312ad78cae5dce38a9042bab5

SHA256
ea9cab9f5c84b1e92639bf05595f2bc243e8e02e22d0777b765ba3195c4a9478

SHA512
8179d5d46fdc6442bb369717afae0a6fcb4c8c020dfc7898d866bf1c980dbfaccf50c1ec73f4e807ef7ba6b2f5f2606ac987c7742b078a36651cd923ec3824fa

Download Submit
C:\Windows\SysWOW64\Neffpj32.exe

Filesize
223KB

MD5
a20f0f68612a3c86c89a9d443568cc93

SHA1
b4b1484a55be16d4cafdc890b2ebfa2f91c2768c

SHA256
a9c9eb1a8d07a9d14dde7cbbcac3e0924e28739b75074ddfed1a7b21bf40b7d2

SHA512
1c6ee9a5c47b4b9947fe06986ef3e66e8d3298117caef0d7f3645d0140b91e7094de756790f48636649fa468e5386dd5e09b9db4ef57eaf6068200962745d855

Download Submit
C:\Windows\SysWOW64\Nemcjk32.exe

Filesize
223KB

MD5
3b8d1b42ef17634429912cde807ade5a

SHA1
a03f1ee07e3976ec29e427a88f7adad8c19ef346

SHA256
2e56477bed1c38dc95ec5bfaa080cd9c8924ce4ef825ff80d1b51505aa4b3925

SHA512
18f4121f1cfd50b163e6c4dc90a8cf7b96dde235d41245e062310515b4c64a2973c3789988f6f8c8642d1879cba461c407ef91e26c00df3cb07226a62772607a

Download Submit
C:\Windows\SysWOW64\Neoieenp.exe

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\SysWOW64\Neppokal.exe

Filesize
223KB

MD5
2e1d743961e746102f229f28c06bd3ff

SHA1
471acb5a3a42465dc08ab1aadd55bedbde4ded4c

SHA256
bfc5bc27024119ef15316ea9a9ae9188a2e347d91d1f9ec437c4b5fd48104604

SHA512
e2c00cbfa28241190924295860055acfd69269b8907952014b4f39936a4ff648cc3294418d249a9a2115a0a7fcb17d722ac3582c5d8c453fed91d321b09154ba

Download Submit
C:\Windows\SysWOW64\Ngaionfl.exe

Filesize
223KB

MD5
224ec21d0f1d005fb2e576ae9365f1f0

SHA1
5aee8b47b8098bc75cd85b03e40243642c7b6ad6

SHA256
c335f6985656d527adff6b2e4bcb1223bc167f92c9e23e72115fb3e73a769686

SHA512
e69be00a2080108753b4a2cdceb792a8f42ec83dea88426b23b463a69efd9c236da6359c1e0eea6db9ea2a1ac45abccf605110a520a20e1f89cfad097c9bcea3

Download Submit
C:\Windows\SysWOW64\Nhlpfgbb.exe

Filesize
223KB

MD5
ebb51b9d5162dbca2d9fc6f5668f1754

SHA1
bc4459b171074862daa106d82f5acbda50bf66e5

SHA256
4b2d7f07247c9d28a6980a1ab26b9e39aa380674134eae0541da660b88bb06e5

SHA512
160cf408f2c26716d9b9034935b5ad42708d0af5e232bba3147589ba15b83fb7dee54a757d11314cb14756f0daba432277f464808c1bcc27761b6ab5906cd539

Download Submit
C:\Windows\SysWOW64\Nlleaeff.exe

Filesize
223KB

MD5
e782f987d8855996941334e61b582543

SHA1
f511c759620b5889e8a5edbb88a71eeec6823f43

SHA256
621510378c5a8f8fda541efd76b733ef733261c81397ef34ca68c6e008e80374

SHA512
24fdf8e68d20d3d2f08a78c1864d27cb90ec40e83ba8a121516959be1cfd1d3058d6669c8ee160aba4d7233b676396f61d4b8bb5b64a5e401b1b1514f31adc1f

Download Submit
C:\Windows\SysWOW64\Npjnhc32.exe

Filesize
223KB

MD5
207c2a1268caef24c271be74b39d2e10

SHA1
2e0f154f4b0a34b6b32b7c2e7707b7bab4b8e0f0

SHA256
07359997fe5b0c1f5f2b0c47cd43af791fc1ccae9b812ffdf31785b63cb93300

SHA512
d82f7688a3e6cbefebdbfad4521b4f895c18cda41d079c0aed959146eaa75ff9526e27c3c180f66a251fc993a3dd534bdb77bb53a7ca3df37b45d2f8f4c30f89

Download Submit
C:\Windows\SysWOW64\Objpoh32.exe

Filesize
223KB

MD5
406b3b0d54ffedea60b363ddbbb7b62f

SHA1
3a5ba2dd5ba282ee9d85c7a80fe598617ca193de

SHA256
6c4bb96029d101286b8f4d82b67e69bed6336eb1d33ab5522fb7370d9f835019

SHA512
42e1572430bd19113494f4854baf752779d7b3a10f34338fe64e7ac67bf6b52494e654046a682e5e76685264d72a62299570c9254ed808b15f05d7411e65521b

Download Submit
C:\Windows\SysWOW64\Ojgjndno.exe

Filesize
223KB

MD5
379843fe5477e7184ac235d99e7cfd4b

SHA1
f8e53032ff7b55c5eb5f1bd2a1b081fb8a161885

SHA256
594623b8441d29759131590f19fcc8dacf0eb45fe511e9b746088cdc1854fda6

SHA512
cdde4922be0faddf15be672d5ce6a989f8727f061d6f8f5c82af73e6e7d71d56ec348af55417f49a8865da9a61b8c5dad1fe26e19a719511c83ccb2b9caa83ad

Download Submit
C:\Windows\SysWOW64\Pedlgbkh.exe

Filesize
223KB

MD5
bff82960193b3deed29754042abcd754

SHA1
4a55db370ecaa027b0acf5a26f6ac1f6457a8126

SHA256
57b8035f6ec2f7f5d1113b884faa9bb8fec046c50d0bfd55cc41fa6cf6d31349

SHA512
073b611a29043d4eabea507cec634663357894bda54efca3a51a4cdaef217d31ec291437d41883a299fb1c18b89baae4753cb71d88c7f69e77cbe7ecef2eb203

Download Submit
memory/8-209-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/264-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/264-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/264-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/316-82-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/412-122-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/536-379-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/644-162-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/660-318-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/696-373-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/776-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/856-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/860-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/896-354-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/964-367-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1396-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1748-427-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1756-330-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1952-137-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2232-154-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2264-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2344-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2364-247-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2536-280-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2796-315-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2840-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2876-391-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2904-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2968-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3044-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3116-397-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3176-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3388-237-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3408-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3420-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3452-264-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3484-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3552-415-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3624-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3772-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4028-226-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4040-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4048-389-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4092-355-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4272-324-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4344-150-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4372-294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4440-218-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4512-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4560-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4572-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4644-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4668-194-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4680-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4688-421-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4760-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4764-361-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4808-403-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4836-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4964-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4996-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5048-186-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5076-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5084-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads