ca3510f9563805739d66ebbbf4eacbe30a9d4dcfc6fca05bfe4259cb0e60d4f0

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca3510f9563805739d66ebbbf4eacbe30a9d4dcfc6fca05bfe4259cb0e60d4f0.exe
Size

192KB
MD5

d7322d8347d6faed61649f87428b5221
SHA1

511697e504017584794ae2b4d4357043533839fd
SHA256

ca3510f9563805739d66ebbbf4eacbe30a9d4dcfc6fca05bfe4259cb0e60d4f0
SHA512

2640eaddb7e8c001c5dee256c62bafc132b6265b514957411b2b2073bb8a87d4e66d2cbdc28f796cf2ed4ff5be71fcac8c308549bc564523b92b17ed115ae5ef
SSDEEP

3072:Tw7P4AXmD48kGmNbM2DUOLl+n39bSR0sgNa6KL5qrxdbMqlWGRdA6sQO56TQYNHI:Ez4AXmD48nmNbMuUOLl+39bSR0xZKL2g

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoobdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibobdqid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpejlmcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfheof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgepom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jeqbpb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nedjjj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlmfeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iliinc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmkigh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hehkajig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnpfop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkfcndce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpnkdq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cocacl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpkibf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Malgcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmpqfq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkconn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqndhcdc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njfkmphe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omgmeigd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppgegd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnmopk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Poliea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kngkqbgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnojho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaldccip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdqejn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibmeoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blhpqhlh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hginecde.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpaekqhh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chdialdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eajeon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emehdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahgjejhd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmfhkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjlhgaqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlieda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdfjld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkkjmlan.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffpicn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmndpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emoadlfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgphpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gklnjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdilnojp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Achegd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejlbhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjgeedch.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npiiffqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmpkadnm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcjmel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dflfac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffceip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckeimm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gppcmeem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amqhbe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akdilipp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amfjeobf.exe

Executes dropped EXE 64 IoCs

pid	Process
4664	Jcefno32.exe
2344	Jmmjgejj.exe
2512	Jbjcolha.exe
1556	Jehokgge.exe
1760	Jpnchp32.exe
3828	Jifhaenk.exe
1828	Kbaipkbi.exe
4924	Kdqejn32.exe
2240	Kebbafoj.exe
3600	Kpgfooop.exe
4980	Kfankifm.exe
4628	Klngdpdd.exe
2108	Kfckahdj.exe
5028	Kdgljmcd.exe
2416	Lmppcbjd.exe
1704	Ldjhpl32.exe
4520	Lfhdlh32.exe
4496	Liimncmf.exe
1520	Lepncd32.exe
3412	Lljfpnjg.exe
3956	Mbfkbhpa.exe
3972	Mlampmdo.exe
696	Mckemg32.exe
3992	Mpoefk32.exe
2260	Melnob32.exe
1984	Menjdbgj.exe
3276	Npcoakfp.exe
1292	Nngokoej.exe
4852	Nphhmj32.exe
3116	Neeqea32.exe
1188	Ncianepl.exe
4828	Npmagine.exe
4916	Olfobjbg.exe
3372	Ocbddc32.exe
4412	Ofqpqo32.exe
4472	Oqfdnhfk.exe
1072	Ogpmjb32.exe
3404	Ocgmpccl.exe
4452	Bcoenmao.exe
1908	Cfmajipb.exe
1124	Cmgjgcgo.exe
1992	Cnffqf32.exe
3916	Chokikeb.exe
1384	Cagobalc.exe
4028	Chagok32.exe
1560	Cjpckf32.exe
5124	Cdhhdlid.exe
5164	Cnnlaehj.exe
5204	Dhfajjoj.exe
5244	Dopigd32.exe
5284	Ddmaok32.exe
5328	Dobfld32.exe
5368	Daqbip32.exe
5408	Dhkjej32.exe
5452	Daconoae.exe
5492	Dogogcpo.exe
5564	Dhocqigp.exe
5604	Dahhio32.exe
5644	Egdqae32.exe
5684	Eajeon32.exe
5724	Eonehbjg.exe
5764	Eehnem32.exe
5804	Egijmegb.exe
5844	Eejjjl32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ojhnmh32.dll	Kebbafoj.exe
File created	C:\Windows\SysWOW64\Lblldc32.dll	Imiehfao.exe
File created	C:\Windows\SysWOW64\Ffpicn32.exe	Ehjlaaig.exe
File opened for modification	C:\Windows\SysWOW64\Oldjcg32.exe	Ohhnbhok.exe
File created	C:\Windows\SysWOW64\Afkicf32.dll	Mibijk32.exe
File created	C:\Windows\SysWOW64\Kmmmic32.dll	Olgemcli.exe
File created	C:\Windows\SysWOW64\Jkdnhmdp.dll	Oofaiokl.exe
File created	C:\Windows\SysWOW64\Hoobdp32.exe	Hefnkkkj.exe
File opened for modification	C:\Windows\SysWOW64\Jbjcolha.exe	Jmmjgejj.exe
File created	C:\Windows\SysWOW64\Bdabnm32.dll	Oloahhki.exe
File created	C:\Windows\SysWOW64\Gejopl32.exe	Gnqfcbnj.exe
File created	C:\Windows\SysWOW64\Mmnbeadp.dll	Ocgmpccl.exe
File created	C:\Windows\SysWOW64\Jkiocibf.dll	Lmpkadnm.exe
File opened for modification	C:\Windows\SysWOW64\Eofgpikj.exe	Eiloco32.exe
File created	C:\Windows\SysWOW64\Caghhk32.exe	Cpglnhad.exe
File created	C:\Windows\SysWOW64\Dbmiag32.dll	Oldamm32.exe
File created	C:\Windows\SysWOW64\Npiiffqe.exe	Ngndaccj.exe
File created	C:\Windows\SysWOW64\Hlhefcoo.dll	Ppgegd32.exe
File created	C:\Windows\SysWOW64\Aopemh32.exe	Akdilipp.exe
File created	C:\Windows\SysWOW64\Jehokgge.exe	Jbjcolha.exe
File opened for modification	C:\Windows\SysWOW64\Nlihle32.exe	Niklpj32.exe
File created	C:\Windows\SysWOW64\Idqionfg.dll	Bqdblmhl.exe
File created	C:\Windows\SysWOW64\Bcoenmao.exe	Ocgmpccl.exe
File opened for modification	C:\Windows\SysWOW64\Bmhocd32.exe	Bobabg32.exe
File created	C:\Windows\SysWOW64\Hmcldf32.dll	Djjebh32.exe
File created	C:\Windows\SysWOW64\Aafemk32.exe	Aogiap32.exe
File created	C:\Windows\SysWOW64\Bjdlfi32.dll	Fpimlfke.exe
File created	C:\Windows\SysWOW64\Eemgplno.exe	Eejjjl32.exe
File created	C:\Windows\SysWOW64\Jjdcihik.dll	Kppici32.exe
File opened for modification	C:\Windows\SysWOW64\Falcae32.exe	Fggocmhf.exe
File created	C:\Windows\SysWOW64\Dfoplpla.exe	Ddadpdmn.exe
File opened for modification	C:\Windows\SysWOW64\Dblgpl32.exe	Dpnkdq32.exe
File opened for modification	C:\Windows\SysWOW64\Jnlbojee.exe	Jddnfd32.exe
File created	C:\Windows\SysWOW64\Nphhmj32.exe	Nngokoej.exe
File opened for modification	C:\Windows\SysWOW64\Gdncmghi.exe	Fgjccb32.exe
File opened for modification	C:\Windows\SysWOW64\Ocffempp.exe	Ollnhb32.exe
File created	C:\Windows\SysWOW64\Ncnaabfm.dll	Jmmjgejj.exe
File opened for modification	C:\Windows\SysWOW64\Keimof32.exe	Kgflcifg.exe
File created	C:\Windows\SysWOW64\Menjdbgj.exe	Melnob32.exe
File created	C:\Windows\SysWOW64\Gcbpne32.dll	Mnlnbl32.exe
File created	C:\Windows\SysWOW64\Mlelal32.dll	Ilnbicff.exe
File opened for modification	C:\Windows\SysWOW64\Icfekc32.exe	Iphioh32.exe
File opened for modification	C:\Windows\SysWOW64\Nbnpcj32.exe	Mhilfa32.exe
File created	C:\Windows\SysWOW64\Flngfn32.exe	Fmikeaap.exe
File created	C:\Windows\SysWOW64\Gkmdecbg.exe	Gmiclo32.exe
File created	C:\Windows\SysWOW64\Glienb32.dll	Elbhjp32.exe
File created	C:\Windows\SysWOW64\Pffgom32.exe	Pplobcpp.exe
File opened for modification	C:\Windows\SysWOW64\Mnhdgpii.exe	Mjlhgaqp.exe
File opened for modification	C:\Windows\SysWOW64\Mlpeff32.exe	Mibijk32.exe
File created	C:\Windows\SysWOW64\Dooaoj32.exe	Cohkokgj.exe
File opened for modification	C:\Windows\SysWOW64\Ebdcld32.exe	Eofgpikj.exe
File created	C:\Windows\SysWOW64\Gikgni32.dll	Bobabg32.exe
File created	C:\Windows\SysWOW64\Kkfcndce.exe	Kelkaj32.exe
File created	C:\Windows\SysWOW64\Malhfo32.dll	Qhlkilba.exe
File created	C:\Windows\SysWOW64\Eklikcef.dll	Gpbpbecj.exe
File created	C:\Windows\SysWOW64\Dopigd32.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Egijmegb.exe	Eehnem32.exe
File created	C:\Windows\SysWOW64\Jboqnpjm.dll	Mplafeil.exe
File created	C:\Windows\SysWOW64\Ofcmimpk.dll	Eiieicml.exe
File opened for modification	C:\Windows\SysWOW64\Kjblje32.exe	Jpenfp32.exe
File created	C:\Windows\SysWOW64\Ndikch32.dll	Bpfkpp32.exe
File opened for modification	C:\Windows\SysWOW64\Ollnhb32.exe	Oepifi32.exe
File created	C:\Windows\SysWOW64\Amodep32.exe	Acgolj32.exe
File opened for modification	C:\Windows\SysWOW64\Ehfcfb32.exe	Ejbbmnnb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6840	12192	WerFault.exe	720

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qljcoj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhcjqinf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hefnkkkj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hehkajig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aopmfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjmoag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eppjfgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbpbca32.dll"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfaajnfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldpnmg32.dll"	Mqkiok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nodkhj32.dll"	Eajeon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahenokjf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dflmlj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pefabkej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgmchiim.dll"	Gnqfcbnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hhbkinel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adnipccc.dll"	Gmdjapgb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcifkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfjhbihm.dll"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggqida32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkconn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlfnaicd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cbdjeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgflcifg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgiiiidd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kebbafoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gklnjj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efhlhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lomqcjie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbghfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mhilfa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmbiamhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogpmjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdfjld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Apaadpng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apddkmko.dll"	Lgffic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Moqkim32.dll"	Hjjnae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ihnkel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmokmkpo.dll"	Kgipcogp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fimhjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igcnla32.dll"	Hekgfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aepjgm32.dll"	Nfcabp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpeohh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpoefk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkeekk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgnddp32.dll"	Chfegk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcefno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmafajfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dafppp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fccfqqkf.dll"	Bbdhiojo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ppolhcnm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chnbbqpn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kqnbkl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lklbdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eoefilfc.dll"	Agiamhdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhjckcgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaocia32.dll"	Idhnkf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nabfjpak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljnlecmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfckahdj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 4664	1284	ca3510f9563805739d66ebbbf4eacbe30a9d4dcfc6fca05bfe4259cb0e60d4f0.exe	94
PID 1284 wrote to memory of 4664	1284	ca3510f9563805739d66ebbbf4eacbe30a9d4dcfc6fca05bfe4259cb0e60d4f0.exe	94
PID 1284 wrote to memory of 4664	1284	ca3510f9563805739d66ebbbf4eacbe30a9d4dcfc6fca05bfe4259cb0e60d4f0.exe	94
PID 4664 wrote to memory of 2344	4664	Jcefno32.exe	95
PID 4664 wrote to memory of 2344	4664	Jcefno32.exe	95
PID 4664 wrote to memory of 2344	4664	Jcefno32.exe	95
PID 2344 wrote to memory of 2512	2344	Jmmjgejj.exe	96
PID 2344 wrote to memory of 2512	2344	Jmmjgejj.exe	96
PID 2344 wrote to memory of 2512	2344	Jmmjgejj.exe	96
PID 2512 wrote to memory of 1556	2512	Jbjcolha.exe	97
PID 2512 wrote to memory of 1556	2512	Jbjcolha.exe	97
PID 2512 wrote to memory of 1556	2512	Jbjcolha.exe	97
PID 1556 wrote to memory of 1760	1556	Jehokgge.exe	98
PID 1556 wrote to memory of 1760	1556	Jehokgge.exe	98
PID 1556 wrote to memory of 1760	1556	Jehokgge.exe	98
PID 1760 wrote to memory of 3828	1760	Jpnchp32.exe	99
PID 1760 wrote to memory of 3828	1760	Jpnchp32.exe	99
PID 1760 wrote to memory of 3828	1760	Jpnchp32.exe	99
PID 3828 wrote to memory of 1828	3828	Jifhaenk.exe	101
PID 3828 wrote to memory of 1828	3828	Jifhaenk.exe	101
PID 3828 wrote to memory of 1828	3828	Jifhaenk.exe	101
PID 1828 wrote to memory of 4924	1828	Kbaipkbi.exe	102
PID 1828 wrote to memory of 4924	1828	Kbaipkbi.exe	102
PID 1828 wrote to memory of 4924	1828	Kbaipkbi.exe	102
PID 4924 wrote to memory of 2240	4924	Kdqejn32.exe	103
PID 4924 wrote to memory of 2240	4924	Kdqejn32.exe	103
PID 4924 wrote to memory of 2240	4924	Kdqejn32.exe	103
PID 2240 wrote to memory of 3600	2240	Kebbafoj.exe	104
PID 2240 wrote to memory of 3600	2240	Kebbafoj.exe	104
PID 2240 wrote to memory of 3600	2240	Kebbafoj.exe	104
PID 3600 wrote to memory of 4980	3600	Kpgfooop.exe	105
PID 3600 wrote to memory of 4980	3600	Kpgfooop.exe	105
PID 3600 wrote to memory of 4980	3600	Kpgfooop.exe	105
PID 4980 wrote to memory of 4628	4980	Kfankifm.exe	106
PID 4980 wrote to memory of 4628	4980	Kfankifm.exe	106
PID 4980 wrote to memory of 4628	4980	Kfankifm.exe	106
PID 4628 wrote to memory of 2108	4628	Klngdpdd.exe	107
PID 4628 wrote to memory of 2108	4628	Klngdpdd.exe	107
PID 4628 wrote to memory of 2108	4628	Klngdpdd.exe	107
PID 2108 wrote to memory of 5028	2108	Kfckahdj.exe	108
PID 2108 wrote to memory of 5028	2108	Kfckahdj.exe	108
PID 2108 wrote to memory of 5028	2108	Kfckahdj.exe	108
PID 5028 wrote to memory of 2416	5028	Kdgljmcd.exe	109
PID 5028 wrote to memory of 2416	5028	Kdgljmcd.exe	109
PID 5028 wrote to memory of 2416	5028	Kdgljmcd.exe	109
PID 2416 wrote to memory of 1704	2416	Lmppcbjd.exe	110
PID 2416 wrote to memory of 1704	2416	Lmppcbjd.exe	110
PID 2416 wrote to memory of 1704	2416	Lmppcbjd.exe	110
PID 1704 wrote to memory of 4520	1704	Ldjhpl32.exe	111
PID 1704 wrote to memory of 4520	1704	Ldjhpl32.exe	111
PID 1704 wrote to memory of 4520	1704	Ldjhpl32.exe	111
PID 4520 wrote to memory of 4496	4520	Lfhdlh32.exe	112
PID 4520 wrote to memory of 4496	4520	Lfhdlh32.exe	112
PID 4520 wrote to memory of 4496	4520	Lfhdlh32.exe	112
PID 4496 wrote to memory of 1520	4496	Liimncmf.exe	113
PID 4496 wrote to memory of 1520	4496	Liimncmf.exe	113
PID 4496 wrote to memory of 1520	4496	Liimncmf.exe	113
PID 1520 wrote to memory of 3412	1520	Lepncd32.exe	114
PID 1520 wrote to memory of 3412	1520	Lepncd32.exe	114
PID 1520 wrote to memory of 3412	1520	Lepncd32.exe	114
PID 3412 wrote to memory of 3956	3412	Lljfpnjg.exe	115
PID 3412 wrote to memory of 3956	3412	Lljfpnjg.exe	115
PID 3412 wrote to memory of 3956	3412	Lljfpnjg.exe	115
PID 3956 wrote to memory of 3972	3956	Mbfkbhpa.exe	117

C:\Users\Admin\AppData\Local\Temp\ca3510f9563805739d66ebbbf4eacbe30a9d4dcfc6fca05bfe4259cb0e60d4f0.exe
"C:\Users\Admin\AppData\Local\Temp\ca3510f9563805739d66ebbbf4eacbe30a9d4dcfc6fca05bfe4259cb0e60d4f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\Jcefno32.exe
  C:\Windows\system32\Jcefno32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\SysWOW64\Jmmjgejj.exe
    C:\Windows\system32\Jmmjgejj.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\SysWOW64\Jbjcolha.exe
      C:\Windows\system32\Jbjcolha.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1556
      - C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3828
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1828
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3600
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3412
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3956
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        23⤵
        Executes dropped EXE
        
        PID:3972
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        24⤵
        Executes dropped EXE
        
        PID:696
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3992
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2260
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        27⤵
        Executes dropped EXE
        
        PID:1984
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        28⤵
        Executes dropped EXE
        
        PID:3276
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1292
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        30⤵
        Executes dropped EXE
        
        PID:4852
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        31⤵
        Executes dropped EXE
        
        PID:3116
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        32⤵
        Executes dropped EXE
        
        PID:1188
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        33⤵
        Executes dropped EXE
        
        PID:4828
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        34⤵
        Executes dropped EXE
        
        PID:4916
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        35⤵
        Executes dropped EXE
        
        PID:3372
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        36⤵
        Executes dropped EXE
        
        PID:4412
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        37⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1072
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3404
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        40⤵
        Executes dropped EXE
        
        PID:4452
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1908
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1124
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        43⤵
        Executes dropped EXE
        
        PID:1992
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        44⤵
        Executes dropped EXE
        
        PID:3916
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        45⤵
        Executes dropped EXE
        
        PID:1384
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        46⤵
        Executes dropped EXE
        
        PID:4028
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        47⤵
        Executes dropped EXE
        
        PID:1560
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        48⤵
        Executes dropped EXE
        
        PID:5124
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        49⤵
        Executes dropped EXE
        
        PID:5164
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5204
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        51⤵
        Executes dropped EXE
        
        PID:5244
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5284
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        53⤵
        Executes dropped EXE
        
        PID:5328
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        56⤵
        Executes dropped EXE
        
        PID:5452
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5492
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5564
        
        C:\Windows\SysWOW64\Dahhio32.exe
        
        C:\Windows\system32\Dahhio32.exe
        59⤵
        Executes dropped EXE
        
        PID:5604
        
        C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        60⤵
        Executes dropped EXE
        
        PID:5644
        
        C:\Windows\SysWOW64\Eajeon32.exe
        
        C:\Windows\system32\Eajeon32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5684
        
        C:\Windows\SysWOW64\Eonehbjg.exe
        
        C:\Windows\system32\Eonehbjg.exe
        62⤵
        Executes dropped EXE
        
        PID:5724
        
        C:\Windows\SysWOW64\Eehnem32.exe
        
        C:\Windows\system32\Eehnem32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5764
        
        C:\Windows\SysWOW64\Egijmegb.exe
        
        C:\Windows\system32\Egijmegb.exe
        64⤵
        Executes dropped EXE
        
        PID:5804
        
        C:\Windows\SysWOW64\Eejjjl32.exe
        
        C:\Windows\system32\Eejjjl32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5844
        
        C:\Windows\SysWOW64\Eemgplno.exe
        
        C:\Windows\system32\Eemgplno.exe
        66⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Ekiohclf.exe
        
        C:\Windows\system32\Ekiohclf.exe
        67⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Feocelll.exe
        
        C:\Windows\system32\Feocelll.exe
        68⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Fkllnbjc.exe
        
        C:\Windows\system32\Fkllnbjc.exe
        69⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Fddqghpd.exe
        
        C:\Windows\system32\Fddqghpd.exe
        70⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Fnmepn32.exe
        
        C:\Windows\system32\Fnmepn32.exe
        71⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Fgeihcme.exe
        
        C:\Windows\system32\Fgeihcme.exe
        72⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Fefjfked.exe
        
        C:\Windows\system32\Fefjfked.exe
        73⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Fonnop32.exe
        
        C:\Windows\system32\Fonnop32.exe
        74⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Fgjccb32.exe
        
        C:\Windows\system32\Fgjccb32.exe
        75⤵
        Drops file in System32 directory
        
        PID:5264
        
        C:\Windows\SysWOW64\Gdncmghi.exe
        
        C:\Windows\system32\Gdncmghi.exe
        76⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Gnfhfl32.exe
        
        C:\Windows\system32\Gnfhfl32.exe
        77⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Ggnlobej.exe
        
        C:\Windows\system32\Ggnlobej.exe
        78⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Gnhdkl32.exe
        
        C:\Windows\system32\Gnhdkl32.exe
        79⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        80⤵
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Gddinf32.exe
        
        C:\Windows\system32\Gddinf32.exe
        81⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Gkaopp32.exe
        
        C:\Windows\system32\Gkaopp32.exe
        82⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Hheoid32.exe
        
        C:\Windows\system32\Hheoid32.exe
        83⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        84⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Hoadkn32.exe
        
        C:\Windows\system32\Hoadkn32.exe
        85⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Hgoeep32.exe
        
        C:\Windows\system32\Hgoeep32.exe
        86⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Hdbfodfa.exe
        
        C:\Windows\system32\Hdbfodfa.exe
        87⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Ibffhhek.exe
        
        C:\Windows\system32\Ibffhhek.exe
        88⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Ifgldfio.exe
        
        C:\Windows\system32\Ifgldfio.exe
        89⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Iigdfa32.exe
        
        C:\Windows\system32\Iigdfa32.exe
        90⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        91⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5676
        
        C:\Windows\SysWOW64\Jkkjmlan.exe
        
        C:\Windows\system32\Jkkjmlan.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1568
        
        C:\Windows\SysWOW64\Jnifigpa.exe
        
        C:\Windows\system32\Jnifigpa.exe
        94⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Jgakbm32.exe
        
        C:\Windows\system32\Jgakbm32.exe
        95⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Jfbkpd32.exe
        
        C:\Windows\system32\Jfbkpd32.exe
        96⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Jfehed32.exe
        
        C:\Windows\system32\Jfehed32.exe
        97⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Kppici32.exe
        
        C:\Windows\system32\Kppici32.exe
        98⤵
        Drops file in System32 directory
        
        PID:2308
        
        C:\Windows\SysWOW64\Kelalp32.exe
        
        C:\Windows\system32\Kelalp32.exe
        99⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Kihnmohm.exe
        
        C:\Windows\system32\Kihnmohm.exe
        100⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        101⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Khmknk32.exe
        
        C:\Windows\system32\Khmknk32.exe
        102⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Khpgckkb.exe
        
        C:\Windows\system32\Khpgckkb.exe
        103⤵
        
        PID:412
        
        C:\Windows\SysWOW64\Kpgodhkd.exe
        
        C:\Windows\system32\Kpgodhkd.exe
        104⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        105⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Khbdikip.exe
        
        C:\Windows\system32\Khbdikip.exe
        106⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Kbghfc32.exe
        
        C:\Windows\system32\Kbghfc32.exe
        107⤵
        Modifies registry class
        
        PID:5152
        
        C:\Windows\SysWOW64\Lhfmdj32.exe
        
        C:\Windows\system32\Lhfmdj32.exe
        108⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Lnqeqd32.exe
        
        C:\Windows\system32\Lnqeqd32.exe
        109⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Locbfd32.exe
        
        C:\Windows\system32\Locbfd32.exe
        110⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        111⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        112⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Lpekef32.exe
        
        C:\Windows\system32\Lpekef32.exe
        113⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Mimpolee.exe
        
        C:\Windows\system32\Mimpolee.exe
        114⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Mhbmphjm.exe
        
        C:\Windows\system32\Mhbmphjm.exe
        115⤵
        
        PID:856
        
        C:\Windows\SysWOW64\Mpieqeko.exe
        
        C:\Windows\system32\Mpieqeko.exe
        116⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Mibijk32.exe
        
        C:\Windows\system32\Mibijk32.exe
        117⤵
        Drops file in System32 directory
        
        PID:2380
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        118⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        119⤵
        Drops file in System32 directory
        
        PID:936
        
        C:\Windows\SysWOW64\Mehjol32.exe
        
        C:\Windows\system32\Mehjol32.exe
        120⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\Moaogand.exe
        
        C:\Windows\system32\Moaogand.exe
        121⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        122⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        123⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\Niklpj32.exe
        
        C:\Windows\system32\Niklpj32.exe
        124⤵
        Drops file in System32 directory
        
        PID:6160
        
        C:\Windows\SysWOW64\Nlihle32.exe
        
        C:\Windows\system32\Nlihle32.exe
        125⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        126⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Nedjjj32.exe
        
        C:\Windows\system32\Nedjjj32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6296
        
        C:\Windows\SysWOW64\Nookip32.exe
        
        C:\Windows\system32\Nookip32.exe
        128⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        129⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        130⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Ocmconhk.exe
        
        C:\Windows\system32\Ocmconhk.exe
        131⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Oigllh32.exe
        
        C:\Windows\system32\Oigllh32.exe
        132⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Olgemcli.exe
        
        C:\Windows\system32\Olgemcli.exe
        133⤵
        Drops file in System32 directory
        
        PID:6560
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        134⤵
        Drops file in System32 directory
        
        PID:6604
        
        C:\Windows\SysWOW64\Oepifi32.exe
        
        C:\Windows\system32\Oepifi32.exe
        135⤵
        Drops file in System32 directory
        
        PID:6648
        
        C:\Windows\SysWOW64\Ollnhb32.exe
        
        C:\Windows\system32\Ollnhb32.exe
        136⤵
        Drops file in System32 directory
        
        PID:6692
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        137⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Pcicklnn.exe
        
        C:\Windows\system32\Pcicklnn.exe
        138⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Plagcbdn.exe
        
        C:\Windows\system32\Plagcbdn.exe
        139⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Pfillg32.exe
        
        C:\Windows\system32\Pfillg32.exe
        140⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Phhhhc32.exe
        
        C:\Windows\system32\Phhhhc32.exe
        141⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Pjgebf32.exe
        
        C:\Windows\system32\Pjgebf32.exe
        142⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        143⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        144⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Acgolj32.exe
        
        C:\Windows\system32\Acgolj32.exe
        145⤵
        Drops file in System32 directory
        
        PID:7088
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        146⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Agdhbi32.exe
        
        C:\Windows\system32\Agdhbi32.exe
        147⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Aopmfk32.exe
        
        C:\Windows\system32\Aopmfk32.exe
        148⤵
        Modifies registry class
        
        PID:6204
        
        C:\Windows\SysWOW64\Aihaoqlp.exe
        
        C:\Windows\system32\Aihaoqlp.exe
        149⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Aqoiqn32.exe
        
        C:\Windows\system32\Aqoiqn32.exe
        150⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Agiamhdo.exe
        
        C:\Windows\system32\Agiamhdo.exe
        151⤵
        Modifies registry class
        
        PID:6396
        
        C:\Windows\SysWOW64\Amfjeobf.exe
        
        C:\Windows\system32\Amfjeobf.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6452
        
        C:\Windows\SysWOW64\Ajjjocap.exe
        
        C:\Windows\system32\Ajjjocap.exe
        153⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Bqdblmhl.exe
        
        C:\Windows\system32\Bqdblmhl.exe
        154⤵
        Drops file in System32 directory
        
        PID:6596
        
        C:\Windows\SysWOW64\Bjodjb32.exe
        
        C:\Windows\system32\Bjodjb32.exe
        155⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Bfedoc32.exe
        
        C:\Windows\system32\Bfedoc32.exe
        156⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Bmomlnjk.exe
        
        C:\Windows\system32\Bmomlnjk.exe
        157⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Bciehh32.exe
        
        C:\Windows\system32\Bciehh32.exe
        158⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Bmbiamhi.exe
        
        C:\Windows\system32\Bmbiamhi.exe
        159⤵
        Modifies registry class
        
        PID:6968
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        160⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Cpbbch32.exe
        
        C:\Windows\system32\Cpbbch32.exe
        161⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        162⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        163⤵
        Modifies registry class
        
        PID:6168
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        164⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Cjjcfabm.exe
        
        C:\Windows\system32\Cjjcfabm.exe
        165⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Cpglnhad.exe
        
        C:\Windows\system32\Cpglnhad.exe
        166⤵
        Drops file in System32 directory
        
        PID:6516
        
        C:\Windows\SysWOW64\Caghhk32.exe
        
        C:\Windows\system32\Caghhk32.exe
        167⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Cjaifp32.exe
        
        C:\Windows\system32\Cjaifp32.exe
        168⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        169⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        170⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Diicml32.exe
        
        C:\Windows\system32\Diicml32.exe
        171⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Dhjckcgi.exe
        
        C:\Windows\system32\Dhjckcgi.exe
        172⤵
        Modifies registry class
        
        PID:3144
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        173⤵
        Drops file in System32 directory
        
        PID:6232
        
        C:\Windows\SysWOW64\Dfoplpla.exe
        
        C:\Windows\system32\Dfoplpla.exe
        174⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        175⤵
        
        PID:392
        
        C:\Windows\SysWOW64\Eipinkib.exe
        
        C:\Windows\system32\Eipinkib.exe
        176⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        177⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Eplnpeol.exe
        
        C:\Windows\system32\Eplnpeol.exe
        178⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Ejbbmnnb.exe
        
        C:\Windows\system32\Ejbbmnnb.exe
        179⤵
        Drops file in System32 directory
        
        PID:5976
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        180⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Eangpgcl.exe
        
        C:\Windows\system32\Eangpgcl.exe
        181⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Efkphnbd.exe
        
        C:\Windows\system32\Efkphnbd.exe
        182⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4260
        
        C:\Windows\SysWOW64\Ehjlaaig.exe
        
        C:\Windows\system32\Ehjlaaig.exe
        184⤵
        Drops file in System32 directory
        
        PID:6392
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6800
        
        C:\Windows\SysWOW64\Fphnlcdo.exe
        
        C:\Windows\system32\Fphnlcdo.exe
        186⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        187⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        188⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Fmnkkg32.exe
        
        C:\Windows\system32\Fmnkkg32.exe
        189⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Fggocmhf.exe
        
        C:\Windows\system32\Fggocmhf.exe
        190⤵
        Drops file in System32 directory
        
        PID:7212
        
        C:\Windows\SysWOW64\Falcae32.exe
        
        C:\Windows\system32\Falcae32.exe
        191⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        192⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        193⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        194⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        195⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        196⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Gklnjj32.exe
        
        C:\Windows\system32\Gklnjj32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7504
        
        C:\Windows\SysWOW64\Gphgbafl.exe
        
        C:\Windows\system32\Gphgbafl.exe
        198⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Gnlgleef.exe
        
        C:\Windows\system32\Gnlgleef.exe
        199⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Hhbkinel.exe
        
        C:\Windows\system32\Hhbkinel.exe
        200⤵
        Modifies registry class
        
        PID:7624
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        201⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7712
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        203⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Hpomcp32.exe
        
        C:\Windows\system32\Hpomcp32.exe
        204⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        205⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Hjjnae32.exe
        
        C:\Windows\system32\Hjjnae32.exe
        206⤵
        Modifies registry class
        
        PID:7884
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        207⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        208⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        209⤵
        Modifies registry class
        
        PID:8008
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        210⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        211⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Ihdafkdg.exe
        
        C:\Windows\system32\Ihdafkdg.exe
        212⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8168
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        214⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        215⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7312
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        217⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Jqglkmlj.exe
        
        C:\Windows\system32\Jqglkmlj.exe
        218⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Jjopcb32.exe
        
        C:\Windows\system32\Jjopcb32.exe
        219⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        220⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        221⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        222⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7796
        
        C:\Windows\SysWOW64\Kqnbkl32.exe
        
        C:\Windows\system32\Kqnbkl32.exe
        224⤵
        Modifies registry class
        
        PID:7848
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        225⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Kghjhemo.exe
        
        C:\Windows\system32\Kghjhemo.exe
        226⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        227⤵
        Drops file in System32 directory
        
        PID:8076
        
        C:\Windows\SysWOW64\Kkfcndce.exe
        
        C:\Windows\system32\Kkfcndce.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8156
        
        C:\Windows\SysWOW64\Kenggi32.exe
        
        C:\Windows\system32\Kenggi32.exe
        229⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        230⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        231⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Leenhhdn.exe
        
        C:\Windows\system32\Leenhhdn.exe
        232⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        233⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Lalnmiia.exe
        
        C:\Windows\system32\Lalnmiia.exe
        234⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        235⤵
        Modifies registry class
        
        PID:7908
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        236⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        237⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        238⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        239⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        240⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        241⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        242⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Mnlnbl32.exe
        
        C:\Windows\system32\Mnlnbl32.exe
        243⤵
        Drops file in System32 directory
        
        PID:8164
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        244⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Malgcg32.exe
        
        C:\Windows\system32\Malgcg32.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7568
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        246⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        247⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7220
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        248⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        249⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        250⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Nbcjnilj.exe
        
        C:\Windows\system32\Nbcjnilj.exe
        251⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Nojjcj32.exe
        
        C:\Windows\system32\Nojjcj32.exe
        252⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        253⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        254⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        255⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        256⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        257⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        258⤵
        Drops file in System32 directory
        
        PID:8436
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        259⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        260⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        261⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        262⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        263⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        264⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        265⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        266⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Pchlpfjb.exe
        
        C:\Windows\system32\Pchlpfjb.exe
        267⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Peieba32.exe
        
        C:\Windows\system32\Peieba32.exe
        268⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        269⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        270⤵
        Drops file in System32 directory
        
        PID:8972
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        271⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        272⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        273⤵
        Modifies registry class
        
        PID:9092
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        274⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        275⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Achegd32.exe
        
        C:\Windows\system32\Achegd32.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8212
        
        C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        277⤵
        Modifies registry class
        
        PID:8272
        
        C:\Windows\SysWOW64\Ackbmcjl.exe
        
        C:\Windows\system32\Ackbmcjl.exe
        278⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8428
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        280⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        281⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8604
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        283⤵
        Modifies registry class
        
        PID:8668
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        284⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        285⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        286⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        287⤵
        Modifies registry class
        
        PID:8956
        
        C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        288⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        289⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        290⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        291⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        292⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        293⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        294⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Cfqmpl32.exe
        
        C:\Windows\system32\Cfqmpl32.exe
        295⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        296⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        297⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        298⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        299⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9128
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        301⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        302⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        303⤵
        Modifies registry class
        
        PID:8684
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8804
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        305⤵
        Drops file in System32 directory
        
        PID:8968
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        306⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8316
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        308⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        309⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        310⤵
        Drops file in System32 directory
        
        PID:9196
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        311⤵
        Modifies registry class
        
        PID:8492
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        312⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        313⤵
        Drops file in System32 directory
        
        PID:8400
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        314⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        315⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        316⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9300
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        318⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        319⤵
        Drops file in System32 directory
        
        PID:9388
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        320⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9468
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9512
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9556
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        324⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        325⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        326⤵
        Modifies registry class
        
        PID:9680
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        327⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        328⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        329⤵
        Drops file in System32 directory
        
        PID:9812
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        330⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        331⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        332⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        333⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        334⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        335⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10124
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        337⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        338⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        339⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        340⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        341⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        342⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        343⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        344⤵
        Drops file in System32 directory
        
        PID:9736
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        345⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        346⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        347⤵
        Modifies registry class
        
        PID:9960
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        348⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        349⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        350⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        351⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        352⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        353⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        354⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9792
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        356⤵
        Drops file in System32 directory
        
        PID:9872
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        357⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10092
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        359⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        360⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        361⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        362⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9920
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        364⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        365⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        366⤵
        Modifies registry class
        
        PID:9452
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1464
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        368⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        369⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        370⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        371⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        372⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        373⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        374⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        375⤵
        Modifies registry class
        
        PID:9716
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        376⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        377⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        378⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        379⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        380⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2268
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2240
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        383⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        384⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        385⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10284
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        386⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        387⤵
        Modifies registry class
        
        PID:10372
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        388⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        389⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        390⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        391⤵
        Modifies registry class
        
        PID:10540
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        392⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        393⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        394⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        395⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        396⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10752
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        397⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        398⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        399⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        400⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        401⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        402⤵
        Modifies registry class
        
        PID:11012
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        403⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        404⤵
        Modifies registry class
        
        PID:11096
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        405⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        406⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        407⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        408⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        409⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        410⤵
        
        PID:440
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        411⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        412⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        413⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        414⤵
        Drops file in System32 directory
        
        PID:848
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        415⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        416⤵
        Drops file in System32 directory
        
        PID:10572
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        417⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        418⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        419⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        420⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        421⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        422⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        423⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        424⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        425⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        426⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        427⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11160
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        428⤵
        Modifies registry class
        
        PID:11196
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        429⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        430⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        431⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        432⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        433⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        434⤵
        Drops file in System32 directory
        
        PID:1292
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        435⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        436⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        437⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        438⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        439⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        440⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        441⤵
        
        PID:8
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        442⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        443⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        444⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11148
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10192
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        446⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        447⤵
        Modifies registry class
        
        PID:11256
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        448⤵
        Modifies registry class
        
        PID:10248
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        449⤵
        Drops file in System32 directory
        
        PID:10368
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        450⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        451⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        452⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10776
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        454⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        455⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        456⤵
        Drops file in System32 directory
        
        PID:3236
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        457⤵
        Drops file in System32 directory
        
        PID:11124
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        458⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        459⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        460⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        461⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        462⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10304
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        463⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        464⤵
        Modifies registry class
        
        PID:1384
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        465⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        466⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        467⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        468⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        469⤵
        Modifies registry class
        
        PID:5044
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        470⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        471⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        472⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        473⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        474⤵
        Drops file in System32 directory
        
        PID:3264
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        475⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5816
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        476⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5900
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        478⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        479⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        480⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4048
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        481⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        482⤵
        Modifies registry class
        
        PID:10712
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5616
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        484⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        485⤵
        Drops file in System32 directory
        
        PID:11004
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        486⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        487⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        488⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        489⤵
        Modifies registry class
        
        PID:5452
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        490⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6012
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        491⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        492⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6052
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        493⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6092
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        494⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5128
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        495⤵
        Modifies registry class
        
        PID:6132
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        496⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        497⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        498⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5372
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        499⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        500⤵
        Drops file in System32 directory
        
        PID:5404
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        501⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        502⤵
        Drops file in System32 directory
        
        PID:5260
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        503⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        504⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        505⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        506⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        507⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        508⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        509⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5308
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        510⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        511⤵
        Drops file in System32 directory
        
        PID:3696
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        512⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        513⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        514⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        515⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        516⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        517⤵
        Modifies registry class
        
        PID:636
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        518⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        519⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5280
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        520⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        521⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        522⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        523⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        524⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        525⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5788
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        526⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        527⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        528⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        529⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        530⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        531⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        532⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        533⤵
        Modifies registry class
        
        PID:3732
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        534⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        535⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        536⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        537⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        538⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        539⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2732
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        540⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        541⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        542⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        543⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6116
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        544⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        545⤵
        Modifies registry class
        
        PID:6004
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        546⤵
        Modifies registry class
        
        PID:5084
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        547⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        548⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1116
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        549⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        550⤵
        
        PID:412
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        551⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        552⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5832
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        553⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        554⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        555⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        556⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        557⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        558⤵
        Drops file in System32 directory
        
        PID:208
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        559⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6036
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        560⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        561⤵
        Modifies registry class
        
        PID:5336
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        562⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        563⤵
        
        PID:856
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        564⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        565⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        566⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        567⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        568⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3692
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        569⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        570⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6252
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        571⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        572⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        573⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        574⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        575⤵
        Drops file in System32 directory
        
        PID:6564
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        576⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        577⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6476
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        578⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        579⤵
        Modifies registry class
        
        PID:11312
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        580⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        581⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        582⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        583⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        584⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        585⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        586⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        587⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        588⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        589⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        590⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        591⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        592⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11876
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        593⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11920
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        594⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        595⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11996
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        596⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        597⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        598⤵
        Modifies registry class
        
        PID:12116
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        599⤵
        Drops file in System32 directory
        
        PID:12176
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        600⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        601⤵
        Drops file in System32 directory
        
        PID:12256
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        602⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        603⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        604⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11336
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        605⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        606⤵
        
        PID:11488
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        607⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        608⤵
        Modifies registry class
        
        PID:11564
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        609⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        610⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        611⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        612⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        613⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        614⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        615⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        616⤵
        Modifies registry class
        
        PID:7044
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        617⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        618⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        619⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        620⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        621⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12192 -s 404
        622⤵
        Program crash
        
        PID:6840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 12192 -ip 12192
1⤵
PID:12240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=2320,i,3025503729105798828,9325691672526736153,262144 --variations-seed-version /prefetch:8
1⤵
PID:6544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Achegd32.exe

Filesize
192KB

MD5
f54efc439047315660da9809ade17f70

SHA1
b6d571ef3cf9753bb351a271a91b8040fd05ebb4

SHA256
2762bb98754d96f3a3f98efac76c1816bfbff84bb42513b423ce499226201ff3

SHA512
1e402682085ec906031d953ed542017c328d8eaa3ca065ebf1a100b01aaa3322343db0ca411b7670a9013b3fec91674b46b7f74e0962f8655c240d86fa206d1d

Download Submit
C:\Windows\SysWOW64\Amlogfel.exe

Filesize
192KB

MD5
4ce3170c32599d7a7fe75f6a937267b1

SHA1
ccfe20e640c481914eab28a90ea46a2ddbc2875e

SHA256
5233e49183c922d389956bdc149c4a79fa0b74b3c65677b4a1af504485259a92

SHA512
e08e070e6fe19ad4f16615bcb451f3f5999b9e5363201897d1bfa7b3a19ce48b7122271b1b1dfbdc86ef71804c57756f2bfc4b30d6b2eba4b61ad6c5685d739b

Download Submit
C:\Windows\SysWOW64\Bfgjjm32.exe

Filesize
192KB

MD5
7b06de8e5cb4a3fc9d53813a81c04c98

SHA1
7d68e73f260f26f9d8b009a010f76ade663e109a

SHA256
4d960ccb3c2b92cef4745db64f8d070dfef9fc1af41415987240d3b18fd34ffa

SHA512
2a1f5a2811ca2ae9d97d0d932696c88b1a50b7090a70066f151d28eda5ed16bdf9b4efdee91f814910ed1e90fca6ad57cd4abbabadaab5c3360a410bda763ad4

Download Submit
C:\Windows\SysWOW64\Bnhenj32.exe

Filesize
192KB

MD5
7c465901e467fc7e3e1ee3eb69f4dcb4

SHA1
ff207bc9675359d686372f560b5e179015620472

SHA256
2676e952fa7f81e3e027dbc27851f000be50269e24109b524527b93bda7b6c8c

SHA512
8bab654fc605a5082269395a38493c44e31da1484197661f94599090bfd47647b1e693e878040516b13f894d5d1591332fde31e76d7a7ca68b9dd3ec5fc40403

Download Submit
C:\Windows\SysWOW64\Bnlhncgi.exe

Filesize
192KB

MD5
2fa7116daa00bfedf6da5f573580f5f8

SHA1
1e23043f3b65b15a1e66682b3c99df5f9128b8d1

SHA256
0dca3edcbb125a9b489d3b73cef969d4afb7c2a0a3cff32e88494c953b15c965

SHA512
66765b8841401cef2f80104747b7d15b3605bdb763b68a733a909271c3a98815d75a3f99fd0743ca309e218c2a0bd6362dc632b5be5db803351cc9808dfa123e

Download Submit
C:\Windows\SysWOW64\Ckkiccep.exe

Filesize
64KB

MD5
ec7c42995f1f9fd1ab358e9a80ec1f7c

SHA1
3bd9b7e7495837031fbc18e39f7c78dd93fded06

SHA256
6c441bef20178c7db79398c3e7477ffd35d9557526de12d16b023af42a2e018b

SHA512
58a4ce87ec334b5982fc5e067502e37288ba5e3ee599e6507caa25f1c2ee7732eb861a86de6da12d2358087c44972543fd7d1f30fb5f21c017616f10cb5b5962

Download Submit
C:\Windows\SysWOW64\Dflmlj32.exe

Filesize
192KB

MD5
43ac3baff669b44dc966e18bc71e8fe0

SHA1
543fa229954e1f309a9fd1e0d2496a371ee31d3d

SHA256
fef8257178bcc55059543fa6e5e521d1071fd2b528abdfa0aa9d2769e3f7336b

SHA512
1dc66db1f6d3e10a237721cbe3016af2009f0e94a632f00bdabc52ed67f569a9d15fd032c24de31810262038ee5f7179f715a70972478a327b5c7595909ef223

Download Submit
C:\Windows\SysWOW64\Diicml32.exe

Filesize
192KB

MD5
bc2e4d4b081d7190af391a7d9cf1163f

SHA1
59fe65ff22c8163de46dc3034ae5a9f298201ecb

SHA256
8532a12a8bb852467bb00eae26f84e6ba85745e7887f5c18c06a6b8d9d7c2f96

SHA512
09d3773f89749f7b99273adfc3edfcab1c17196d253cd0e8750ea317531714ccadba43aad6c3eede1282fcddffb3847b1715cfdc859bd814754a1efb729d2b0a

Download Submit
C:\Windows\SysWOW64\Ffpicn32.exe

Filesize
192KB

MD5
e1ab0e8fad88772bc50270c33bea77c4

SHA1
2691f6f9584fdb706ae1666f81715444d1f0cd80

SHA256
baa35984896b1b6d1f64b8a0b6696a2af8af8d8507f2558c7fc7cab92e0bb2d9

SHA512
0d58133ec1dedb2f959747a18906bfaf681ab0eaa77c54546356580b811b33af722096da88e668eb4ab8dec41d7f679cb80e35b145aa8702bb9eb7a3ec964cb9

Download Submit
C:\Windows\SysWOW64\Fgjccb32.exe

Filesize
192KB

MD5
0155719b53626189a240a03f24c255a0

SHA1
c52343402032b166d62bab2d3fc001ca2fd3ce47

SHA256
dcd92744068bd7eb5f2ee48e6818fe8441c7d4e7e38219750dc16ae39b6f3f4a

SHA512
02792df74870ebd7b1e1b2a672ab4dad1e758e6e2d6a9d71cb20a7989e98b25d63582b61c62a11d29cbb88ef90339ff0dd7424535cb929af8b999947ee996d39

Download Submit
C:\Windows\SysWOW64\Gkmdecbg.exe

Filesize
192KB

MD5
f6c1565441100cca7a2d0e5997a7e0af

SHA1
3ef8680ab1c8bd95afe01810a836191f19304d70

SHA256
7966f3ceaf5f42571f5bbf8ee7a26b2b51dfff370fa203385479bcf902b4fcc2

SHA512
f81608bad81903b71da1c1d5069373b740fffbc9c3a39ad328fe36257c1ee36033140c3f1c113b914c808f772ee2f95cdcddd01d3b1b1ce08992f65abd5c3be5

Download Submit
C:\Windows\SysWOW64\Gphgbafl.exe

Filesize
192KB

MD5
1fdebc6d0ebab27ea171cb662d6a16af

SHA1
b5afbc990d322f1ceb182938723970d290f3ca46

SHA256
f6923a18d4044ab3b39523ad6db9b69c64196fda042402245126072e460adeaf

SHA512
a9ddd9906ef233f3c85057d5d5e534ef621358129776441b488854f49e303be8d625fb3dfc7be6dbe9a64bb258aeec368fa8fa60f9ca39dcbeaeba2d65b94657

Download Submit
C:\Windows\SysWOW64\Hjjnae32.exe

Filesize
192KB

MD5
14ae72654170bf83eca79d95de7bc103

SHA1
e1a9be0e32339e0dbae6f5914dafb77cdfd0908e

SHA256
530fa82f9d231cb7e5dc88452b55a5d985a5279a853dd0b73dbcf6afbf4905c1

SHA512
384b2145b74fcd081e687627523b6ea2f1d9de255c51f0224367901878b37b2ab0cf61faf04e5b57fac40722dbd6ee0b5bce2bc0f4ef9403b52c4554f93e4a0f

Download Submit
C:\Windows\SysWOW64\Hoadkn32.exe

Filesize
192KB

MD5
2e8f3075d60e85752f460061caf17388

SHA1
c6cdd7ee61a04051636dff1540faf454e78084e0

SHA256
13a92ce6ed342661a41de6113b16031dbd8d53f8f71476a015d9cfec3b2db430

SHA512
98204e51c66710b89ac04a726691c4c33295647b031307973a5f6f92e7713cd5816cd5f0c28f034aefeefe1d41128a797ef5fadbd4bc44fea560db242fc316d4

Download Submit
C:\Windows\SysWOW64\Jbjcolha.exe

Filesize
192KB

MD5
6cd97a6f8b39c7de5add7e131d7f2098

SHA1
d54dd48be833fc43267c2c81e5eac5032bfc5a72

SHA256
9818728f38736c99c1b15c75f12e01fc5f69f1d325fa71adac94e3be8eb92506

SHA512
f7d3477031ec1433472c680e24e5b702bb537841ba3ec33c0fc9ca3143863107aca10c9fedbfa2b2a1a2c3dcd75746116975bf9bc7cc42a419ff84caa57a5067

Download Submit
C:\Windows\SysWOW64\Jcefno32.exe

Filesize
192KB

MD5
b28580728f4942b16eaf6fa618bd843f

SHA1
22c5453107ba682bef07115197f67e0d02e193e2

SHA256
ce039ce91b0aeaff072777d3bba99c8b2fcda2c1d8fd2c83e87ba137db7c229c

SHA512
4c2bd97ae5abc57b8882158563eccff0969fb78485cc4a4617d16b2f27433183b1edfa84e5c094a9f919cffd48ae7e2fa980fd71a7c776691104c3f2a69c33b3

Download Submit
C:\Windows\SysWOW64\Jehokgge.exe

Filesize
192KB

MD5
7c5e3990d9eee66bc3185cf08b407c28

SHA1
2a63e4005207c068fb34f43805e06c9e679b8439

SHA256
11b62c532b16043d9b958b71eb5854776f42b84ebe359133da9e4f8a55b17478

SHA512
747d7e961b1ef4d6372722e981f034f21295e10b5ac6a23424b1628009ebfa2acb710e04e89a497a90c87824d06691f6d3f6c85cbd6b41ce70632541a334e5bf

Download Submit
C:\Windows\SysWOW64\Jifhaenk.exe

Filesize
192KB

MD5
6ff622f69b65f9082565bd69a68cd3b2

SHA1
03e6765d6acea400d397f488554e1027400cef31

SHA256
fdf8841108d9f516b8c9df06ab3b1566757f28c6819b97f116a9cfb3fcfbe2e0

SHA512
99c41795491c3dec0c6ac030e96e7dd550bf6ea98c8d5485ea96cee4c10ce7739ab524ccf4abb69ef9797b767bdfc2d702a779e2d1c4a8f5a713497375724051

Download Submit
C:\Windows\SysWOW64\Jmmjgejj.exe

Filesize
192KB

MD5
bfaa3ec0db662dcfc6a1edfd9b5456c2

SHA1
0ed6927a0ecc2fef80a7bac80ca978d40dcf9d1c

SHA256
df468c6541cf5270e10adf55961488c27a16c74eecd66bc4b5eb829d8ea95226

SHA512
736bc2a1e906791dc5eab536adf04cb62b50b44967e4b4b64544db3704de06717db8589cfedd6120d188d779c35718ff380514508fc92fc08288b038ba285560

Download Submit
C:\Windows\SysWOW64\Jnifigpa.exe

Filesize
192KB

MD5
20ec5502b9778a95fa96cda32dc94018

SHA1
6c93cfa318a3f2df5abda20e3a5b7b259ba3a137

SHA256
acf8095e48ed0361f57ed16baf6bfd722f39118167e8a59f5d3b39000eb75e52

SHA512
c4e8dd78b19d6fc9f62a367e95636817709bd2458de28ebd2662301bb5f3d1d343c843e639f1c3ac901c0af4e663632e7c80bea607c53ca3835ef516021a36d5

Download Submit
C:\Windows\SysWOW64\Jpnchp32.exe

Filesize
192KB

MD5
ee5195e55946f9aa360099861f8ccc0c

SHA1
5818332180cc9766f204f2e9c6265323c4f8dcc4

SHA256
bbaf1052f7dbf776142449f428c8c83ad234b50498e113a6273adbe86f8ea94a

SHA512
71fd29c46128b68d2e15e7ba89e4a9154d51b0b2a8ffa3c40127630cad190e110fbb85c9f4e17300152b192c80bd652d679379c374b92f997f8e4a59914cd727

Download Submit
C:\Windows\SysWOW64\Kbaipkbi.exe

Filesize
192KB

MD5
9dd00c01ef8a071620d96a6f2a8176b0

SHA1
b76971f0d16fa00330979249f8f7eb5c4f2c08ef

SHA256
8554b17ccc74ec4cdb126dcc185f9cc7044b20789bbe13488e4acc6ac6614279

SHA512
a544a014a0d9d0d256d56f5e4acb971977767f59e5039ca0c723875e0af216201c7fb988f9697cf61ac7fc78a5732c5bb85817ecd89350492ae4519cf0d8b983

Download Submit
C:\Windows\SysWOW64\Kdgljmcd.exe

Filesize
192KB

MD5
bf45e17392448ac8bbe49329e7e42573

SHA1
cd79526db0ce4036dea1c0bbeabdb7e0cccd3f76

SHA256
1b28cc3b2cad17ef1a2a6fa979e9d3f01303f34ff142eee9a401a1e658f17d88

SHA512
92706fd3762ad2a2947647a86a94f9e06abf382e322b1fac474ccffcea28eb5a25bfb607462f2ba46e5966dd7283e1891accbd4ba4b147b4421cb81cebd93a9d

Download Submit
C:\Windows\SysWOW64\Kdqejn32.exe

Filesize
192KB

MD5
5ddce31a87014a3a246a1a151ad2de5e

SHA1
67f4bb315131a147d5c5352e920056d139abb2b3

SHA256
9cf7376b6effda6ab69d52438b901c5aa1a804db5a3cf9bfaf241c1921066751

SHA512
aefda63c72e81aff388e432d98d4b41a78620ed470b97df488a158fb2c3f8f18a514a5fd25144ac355a4f688fe38192b649bb8196de1ba7dad0d2dd4c00897de

Download Submit
C:\Windows\SysWOW64\Kebbafoj.exe

Filesize
192KB

MD5
51f5875bbe21b76415150bc28c4bc853

SHA1
c0377d2e5a73df7c562a1493a0f1735987c7766f

SHA256
ba1b0d8c336bcdf6dafbd3070115b90fc39fe7941555a5011d596c50e1bc7c17

SHA512
6ca68aaca010ec7e795b40bf64a5e1cbd0a07c21982ff885db61f888d6dd73b8f50f9ef701417f517c2ba696b102c8722d6dba9f5b26a9569b67566e81a4587b

Download Submit
C:\Windows\SysWOW64\Kfankifm.exe

Filesize
192KB

MD5
5fc92a381b2e7fb088334d378709394c

SHA1
e4bbd0c45c3adeb619545021391afb3e99d33292

SHA256
8ceebe2491045c79ff405483b163fbd93a55d734932da493cbcf24960bf31fc2

SHA512
cadf0634a451ab8a632227feab04f52bb1093539792b49d2126c53329d2b530474a44b76cd796870a7020911e525e38106e7c99420526983a8ccab95d3916e43

Download Submit
C:\Windows\SysWOW64\Kfckahdj.exe

Filesize
64KB

MD5
4d3cf838dc8802f499886a28f07ccb72

SHA1
fef8159de84e3d7f65be3f548ebbd62aef55ac20

SHA256
1a6894279b6b65f36432482824e720b203c3da3542fa4faeb3e46a59960a214b

SHA512
5c02fd7547ed66eb0c853deedc369e0207cdd0ebef73b2d621a0e9b091416fa81fbefb4e043a5fa158e76944fdc6f941af2a056c006ab50b3072ddfadc015552

Download Submit
C:\Windows\SysWOW64\Kfckahdj.exe

Filesize
192KB

MD5
3572776471ed801202cd113e2d729ace

SHA1
dda912e22c5c9f7169c71d1fe5bb8d5a5a258392

SHA256
f488abb497fbe253362e2e7262d18e91353cee7de39e4f3651714d8df3e02da1

SHA512
c219f4712655e9c57c11c7115195437046983eff6ee6649ba0b8a037deafacb0a4bd2e5c402169398c8569cf6c49cacb493d0eae10f6cfaaf83fbb1efb75a4ad

Download Submit
C:\Windows\SysWOW64\Klngdpdd.exe

Filesize
192KB

MD5
edbc78e46954056da73aad1b3209d616

SHA1
09b4b02874dce1cd710c9d65970c2b162361d242

SHA256
f9956282ac8d0150c906acff839f6a7637459c4fe2cff54b7345cc174858e2f9

SHA512
7a1aeb66cb7d3161753a8b318624c268104f4090eb1e59c50cc57e0eb9f7eba9d8d9739a729f24acb2df7ef70a883d967323d03460dcbb24a8ed212eba3e8d36

Download Submit
C:\Windows\SysWOW64\Kpgfooop.exe

Filesize
192KB

MD5
8fdbf32c6c26e3c8ba06f91bca3b4f2c

SHA1
92a0720d97940f93dc6e56864901d3898d8c2c20

SHA256
d2fbc39ff5d9b35986008df9be5aced01566705a7d83190456c774c671dc287d

SHA512
58d74b1fe970db760eaa256b71b38565e0831589a87489f8fb8ffd4aa0673092ec35ad879184b0d006adea5472ce81f77250625ae4928d975141d4e6a61e0ce9

Download Submit
C:\Windows\SysWOW64\Kppici32.exe

Filesize
64KB

MD5
4af67c616860581515c3b67a57342e08

SHA1
859719e4d2707c60a8fc1eb04a2df032d6b5637d

SHA256
f1346a4432a30eab6317f8e9af4c457660a880389dab13e514c90e1c7f0c8b2e

SHA512
90eb697fc79f491ddd40d55c026899aba39109876dc5f66fd49aecf38892de205a4ef7b473ece1171dd1fd85ef7ca9aa89806fe729879c70d32bd3636fd5855f

Download Submit
C:\Windows\SysWOW64\Ldjhpl32.exe

Filesize
192KB

MD5
78a6a5a76f9891c1132eb70f83c7cdb1

SHA1
f2a61dc25dfc8c7c1b926fc9de7d5047e004b832

SHA256
1a0642a99aa225fabc00dc0bf3154e4477fc5d2d385a5560e38b9cbb59e5c98f

SHA512
584e1da77e96f8513093b87d35ccf30ccb3852d5110749e1744ba5d6037c07111154ea10020c16810482da3eee6a453594ea68bbf7509c52cad33431bc0be4a5

Download Submit
C:\Windows\SysWOW64\Lepncd32.exe

Filesize
192KB

MD5
21a654756a20d2bab6e5a381ef1c4d88

SHA1
ed8fa6489e5b1e35d871ef13d3a7f30ccf163b2e

SHA256
4531d5e10facfe1613aeca4f337d417c2d72b417b58e5a2f6bb3d96a5b81a945

SHA512
1e5da22822541e4ea8e8ad87c74a5498dbc87f5a2ddcb1a72ccf59c9243a8351f335a0a0c5445889018e8b6732c4b43aabc154cf4f0ac6b2ae8f4d3c55d95075

Download Submit
C:\Windows\SysWOW64\Lfhdlh32.exe

Filesize
192KB

MD5
498915b63ab249584e7f0cdd18d2973a

SHA1
75c0dcd0dd847991673bc89f5f97a1393aa29eab

SHA256
5ca360dbe13ba1bc10a9dc7563386487f38f35a8396a30fdfe5d0530b1102ff6

SHA512
a15b78f8bd9a70f6d51648593903ef3cdc720a1d244afdeac1f80e5e248fa8effb13c69c67557b2acfd32c3efb1f534c712132033d82dd03ba137a075da19f35

Download Submit
C:\Windows\SysWOW64\Liimncmf.exe

Filesize
192KB

MD5
e42a721aa49e418d459237cdaeec707b

SHA1
5a44747ae1849114d33d63849b608a59da47eb60

SHA256
ed08743f4320252d5a92963ebafd59b0ab955e5df1f16906353ecdc01741bafa

SHA512
243fdec211291ce3c26d254b47696c00bd68fa09e21dbc76a276ad544f435f5ccaf8036452d015f601e2880d5def1dfd39e19a5e757ab5168d03d47cfaed9c7b

Download Submit
C:\Windows\SysWOW64\Lljfpnjg.exe

Filesize
192KB

MD5
0fe464a96fc0fb75535fae8871d954e0

SHA1
a8f273be675dfa2f37ce570286ee554e4b5dfffc

SHA256
8c7200e9e9915d9c856d655edadf8b89111df0a1f62b9280e135e88fe9e0eeda

SHA512
ea439c8c215104a9d8aaebe26c6b0dafc9fdd789b69834ae0a96482f81c70545d340dd7fff079026b9a2621ea00993e4d55b995974ca17dc0a29a4e4d70b1e73

Download Submit
C:\Windows\SysWOW64\Lmppcbjd.exe

Filesize
192KB

MD5
03477b38dfd0bcca0237ffd4b7bb1316

SHA1
70871b3634424e6b00c87be0d04c724c95a77a9b

SHA256
d74b0fe36d9c08b898731f70fcb4d623cfba7caa31f728a31641dec9cace0b87

SHA512
621c474ba474d53f02006bee8898791d8628513abc4166101b93119e84e11e1560d84aae0b722b60fa57b66f945b05f8f36144ecdaadec0fa5311d9e5c17e079

Download Submit
C:\Windows\SysWOW64\Mbfkbhpa.exe

Filesize
192KB

MD5
8c0993bfd82e62b502cbb53d4e0442dc

SHA1
a106b0b4714e4e6aea77142b889a334664b68c78

SHA256
0eabd2de1460ae835d09602679d3d8922f6b94ab99e3aa563945472ff11d7919

SHA512
66be4b85e8280fd78f5a20c875ad70bb4147c9bf44fc7b04316089f3395ff33f53154a9fe2154dc48d0f2428560cf01a0e61715da74afb4eef2059cb097834a9

Download Submit
C:\Windows\SysWOW64\Mckemg32.exe

Filesize
192KB

MD5
b258dc4079fd3f3da2e38d43f6fdd125

SHA1
852881b3c05d698206103f47931028cb00578b2a

SHA256
9316fa312abe627db16f751cd22a01b961ba6472679ae0c8aad4abc3eb72b9d4

SHA512
98f334b1ca6006c51ec8f63f6968188570da60abb488441fd398c081d75fcab274d3f98d00731af46c77aba3a3cac13fd15d4dfce1afd526624896de46eac9e9

Download Submit
C:\Windows\SysWOW64\Melnob32.exe

Filesize
192KB

MD5
d01e4a9da1f0d7dad6f8bf0d699931a8

SHA1
8b985ebee4427444d597e6642aa0de262318be1e

SHA256
e954441eed29dce2570422fe12c63a58fdb4632a70c965fb2cb344ec74f804d4

SHA512
50ed76fd5ac07c8317d228eadf9398af0e19e783ad5c2dcda3d5cf4575a2a5f8cdcf66080af1c3b6ebf7d5a1f6fd7929c7186f75d04482f6329c1718768f3685

Download Submit
C:\Windows\SysWOW64\Menjdbgj.exe

Filesize
192KB

MD5
550b1d76eaf145c6d58ca172afffb775

SHA1
fa302fe2c49fed47c1cee5544666ee6def114337

SHA256
f35ccfe04ab0dfd8760836cebedbcec52a1901e8b6cba805bdbfb733680d484f

SHA512
8c4952ae208bdbbd52c04f0b91ad1e73f926ac12bd93775b7605aa30ad4fe5302b7ed8b8dd90fecdaeb246c5676f43524ed9c49a5f887ff970593e41edeb57ee

Download Submit
C:\Windows\SysWOW64\Mimpolee.exe

Filesize
192KB

MD5
bcb01177f233f528b10bed9c0778e865

SHA1
5546ed2de590617afaf992b8f1ee884cee07a18a

SHA256
3fe5ca37fa9aa619e507de6d8bf3aea06373a3bd10c83bb96cb1aa6e1dd16eff

SHA512
b42c1ed6fc9b71c0ef5f72cb6f469227a1dba8feaee7f79422e1714d8d2fd696a04060b371040e5ebdc1918e0ff91242f6ee4990d8801515dc8e49c91d5ef540

Download Submit
C:\Windows\SysWOW64\Mkohaj32.exe

Filesize
192KB

MD5
f0f3ce0bca4b45127e488bb36dad2556

SHA1
689e309ca50b72873beb8c27a9bf018099217271

SHA256
af9a5fe7cdf7a8815f4da9f62d3f4dbea38dc4ec2f3a28a78eb8e05a308014c0

SHA512
e7aaac6085892b71c98b375d84768485516e3adb467d5e4957e58756ea42f9a9f355202eff9aa68ab5fa8a8d17be385708ab84a95a092611f02c111b1fbbdaee

Download Submit
C:\Windows\SysWOW64\Mlampmdo.exe

Filesize
192KB

MD5
fb722c3f0254b7120adacb314c32f64f

SHA1
21e0cf76b05d61cacb6e2f95888b971d46235670

SHA256
c5eaa9745022ffae6dc918226e3a2e245a429c874de7cc031c985018d3df8de7

SHA512
178e16297c244ee364abcbad3f220980b38bea26e3333b82c87c7af3da59fa3d18eeee0a822e20bfe61ae396577cd1a40fbaa7a87d3f8c26cecb247cbf479f5c

Download Submit
C:\Windows\SysWOW64\Mpoefk32.exe

Filesize
192KB

MD5
6df51c7a8b8bd220948f9be6a5a52ce1

SHA1
2e04a726faaa5a1a9a0649cf6c74cc62ff51885f

SHA256
0f9be4d2eb6b6a3ae73ff88f6e0717ac2bb081efe340aae86513717d8896394f

SHA512
7a5159ecd34b3a528e999683b64174c36ddde46d0adadda72c8f0dec135c216bd34e936abb04925256d8e8a4010220b7650f6406f8ac9502fd926a8534fba9cf

Download Submit
C:\Windows\SysWOW64\Ncianepl.exe

Filesize
192KB

MD5
d9a538fb72b54dc557ac8386a050ca75

SHA1
93b19bba2072441e207c059d3c89ce1a44b007ee

SHA256
06536980fe28f9d5f5db1ca1f5caf6ce2f94b637b71634889be0c0be8aaa9938

SHA512
7135bee338d727c926a24b8a032d134cbb32799aaf077362d575e8be124c93b6f46cbb8b28272011554fca46c76e2bb5853d01f6d3f62df8304a28afa94df755

Download Submit
C:\Windows\SysWOW64\Nedjjj32.exe

Filesize
192KB

MD5
b4922ba0f7906116f02a7ce87ec535d2

SHA1
a008acbcc1f12f8c7b63c6cd38ca7a330cb101cf

SHA256
91f74802326fac9bd6b6940c56fde17b851177d27efa29a1b5960ee6abe58fd0

SHA512
b256604791b7bedfa6719e306c66d5ea44517669b749085fe99e3448a26e0815f4622f02097ae42e5fac1e04d2f3a807e06668555bfdd3418c04fd6d8f743901

Download Submit
C:\Windows\SysWOW64\Neeqea32.exe

Filesize
192KB

MD5
f454db31b4bdc0799da5bf7876a89133

SHA1
e97d5ebab24c58a4b976a2a6c28d87528a9f92ea

SHA256
6c85259e1260d1144c4631f09e6a61467da4ecc99cc282ef2070ac14539f936a

SHA512
400eaeb1a64129c9fbc670ad803304593fa4307704ff3c75cb4a4aaa2c38514383694436b4c5f53a824458e61f71a8084c2e3b2ef2f2d009b9a4bc84106c8b5f

Download Submit
C:\Windows\SysWOW64\Niakfbpa.exe

Filesize
192KB

MD5
f8416cec29e69b44e784e0b6e730a25e

SHA1
e6f9be17a2a6c6179ac9f7cb79d2c05922252ba8

SHA256
a1083362b56cdfdcd10271d82ad76d121e86c95db73b17905d4b1e8ef363cf13

SHA512
e856eb30af0350c7b6dac7d234fa73babad1ad017f1738167c979fdc6cc4743d549aff4cb80fe9971282f388300d64a6793ba339aa5c8790bb7f2f4af47ba11e

Download Submit
C:\Windows\SysWOW64\Nngokoej.exe

Filesize
192KB

MD5
7fb9375a4218b00a9924f8e10774b9f8

SHA1
f6ce23e214f6047a8d708fa53a92e1ad06ce503a

SHA256
0f4ad86ac2171c41edadf8f5d69fe98c88dccec8caf533fe1ff712026eb51582

SHA512
735fd9cc9395a59bf174d6b5f27624c42e451a2e0b6ed98d1fd03813155b11d000ede1f36c2bac868014f544c52d45ca99aaf1214b7b9a521c7dfff5eb3d4010

Download Submit
C:\Windows\SysWOW64\Nojjcj32.exe

Filesize
192KB

MD5
3e8755f9713fb92c5ce4b25c8b660672

SHA1
adae6d6f5193e32ac8147e6ab0bf9cbbc7a8cd34

SHA256
a8ac34541c3fa7568096e85c4d1c36687f08e619389bf8c2cb6b6bcc73d4ae42

SHA512
36af2bf5351e81c99310e8f7a191d567aed0026b5240c1e6d8222fe43eeeab99b850e470d79da9a5331c2d33ae9ee88628337da8a6175aec379c477e98d12071

Download Submit
C:\Windows\SysWOW64\Npcoakfp.exe

Filesize
192KB

MD5
9587f4b8ff218cf3d0f24451f213db49

SHA1
86a652a95fd40008bc00c71d298d35b405ba6ba4

SHA256
a46d46364507aa4a5ed5d9437d5944b87d710b80ccfbbd673bdcbbf7384bb056

SHA512
25526e9d334bbf07039e4e724fac9e609ee711a198461b926f83f3c0a30ad45bc8fe8d883a23fdcf059b24366e67096218238d747c8267348c5db761f4925da0

Download Submit
C:\Windows\SysWOW64\Nphhmj32.exe

Filesize
192KB

MD5
67f33eb9edd08fcdd37b72d68577c7da

SHA1
c9ffd8bd1ccddc39cf3200cd6f32d81a61135ec6

SHA256
701e3796fdc765ee0525337d03352edc3bd6c4620f9ec882433bba9b936e66ac

SHA512
45e6830827289b9b103da060571f1e9a7a4a04412fb967668932e28b6aa50fd09ce52cb28075972373f0e6f4b3d7718f5b5a1350b3ccbe36d3e4ff0b1c5a8b7c

Download Submit
C:\Windows\SysWOW64\Npmagine.exe

Filesize
192KB

MD5
bbb40f6666dcaa26d74d41fd4854a670

SHA1
8f72b4557632b3f7717c04814d76d5904997af67

SHA256
e09b067f6ad38810767fa78699db8e31300f7f64af5c123211c8dcbb7aaf0126

SHA512
f15122af7ea4a7c71a2eb613c16f2730512a2ae4f3227a17a96b29937d9d7c74138fa27ab1efba120a9f63fbd7db78877447cd6c335b99e65da3dfb7911bbcc1

Download Submit
C:\Windows\SysWOW64\Ofqpqo32.exe

Filesize
192KB

MD5
43038d970cc99011d59b90cf44aa01dc

SHA1
c852cee538f91995db8f7e1670732563acb730fa

SHA256
f8e80d3903f89f71b58c66cfc17255b870591ac57eff5b9ee4554358fe29323b

SHA512
7fc03f5257068cdad97344faeaf4ebb3614d44cfafa6e40fbc180b333b01278870dda01ed5096ecd2bcad3c94567acc40017e083a8b000a913a1635612540d79

Download Submit
C:\Windows\SysWOW64\Pcicklnn.exe

Filesize
192KB

MD5
a5dc12dc589ef2152ae44a278bf19ef4

SHA1
c447a3e5c37ee9c3e298126ff58a9110e01a774c

SHA256
36ac682d39c3c689d9fffd08fd441025e4225cb93ab7f4f5cd6fd255ee785355

SHA512
d0406139f02b0db83bfad4db02be89c50757c940c5fab3423a5f7e04f603c7b9033d01970f246f67f2dda480c9479d5c18d4f20f8098387dae4116cfe162a161

Download Submit
C:\Windows\SysWOW64\Phincl32.exe

Filesize
192KB

MD5
d15e3fc651aab447210170bf2ecf240c

SHA1
af2e81b223d2c330b1205e146edacf174fe40f56

SHA256
1e7723182401713b4266b513b39aaca1aecefdb7141b0c7f21a6cd83d6251276

SHA512
0b94df22fccf0ca4a0861e4e79f9f70028688c3e149baf65ba12eaa6988dc9cc717bc4f274f38394353a95bc018fc9597d34fd225d1111501b9745db97579758

Download Submit
C:\Windows\SysWOW64\Pjjahe32.exe

Filesize
192KB

MD5
97df4e5d947658b9fed184d4fe81eccf

SHA1
6436cb336f763d2e9fdff5a485064f544c06ec50

SHA256
8693690c4b914c98d23bfd340323587b32041ef5315acb34a118f0997060b27d

SHA512
0b0eb2a3649506d36c648aa1f5f3856f67e1ab2c0e2a92e5e615e8e609d978a0f7ee32e618baf993ac2379cae0b2234db4953b2f391c360f7661774c9b57effc

Download Submit
C:\Windows\SysWOW64\Qkmdkgob.exe

Filesize
192KB

MD5
be2bd3e22248e9a2f173848b3a07a935

SHA1
e2043d044e1b6e1ae607ab8d3e5697ef78160e6d

SHA256
e155877b356857d0975e77a523eee5ae3772ab86e28c29831bfef2cfac55a691

SHA512
59f469a3c094751bdef84b8f526295501d45478df0fead13ccf32ebe67576702e9b410b6e68ad11c00979a1c0a2b3e66e2ff0321d8d38f5e7141ca7b24bef949

Download Submit
memory/696-185-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1072-288-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1124-312-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1188-249-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1284-88-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1284-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1284-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1292-230-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1384-330-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1520-158-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1556-33-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1560-342-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1704-133-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1760-41-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1828-60-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1908-306-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1984-209-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1992-318-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2108-137-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2240-73-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2260-202-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2344-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2416-132-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2512-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3116-241-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3276-218-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3372-270-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3404-294-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3412-161-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3600-100-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3828-48-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3916-324-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3956-169-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3972-178-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3992-194-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4028-340-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4412-276-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4452-304-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4472-286-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4496-146-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4520-144-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4628-109-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4664-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4828-257-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4852-234-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4916-264-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4924-65-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4980-102-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5028-131-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5124-348-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5164-354-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5204-360-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5244-370-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5284-372-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5328-378-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5368-384-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5408-390-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5452-396-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5492-402-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5564-408-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5604-414-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5644-420-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5684-426-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5724-432-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads