f83ee4d09cb0859513809d952eeb1fe40126f12f878bc8b70efaf2a33072bf36

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f83ee4d09cb0859513809d952eeb1fe40126f12f878bc8b70efaf2a33072bf36.exe
Size

78KB
MD5

28cdccd75f024b498d769ed32d888ab0
SHA1

6e07cd1cdf4672522cd6718e285364ca79995cf5
SHA256

f83ee4d09cb0859513809d952eeb1fe40126f12f878bc8b70efaf2a33072bf36
SHA512

149eee5b1bb6e9d917a4efa63e56ec0d9221ca5eb1d2b2f6d0a6f98d3ec063b28e88c61bab37b30fe24227058a3048deb5f3b9d7b8b2cb8c578df48f2e2aeb38
SSDEEP

1536:heVhYHY8HGY+ifzqHgeP9R+20iVGN+zL20gJi1ie:hglNY+6zqHgs+20iVGgzL20WKt

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpocjdld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mglack32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojhiqefo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dadeieea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dddojq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Peqcjkfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjpiha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cknnpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chbnia32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmjlcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmijbcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdckfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clnjjpod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfpcgpae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmoahijl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lklnhlfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcojkhap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbllbibl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpbmco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfcfml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daolnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pggbkagp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adgbpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcojkhap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cafigg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekemhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdgljmcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekemhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nckndeni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kaqcbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnihcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nljofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhikcb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkjmlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dccbbhld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kemhff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lepncd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmdkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dllfkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqnaim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iihkpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfngap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acqimo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qchmagie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njfmke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnnanphk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hckjacjg.exe

Executes dropped EXE 64 IoCs

pid	Process
336	Jbkjjblm.exe
3668	Jfffjqdf.exe
3812	Jidbflcj.exe
4452	Jpojcf32.exe
2340	Jbmfoa32.exe
4524	Jkdnpo32.exe
2980	Jigollag.exe
1924	Jdmcidam.exe
3744	Jfkoeppq.exe
4992	Jkfkfohj.exe
4432	Kaqcbi32.exe
4560	Kdopod32.exe
1960	Kkihknfg.exe
3784	Kilhgk32.exe
3108	Kacphh32.exe
3020	Kdaldd32.exe
3568	Kkkdan32.exe
2548	Kaemnhla.exe
1840	Kknafn32.exe
1432	Kipabjil.exe
3816	Kpjjod32.exe
1788	Kkpnlm32.exe
2188	Kibnhjgj.exe
3148	Kpmfddnf.exe
3740	Kkbkamnl.exe
2256	Lpocjdld.exe
4572	Ldkojb32.exe
3120	Liggbi32.exe
4804	Lpappc32.exe
1972	Lgkhlnbn.exe
3100	Laalifad.exe
3660	Ldohebqh.exe
996	Lnhmng32.exe
760	Lpfijcfl.exe
3576	Lklnhlfb.exe
1952	Lphfpbdi.exe
4672	Lgbnmm32.exe
4536	Mjqjih32.exe
2896	Mpkbebbf.exe
1132	Mdfofakp.exe
400	Mgekbljc.exe
4756	Mjcgohig.exe
3448	Majopeii.exe
4796	Mdiklqhm.exe
4884	Mgghhlhq.exe
3220	Mkbchk32.exe
412	Mnapdf32.exe
872	Mdkhapfj.exe
3772	Mkepnjng.exe
4592	Mjhqjg32.exe
4952	Maohkd32.exe
3940	Mdmegp32.exe
2808	Mglack32.exe
2396	Mkgmcjld.exe
4476	Mjjmog32.exe
1428	Mnfipekh.exe
4312	Maaepd32.exe
5068	Mdpalp32.exe
2884	Mgnnhk32.exe
3248	Nkjjij32.exe
1780	Nnhfee32.exe
2204	Nacbfdao.exe
3204	Nqfbaq32.exe
732	Ndbnboqb.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Aafdghob.dll	Pclneicb.exe
File created	C:\Windows\SysWOW64\Ddakjkqi.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Lpcqcc32.dll	Hflcbngh.exe
File opened for modification	C:\Windows\SysWOW64\Kpeiioac.exe	Kmfmmcbo.exe
File created	C:\Windows\SysWOW64\Ngpjnkpf.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Jnmkhg32.dll	Ojalgcnd.exe
File created	C:\Windows\SysWOW64\Gokdeeec.exe	Gmlhii32.exe
File created	C:\Windows\SysWOW64\Dgdelcpg.dll	Jcefno32.exe
File opened for modification	C:\Windows\SysWOW64\Nckndeni.exe	Nlaegk32.exe
File created	C:\Windows\SysWOW64\Ogpnaafp.dll	Ngedij32.exe
File opened for modification	C:\Windows\SysWOW64\Gcagkdba.exe	Gkkojgao.exe
File created	C:\Windows\SysWOW64\Hflcbngh.exe	Hobkfd32.exe
File created	C:\Windows\SysWOW64\Odaoecld.dll	Pfolbmje.exe
File created	C:\Windows\SysWOW64\Ldfgeigq.dll	Agoabn32.exe
File created	C:\Windows\SysWOW64\Anmnemcc.dll	Aanjpk32.exe
File created	C:\Windows\SysWOW64\Ejdofn32.dll	Cbjoljdo.exe
File opened for modification	C:\Windows\SysWOW64\Hobkfd32.exe	Hmcojh32.exe
File created	C:\Windows\SysWOW64\Lnhjmp32.dll	Jcllonma.exe
File created	C:\Windows\SysWOW64\Allebf32.dll	Lekehdgp.exe
File created	C:\Windows\SysWOW64\Ogndib32.dll	Liggbi32.exe
File created	C:\Windows\SysWOW64\Nnolfdcn.exe	Nkqpjidj.exe
File opened for modification	C:\Windows\SysWOW64\Ocbddc32.exe	Olhlhjpd.exe
File created	C:\Windows\SysWOW64\Hobkfd32.exe	Hmcojh32.exe
File opened for modification	C:\Windows\SysWOW64\Icnpmp32.exe	Ilghlc32.exe
File created	C:\Windows\SysWOW64\Ingapb32.dll	Jlbgha32.exe
File opened for modification	C:\Windows\SysWOW64\Nbhkac32.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Bdknoa32.dll	Nbhkac32.exe
File opened for modification	C:\Windows\SysWOW64\Ojalgcnd.exe	Ogcpjhoq.exe
File created	C:\Windows\SysWOW64\Qnnanphk.exe	Qjbena32.exe
File created	C:\Windows\SysWOW64\Bgdpie32.dll	Beeflhdh.exe
File created	C:\Windows\SysWOW64\Efpmmmoo.dll	Ckedalaj.exe
File created	C:\Windows\SysWOW64\Efhaoapj.dll	Llemdo32.exe
File opened for modification	C:\Windows\SysWOW64\Aqppkd32.exe	Anadoi32.exe
File created	C:\Windows\SysWOW64\Mgbpghdn.dll	Aminee32.exe
File opened for modification	C:\Windows\SysWOW64\Eabbjc32.exe	Eleiam32.exe
File created	C:\Windows\SysWOW64\Dndgjk32.dll	Ieolehop.exe
File opened for modification	C:\Windows\SysWOW64\Miifeq32.exe	Mcpnhfhf.exe
File created	C:\Windows\SysWOW64\Kkbkamnl.exe	Kpmfddnf.exe
File opened for modification	C:\Windows\SysWOW64\Pjffbc32.exe	Pghieg32.exe
File opened for modification	C:\Windows\SysWOW64\Qjpiha32.exe	Qgallfcq.exe
File opened for modification	C:\Windows\SysWOW64\Cajcbgml.exe	Colffknh.exe
File created	C:\Windows\SysWOW64\Clbceo32.exe	Cdkldb32.exe
File created	C:\Windows\SysWOW64\Cnkplejl.exe	Cfdhkhjj.exe
File opened for modification	C:\Windows\SysWOW64\Cegdnopg.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Hflheb32.dll	Lpcfkm32.exe
File created	C:\Windows\SysWOW64\Agoabn32.exe	Accfbokl.exe
File opened for modification	C:\Windows\SysWOW64\Cfpnph32.exe	Cabfga32.exe
File opened for modification	C:\Windows\SysWOW64\Mkbchk32.exe	Mgghhlhq.exe
File opened for modification	C:\Windows\SysWOW64\Ojhiqefo.exe	Okeieh32.exe
File created	C:\Windows\SysWOW64\Fgnjkdco.dll	Behbag32.exe
File created	C:\Windows\SysWOW64\Ippohl32.dll	Jlpkba32.exe
File created	C:\Windows\SysWOW64\Bfajji32.dll	Ldleel32.exe
File created	C:\Windows\SysWOW64\Dmjocp32.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Febgea32.exe	Fkmchi32.exe
File created	C:\Windows\SysWOW64\Knkffk32.dll	Fchddejl.exe
File opened for modification	C:\Windows\SysWOW64\Fbnafb32.exe	Fooeif32.exe
File opened for modification	C:\Windows\SysWOW64\Mplhql32.exe	Megdccmb.exe
File opened for modification	C:\Windows\SysWOW64\Pcppfaka.exe	Pqbdjfln.exe
File created	C:\Windows\SysWOW64\Bnmqkjel.dll	Fkmchi32.exe
File created	C:\Windows\SysWOW64\Gkhbdg32.exe	Fdnjgmle.exe
File opened for modification	C:\Windows\SysWOW64\Pmdkch32.exe	Pjeoglgc.exe
File created	C:\Windows\SysWOW64\Ifoihl32.dll	Pqbdjfln.exe
File created	C:\Windows\SysWOW64\Jhbffb32.dll	Bmemac32.exe
File created	C:\Windows\SysWOW64\Djnkap32.dll	Qmkadgpo.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11856	11760	WerFault.exe	564

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldanqkki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lebkhc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aneonqmj.dll"	Bjdkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Clnjjpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adopjh32.dll"	Ifjodl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eepjpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Miifeq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oboaabga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmbcpkhj.dll"	Bbifelba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flioncbc.dll"	Dkjmlk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdmcidam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgcqbd32.dll"	Pjhbgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jclhkbae.dll"	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Meknidfo.dll"	Qbimoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffgqqaip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlklhm32.dll"	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpcqcc32.dll"	Hflcbngh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cefofm32.dll"	Jioaqfcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfjhkjle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dekclg32.dll"	Gmjlcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkikkeeo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgfqmfde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naekcf32.dll"	Oqfdnhfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nacbfdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpqdba32.dll"	Bhikcb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cahfmgoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohbkfake.dll"	Ojgbfocc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgngp32.dll"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kacphh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agbnmibj.dll"	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dddojq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbagnedl.dll"	Pncgmkmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dccbbhld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmcojh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odbgim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjmcmj32.dll"	Pqpnombl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifclaeem.dll"	Oqbamo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knkffk32.dll"	Fchddejl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hobkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paadbk32.dll"	Ffgqqaip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkoqfnpl.dll"	Jeklag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deimfpda.dll"	Ldanqkki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdckfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njcqqgjb.dll"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjmlbbdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Alfkbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahoimd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbnafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifgbnlmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcioiood.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgqhjop.dll"	Ldkojb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcojkhap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qgciaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjljbfog.dll"	Fkciihgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipknlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hleecc32.dll"	Mpjlklok.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 336	4196	f83ee4d09cb0859513809d952eeb1fe40126f12f878bc8b70efaf2a33072bf36.exe	86
PID 4196 wrote to memory of 336	4196	f83ee4d09cb0859513809d952eeb1fe40126f12f878bc8b70efaf2a33072bf36.exe	86
PID 4196 wrote to memory of 336	4196	f83ee4d09cb0859513809d952eeb1fe40126f12f878bc8b70efaf2a33072bf36.exe	86
PID 336 wrote to memory of 3668	336	Jbkjjblm.exe	88
PID 336 wrote to memory of 3668	336	Jbkjjblm.exe	88
PID 336 wrote to memory of 3668	336	Jbkjjblm.exe	88
PID 3668 wrote to memory of 3812	3668	Jfffjqdf.exe	89
PID 3668 wrote to memory of 3812	3668	Jfffjqdf.exe	89
PID 3668 wrote to memory of 3812	3668	Jfffjqdf.exe	89
PID 3812 wrote to memory of 4452	3812	Jidbflcj.exe	90
PID 3812 wrote to memory of 4452	3812	Jidbflcj.exe	90
PID 3812 wrote to memory of 4452	3812	Jidbflcj.exe	90
PID 4452 wrote to memory of 2340	4452	Jpojcf32.exe	91
PID 4452 wrote to memory of 2340	4452	Jpojcf32.exe	91
PID 4452 wrote to memory of 2340	4452	Jpojcf32.exe	91
PID 2340 wrote to memory of 4524	2340	Jbmfoa32.exe	92
PID 2340 wrote to memory of 4524	2340	Jbmfoa32.exe	92
PID 2340 wrote to memory of 4524	2340	Jbmfoa32.exe	92
PID 4524 wrote to memory of 2980	4524	Jkdnpo32.exe	93
PID 4524 wrote to memory of 2980	4524	Jkdnpo32.exe	93
PID 4524 wrote to memory of 2980	4524	Jkdnpo32.exe	93
PID 2980 wrote to memory of 1924	2980	Jigollag.exe	95
PID 2980 wrote to memory of 1924	2980	Jigollag.exe	95
PID 2980 wrote to memory of 1924	2980	Jigollag.exe	95
PID 1924 wrote to memory of 3744	1924	Jdmcidam.exe	96
PID 1924 wrote to memory of 3744	1924	Jdmcidam.exe	96
PID 1924 wrote to memory of 3744	1924	Jdmcidam.exe	96
PID 3744 wrote to memory of 4992	3744	Jfkoeppq.exe	97
PID 3744 wrote to memory of 4992	3744	Jfkoeppq.exe	97
PID 3744 wrote to memory of 4992	3744	Jfkoeppq.exe	97
PID 4992 wrote to memory of 4432	4992	Jkfkfohj.exe	98
PID 4992 wrote to memory of 4432	4992	Jkfkfohj.exe	98
PID 4992 wrote to memory of 4432	4992	Jkfkfohj.exe	98
PID 4432 wrote to memory of 4560	4432	Kaqcbi32.exe	99
PID 4432 wrote to memory of 4560	4432	Kaqcbi32.exe	99
PID 4432 wrote to memory of 4560	4432	Kaqcbi32.exe	99
PID 4560 wrote to memory of 1960	4560	Kdopod32.exe	100
PID 4560 wrote to memory of 1960	4560	Kdopod32.exe	100
PID 4560 wrote to memory of 1960	4560	Kdopod32.exe	100
PID 1960 wrote to memory of 3784	1960	Kkihknfg.exe	101
PID 1960 wrote to memory of 3784	1960	Kkihknfg.exe	101
PID 1960 wrote to memory of 3784	1960	Kkihknfg.exe	101
PID 3784 wrote to memory of 3108	3784	Kilhgk32.exe	103
PID 3784 wrote to memory of 3108	3784	Kilhgk32.exe	103
PID 3784 wrote to memory of 3108	3784	Kilhgk32.exe	103
PID 3108 wrote to memory of 3020	3108	Kacphh32.exe	104
PID 3108 wrote to memory of 3020	3108	Kacphh32.exe	104
PID 3108 wrote to memory of 3020	3108	Kacphh32.exe	104
PID 3020 wrote to memory of 3568	3020	Kdaldd32.exe	105
PID 3020 wrote to memory of 3568	3020	Kdaldd32.exe	105
PID 3020 wrote to memory of 3568	3020	Kdaldd32.exe	105
PID 3568 wrote to memory of 2548	3568	Kkkdan32.exe	106
PID 3568 wrote to memory of 2548	3568	Kkkdan32.exe	106
PID 3568 wrote to memory of 2548	3568	Kkkdan32.exe	106
PID 2548 wrote to memory of 1840	2548	Kaemnhla.exe	107
PID 2548 wrote to memory of 1840	2548	Kaemnhla.exe	107
PID 2548 wrote to memory of 1840	2548	Kaemnhla.exe	107
PID 1840 wrote to memory of 1432	1840	Kknafn32.exe	108
PID 1840 wrote to memory of 1432	1840	Kknafn32.exe	108
PID 1840 wrote to memory of 1432	1840	Kknafn32.exe	108
PID 1432 wrote to memory of 3816	1432	Kipabjil.exe	109
PID 1432 wrote to memory of 3816	1432	Kipabjil.exe	109
PID 1432 wrote to memory of 3816	1432	Kipabjil.exe	109
PID 3816 wrote to memory of 1788	3816	Kpjjod32.exe	110

C:\Users\Admin\AppData\Local\Temp\f83ee4d09cb0859513809d952eeb1fe40126f12f878bc8b70efaf2a33072bf36.exe
"C:\Users\Admin\AppData\Local\Temp\f83ee4d09cb0859513809d952eeb1fe40126f12f878bc8b70efaf2a33072bf36.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\Jbkjjblm.exe
  C:\Windows\system32\Jbkjjblm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Windows\SysWOW64\Jfffjqdf.exe
    C:\Windows\system32\Jfffjqdf.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\Windows\SysWOW64\Jidbflcj.exe
      C:\Windows\system32\Jidbflcj.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3812
    - - C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4452
      - C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1924
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3744
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1960
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3784
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2548
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1840
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1432
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3816
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        23⤵
        Executes dropped EXE
        
        PID:1788
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        24⤵
        Executes dropped EXE
        
        PID:2188
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3148
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        26⤵
        Executes dropped EXE
        
        PID:3740
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2256
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4572
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3120
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4804
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        31⤵
        Executes dropped EXE
        
        PID:1972
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        32⤵
        Executes dropped EXE
        
        PID:3100
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        33⤵
        Executes dropped EXE
        
        PID:3660
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        34⤵
        Executes dropped EXE
        
        PID:996
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        35⤵
        Executes dropped EXE
        
        PID:760
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3576
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        37⤵
        Executes dropped EXE
        
        PID:1952
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        38⤵
        Executes dropped EXE
        
        PID:4672
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        39⤵
        Executes dropped EXE
        
        PID:4536
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        40⤵
        Executes dropped EXE
        
        PID:2896
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        41⤵
        Executes dropped EXE
        
        PID:1132
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        42⤵
        Executes dropped EXE
        
        PID:400
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        43⤵
        Executes dropped EXE
        
        PID:4756
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        44⤵
        Executes dropped EXE
        
        PID:3448
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4796
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4884
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        47⤵
        Executes dropped EXE
        
        PID:3220
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:412
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        49⤵
        Executes dropped EXE
        
        PID:872
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        50⤵
        Executes dropped EXE
        
        PID:3772
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        51⤵
        Executes dropped EXE
        
        PID:4592
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        52⤵
        Executes dropped EXE
        
        PID:4952
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        53⤵
        Executes dropped EXE
        
        PID:3940
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2808
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        55⤵
        Executes dropped EXE
        
        PID:2396
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        56⤵
        Executes dropped EXE
        
        PID:4476
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1428
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4312
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        59⤵
        Executes dropped EXE
        
        PID:5068
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        60⤵
        Executes dropped EXE
        
        PID:2884
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        61⤵
        Executes dropped EXE
        
        PID:3248
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        62⤵
        Executes dropped EXE
        
        PID:1780
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2204
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3204
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:732
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        66⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        67⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        68⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        69⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        70⤵
        Drops file in System32 directory
        
        PID:2988
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        71⤵
        Drops file in System32 directory
        
        PID:4372
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        72⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        73⤵
        Drops file in System32 directory
        
        PID:828
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        74⤵
        Drops file in System32 directory
        
        PID:4736
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        75⤵
        
        PID:388
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        76⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        77⤵
        
        PID:632
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        78⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3620
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2144
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        81⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        82⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        83⤵
        Drops file in System32 directory
        
        PID:4280
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:912
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        85⤵
        Modifies registry class
        
        PID:4912
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        86⤵
        Modifies registry class
        
        PID:3560
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        87⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        88⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        89⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        90⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        91⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        92⤵
        
        PID:836
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        93⤵
        Modifies registry class
        
        PID:4868
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        94⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        95⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        96⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        97⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        98⤵
        Drops file in System32 directory
        
        PID:5244
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        99⤵
        Drops file in System32 directory
        
        PID:5284
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        100⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        101⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        102⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        103⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5544
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        105⤵
        Drops file in System32 directory
        
        PID:5580
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        106⤵
        Drops file in System32 directory
        
        PID:5624
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        107⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        108⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        109⤵
        Modifies registry class
        
        PID:5764
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        111⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        112⤵
        Modifies registry class
        
        PID:5884
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        113⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        114⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6028
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        116⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        117⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        118⤵
        Modifies registry class
        
        PID:772
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5152
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        120⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        121⤵
        Drops file in System32 directory
        
        PID:5300
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5372
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        123⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        124⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        125⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5704
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        127⤵
        Modifies registry class
        
        PID:5752
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        128⤵
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5860
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        130⤵
        Modifies registry class
        
        PID:5964
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        131⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        132⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        133⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        134⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        135⤵
        Drops file in System32 directory
        
        PID:5380
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        136⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        137⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        138⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        139⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        140⤵
        Modifies registry class
        
        PID:6060
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        141⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        142⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        143⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        144⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        145⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        146⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        147⤵
        Modifies registry class
        
        PID:5912
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        148⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        149⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        150⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        151⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        152⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        153⤵
        Drops file in System32 directory
        
        PID:6380
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        154⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        155⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        156⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        157⤵
        Modifies registry class
        
        PID:6544
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        158⤵
        Drops file in System32 directory
        
        PID:6596
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        159⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        160⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        161⤵
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        162⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        163⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        164⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6896
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        166⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        167⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        168⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        169⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        170⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        171⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        172⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6244
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        174⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6396
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        176⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        177⤵
        Modifies registry class
        
        PID:6532
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        178⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6664
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6748
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        181⤵
        Drops file in System32 directory
        
        PID:6840
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        182⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        183⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        184⤵
        Drops file in System32 directory
        
        PID:7056
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        185⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        186⤵
        Drops file in System32 directory
        
        PID:5368
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        187⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        188⤵
        Drops file in System32 directory
        
        PID:6356
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6476
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6604
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        191⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        192⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        193⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        194⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7156
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6256
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        198⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6916
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7132
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        201⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        202⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        203⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        204⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        205⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        206⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6852
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        208⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        209⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        210⤵
        Drops file in System32 directory
        
        PID:7252
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        211⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        212⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        213⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        214⤵
        Modifies registry class
        
        PID:7412
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        215⤵
        Drops file in System32 directory
        
        PID:7452
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        216⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        217⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        218⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        219⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        220⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        221⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        222⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        223⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7800
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        224⤵
        Modifies registry class
        
        PID:7848
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        225⤵
        Modifies registry class
        
        PID:7904
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        226⤵
        Drops file in System32 directory
        
        PID:7952
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        227⤵
        Modifies registry class
        
        PID:7996
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        228⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        229⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        230⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        231⤵
        Drops file in System32 directory
        
        PID:8160
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        232⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        233⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7288
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        235⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        236⤵
        Drops file in System32 directory
        
        PID:7444
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        237⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7568
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        239⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7696
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        241⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        242⤵
        Drops file in System32 directory
        
        PID:7864
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        243⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        244⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        245⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        246⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        247⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        248⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7356
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        250⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        251⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7576
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        252⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7688
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        253⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7728
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        254⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        255⤵
        Modifies registry class
        
        PID:8048
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        256⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        257⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        258⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        259⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        260⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        261⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        262⤵
        Modifies registry class
        
        PID:8144
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        263⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        264⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        265⤵
        Modifies registry class
        
        PID:8068
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        266⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        267⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        268⤵
        Modifies registry class
        
        PID:7460
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7968
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        270⤵
        Drops file in System32 directory
        
        PID:7656
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        271⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        272⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        273⤵
        Drops file in System32 directory
        
        PID:8316
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        274⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        275⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        276⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        277⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        278⤵
        Modifies registry class
        
        PID:8540
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        279⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        280⤵
        Drops file in System32 directory
        
        PID:8624
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        281⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        282⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        283⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        284⤵
        Drops file in System32 directory
        
        PID:8800
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        285⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        286⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        287⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        288⤵
        Drops file in System32 directory
        
        PID:8968
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        289⤵
        Modifies registry class
        
        PID:9008
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        290⤵
        Modifies registry class
        
        PID:9052
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        291⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        292⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        293⤵
        Drops file in System32 directory
        
        PID:9172
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        294⤵
        Modifies registry class
        
        PID:9212
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8224
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        296⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8372
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        298⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        299⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        300⤵
        Drops file in System32 directory
        
        PID:8584
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        301⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        302⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8836
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        304⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        305⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        306⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        307⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        308⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        309⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        310⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8656
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8828
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        313⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        314⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        315⤵
        Drops file in System32 directory
        
        PID:8272
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        316⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        317⤵
        Drops file in System32 directory
        
        PID:8832
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        318⤵
        Drops file in System32 directory
        
        PID:8996
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        319⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        320⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        321⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        322⤵
        Drops file in System32 directory
        
        PID:8532
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        323⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        324⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9220
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        326⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        327⤵
        Modifies registry class
        
        PID:9304
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        328⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        329⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        330⤵
        Modifies registry class
        
        PID:9440
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        331⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        332⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9568
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        334⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        335⤵
        Modifies registry class
        
        PID:9648
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        336⤵
        Drops file in System32 directory
        
        PID:9692
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        337⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        338⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        339⤵
        Modifies registry class
        
        PID:9820
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        340⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        341⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        342⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        343⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        344⤵
        Drops file in System32 directory
        
        PID:10040
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        345⤵
        Modifies registry class
        
        PID:10080
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        346⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        347⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10212
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        349⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        350⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        351⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        352⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        353⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        354⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        355⤵
        Drops file in System32 directory
        
        PID:9608
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9668
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        357⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        358⤵
        Modifies registry class
        
        PID:1152
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        359⤵
        Modifies registry class
        
        PID:9836
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        360⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        361⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        362⤵
        Modifies registry class
        
        PID:10012
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        363⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        364⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        365⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        366⤵
        Drops file in System32 directory
        
        PID:9252
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        367⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        368⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        369⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        370⤵
        Modifies registry class
        
        PID:9700
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        371⤵
        Modifies registry class
        
        PID:220
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        372⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        373⤵
        Modifies registry class
        
        PID:9932
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        374⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        375⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        376⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9416
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        378⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        379⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        380⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        381⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10232
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        383⤵
        Drops file in System32 directory
        
        PID:9284
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3888
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        385⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        386⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        387⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        388⤵
        Modifies registry class
        
        PID:9956
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        389⤵
        Drops file in System32 directory
        
        PID:9388
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        390⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        391⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        392⤵
        Drops file in System32 directory
        
        PID:10244
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        393⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        394⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        395⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        396⤵
        Drops file in System32 directory
        
        PID:10424
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        397⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10504
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        399⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        400⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        401⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10672
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        403⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        404⤵
        Modifies registry class
        
        PID:10756
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        405⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10792
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        406⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10876
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        408⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        409⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        410⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        411⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11048
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        412⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        413⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11172
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        415⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        416⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10260
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        418⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        419⤵
        Drops file in System32 directory
        
        PID:10408
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        420⤵
        Drops file in System32 directory
        
        PID:10468
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        421⤵
        Drops file in System32 directory
        
        PID:5340
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        422⤵
        Modifies registry class
        
        PID:10500
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        423⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        424⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        425⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        426⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        427⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        428⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        429⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        430⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        431⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11124
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        432⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        433⤵
        Modifies registry class
        
        PID:10200
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        434⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        435⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        436⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        437⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        438⤵
        Drops file in System32 directory
        
        PID:10628
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        439⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        440⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10848
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        441⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        442⤵
        Drops file in System32 directory
        
        PID:11080
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        443⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        444⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        445⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        446⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        447⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        448⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11120
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        450⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        451⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        452⤵
        Modifies registry class
        
        PID:10700
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        453⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10388
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10680
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        456⤵
        Drops file in System32 directory
        
        PID:11236
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        457⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        458⤵
        Modifies registry class
        
        PID:11164
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        459⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        460⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        461⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        462⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        463⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11468
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        464⤵
        Drops file in System32 directory
        
        PID:11504
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        465⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        466⤵
        Drops file in System32 directory
        
        PID:11596
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        467⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        468⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        469⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        470⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11760 -s 396
        471⤵
        Program crash
        
        PID:11856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 11760 -ip 11760
1⤵
PID:11832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ajkaii32.exe

Filesize
78KB

MD5
5a2ff278782f5698be00b9518564409a

SHA1
be09f728ac451011440011d6a4dec51600491db8

SHA256
a89786ed9848b93cf7ed05b1f7408a2b4b1548b2257d0ca913859f8122e406ff

SHA512
8c26eb425832237681bdfb4e0c2f956a0d6de9de0883cd2e531f0d3d79e589d8057ac764aafec926659be5463508720e1f1dfc8aae2a9254a2503a991a52b95c

Download Submit
C:\Windows\SysWOW64\Anadoi32.exe

Filesize
78KB

MD5
92365517a700ddba27adc76b9900347b

SHA1
14c01c9796bc46eb020e904c196edef73bbac43d

SHA256
653b37589e4be49555dc66bf54e9842336a01679408a6e5250684de4e717e50b

SHA512
b5eda522fe47b64b2f3bba29c7a043fa3109da3836b3724430fe79838da2b40adc963d55527b8d7e45f9029c451a3138a793be7c0e00c61f68a05ce3f6a4b41c

Download Submit
C:\Windows\SysWOW64\Banllbdn.exe

Filesize
78KB

MD5
751bd18ca4f1bb9a37bc1e09dcb840f8

SHA1
754d460b0e575bdee23ce66ee605c3bffedb710f

SHA256
ab1ac6eecf8e9788226194157de20c72a41564e05745ac64942354ded9a3f86b

SHA512
c4f7fc41840808b0818d2d7e96674b125eb239feb52c214f1c3e46198980a57ad93e1a5dc4d432fa2821f77140a100cd03edbc32a91dec3f6d959f99a6401505

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
78KB

MD5
9ca07d526a732ddc60a0292a05f17002

SHA1
0d9455a95e67d55574a3ae613ce447a8a9b95ab3

SHA256
684af5ba1fa0fc6bc7fe86ff4ca392a6a6d57c7ec9cbddb6988490a44b1c711d

SHA512
fa6fe2b9910b4c2c58ab171f6097f6bf02bc738a095542ce108595ff6501c623b6122942b675e2b054c598f7e755c1d188fe582d92d4705375036af9ac1b4ded

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
78KB

MD5
714c4f2ad8cc78f601c18fff4b19676a

SHA1
66d1d59505a7dc18ee1016dce5a2d713c6f21699

SHA256
e4690786104c7337eebec86054fc31c02f145f4d78a66f8cfb283045153ae1a8

SHA512
8022194f3233221a37074599cd5f202538cb220c3479c8d44a8cf0d959474f0d727eb197d9c216c45130bfa4f7c560394f671636284a41e605ae506de7566c8a

Download Submit
C:\Windows\SysWOW64\Cecbmf32.exe

Filesize
78KB

MD5
51b5dc450eada24ec976c91483ee6df9

SHA1
2b932b6dee9e1a47757ad3b03879dcc95b9465e3

SHA256
7c0dd03c13498e6c1468bd572d1d214eefd1a8d807014a714c79f02f69aebc9c

SHA512
12bbdfbc193c128067ee3f4d03f2b40299d0172be4d7f96750d0a9ef701818eadd7b197b584898f3d3200e68a204a1f2587310211396e61de550f33c3b6d1e6a

Download Submit
C:\Windows\SysWOW64\Colffknh.exe

Filesize
78KB

MD5
a10c6a365781310a96f736d0eb9e91af

SHA1
5c06f19319a880195b50e77c5e451a1727ab5e9f

SHA256
0fa8fa4827fb38a4d361e4e768e317cf2d122361fd736f0a9a5d77d4d6cf652c

SHA512
0211be700df6bf47bd06f8c587ca09442d5ead622a4fb35a8d7e22aae4c42d7c8c4c4cfb7db884e31f2414fb749f7d057fc687df5b68b0bba7b134df9990aae9

Download Submit
C:\Windows\SysWOW64\Dllfkn32.exe

Filesize
78KB

MD5
cfba8b736cd258257761ec8e3c4ba44b

SHA1
7a931cf008e75f5561394b5ca0328f9751b21ce6

SHA256
6f0a004eff0ec6046763af10bf526c2d22368487a1c64e5c83567de6f515c01f

SHA512
488e9c8bdcb2afe4a0ce40770fc3f96d6ee7b6244addbde087fb38acd38ba79beed73b42d10ad488bcbc588674d19083fd403e513c93f40271561e71c16554c1

Download Submit
C:\Windows\SysWOW64\Fhqcam32.exe

Filesize
78KB

MD5
f95e24ca47b213f8329e9de904597773

SHA1
84ebf4cafecf44bc4f8a1c28e0bdd97850f7cc83

SHA256
52f6a39ba95fa92a1731e1ebe290d104d558cedd8b7d44d9bf15f5fea07fae85

SHA512
dc778633dd2c8a311fee587584655c7ec3b83bb93828179fc470baa25a1c6fb8c16ece38c288ed44e287b7e649ab1b2dd402fb64371c5861f93f168e49d0c9a0

Download Submit
C:\Windows\SysWOW64\Heapdjlp.exe

Filesize
78KB

MD5
b908041d5d1e62ac0614162cfe2b4aeb

SHA1
86b741cf8c8a2d18d20fefb33818905c5b440aad

SHA256
95b56ee428cc08d7fa9a68561bf12284a30b611b03f398584ed22d6546b1a8c5

SHA512
b7fdfebb3742e70c3bde407bbba77190f580ba0390e7ad09fc1687bcc02e833a61ade3d5261b094534f8fd753dd7168c4b2b6c758e532adcb88affaa0f3e93bb

Download Submit
C:\Windows\SysWOW64\Jbkjjblm.exe

Filesize
78KB

MD5
61a414007096c6e9986cc1de80f40cef

SHA1
bc6b1951fb5ac367d17f980fd17122645c660d70

SHA256
4490defd8905e6db5801513e143d1c0a063763401d94e728e5cb5ce478576e71

SHA512
1d997abb7ba2d0fd39b6fe0ad404764607b242d8ca1d76aba8e3d4beed7d834fb2bec0005a6704cc39ddc70627a03c3bc3ce0099a82204ec3199085ba91f3078

Download Submit
C:\Windows\SysWOW64\Jbmfoa32.exe

Filesize
78KB

MD5
385f6fa4df5d5db96e30e5ee0d5bc91f

SHA1
42c65e53fd84caa72a7e5d8d80d19a8e14f48aa5

SHA256
a6739cfb1e00ec790b21a397bad1ea729ca303e8d219662736191c0dba963b8b

SHA512
807ca83d8223b9f6c4bd1bade079d21762d73e60da5fe70bf5d6220baa38b74d11940c98f8003ef0357ce1d2820c48024b75ce365d41858df812eda68f722ba8

Download Submit
C:\Windows\SysWOW64\Jcllonma.exe

Filesize
78KB

MD5
f6ef7a2b37b28cb015252781027e8481

SHA1
d5e7b8a1eafe97f362bc6c35cc1db2fafd1cc015

SHA256
a00a162208ff7b0952a8242be2161b3885819737b92a87d7f0b090ce39f76380

SHA512
9d53d967537181fb3d143bf8def3a80fa224dc0cfc85f9160667f9b013488d376f05f519c81c894c270643d30a7380b7a41903c577e4598b27d0727fd5023b5e

Download Submit
C:\Windows\SysWOW64\Jdmcidam.exe

Filesize
78KB

MD5
eb3eff03573685f2a92e89a87ddd973b

SHA1
43c52d02a60b3eaad007aa1979bdcac9cecc0da2

SHA256
f369675c0b0c10ee8153522dae0814c93117803ea39ba3f32817b46580344b6b

SHA512
9c28a9ab7be90554a5aafd54b08962b7fe7173903838294cda98be07e7014cab660770cd8a732cc24c81d2b08e441c96f69b9fc5130ed71309a44f1efbd64611

Download Submit
C:\Windows\SysWOW64\Jfffjqdf.exe

Filesize
78KB

MD5
7954e1abfd5679d9205a6b2d761930ee

SHA1
ea5e836ac0cc633b4fb85ac4e3d0b84b3476ee87

SHA256
c4a2f356f85a1057d9131fdd6aef904592569b775afa8f5421de6d127076579e

SHA512
74b7f11db05276f5751d173b869bc784b36ae81ead6596c25d17a13687027e9019bdd80952952ccadd859138eca774be0c2b6835ca5fc0e538ed5e00392d5635

Download Submit
C:\Windows\SysWOW64\Jfkoeppq.exe

Filesize
78KB

MD5
2751a5fe82d0c3f8642d141a61e2859e

SHA1
af74338157957cf07a5593053f49fb4fe292d448

SHA256
4d26079428638abbaeaa67bbd6e5bd9a0904b473fb6269e60864a83c9e68e522

SHA512
20209aefb9bcabc94fbe4ea586a8a027426310dddf80d29b27a52bd8621959e0e6a4d794a402aa58db622922a9c9d315c79590ade82d8c6e09b06ac5604ea97c

Download Submit
C:\Windows\SysWOW64\Jidbflcj.exe

Filesize
78KB

MD5
ee85c70380e8909849dd83f46389c8b4

SHA1
d5d349f68f207fbf7eb1020bf866c66ca0a9fc60

SHA256
ddde068ef6aa2e28f69a76777141f1f78de809962262db3297b1f1850339aa2b

SHA512
154002720c252e19e72ec31b0d2bea5635ea5cbe0dd9b7260bab8146b13ed54d6aca5a15cc61c0c5dea4be7c6569e4fc928b9e987bd4c5be8808f25f0734cfae

Download Submit
C:\Windows\SysWOW64\Jigollag.exe

Filesize
78KB

MD5
506433c2d7272d60e542120d3d7458a6

SHA1
5c5a47a74ef4ffded01ba7fcc5488ab6634f0e5a

SHA256
850827b8456a0540abede4031be300c4e001888c07eaeb6fb994ccc626355866

SHA512
0da2aeb3351db7de01dd5bc10e9c54c0e993ae942dd7dd3ad9cc512469a0867de0cea4b723d81e3a357960ece55cad55c39940c16a7af0948670ac1b98881c09

Download Submit
C:\Windows\SysWOW64\Jkdnpo32.exe

Filesize
78KB

MD5
f300a33e8d0f56cf98747d48b6cd4309

SHA1
7790ce35c16ace09b5172924e575afc3feabdb07

SHA256
da0aa342e14f707c4c167ec4dbfe968514b36d70357af08e2528a401de0e26fc

SHA512
f65fd1bc1a93b1a7ff2b4a99d71a553acf2cb553fe7b3efb4d920e10414c3e4333d0a3f8e2cdc8f48efcfe5d84d7afe5a8f751dd9ee1ba749952089b4da05e0e

Download Submit
C:\Windows\SysWOW64\Jkfkfohj.exe

Filesize
78KB

MD5
0980bd2de52e4913b01120e45796efa3

SHA1
7f74ca1607b89f5f9e98cb6121803ebf42af6c6e

SHA256
87a4e0d75b59ab217d2bdec681cc93936efec8acc03f89c5c2fb0a1e0a9b3ee7

SHA512
87ec62e2b08d558cf20cc1d93e291f7d895abdac15e26d4f25d44b100823f91281d34cc0f884a2c7898a7a6bc63e6da28cd69598367090caa14e54e5309ce7b5

Download Submit
C:\Windows\SysWOW64\Jlpkba32.exe

Filesize
78KB

MD5
f6966e258fc9a0a2dc265128266de6a8

SHA1
839e43534c5a6fa7b880ba0982c62abfd2a44563

SHA256
d7d2b9dc6e24fbaf7ca3739d5115c52699209d555888d890bc8ab6f564e017aa

SHA512
1d3b5b9dbb33967ba69435fd6a910f2e97a41e9876e9b9be3a73fdc28d0ed440963d67c926296ef39f74924b9a78357e6c2f3e96911e120c2cbcda099f4d584a

Download Submit
C:\Windows\SysWOW64\Jpojcf32.exe

Filesize
78KB

MD5
551429bd375111fc04a18ed36f0df95e

SHA1
0c0b24b91fe1e24bd1204476b84c271b51fcc394

SHA256
437bf78c88c8a892c0649e48bb5bca788a56e7ca7ef96ebcc104363ece920506

SHA512
22cdf304185f3c3409cac8444172b9899fda87e8bab17e190eea31d216fb2ed983f19397ebddc2601f5fc3afcc2891a59d217b7be407db3a20bb3ad870506692

Download Submit
C:\Windows\SysWOW64\Kacphh32.exe

Filesize
78KB

MD5
bfb055980ec6d8d3904dd9bb7792080c

SHA1
86c81dd470c6706ac739c131d439779c9cdeb8ca

SHA256
fe93de7d1474b28113790d1fdea3dfb61f34506c14e7d71f67f6e60d4d1366e2

SHA512
03ead6597e3565df4964ca82ab4655cf167b41e33306ea2ad249c32fc342d51a66d226132a99bab2957348121cbf23ea740cf9aaf71294c1f5ae1e6757a87af5

Download Submit
C:\Windows\SysWOW64\Kaemnhla.exe

Filesize
78KB

MD5
bdbc38eb0340356265b5a7c344fab3dc

SHA1
2d496daa7062b2102c21254d889f3595b25435c7

SHA256
d27134615fa4fce16af3071c130574c529c8aad91ae3aa71ca9bc1df2f117829

SHA512
709f1b94c90ac14ffb1460e5b8f2f800923939aa2fcd9c285335a243c753804b3293cfd401737ee25d74811a4b6139cb2cd2627c25afa1536695fbc67e75cb6f

Download Submit
C:\Windows\SysWOW64\Kaqcbi32.exe

Filesize
78KB

MD5
1b2827fdbd4588c3846ae6963fcb10ee

SHA1
5ac7caf3da3c463b7cf152eb58660db952c7ae1c

SHA256
89499806008a757e77751beab37f068b3107563487975121efaa321f4a1e627c

SHA512
591542e3a4355b50ff14a962a82b8ec8804b877b92bbb42ab5f1a3801525d3ba92ffce15a38eab609973a86ad8f0274b52736ff4035c9b5fc949047e927c4086

Download Submit
C:\Windows\SysWOW64\Kdaldd32.exe

Filesize
78KB

MD5
5757867021e51ca9e4497cd14bbe588f

SHA1
ebf95f1d5958eab6334bd51c3d3a19cb7b1486bb

SHA256
1a8a39d4146cd9210da779757264d8b9dc2b1723fca1dab67208bd165fd6f532

SHA512
161bf88f890376f0ff904942d8ccf4a32247cb4bf41967b590beced5fec65abf4a231c8a5b3ff71572b063cdaeeb1b40ddc264fcadc220acec3071fa0d35989c

Download Submit
C:\Windows\SysWOW64\Kdopod32.exe

Filesize
78KB

MD5
594ddf632e8c43d9e3f34c67fef21945

SHA1
5a3d411434a41a4c1d600ba50a680ef78f0d7afc

SHA256
48963fd5a8b845ec658b7634e3b7cc7d6409c1a07fe9c9f2cfddb7e342df7816

SHA512
39195c5d935f321971ba714721807402394320c2852d5fcbb9608198b95ed036b3bd6e5ba2abbae90617e98ea82c90c6ced475922bbc555e3f10619085caf7a0

Download Submit
C:\Windows\SysWOW64\Kibnhjgj.exe

Filesize
78KB

MD5
6759e2338969e9f3614b3ff6c560dcd1

SHA1
9c6c74e90dd4b9aaa63c583c0451ed2199f4accd

SHA256
d701ae340dd1709e4698787fb3b0f3e1051144923d0b9832cfd7d0b6d7b97bb5

SHA512
ea29de4ed6b86120db1ea243de4eeb087e6bec669161cf098e255fc9ef98f5276d967e804e5646d904f862c40f5d3b1441b1df5ed8416bb9daed7087c7054bc9

Download Submit
C:\Windows\SysWOW64\Kilhgk32.exe

Filesize
78KB

MD5
55e0177bb92383f3274df4b127f8c8dd

SHA1
3943ca8ba62824779f1fd1b0fb075bafc62fbb16

SHA256
b12ebcb2fba75b555feeb5a1c7fe919f2136de5a4085aafbc623f37c8aba9b0b

SHA512
794c2895486cb5f10bc6e7e44fbca4a026c7f1f124b7c0bba3d202768521caaa11e9e6f3c6dff5b2cae507569f0fd1c9fb11395ca60cfcdc0118fc9df2cea8ad

Download Submit
C:\Windows\SysWOW64\Kipabjil.exe

Filesize
78KB

MD5
7a328c711518ea1c019dc92969fd2d84

SHA1
8764da6fd34687109a74ea874eca7cf553e7be7b

SHA256
0b747191cfe990415ac3eb53a72d6b3fd32df12ea2d05cbce51eff425fe2333b

SHA512
408a023ccbe3686576303a7864f5d6bd6f22343c729e2a264dbfa8c27f8eec6b7849fa7668bb7baad24895ba79c9f650eb9ea11076400f3df086ef510abcb415

Download Submit
C:\Windows\SysWOW64\Kkbkamnl.exe

Filesize
78KB

MD5
fdce15fb72cb86d189f99d8268399e94

SHA1
97e0392594606c9c7ed3196e6177dfb11289be39

SHA256
81f8b275b3cef02e7af4ddb7de05786f7b3e7aa10eff241d3105285feef26745

SHA512
317ab55c1a4fccbe29382a3bc709f6e9f4bffb239ed3de1e269bb15d527f5995a50a27e94067686ab0e718175afae357fa7d8941c245bcd3e13d1dff9ffadef5

Download Submit
C:\Windows\SysWOW64\Kkihknfg.exe

Filesize
78KB

MD5
3ae20570522b7b3a0dd5abf32fc7338e

SHA1
f0e7564754e8db6f01b6661872e4a46f64f0d883

SHA256
93279e64aeaab405937fcdb7c9cbdcca6bcb61b625b9459147f43f8fca9894da

SHA512
202bb9026f9e9ce94fa4b378c1da60043e92e1863ca6d2278f6e7ad369abcf357a0e2251b2e19da8f56cb84df139c0e156540199cd7148589fd9a758a1eb7249

Download Submit
C:\Windows\SysWOW64\Kkkdan32.exe

Filesize
78KB

MD5
f0e4e26d433f1334f36eb50d0e817fb8

SHA1
640153deaf22ed4d1ad8338e7f6a275805520436

SHA256
1ff01e535f108e72296f20597c4f3890ec4f2080061986ad6e754439823e89eb

SHA512
2d32bde8713682169645fbe5050013e88de27127bfa44b61b376aa19b8bb8aee0a60549ec370c88aaa5f5c8b6cb06a7a1ce90834f6a26cfe330ff3e01c9f7288

Download Submit
C:\Windows\SysWOW64\Kknafn32.exe

Filesize
78KB

MD5
5518c4346d362769ba864df357ca2091

SHA1
789c4487313d1ed9c538a297f1fd7e82366e6d3b

SHA256
0c8b18243c200b2a9b92437bdb445e904d341e01cec482cbd9a932591a283119

SHA512
dc5b0cbe08d503771702a5a0d4f4b986449ef7246822f747bc1aa7bf18338f10ced6b084b8a2a277192665c69f38213ddac4f3d9d70fe4f5be4cb5a1e01af4e8

Download Submit
C:\Windows\SysWOW64\Kkpnlm32.exe

Filesize
78KB

MD5
c001e6057b01bffdee4bd869607f784c

SHA1
10769a83362460d59761a83b4865b86821d2b92f

SHA256
99f13793cc2bcadcc3fa4c7b55221a43dd826e73349ab59a4100999c577591f9

SHA512
3993de77b111e35768e122872faf0672f80424a975ce4fb57c2a4ab37c51250c6c9f9fc1e5503166f2df70e515dc8fc20d4aadf0d77dbd5c52448501c2a0b26c

Download Submit
C:\Windows\SysWOW64\Kpjjod32.exe

Filesize
78KB

MD5
003e752356f9868a599d57621265c38e

SHA1
beb673342546afa4984d2ba914f5d05b9ee796c2

SHA256
c35807a84207feca8ff9f4e6eaf09266bb5ec6c9d27a7202570f0ea827b16999

SHA512
5a74d46dc6ca0e58e3805e94581a07d268d00dcbb756c0b9b6b52d2a767f8800f6952ae83a0e7415e8bf7286be27b559b45f690daabf05a6da90828710d5e5fe

Download Submit
C:\Windows\SysWOW64\Kpmfddnf.exe

Filesize
78KB

MD5
fa31d804ed37228addfcd24d828ec7a2

SHA1
e28712e4f6af4230817af48883dca5a0e5a44f64

SHA256
049479b8eba57d05beefffae0526bd68fe39c4068ea98a07fd7bf69a5bc9a89d

SHA512
c3552a50836e4ef1c5452e522afb9e84dea360473ab78546c6b5084fccb2612f8d28c864e83f77469e08e6cf0d6cec637a742fd0925498b8af66b2856d857786

Download Submit
C:\Windows\SysWOW64\Laalifad.exe

Filesize
78KB

MD5
cefea2d2342af66650f8cbbfa73f3cad

SHA1
83a5a3d049c58fa9179cf08c2947a330a7ddd253

SHA256
c308f0d39a10eefff9fc703d074bb5a52af8f8daa59017c28619b918a8c31ca4

SHA512
7ca4ac8b6222daaeb2d23d5889a9a7df56134140177f40a3dd62082c0287d8368de776f6ec04c3bc8c25c99eae359569a115e76c316aab7928c274d1194efa86

Download Submit
C:\Windows\SysWOW64\Ldkojb32.exe

Filesize
78KB

MD5
af54eea767c4c4c89836599bdca380d9

SHA1
82d0aeaca3ee19a6e2e354c6f3ae42c45b56cf35

SHA256
1f402d162c572fd35b0f21ff34c658258dcefc1afbd5bb87e3e5cd2aac46c199

SHA512
2982f65bf22dca7c7f75b4f5600e708b4175f62070a7a27f1a1012ed387010b4cad9e6d1310a8bc9798ad3379d61587fe6e21cd9535fb50fd51849ab1eab062f

Download Submit
C:\Windows\SysWOW64\Ldohebqh.exe

Filesize
78KB

MD5
b7802b1dae76ce5cb186b2d4c0f930f4

SHA1
b44ce7b60318d61d88e8bf0a47f6d2110edcb7ec

SHA256
1bfe68ac3db46cd084524cbece4be3b52b85f84440494c1dfff8061f4898e7e4

SHA512
3388ad0447c063502f3fb88b302ea31a2d83eeac220788f81bdd978ca43db808a2b781034c6631dc2c346b546c0fd83dd66b82f7aed8b278a47b30328f445f3e

Download Submit
C:\Windows\SysWOW64\Lgkhlnbn.exe

Filesize
78KB

MD5
0d524fe50a0013aeb12811bba7d778cf

SHA1
6443dc46fe35c2d4cb160eaf3a6c35a4df538dcc

SHA256
2b6498239bae46d257ecdcec91034e9565d9bf3529756b2015ffd6fb6673cc14

SHA512
1a59c2b46a82f5f41f53831f9831ded35b67a70d565b7ffc992c00e67f925fca6f2cea19872be8024190878df3ef6de2c3d6a72311e956c1d55578c01216e4d3

Download Submit
C:\Windows\SysWOW64\Liggbi32.exe

Filesize
78KB

MD5
b1130923a9f7b619a06bb104c3e90188

SHA1
c3cb522d4eb46c76e3ead97a11c4242171ca1856

SHA256
4d366de13712f05fcf9816459bdbef40761e20853b79ee0a8fc70e931dbe03b1

SHA512
eaaaa143b8b4daddb563c4daec64e74eb89687a7e145144f90e0864e1970cfb70565c4100811914f06bacf76d55582ab8702e29f0c06a7c547ae20d4d2d58089

Download Submit
C:\Windows\SysWOW64\Lpappc32.exe

Filesize
78KB

MD5
ad5650e7aa15ac464f73c6fb2b7020d8

SHA1
6e8c36baddcbffb0139bc8a7d9948c74cb27d82d

SHA256
d187618b0f3f7bb753b0b9178ce37260b253fa3536524af8c14c6f04c2913fb5

SHA512
85ad1f339c6d2854a3a7f3fcbe9c7ae2d1fe54c1282b0d4f1975e159785a6d51f449c72500c33bd8ff0e69bd36e4dea14c6d47b248b6f510a3b524b66ea412c4

Download Submit
C:\Windows\SysWOW64\Lpocjdld.exe

Filesize
78KB

MD5
ae0cc173878383e1ee944c9509c21dad

SHA1
9a0d21b2b70849bb4ee231402e8ff0c152389615

SHA256
2efe9ec650642a04d6241da3882a1fe7f6a9ce0844223ee94c89cfad388a7e62

SHA512
7dc414bfecae219bb52a3cd0c123f3ed65186c0953ef1d1563f51c369a6461e3b6de32e08af7f826e259b053bd6f427650622dc655f0ee111e933a9090cf9cea

Download Submit
C:\Windows\SysWOW64\Mdhdajea.exe

Filesize
78KB

MD5
e12bfbf0a5d53602da57e12894ad3fa5

SHA1
1480c5fc9c480c43d45c80f7e542c2a819253c58

SHA256
65a3e69a9fbfd3ba8d7ab3bed2acf8dbe47c2bfe511829c6216ca8e9d3884eaf

SHA512
838ac5a4c7810caf4b1084e51972aefd7f5c4771ee605ed09b3c6ecba765a18b1fb121a9f1a50b5465d2cc75ab4981265824f155b2f86f4767d1bf22c6e06027

Download Submit
C:\Windows\SysWOW64\Oqbamo32.exe

Filesize
78KB

MD5
9ffdabe7cc2c18ba38c82a4313dab960

SHA1
6e86eca33db6bfd2ba5c74105cfd89562cd692d8

SHA256
8400dd8a98654ab7403e11db7c7a03696154015966c1fdf278df0f2f41113aa2

SHA512
a41437b6c6271564ebc6c9d34f0df4987bed2813395e2f071655089e3fb95e9400ab817dda17b24479196ee423d9e39b7daf0a7343ed0f4f93017ae7d10f8433

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
78KB

MD5
df8d114843f7ebf485fd4598da2a3c96

SHA1
72399b62bba963f2a15a4e8bdcdf557cb2c0aa6d

SHA256
6ca17942aef86b8ce3b4b9f15f101f8bd1b6fc874073984a48fe5eb4e1b1fedf

SHA512
de8a94203a087233424fffa9081445a41fdce1e51cb868977e065a4345c636fbefb85ddda63e99fc2440b371148957afc7f9cc9f308c303dab7c042ef5e05e77

Download Submit
memory/336-14-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/400-325-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/760-286-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/996-277-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1132-323-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1432-170-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1788-190-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1840-250-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1840-158-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1924-172-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1924-65-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1952-294-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1952-357-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1960-114-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1972-258-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2188-283-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2188-192-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2256-218-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2256-300-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2340-41-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2340-121-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2548-154-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2896-313-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2980-61-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3020-145-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3100-264-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3108-138-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3120-240-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3148-205-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3148-285-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3448-338-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3568-146-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3576-287-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3576-354-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3660-270-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3660-331-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3668-96-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3668-16-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3740-293-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3740-210-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3744-73-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3744-187-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3784-131-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3812-25-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3812-106-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3816-179-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4196-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4196-8-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4432-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4432-197-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4452-128-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4452-35-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4524-49-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4524-149-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4536-307-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4560-97-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4560-208-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4572-230-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4672-305-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4756-336-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4796-344-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4804-247-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4884-356-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4992-85-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads