ad6cca6f178167ededb87e6715295545dacf7be4e0ce7bb03352ea5306fb9f07

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2752e1f509e3c0cf88432c9773f38b58.exe
Size

128KB
MD5

2752e1f509e3c0cf88432c9773f38b58
SHA1

f29154be53805937884ec6dfff5e3e1669f3dded
SHA256

ad6cca6f178167ededb87e6715295545dacf7be4e0ce7bb03352ea5306fb9f07
SHA512

1ccbee3870d5f1c69eed27d5f63c9fa3b013374b2da9845b9914a7eb06a853753236e52988baa0400a0848447a4cd371afca69c32a8a41617a7b220d19517e5e
SSDEEP

3072:MarsZzR9BNd2vOhDrLXfzoeqarm9mTKpAImA:3rGR2vOtXfxqySSKpRmA

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Onmhgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdkldb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klngdpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmdina32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Megdccmb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogljjiei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnpemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dafbne32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dedkdcie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbbkaako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Abkjdnoa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boepel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghaliknf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eofbch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnfdcjkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcbpab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdifoehl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqbamo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eolpmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jeaikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dlijfneg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ogbipa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmbmibhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndhmhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Opdghh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onklabip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Onklabip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fdnjgmle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkkojgao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ildkgc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldjhpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Migjoaaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kphmie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnpemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pghieg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Foabofnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhpjkojk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fljcmlfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkaejf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ilidbbgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dldpkoil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kfjhkjle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mglack32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klimip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odocigqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjkombfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Faihkbci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmijbcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nfgmjqop.exe

Executes dropped EXE 64 IoCs

pid	Process
4372	Kphmie32.exe
4548	Kbfiep32.exe
924	Kknafn32.exe
4576	Kmlnbi32.exe
4444	Kpjjod32.exe
1816	Kcifkp32.exe
2644	Kpmfddnf.exe
3924	Kckbqpnj.exe
2756	Liekmj32.exe
1328	Lalcng32.exe
4236	Ldkojb32.exe
2152	Liggbi32.exe
672	Ldmlpbbj.exe
1436	Lkgdml32.exe
4508	Laalifad.exe
4908	Lcbiao32.exe
4872	Lilanioo.exe
2716	Ldaeka32.exe
2476	Lgpagm32.exe
2508	Ljnnch32.exe
4720	Lphfpbdi.exe
4228	Lgbnmm32.exe
3432	Lknjmkdo.exe
1004	Mjcgohig.exe
3952	Majopeii.exe
1924	Mcklgm32.exe
4256	Mkbchk32.exe
1012	Mpolqa32.exe
1840	Mkepnjng.exe
556	Maohkd32.exe
4392	Mglack32.exe
224	Mdpalp32.exe
4000	Nkjjij32.exe
1768	Nacbfdao.exe
4976	Nceonl32.exe
744	Nklfoi32.exe
1608	Nafokcol.exe
4556	Nddkgonp.exe
1384	Ngcgcjnc.exe
3080	Nbhkac32.exe
1256	Ndghmo32.exe
1908	Nkqpjidj.exe
1488	Nqmhbpba.exe
764	Nggqoj32.exe
4424	Njfmke32.exe
2824	Nqpego32.exe
2068	Okeieh32.exe
3556	Oqbamo32.exe
3024	Odnnnnfe.exe
4896	Ogljjiei.exe
3408	Ojjffddl.exe
3728	Oqdoboli.exe
1380	Ogogoi32.exe
464	Obdkma32.exe
2760	Odbgim32.exe
4316	Okloegjl.exe
116	Onklabip.exe
2196	Odednmpm.exe
1432	Ogcpjhoq.exe
4912	Onmhgb32.exe
4088	Odgqdlnj.exe
4348	Pgemphmn.exe
448	Pnpemb32.exe
2220	Pqnaim32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ogqnnn32.dll	Dhkapp32.exe
File opened for modification	C:\Windows\SysWOW64\Leihbeib.exe	Lbjlfi32.exe
File opened for modification	C:\Windows\SysWOW64\Nnneknob.exe	Nfgmjqop.exe
File created	C:\Windows\SysWOW64\Djoeni32.dll	Ocnjidkf.exe
File opened for modification	C:\Windows\SysWOW64\Cdkldb32.exe	Camphf32.exe
File created	C:\Windows\SysWOW64\Lmiciaaj.exe	Lebkhc32.exe
File created	C:\Windows\SysWOW64\Bnecbhin.dll	Medgncoe.exe
File created	C:\Windows\SysWOW64\Hppdbdbc.dll	Ogpmjb32.exe
File opened for modification	C:\Windows\SysWOW64\Aadifclh.exe	Aminee32.exe
File created	C:\Windows\SysWOW64\Cliaoq32.exe	Cacmah32.exe
File created	C:\Windows\SysWOW64\Lommhphi.dll	Bjmnoi32.exe
File created	C:\Windows\SysWOW64\Iihqganf.dll	Lenamdem.exe
File created	C:\Windows\SysWOW64\Bcobhnfc.dll	Pnpemb32.exe
File created	C:\Windows\SysWOW64\Ahoimd32.exe	Aealah32.exe
File created	C:\Windows\SysWOW64\Fhcpgmjf.exe	Faihkbci.exe
File created	C:\Windows\SysWOW64\Nfgmjqop.exe	Ngdmod32.exe
File opened for modification	C:\Windows\SysWOW64\Ojaelm32.exe	Ogbipa32.exe
File created	C:\Windows\SysWOW64\Kmlnbi32.exe	Kknafn32.exe
File created	C:\Windows\SysWOW64\Dbaemi32.exe	Dkjmlk32.exe
File created	C:\Windows\SysWOW64\Fdnjgmle.exe	Fbpnkama.exe
File opened for modification	C:\Windows\SysWOW64\Hkfoeega.exe	Hihbijhn.exe
File opened for modification	C:\Windows\SysWOW64\Jfaedkdp.exe	Jcbihpel.exe
File created	C:\Windows\SysWOW64\Oahicipe.dll	Acqimo32.exe
File opened for modification	C:\Windows\SysWOW64\Aminee32.exe	Ajkaii32.exe
File created	C:\Windows\SysWOW64\Bganhm32.exe	Bebblb32.exe
File created	C:\Windows\SysWOW64\Blpnib32.exe	Bdhfhe32.exe
File opened for modification	C:\Windows\SysWOW64\Ibjjhn32.exe	Ipknlb32.exe
File created	C:\Windows\SysWOW64\Jioaqfcc.exe	Jfaedkdp.exe
File created	C:\Windows\SysWOW64\Fbnkjc32.dll	Kepelfam.exe
File opened for modification	C:\Windows\SysWOW64\Olcbmj32.exe	Njefqo32.exe
File opened for modification	C:\Windows\SysWOW64\Olkhmi32.exe	Onhhamgg.exe
File opened for modification	C:\Windows\SysWOW64\Mdpalp32.exe	Mglack32.exe
File created	C:\Windows\SysWOW64\Fhqcam32.exe	Fafkecel.exe
File created	C:\Windows\SysWOW64\Fbnafb32.exe	Fooeif32.exe
File created	C:\Windows\SysWOW64\Enlqgg32.dll	Hmjdjgjo.exe
File created	C:\Windows\SysWOW64\Klgqcqkl.exe	Kiidgeki.exe
File opened for modification	C:\Windows\SysWOW64\Kbfbkj32.exe	Kpgfooop.exe
File created	C:\Windows\SysWOW64\Kqgmgehp.dll	Mlefklpj.exe
File created	C:\Windows\SysWOW64\Dnhqigge.dll	Pcccfh32.exe
File opened for modification	C:\Windows\SysWOW64\Agffge32.exe	Aegikj32.exe
File created	C:\Windows\SysWOW64\Hckjacjg.exe	Hmabdibj.exe
File created	C:\Windows\SysWOW64\Lmgfda32.exe	Likjcbkc.exe
File created	C:\Windows\SysWOW64\Hiclgb32.dll	Onhhamgg.exe
File created	C:\Windows\SysWOW64\Pnfdcjkg.exe	Pfolbmje.exe
File created	C:\Windows\SysWOW64\Qopkop32.dll	Bebblb32.exe
File created	C:\Windows\SysWOW64\Lpggmhkg.dll	Ceehho32.exe
File created	C:\Windows\SysWOW64\Nddkgonp.exe	Nafokcol.exe
File created	C:\Windows\SysWOW64\Jjjald32.dll	Dejacond.exe
File created	C:\Windows\SysWOW64\Lphfpbdi.exe	Ljnnch32.exe
File created	C:\Windows\SysWOW64\Oendmdab.dll	Jpppnp32.exe
File created	C:\Windows\SysWOW64\Nedmmlba.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Ppaaagol.dll	Kphmie32.exe
File opened for modification	C:\Windows\SysWOW64\Pcccfh32.exe	Pbbgnpgl.exe
File created	C:\Windows\SysWOW64\Bnnjen32.exe	Blpnib32.exe
File opened for modification	C:\Windows\SysWOW64\Eamhodmf.exe	Eoolbinc.exe
File opened for modification	C:\Windows\SysWOW64\Migjoaaf.exe	Mgimcebb.exe
File created	C:\Windows\SysWOW64\Laqpgflj.dll	Qddfkd32.exe
File created	C:\Windows\SysWOW64\Ickfifmb.dll	Aeiofcji.exe
File created	C:\Windows\SysWOW64\Eifnachf.dll	Cnicfe32.exe
File opened for modification	C:\Windows\SysWOW64\Okeieh32.exe	Nqpego32.exe
File created	C:\Windows\SysWOW64\Mlhbal32.exe	Miifeq32.exe
File opened for modification	C:\Windows\SysWOW64\Fhqcam32.exe	Fafkecel.exe
File created	C:\Windows\SysWOW64\Gokdeeec.exe	Ghaliknf.exe
File created	C:\Windows\SysWOW64\Ecnpbjmi.dll	Hbgmcnhf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12116	12020	WerFault.exe	567

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpggmhkg.dll"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jheiojpj.dll"	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pnpemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aldomc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Adapgfqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eheqhpfp.dll"	Immapg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lmbmibhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njfmke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dceohhja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fbnafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fplmmdoj.dll"	Ldoaklml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fcckif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pnakhkol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bhfonc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkoggkjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kmijbcpl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nlmllkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjbnapki.dll"	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Laalifad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fdialn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfgkmfoj.dll"	Gkkojgao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jfaedkdp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lebkhc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnonbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibjjh32.dll"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ceipnc32.dll"	Qjpiha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iclnemml.dll"	Aegikj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ipknlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adopjh32.dll"	Iemppiab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Klimip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjbodfcj.dll"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Okloegjl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cajcbgml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjgfjhqm.dll"	Pggbkagp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ldjhpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeheh32.dll"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdfbibnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcbldglg.dll"	Demecd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khkaedic.dll"	Gokdeeec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oendmdab.dll"	Jpppnp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdiooblp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Glebhjlg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gfngap32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gblngpbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jplfcpin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnngob32.dll"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gbiaapdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ibqpimpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jlbgha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gijloo32.dll"	Klgqcqkl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 4372	2572	2752e1f509e3c0cf88432c9773f38b58.exe	85
PID 2572 wrote to memory of 4372	2572	2752e1f509e3c0cf88432c9773f38b58.exe	85
PID 2572 wrote to memory of 4372	2572	2752e1f509e3c0cf88432c9773f38b58.exe	85
PID 4372 wrote to memory of 4548	4372	Kphmie32.exe	86
PID 4372 wrote to memory of 4548	4372	Kphmie32.exe	86
PID 4372 wrote to memory of 4548	4372	Kphmie32.exe	86
PID 4548 wrote to memory of 924	4548	Kbfiep32.exe	87
PID 4548 wrote to memory of 924	4548	Kbfiep32.exe	87
PID 4548 wrote to memory of 924	4548	Kbfiep32.exe	87
PID 924 wrote to memory of 4576	924	Kknafn32.exe	88
PID 924 wrote to memory of 4576	924	Kknafn32.exe	88
PID 924 wrote to memory of 4576	924	Kknafn32.exe	88
PID 4576 wrote to memory of 4444	4576	Kmlnbi32.exe	89
PID 4576 wrote to memory of 4444	4576	Kmlnbi32.exe	89
PID 4576 wrote to memory of 4444	4576	Kmlnbi32.exe	89
PID 4444 wrote to memory of 1816	4444	Kpjjod32.exe	90
PID 4444 wrote to memory of 1816	4444	Kpjjod32.exe	90
PID 4444 wrote to memory of 1816	4444	Kpjjod32.exe	90
PID 1816 wrote to memory of 2644	1816	Kcifkp32.exe	91
PID 1816 wrote to memory of 2644	1816	Kcifkp32.exe	91
PID 1816 wrote to memory of 2644	1816	Kcifkp32.exe	91
PID 2644 wrote to memory of 3924	2644	Kpmfddnf.exe	92
PID 2644 wrote to memory of 3924	2644	Kpmfddnf.exe	92
PID 2644 wrote to memory of 3924	2644	Kpmfddnf.exe	92
PID 3924 wrote to memory of 2756	3924	Kckbqpnj.exe	93
PID 3924 wrote to memory of 2756	3924	Kckbqpnj.exe	93
PID 3924 wrote to memory of 2756	3924	Kckbqpnj.exe	93
PID 2756 wrote to memory of 1328	2756	Liekmj32.exe	94
PID 2756 wrote to memory of 1328	2756	Liekmj32.exe	94
PID 2756 wrote to memory of 1328	2756	Liekmj32.exe	94
PID 1328 wrote to memory of 4236	1328	Lalcng32.exe	95
PID 1328 wrote to memory of 4236	1328	Lalcng32.exe	95
PID 1328 wrote to memory of 4236	1328	Lalcng32.exe	95
PID 4236 wrote to memory of 2152	4236	Ldkojb32.exe	97
PID 4236 wrote to memory of 2152	4236	Ldkojb32.exe	97
PID 4236 wrote to memory of 2152	4236	Ldkojb32.exe	97
PID 2152 wrote to memory of 672	2152	Liggbi32.exe	98
PID 2152 wrote to memory of 672	2152	Liggbi32.exe	98
PID 2152 wrote to memory of 672	2152	Liggbi32.exe	98
PID 672 wrote to memory of 1436	672	Ldmlpbbj.exe	99
PID 672 wrote to memory of 1436	672	Ldmlpbbj.exe	99
PID 672 wrote to memory of 1436	672	Ldmlpbbj.exe	99
PID 1436 wrote to memory of 4508	1436	Lkgdml32.exe	101
PID 1436 wrote to memory of 4508	1436	Lkgdml32.exe	101
PID 1436 wrote to memory of 4508	1436	Lkgdml32.exe	101
PID 4508 wrote to memory of 4908	4508	Laalifad.exe	102
PID 4508 wrote to memory of 4908	4508	Laalifad.exe	102
PID 4508 wrote to memory of 4908	4508	Laalifad.exe	102
PID 4908 wrote to memory of 4872	4908	Lcbiao32.exe	103
PID 4908 wrote to memory of 4872	4908	Lcbiao32.exe	103
PID 4908 wrote to memory of 4872	4908	Lcbiao32.exe	103
PID 4872 wrote to memory of 2716	4872	Lilanioo.exe	104
PID 4872 wrote to memory of 2716	4872	Lilanioo.exe	104
PID 4872 wrote to memory of 2716	4872	Lilanioo.exe	104
PID 2716 wrote to memory of 2476	2716	Ldaeka32.exe	105
PID 2716 wrote to memory of 2476	2716	Ldaeka32.exe	105
PID 2716 wrote to memory of 2476	2716	Ldaeka32.exe	105
PID 2476 wrote to memory of 2508	2476	Lgpagm32.exe	106
PID 2476 wrote to memory of 2508	2476	Lgpagm32.exe	106
PID 2476 wrote to memory of 2508	2476	Lgpagm32.exe	106
PID 2508 wrote to memory of 4720	2508	Ljnnch32.exe	107
PID 2508 wrote to memory of 4720	2508	Ljnnch32.exe	107
PID 2508 wrote to memory of 4720	2508	Ljnnch32.exe	107
PID 4720 wrote to memory of 4228	4720	Lphfpbdi.exe	108

C:\Users\Admin\AppData\Local\Temp\2752e1f509e3c0cf88432c9773f38b58.exe
"C:\Users\Admin\AppData\Local\Temp\2752e1f509e3c0cf88432c9773f38b58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\Kphmie32.exe
  C:\Windows\system32\Kphmie32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\SysWOW64\Kbfiep32.exe
    C:\Windows\system32\Kbfiep32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\SysWOW64\Kknafn32.exe
      C:\Windows\system32\Kknafn32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:924
    - - C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4576
      - C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3924
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4236
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:672
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4228
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        24⤵
        Executes dropped EXE
        
        PID:3432
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        25⤵
        Executes dropped EXE
        
        PID:1004
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        26⤵
        Executes dropped EXE
        
        PID:3952
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        27⤵
        Executes dropped EXE
        
        PID:1924
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        28⤵
        Executes dropped EXE
        
        PID:4256
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        29⤵
        Executes dropped EXE
        
        PID:1012
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        30⤵
        Executes dropped EXE
        
        PID:1840
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        31⤵
        Executes dropped EXE
        
        PID:556
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4392
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        33⤵
        Executes dropped EXE
        
        PID:224
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        34⤵
        Executes dropped EXE
        
        PID:4000
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        35⤵
        Executes dropped EXE
        
        PID:1768
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4976
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        37⤵
        Executes dropped EXE
        
        PID:744
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1608
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        39⤵
        Executes dropped EXE
        
        PID:4556
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        40⤵
        Executes dropped EXE
        
        PID:1384
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        41⤵
        Executes dropped EXE
        
        PID:3080
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        42⤵
        Executes dropped EXE
        
        PID:1256
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        43⤵
        Executes dropped EXE
        
        PID:1908
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        44⤵
        Executes dropped EXE
        
        PID:1488
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:764
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4424
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2824
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        48⤵
        Executes dropped EXE
        
        PID:2068
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3556
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        50⤵
        Executes dropped EXE
        
        PID:3024
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4896
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        52⤵
        Executes dropped EXE
        
        PID:3408
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        53⤵
        Executes dropped EXE
        
        PID:3728
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        54⤵
        Executes dropped EXE
        
        PID:1380
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        55⤵
        Executes dropped EXE
        
        PID:464
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        56⤵
        Executes dropped EXE
        
        PID:2760
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4316
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        59⤵
        Executes dropped EXE
        
        PID:2196
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        60⤵
        Executes dropped EXE
        
        PID:1432
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4912
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        62⤵
        Executes dropped EXE
        
        PID:4088
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        63⤵
        Executes dropped EXE
        
        PID:4348
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:448
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        65⤵
        Executes dropped EXE
        
        PID:2220
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4468
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        67⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        68⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        69⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        70⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        71⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        72⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        73⤵
        
        PID:964
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:216
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        75⤵
        Drops file in System32 directory
        
        PID:2244
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        76⤵
        Drops file in System32 directory
        
        PID:632
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        77⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        78⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        79⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        80⤵
        Modifies registry class
        
        PID:1480
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        81⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        82⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        83⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        84⤵
        
        PID:3804
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        85⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        86⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        87⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2360
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        89⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        90⤵
        Modifies registry class
        
        PID:4892
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        91⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        92⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        93⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        94⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        95⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        96⤵
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        97⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        98⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        99⤵
        Drops file in System32 directory
        
        PID:5260
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        100⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        101⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        102⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        103⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        104⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        105⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        106⤵
        Drops file in System32 directory
        
        PID:5584
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        107⤵
        Drops file in System32 directory
        
        PID:5636
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        108⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        109⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        110⤵
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        111⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        112⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        113⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        114⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        115⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        116⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        117⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6124
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        119⤵
        Drops file in System32 directory
        
        PID:5140
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        120⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        121⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        122⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        123⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        124⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        125⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        126⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        127⤵
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        128⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        129⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        130⤵
        Modifies registry class
        
        PID:5948
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        131⤵
        Modifies registry class
        
        PID:6004
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        132⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        133⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        134⤵
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5372
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        136⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        137⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        138⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        139⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        140⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6052
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        142⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        143⤵
        Modifies registry class
        
        PID:5712
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        144⤵
        Drops file in System32 directory
        
        PID:5804
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        145⤵
        Drops file in System32 directory
        
        PID:5244
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        146⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        147⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        148⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6168
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        150⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6276
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        152⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6356
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        154⤵
        Modifies registry class
        
        PID:6400
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        155⤵
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6484
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        157⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6568
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        159⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        160⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        161⤵
        Drops file in System32 directory
        
        PID:6704
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        162⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        163⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        164⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        165⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        166⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        167⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        168⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        169⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        170⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        171⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        172⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6196
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        174⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        175⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6444
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        177⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        178⤵
        Modifies registry class
        
        PID:6548
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        179⤵
        Drops file in System32 directory
        
        PID:6636
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        180⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        181⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        182⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6940
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        184⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        185⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        186⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        187⤵
        Modifies registry class
        
        PID:6200
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        188⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        189⤵
        Drops file in System32 directory
        
        PID:6468
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        190⤵
        Modifies registry class
        
        PID:6540
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        191⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        192⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6956
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        194⤵
        Drops file in System32 directory
        
        PID:7044
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6204
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        196⤵
        Modifies registry class
        
        PID:6384
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        197⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5992
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        199⤵
        Modifies registry class
        
        PID:6864
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        200⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6364
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        202⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        203⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        204⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        205⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        206⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6432
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        208⤵
        Modifies registry class
        
        PID:7180
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        209⤵
        Modifies registry class
        
        PID:7216
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        210⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7300
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        212⤵
        Modifies registry class
        
        PID:7344
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        213⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        214⤵
        Drops file in System32 directory
        
        PID:7424
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        215⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        216⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        217⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        218⤵
        Drops file in System32 directory
        
        PID:7592
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        219⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        220⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        221⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        222⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        223⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        224⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7880
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        226⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        227⤵
        Drops file in System32 directory
        
        PID:7972
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        228⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        229⤵
        Drops file in System32 directory
        
        PID:8052
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        230⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        231⤵
        Modifies registry class
        
        PID:8144
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        232⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        233⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:400
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        234⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        235⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        236⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        237⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        238⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7624
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        240⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        241⤵
        Modifies registry class
        
        PID:7752
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        242⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        243⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        244⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        245⤵
        Modifies registry class
        
        PID:8036
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        246⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        247⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7288
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        249⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7560
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        251⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        252⤵
        Drops file in System32 directory
        
        PID:7824
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        253⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7868
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        254⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        255⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        256⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        257⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        258⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        259⤵
        Modifies registry class
        
        PID:7604
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        260⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        261⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        262⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        263⤵
        Modifies registry class
        
        PID:2028
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        264⤵
        
        PID:724
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        265⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        266⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        267⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        268⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7688
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        269⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8072
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        271⤵
        Drops file in System32 directory
        
        PID:7964
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        272⤵
        Modifies registry class
        
        PID:8204
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        273⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        274⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        275⤵
        Drops file in System32 directory
        
        PID:8320
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        276⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8400
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        278⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        279⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        280⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8564
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        282⤵
        Drops file in System32 directory
        
        PID:8604
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        283⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        284⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        285⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8784
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        287⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        288⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        289⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        290⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        291⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        292⤵
        Drops file in System32 directory
        
        PID:9036
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        293⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        294⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9168
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        296⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        297⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8288
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        299⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        300⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        301⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        302⤵
        Drops file in System32 directory
        
        PID:8548
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8628
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        304⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        305⤵
        Modifies registry class
        
        PID:8764
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        306⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        307⤵
        Drops file in System32 directory
        
        PID:8908
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        308⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        309⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        310⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        311⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        312⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:708
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        313⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        314⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        315⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        316⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        317⤵
        Drops file in System32 directory
        
        PID:8768
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        318⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        319⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        320⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9200
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        322⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        323⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        324⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        325⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        326⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        327⤵
        Drops file in System32 directory
        
        PID:8200
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8372
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        329⤵
        Drops file in System32 directory
        
        PID:8612
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        330⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        331⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        332⤵
        Drops file in System32 directory
        
        PID:8520
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        333⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        334⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        335⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9348
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        337⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        338⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        339⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        340⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        341⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        342⤵
        Modifies registry class
        
        PID:9652
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        343⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        344⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        345⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        346⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        347⤵
        Drops file in System32 directory
        
        PID:9872
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9924
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        349⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        350⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10052
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        352⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        353⤵
        Drops file in System32 directory
        
        PID:10140
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        354⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        355⤵
        Drops file in System32 directory
        
        PID:10220
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        356⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        357⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        358⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        359⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        360⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        361⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9716
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9780
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        364⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        365⤵
        Drops file in System32 directory
        
        PID:9932
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        366⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        367⤵
        Drops file in System32 directory
        
        PID:10072
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        368⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        369⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8968
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        371⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        372⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        373⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        374⤵
        Modifies registry class
        
        PID:9732
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        375⤵
        Modifies registry class
        
        PID:9816
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9996
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        377⤵
        Modifies registry class
        
        PID:10080
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        378⤵
        Modifies registry class
        
        PID:10208
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        379⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        380⤵
        Modifies registry class
        
        PID:9544
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        381⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        382⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        383⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        384⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        385⤵
        Drops file in System32 directory
        
        PID:9708
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9944
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        387⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        388⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10228
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        390⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        391⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        392⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        393⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10372
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10416
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        396⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        397⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        398⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        399⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        400⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        401⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        402⤵
        Drops file in System32 directory
        
        PID:10712
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        403⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        404⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        405⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        406⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10936
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        408⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11024
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        410⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        411⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        412⤵
        Drops file in System32 directory
        
        PID:11152
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        413⤵
        Drops file in System32 directory
        
        PID:11192
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        414⤵
        Drops file in System32 directory
        
        PID:11236
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        415⤵
        Modifies registry class
        
        PID:9856
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        416⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10364
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        418⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        419⤵
        Drops file in System32 directory
        
        PID:10484
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10588
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        421⤵
        Drops file in System32 directory
        
        PID:10648
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        422⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        423⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        424⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        425⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        426⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        427⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        428⤵
        Modifies registry class
        
        PID:11140
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        429⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        430⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        431⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        432⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        433⤵
        Modifies registry class
        
        PID:10548
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        434⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        435⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        436⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        437⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        438⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        439⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        440⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10356
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        441⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        442⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        443⤵
        Modifies registry class
        
        PID:10948
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        444⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10280
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        446⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        447⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        448⤵
        Drops file in System32 directory
        
        PID:11232
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        449⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        450⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        451⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        452⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        453⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5492
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        454⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        455⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        456⤵
        Modifies registry class
        
        PID:1788
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        457⤵
        Modifies registry class
        
        PID:11308
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        458⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        459⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        460⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        461⤵
        Drops file in System32 directory
        
        PID:11472
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        462⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        463⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        464⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        465⤵
        Modifies registry class
        
        PID:11632
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        466⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11676
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11720
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        468⤵
        Modifies registry class
        
        PID:11760
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        469⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11800
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        470⤵
        Modifies registry class
        
        PID:11844
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        471⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        472⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        473⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        474⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12020 -s 408
        475⤵
        Program crash
        
        PID:12116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 12020 -ip 12020
1⤵
PID:12092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bmbplc32.exe

Filesize
128KB

MD5
477aeda0a26bb4973fa6c0b1105208cd

SHA1
a280bb4b9dc3bd8f402c906ee545fa77a8b0318d

SHA256
bc53382d18404e149dbb4a4126fb52b1de88816bacba2ef935fa57ae2b989754

SHA512
33c985f5f645d96c34373c3839758e7bca5c344b86e1e426eb76f82afca871a2652fd6c4cc3ff8a13dc1befd49bfc913f0085cccab8f25062bc91c916ca3d695

Download Submit
C:\Windows\SysWOW64\Clpgpp32.exe

Filesize
128KB

MD5
ea10c752de7950ab905d0ca7bfe873f6

SHA1
9481f94083a11858c93edd3bd4a67b10a9b4d4a1

SHA256
b91fb7c9288fc36a409a6f6867a2f1e85218d5e89f5b84a74f8bcdd6b95fff51

SHA512
daf879a073439c76a8f8b94d92e5b3093d068bbcf62aa5313a20e497db5f30e1baadaab8226b5a247a5803b2b6b793b90bd25c3aec551fd7d818f952d3ff7f9f

Download Submit
C:\Windows\SysWOW64\Gbgdlq32.exe

Filesize
128KB

MD5
eb32b33730a6c139235f52ed6f9f7417

SHA1
af2cc1e263acdd853a529e54fbcdc967e61b12d8

SHA256
6ccdb55b0f839e54272ef51e2547e0d9e6492ac4dc17f17f756bb691dda5dcf8

SHA512
c620a71cefcd6dcec7dd86d65fabf8cf6ab8ac86f6b94932400f8963d6d44ad09027488847c3f5ff91dda35e33f313eb92f8556d6132ef61922f67c376bb9f8a

Download Submit
C:\Windows\SysWOW64\Hfqlnm32.exe

Filesize
128KB

MD5
2d697e09a32d52b8a5904eff210a57d6

SHA1
2209dd747eddf9986cf9fa7cddbe7013a820554a

SHA256
73dde24d66994ee98fdccee67fc2e3be1acad1850e68b8a96712aabb0f3ed271

SHA512
4056ace144d7ea181852f2e706ec34241bf24798ccd15ba77d5ed7bfa539cb82cc53a8f67cf8c039a882cbb734f0887f8dec926aaab3e9ef222cd1ae6013a8a3

Download Submit
C:\Windows\SysWOW64\Joamagmq.dll

Filesize
7KB

MD5
f0f21880a02a5d66875f7e32a22328b7

SHA1
89c6e1bbb36cc64532f3f78ea18c3b34b248a16d

SHA256
d57a06e985f8f141c1c621256c6f01973ecefa2c57fb860a1adac9476118087e

SHA512
9fce5c78b55b83dcf1aa37138fa73dffbadc972c6b4b1af5caddd78d1de9136c76520c55ba98cba1893a37660473cf4291243817477e46ec228a4266c7b6ca68

Download Submit
C:\Windows\SysWOW64\Kbfiep32.exe

Filesize
128KB

MD5
1f9426f9d78a38379b52912a9d2d643f

SHA1
ca5743d5cc25bb3607fe50b600d5a3b0f1ef8956

SHA256
30a6987b3f8677e4576fa42feeba31170b074c8b01856d07963c88d2a901c8bd

SHA512
2efdb481364b210c53a64cb7c47ed0a25a1b4427e1bf67d29355f1d6d986881d746b7ec8e99a6cb07b49c58d7b7666aa73a02d25f374febc13c6cc5d942c7138

Download Submit
C:\Windows\SysWOW64\Kcifkp32.exe

Filesize
128KB

MD5
df1078fb4931b4965ffeaf08ceee6a2b

SHA1
2e702929e468fb860b6aaeadeef59c65594165a9

SHA256
14d59f982ffa9b4ef297a0418018e106a59499d3c4d618d6bd8f52c68c299612

SHA512
49015c9fe2a3d4c7b4e7af7a611b57e74470a0298caad03fe87f556180199891604ebec1e7af021423cc1b703d43ac34a5e7beaf911f03f2044f84384858fc3a

Download Submit
C:\Windows\SysWOW64\Kckbqpnj.exe

Filesize
128KB

MD5
9b03e70e123d27733c5113f0559cc662

SHA1
e485eb5188fe6f1382e11e205c0c2f268af5d98d

SHA256
bd7a64955cd033b3698a31c5549000a3a6089c855582c1bab21c214f08b059ae

SHA512
737207b51d719f74dc352abe1ebbd8e4c14b628c88031d083a29e9bd1cb6f98f29b05c74ee0a443e079dd0befa0984cf78cedcccc204421362331f6e1729b3ff

Download Submit
C:\Windows\SysWOW64\Kknafn32.exe

Filesize
128KB

MD5
cfa66bf9c5f86ba9225fe0aa2eb111d1

SHA1
a645c2801fec53835826cf0253ef45b2971a6597

SHA256
170adff887369e95286821f1e142101d800d100703a316ac63cb7e81af4166db

SHA512
0fd14e855dfc1c930ebad8198f218133237f907ed02834079564c461b24d700157e753388bf0bf77b0535fd70c14bb0401b1af64600b473014ca34dc431613e5

Download Submit
C:\Windows\SysWOW64\Kmlnbi32.exe

Filesize
128KB

MD5
c52fcec1337632f047a0ce2972cd47d4

SHA1
9536e87a3a3eab30d5b583d6254f60b7dc2f8e02

SHA256
a3ddcad052afe1ad8364840fcb3f3e52a2b7a123c70301a6ae86f7a230a3829c

SHA512
b78332edf675db6a9d83fb19072cf88892774e07b34057d93d5591c8d5cc33cbcdd350ac2fda91db7f35cb3d9bbbe65928c3bbfbfac5c911f1debd337f075b63

Download Submit
C:\Windows\SysWOW64\Kphmie32.exe

Filesize
128KB

MD5
efe84bd56c35a604a8620a561c09032b

SHA1
a86226aed954feed06ca10653afece82de111f6e

SHA256
26c16b9052344f5e33408f4da59982232c09152e23bf8b7eb40c01ea3e254ad2

SHA512
df550dcae932bf45b617393b3ef714f7b3b09ae658551c6b3f751386547646be6442de302365cacff0311584153fcdd82dcea9faf74ff58288f860e3668b1a0d

Download Submit
C:\Windows\SysWOW64\Kpjjod32.exe

Filesize
128KB

MD5
3da187737622fbbc6c97c482d02e6bb7

SHA1
550786925f9621036c226f68b68f19e4fcc59a39

SHA256
5f9e6c149694a815443e115c2522b39fd9f6e9a6acbfb1499aa4b64b934d7eb0

SHA512
053774aa5ae3bb68aa70b13409f2214cd401869f0ef5a3bbe63f6bbc9debf47bf0d0550d33e2b83722a08132cb16cd9ac055d02b4330a165400a7c98efc091a3

Download Submit
C:\Windows\SysWOW64\Kpmfddnf.exe

Filesize
128KB

MD5
c731da97a103cb417cee87f034fbace8

SHA1
02ee596ba2edf16a4036f27cee041ebd7170d4f6

SHA256
df7f0dbcd012404a92fc4296258ef017fd7abe5093ffcc362491521dab1842aa

SHA512
ebf19ce0255172e78f8757f8c8c4a0d34210fd39a3d55a96995f32c7efc6c4a37d2620768f9aee07f0cb894986d063aa7fc439aedd3e23598c6e9a75ab0cf2bf

Download Submit
C:\Windows\SysWOW64\Laalifad.exe

Filesize
128KB

MD5
ba5a4ddca2cb713337b647cc3f94952c

SHA1
5dc2d2122057f5fb58cb5cff9b0f77f81344fd4f

SHA256
9a4bf8d739c00e9a196ace4d1225741b7f74eb92c1b80ebcc96de801a8e7f99e

SHA512
0d548f0b94b5b123b0b2163da38e3b03f820d955f2559fe7ce1d984f0544dc7235c5469f116ba9a71a7696eb8d4949dc6fd7d5a38c17d78845d26f7a7ee50060

Download Submit
C:\Windows\SysWOW64\Lalcng32.exe

Filesize
128KB

MD5
db35803db6fc1645dd63b5e47389216b

SHA1
36cc9ae2e7f11fbf7da20f32b1d82fb8972e3d8e

SHA256
07a4e22c9182efc247c0e0ef58dd579fdb4b9b350105b59e6b09ee0235bac2e0

SHA512
57a2d551ee33770658ef31eab1b917147e235c482b6e9dadc38b71f59413db86014b0e1e3e070fd85e6679d2cf091c627a2b8c99065e0b57d1270e153fd05f8f

Download Submit
C:\Windows\SysWOW64\Lcbiao32.exe

Filesize
128KB

MD5
bb3054a8bf16c28970db804ff24dd30f

SHA1
251d3abe2adce253727fe372d5aae57b3a9dc7fc

SHA256
250b7fcee4ae1f4c4d15f2138a4328b00a3582eee1aff882dd1bfdd86678b949

SHA512
5a152b4b09041928adedfd9a8cc84f5bed6f0ccfaf0cacd58d99fd7d4eeb8a745bf86eedf3a9579f5e6dcfa830dfa11246b32f3d19777c49ee64b4850b6127e9

Download Submit
C:\Windows\SysWOW64\Ldaeka32.exe

Filesize
128KB

MD5
c6248a8988302cbb4a6911dbf8c8e487

SHA1
96eb88c75d5164ee48113c3752f27c622503d9eb

SHA256
4495a179ac07c3c70d21bf3ee09066397ee7ae00a63cf317479c9f0dbd55ee99

SHA512
6346f428d9aae7b965aacdd494e8bc531cc7bd8d882a3ae146ccbb1606f615c08f0c17b82cc3362a6a3385127b4143f49ec0279b1190edca096c0dfd87bccac9

Download Submit
C:\Windows\SysWOW64\Ldkojb32.exe

Filesize
128KB

MD5
a0c2d2673a1048d04d464d219f7e6dd3

SHA1
ee30fa3923216d33ee6f694532f8ea63a4fc5fcb

SHA256
0fa85a6addbe00f2a3b978e62915a4459dfd3c21362994aa3ddba3362e544d7d

SHA512
baf08e9e1ecdf90acbea372bb533c1d6496892be31f7f5ace35acba3536001fb4b4356c2bac623f35a72e2877184a2768a8b70eed18ae0cd16ab93b612f33e6a

Download Submit
C:\Windows\SysWOW64\Ldmlpbbj.exe

Filesize
128KB

MD5
b8f29fce2154cbef8a338cf1934562d0

SHA1
6102a704f2a6e1c441a5cb0344aabb41b8fba7e2

SHA256
93d68cc5cf35f988ac25e9c0556f6a50e31c40076e291432b43e5c3d86262a7c

SHA512
17fc872b47aef3ad3bdd415a71c3418cc9708fba275503e1e0b764b58d573743b3e65df09bfd47a66954e9cfcb0019ad821962716c9d44f0671ee59dbb3d96bb

Download Submit
C:\Windows\SysWOW64\Lgbnmm32.exe

Filesize
128KB

MD5
80f22af662dd8aba2120d8e311ab5304

SHA1
1848ce63547738e7baa7edb7c7a913013e87b096

SHA256
5f129b16af565fbb3be6133052f0fa1ed615234a5adf805fc49dd69b8b7dff34

SHA512
f19919631a8c21ef207a19380fc2514a7e149b0eb7a9976bcc31e5212a7b2390ad631633b1589186a08ca0cb323f2f48823c685cd3489126a3d42541a09ca424

Download Submit
C:\Windows\SysWOW64\Lgpagm32.exe

Filesize
128KB

MD5
6ee04bf07b0b95192c2a1d34d9d0750e

SHA1
f1361c1ce12e4aacbe179e251c2f1d245bd945ec

SHA256
a8110d09724a7a341c9d8e7dee3c955a34b89c2dc7372069e58b9c3d2974a5cd

SHA512
fc52e0059b54869f6b034c5a76f6f3d18470657dbfccca3b71f740e23dc2eecd3eb2974e09e544cd0154489160c616b462e12dcfef9dcc0e884e04528e430ce7

Download Submit
C:\Windows\SysWOW64\Liekmj32.exe

Filesize
128KB

MD5
82a74aacf1d2f2a004447ca03aa54c6c

SHA1
1f293efa4e4a492854b906e032c6c994d2637b78

SHA256
c3412c523e809ebc1d1f26858c34b29eb2f41fb02d216036f9240862fe71f79c

SHA512
21faafaae96f219b2b0456ad21e9b3a7e7a8350d6815f0aa9ebc2163be8d5a78b6e8ce33c3ca35ada2061410cddd791651298f3ffc80b23df9d4416265e9e096

Download Submit
C:\Windows\SysWOW64\Liggbi32.exe

Filesize
128KB

MD5
981d28a4231ceafc5cc476e3c156c09d

SHA1
7048d9bd03906d5ef55a64be8c682e636a10dcf5

SHA256
6ab68fb3d39fb2a728c8a0bda90cad1c8b0288cf8385ca129d1098ad0014aca4

SHA512
f0118caa4f3cae64ae523547686303c33c29b0133551979c54422fbf0472ad4363e945977c9a42dc01209ec6e3391723fd280eb5641d903fea3213d4d68e1d6a

Download Submit
C:\Windows\SysWOW64\Lilanioo.exe

Filesize
128KB

MD5
e7184e8bc04c3c2d8d9a5a3d164431a4

SHA1
026097e0f89fc80324e4d552818bc91c7732fcf1

SHA256
041bb2de9ad8c7216c0338c68bf4cbb7602072959e64dd4001f3d0134030d334

SHA512
87ad2daaf1d3ea3ae78bb62608569e62f34831c4f784eca5ac90b5bf93d0ebb4ca36cf6f96b603f8bdce7fbd25749d21db86bb52d7704c6227f6db9f29f0670e

Download Submit
C:\Windows\SysWOW64\Ljnnch32.exe

Filesize
128KB

MD5
e0e2eb5de504ed0d3dd8145a06a6fb15

SHA1
26b4bea5ba9afc5b409db1661a73ac14d969da17

SHA256
1dace9db144a00e880d33a2edde11be543eb99ca4982288131566e6910e5bf27

SHA512
60992f30f96de0e3f171e8f303d09bae36f872f63a2fdeadda63f489eec998d7c2c0af3ca3208a942d6fd83404f6d577b4d5acdcaaf028ad4ef73ebbcce991ea

Download Submit
C:\Windows\SysWOW64\Lkgdml32.exe

Filesize
128KB

MD5
02af50dd61bb1405ff34967e4294f927

SHA1
210c4c874d22bc00213c84ecd5f773dea32e8aad

SHA256
24d5272df0aa6a54e37800a71d47fdbbdf959939c215eb644c2deb60b2063074

SHA512
fce829ad051c40dc24abfb37f35134ab06534cc2b69cfe96f5b92d39e8f61b283e2b2e1816770a76579c88dfc200e373baf986ac59e0587d8f0fe6ecb8d08c6f

Download Submit
C:\Windows\SysWOW64\Lknjmkdo.exe

Filesize
128KB

MD5
63c38a3a0fff88f7f1331f63fdb1d16d

SHA1
aa96482282c96a3be1560c0eab9ad7e4dee561da

SHA256
b4b3953e63f71eabe0115671af42cf651314efa3b16f10cf874d0d29b4402446

SHA512
2982d0e23fae4ddeac8c44c1451433a0e7745715662daeb339edf37fdf1d5d5cec5f87ae8deaaf618c15da85a9f291c61a3e1e723a7360ff3a39501589a8a982

Download Submit
C:\Windows\SysWOW64\Lphfpbdi.exe

Filesize
128KB

MD5
6914be3e342a2b4d289e79e1fe1b05a7

SHA1
e43ae5e4b0fb8c2e2e5f5fdb324df7da6c2f1692

SHA256
f139ec8de9369d9f9843c8638d4c71cedf901db4ace5ffd47e9bb797c346404c

SHA512
fe1cd18fb8b6047ae8d0c3e6bd3c43c8b94ea2f4980d67787e13bdd87bb9d0fa76e272ec39cd87eb8abd536a3eaaf4080f9671a415f718a69639f5f213747de5

Download Submit
C:\Windows\SysWOW64\Majopeii.exe

Filesize
128KB

MD5
0ca9db78722f989b4fa8a6108aac48fe

SHA1
9618c128ea68c9ac648af15d7ee8be003ffd83cd

SHA256
2bf98ca42fc77595eecb9ecb60569bfdf140ff6587f2f2ca544b7cd927dcdedb

SHA512
4a3246efdacfc0aa7145a8a38cef0b9a2d6256b01be6a09211e05da251bb41cfccc01060803531755bd03d322ac401cae61523e2f779122ad77b1d1bc67a0f3f

Download Submit
C:\Windows\SysWOW64\Maohkd32.exe

Filesize
128KB

MD5
3660206d5e0fd8d1fbd046bcc02bd8f3

SHA1
67aa7149005a8d22f810a8134ca68d8743cad0fb

SHA256
682f53e76ecfb76ef91ca2111404fa74735be31023c0457e24ac3de847857d3d

SHA512
2b80475033de0a1b46d9b14395e7edd5370a1588415984affb98f5fb08b1e060b0192d8d52419a49de26696ba91bfa1f77376d528418f19c8760554d596a7f04

Download Submit
C:\Windows\SysWOW64\Mcklgm32.exe

Filesize
128KB

MD5
84cd41053908ca3cfaa6ac3b6e8e6929

SHA1
ce8fc5878f990d921f3c9ab3f82cc2b368f47fb2

SHA256
1062b8d9ed7fb3d72b89aff08d245d55faaf1fea8653cca3582e257fe0c0acbb

SHA512
30b07d7a3fe46f2e0064f68c05c0c740074cca08e909e2984ce135986a69ea6b798040cec3a9a444c10e2d2612c555ba98fd6b2114ca06a7a61a495fdcc333f6

Download Submit
C:\Windows\SysWOW64\Mdpalp32.exe

Filesize
128KB

MD5
979c0b2b35ba395ad66a94583bd57ee9

SHA1
ee180aa7059cf4b7aa7f068e8f5820db3ed8b0ce

SHA256
e6514e353f79fcaeae0c426e469f7ee141cd982717d257859f5508c96953484a

SHA512
8c990054cb2e1a0d952a29eb5b6e009f698670d488fd8665ecc153d02939633cf936baff71ef08859cef4c51654301e42f0b6116987e398b935194cbcddbe4d6

Download Submit
C:\Windows\SysWOW64\Mglack32.exe

Filesize
128KB

MD5
458deb567c110fd9499cf7bf52cb5c76

SHA1
5bb57b4bef539f44f2576f9548eff196d5533fd0

SHA256
4fc2e7239f6aa4076b87c25add41df91fff8174631cbdd17b7707debdd307db1

SHA512
3a55450ea7aa52c950acbda6447bce2a7233d72d5077290f2104e682ea11512cd5f374e39eb5eea315edaedddb7fb9832bfc197a018eb5d6f2d966a7a9b20611

Download Submit
C:\Windows\SysWOW64\Mjcgohig.exe

Filesize
128KB

MD5
4cc7fa3453723cb361df04ef56927853

SHA1
054f3909a5f5b9daaf7a755ea47690cee998ea88

SHA256
4c8efdce5d5c3cb68da9bc1dab4b68174efcc46d4a977bdc43eef8198fe53cf3

SHA512
26b9229d457117620f441dca0137e738251987f33166232f8d24b4e1c114fcef79299af981673215faac431ff2b1f6beba2dcd4a142ae09a2ae1deff83851d01

Download Submit
C:\Windows\SysWOW64\Mkbchk32.exe

Filesize
128KB

MD5
14a571aa9624ef26121c43705e8c9b46

SHA1
d2c438adc4351a8d628ca9a70849096a9685b65c

SHA256
204a0abeca10b5a448f870edbfe39dda3f4ac731051fa11b0aa2b90963f62e68

SHA512
c05d7c4fa1af687f2cd0e9d12e1445e9d522563a57a7d4714008af770e1450f009dd2eca877f8292889d184c0f48da1237c6534684b02ae7f87345fcd8bb79d8

Download Submit
C:\Windows\SysWOW64\Mkepnjng.exe

Filesize
128KB

MD5
82e2acee8e00721c0693bf92baa349e4

SHA1
68d876921b6a9b690992347e445d25f501bbd865

SHA256
584c74f5814712920da030fd82ddb9bba91f901587ecab5df84beff1b1827148

SHA512
3da7dcf6b7602e2e8e34efc5607936f8623324fc66c1eb8a8625ad1e9ec4e6c628da55bd51f214b7a3ed75e214df9ba1b5838d2306e42c2e17d0b4f6be49ca18

Download Submit
C:\Windows\SysWOW64\Mpolqa32.exe

Filesize
128KB

MD5
7147a5a6b107eaea36949f4a23550a8a

SHA1
c137dec946e4f7b88d9b57ce4317f8723fef5dcf

SHA256
25a1d54896da7d4c900f47b6fb3f732851e2ac2dd70c9c9ae7539d115ee57724

SHA512
5d2623896c149d8f486be8e70ce414f10e67608d703c5741ddc533489c474779df1e02b919592c665028d43fdbe86b0d0081d43370179a90106e92214c9bd931

Download Submit
C:\Windows\SysWOW64\Onjegled.exe

Filesize
128KB

MD5
f1ac5fb7ce8c4f34df959de54d33dff5

SHA1
1c25b7d42eea6534d5825b835ea435e25a8ba59c

SHA256
fa478a4fd084b2fad66c9149e7917bfbde452756b4c2e68d158fc632f80ed5d6

SHA512
b82bd34dfa312bb0355ce4db4f3019ac0de46041179feaee9536e0f287cc80ad3ea90d4045934f9b81138aa53ce09da10fd02105720df2696ef1fa000eb69f6d

Download Submit
memory/116-406-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/224-261-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/448-446-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/464-392-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/556-240-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/672-104-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/744-284-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/764-332-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/924-24-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1004-196-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1012-228-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1256-314-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1328-80-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1380-382-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1384-298-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1432-418-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1436-111-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1488-326-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1608-286-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1768-268-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1816-47-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1840-232-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1908-316-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1924-208-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2068-346-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2152-96-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2196-416-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2476-152-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2508-165-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2572-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2644-60-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2716-144-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2756-75-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2760-394-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2824-340-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3024-358-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3080-308-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3408-374-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3432-183-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3556-352-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3728-376-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3924-64-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3952-200-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4000-266-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4088-430-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4228-176-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4236-87-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4256-216-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4316-404-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4348-441-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4372-8-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4392-247-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4424-334-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4444-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4508-120-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4548-20-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4556-296-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4576-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4720-168-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4872-140-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4896-368-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4908-127-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4912-424-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4976-274-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads