2244101c6ce1f94358b8b4a35663eb0ae6ff4502e6d851c8dde069f7fd374e4c

Analysis

max time kernel
93s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2244101c6ce1f94358b8b4a35663eb0ae6ff4502e6d851c8dde069f7fd374e4c.exe
Size

64KB
MD5

b9c5cfd2858fd18ef08c3bf92f315e9e
SHA1

45b123058a85f9eef1babac096d728bd79ad6968
SHA256

2244101c6ce1f94358b8b4a35663eb0ae6ff4502e6d851c8dde069f7fd374e4c
SHA512

7d3511cd86855729e8300c0f3fdeb61c477a5df81936ec47e8a40f53e9de418156021882f964083bafb04fb106f80b8fef53e332922e460d11312b87fab5a61e
SSDEEP

1536:kYHReLTPGD3K/n0nguwNUmLA+w0rjQn1ZuYDPf:ZMXBTw0ry1ZuY7f

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmbfpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdnjgmle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icgjmapi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdehlk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2244101c6ce1f94358b8b4a35663eb0ae6ff4502e6d851c8dde069f7fd374e4c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcojkhap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gohhpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icplcpgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndfqbhia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmannhhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfnphn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kimnbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lljfpnjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chpada32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edkdkplj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpeiioac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncdgcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cojjqlpk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfqlnm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldleel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nggqoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Peimil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdcdbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgagbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndikf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceoibflm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbjlfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mipcob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlampmdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adapgfqj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bahmfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfbibnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daolnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekacmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbaipkbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acjjfggb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlncan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hoiafcic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odbgim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfmepi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lekehdgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcncpbmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmijbcpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjlpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjpaooda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Likjcbkc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qceiaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fllpbldb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jianff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncdgcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdmpcdfm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eapedd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgkjhe32.exe

Executes dropped EXE 64 IoCs

pid	Process
1496	Lphfpbdi.exe
3740	Lgbnmm32.exe
3796	Mnlfigcc.exe
2080	Mdfofakp.exe
1356	Mjcgohig.exe
3636	Majopeii.exe
1832	Mdiklqhm.exe
2072	Mjeddggd.exe
3676	Mamleegg.exe
1368	Mcnhmm32.exe
3304	Mjhqjg32.exe
1976	Mpaifalo.exe
1420	Mcpebmkb.exe
4728	Mjjmog32.exe
4524	Mpdelajl.exe
4516	Mcbahlip.exe
4560	Njljefql.exe
2008	Nqfbaq32.exe
1264	Nceonl32.exe
2264	Njogjfoj.exe
976	Nqiogp32.exe
5000	Ncgkcl32.exe
3488	Njacpf32.exe
4120	Nbhkac32.exe
3532	Ngedij32.exe
3928	Njcpee32.exe
3212	Nbkhfc32.exe
4508	Nggqoj32.exe
4992	Nnaikd32.exe
4008	Nqpego32.exe
4828	Ogjmdigk.exe
3000	Ondeac32.exe
4408	Oqbamo32.exe
2968	Ocqnij32.exe
2680	Okhfjh32.exe
2620	Obangb32.exe
5004	Odpjcm32.exe
4704	Okjbpglo.exe
2456	Onholckc.exe
4016	Odbgim32.exe
4624	Okloegjl.exe
4696	Oqihnn32.exe
4228	Okolkg32.exe
1140	Onmhgb32.exe
868	Odgqdlnj.exe
1480	Pkaiqf32.exe
2308	Pnpemb32.exe
2532	Peimil32.exe
4608	Pghieg32.exe
5028	Pjffbc32.exe
3716	Pbmncp32.exe
4240	Pcojkhap.exe
2536	Pkfblfab.exe
3664	Pbpjhp32.exe
2880	Pabkdmpi.exe
1100	Pcagphom.exe
3860	Pkhoae32.exe
3176	Pnfkma32.exe
936	Paegjl32.exe
5040	Pcccfh32.exe
2644	Pkjlge32.exe
2740	Pnihcq32.exe
5080	Pagdol32.exe
3612	Qcepkg32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ioeeep32.dll	Aealah32.exe
File opened for modification	C:\Windows\SysWOW64\Abemjmgg.exe	Ajneip32.exe
File created	C:\Windows\SysWOW64\Elppfmoo.exe	Ehedfo32.exe
File created	C:\Windows\SysWOW64\Jgmbieme.dll	Ekemhj32.exe
File created	C:\Windows\SysWOW64\Fkciihgg.exe	Flqimk32.exe
File opened for modification	C:\Windows\SysWOW64\Nljofl32.exe	Nilcjp32.exe
File opened for modification	C:\Windows\SysWOW64\Hoiafcic.exe	Hmjdjgjo.exe
File opened for modification	C:\Windows\SysWOW64\Iemppiab.exe	Ibnccmbo.exe
File created	C:\Windows\SysWOW64\Cepkeokh.dll	Ogjmdigk.exe
File created	C:\Windows\SysWOW64\Ajdhcbgd.dll	Bdmpcdfm.exe
File opened for modification	C:\Windows\SysWOW64\Dhkapp32.exe	Demecd32.exe
File opened for modification	C:\Windows\SysWOW64\Dceohhja.exe	Dojcgi32.exe
File created	C:\Windows\SysWOW64\Neiigifj.dll	Dedkdcie.exe
File opened for modification	C:\Windows\SysWOW64\Ehimanbq.exe	Eapedd32.exe
File created	C:\Windows\SysWOW64\Pacghh32.dll	Iemppiab.exe
File created	C:\Windows\SysWOW64\Mgagbf32.exe	Lphoelqn.exe
File created	C:\Windows\SysWOW64\Ochpdn32.dll	Pnfdcjkg.exe
File created	C:\Windows\SysWOW64\Bagflcje.exe	Bnhjohkb.exe
File opened for modification	C:\Windows\SysWOW64\Bjagjhnc.exe	Bgcknmop.exe
File opened for modification	C:\Windows\SysWOW64\Glebhjlg.exe	Fdnjgmle.exe
File created	C:\Windows\SysWOW64\Bkblkg32.dll	Ibqpimpl.exe
File created	C:\Windows\SysWOW64\Lplhdc32.dll	Mgimcebb.exe
File created	C:\Windows\SysWOW64\Mcnhmm32.exe	Mamleegg.exe
File created	C:\Windows\SysWOW64\Aahamf32.dll	Aelcfilb.exe
File created	C:\Windows\SysWOW64\Echknh32.exe	Eolpmi32.exe
File opened for modification	C:\Windows\SysWOW64\Edbklofb.exe	Eadopc32.exe
File opened for modification	C:\Windows\SysWOW64\Alabgd32.exe	Acjjfggb.exe
File created	C:\Windows\SysWOW64\Kmipecpd.dll	Fllpbldb.exe
File created	C:\Windows\SysWOW64\Gdeqhl32.exe	Gbgdlq32.exe
File created	C:\Windows\SysWOW64\Mipcob32.exe	Mgagbf32.exe
File created	C:\Windows\SysWOW64\Naeheh32.dll	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Chagok32.exe	Ceckcp32.exe
File opened for modification	C:\Windows\SysWOW64\Mjeddggd.exe	Mdiklqhm.exe
File opened for modification	C:\Windows\SysWOW64\Cdainc32.exe	Ceoibflm.exe
File created	C:\Windows\SysWOW64\Fobdihjo.dll	Chghdqbf.exe
File created	C:\Windows\SysWOW64\Eapedd32.exe	Ecmeig32.exe
File opened for modification	C:\Windows\SysWOW64\Hcbpab32.exe	Hmhhehlb.exe
File opened for modification	C:\Windows\SysWOW64\Pcijeb32.exe	Pmoahijl.exe
File opened for modification	C:\Windows\SysWOW64\Okjbpglo.exe	Odpjcm32.exe
File opened for modification	C:\Windows\SysWOW64\Ajkhdp32.exe	Alhhhcal.exe
File opened for modification	C:\Windows\SysWOW64\Chdkoa32.exe	Cdiooblp.exe
File created	C:\Windows\SysWOW64\Ogqnnn32.dll	Dhkapp32.exe
File created	C:\Windows\SysWOW64\Fllpbldb.exe	Fdegandp.exe
File created	C:\Windows\SysWOW64\Foabofnn.exe	Fkffog32.exe
File created	C:\Windows\SysWOW64\Daolnf32.exe	Doqpak32.exe
File created	C:\Windows\SysWOW64\Bdmpcdfm.exe	Baocghgi.exe
File opened for modification	C:\Windows\SysWOW64\Ceoibflm.exe	Cbqlfkmi.exe
File created	C:\Windows\SysWOW64\Oncmnnje.dll	Pmannhhj.exe
File created	C:\Windows\SysWOW64\Agoabn32.exe	Accfbokl.exe
File created	C:\Windows\SysWOW64\Hhapkbgi.dll	Mpaifalo.exe
File opened for modification	C:\Windows\SysWOW64\Ajiknpjj.exe	Ahkobekf.exe
File created	C:\Windows\SysWOW64\Ghkmacoj.dll	Jehokgge.exe
File created	C:\Windows\SysWOW64\Aoohalad.dll	Kbaipkbi.exe
File opened for modification	C:\Windows\SysWOW64\Megdccmb.exe	Mchhggno.exe
File created	C:\Windows\SysWOW64\Ghngib32.dll	Pmdkch32.exe
File created	C:\Windows\SysWOW64\Ijnlbk32.dll	Cecbmf32.exe
File opened for modification	C:\Windows\SysWOW64\Kpgfooop.exe	Kmijbcpl.exe
File created	C:\Windows\SysWOW64\Lpcfkm32.exe	Lmdina32.exe
File created	C:\Windows\SysWOW64\Odapnf32.exe	Oqfdnhfk.exe
File created	C:\Windows\SysWOW64\Mnjgghdi.dll	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Bcebhoii.exe	Bagflcje.exe
File created	C:\Windows\SysWOW64\Oicmfmok.dll	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Ahkobekf.exe	Aelcfilb.exe
File created	C:\Windows\SysWOW64\Aaepqjpd.exe	Angddopp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11664	11396	WerFault.exe	591

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjbbkg32.dll"	Nnqbanmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfcbjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojleohnl.dll"	Kbfbkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlfofiig.dll"	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjjald32.dll"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pabkdmpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Clkndpag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbnjmp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldoaklml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olcbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnihcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbqlfkmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpcfkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgagbf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdmpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldjhpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efhaoapj.dll"	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oggacefk.dll"	Fdialn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imhkcaln.dll"	Hbnjmp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klgqcqkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oaeokj32.dll"	Ldleel32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncdgcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmkadgpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjkolmml.dll"	Ffgqqaip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnigkegh.dll"	Clkndpag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjlibkf.dll"	Mnebeogl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acjjfggb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Alhhhcal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Edpnfo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlcifmbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncmlocln.dll"	Lbjlfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Demecd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmipecpd.dll"	Fllpbldb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eadopc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hoiafcic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ikpaldog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibqpimpl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmdina32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgmngglp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Filmclmj.dll"	Ocqnij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Conclk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Menjdbgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnepdqjg.dll"	Ekcpbj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcbpab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jeklag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Neeqea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aafdghob.dll"	Peimil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdiooblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffgqqaip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ligqhc32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1496	2020	2244101c6ce1f94358b8b4a35663eb0ae6ff4502e6d851c8dde069f7fd374e4c.exe	84
PID 2020 wrote to memory of 1496	2020	2244101c6ce1f94358b8b4a35663eb0ae6ff4502e6d851c8dde069f7fd374e4c.exe	84
PID 2020 wrote to memory of 1496	2020	2244101c6ce1f94358b8b4a35663eb0ae6ff4502e6d851c8dde069f7fd374e4c.exe	84
PID 1496 wrote to memory of 3740	1496	Lphfpbdi.exe	85
PID 1496 wrote to memory of 3740	1496	Lphfpbdi.exe	85
PID 1496 wrote to memory of 3740	1496	Lphfpbdi.exe	85
PID 3740 wrote to memory of 3796	3740	Lgbnmm32.exe	86
PID 3740 wrote to memory of 3796	3740	Lgbnmm32.exe	86
PID 3740 wrote to memory of 3796	3740	Lgbnmm32.exe	86
PID 3796 wrote to memory of 2080	3796	Mnlfigcc.exe	87
PID 3796 wrote to memory of 2080	3796	Mnlfigcc.exe	87
PID 3796 wrote to memory of 2080	3796	Mnlfigcc.exe	87
PID 2080 wrote to memory of 1356	2080	Mdfofakp.exe	88
PID 2080 wrote to memory of 1356	2080	Mdfofakp.exe	88
PID 2080 wrote to memory of 1356	2080	Mdfofakp.exe	88
PID 1356 wrote to memory of 3636	1356	Mjcgohig.exe	89
PID 1356 wrote to memory of 3636	1356	Mjcgohig.exe	89
PID 1356 wrote to memory of 3636	1356	Mjcgohig.exe	89
PID 3636 wrote to memory of 1832	3636	Majopeii.exe	90
PID 3636 wrote to memory of 1832	3636	Majopeii.exe	90
PID 3636 wrote to memory of 1832	3636	Majopeii.exe	90
PID 1832 wrote to memory of 2072	1832	Mdiklqhm.exe	91
PID 1832 wrote to memory of 2072	1832	Mdiklqhm.exe	91
PID 1832 wrote to memory of 2072	1832	Mdiklqhm.exe	91
PID 2072 wrote to memory of 3676	2072	Mjeddggd.exe	92
PID 2072 wrote to memory of 3676	2072	Mjeddggd.exe	92
PID 2072 wrote to memory of 3676	2072	Mjeddggd.exe	92
PID 3676 wrote to memory of 1368	3676	Mamleegg.exe	93
PID 3676 wrote to memory of 1368	3676	Mamleegg.exe	93
PID 3676 wrote to memory of 1368	3676	Mamleegg.exe	93
PID 1368 wrote to memory of 3304	1368	Mcnhmm32.exe	94
PID 1368 wrote to memory of 3304	1368	Mcnhmm32.exe	94
PID 1368 wrote to memory of 3304	1368	Mcnhmm32.exe	94
PID 3304 wrote to memory of 1976	3304	Mjhqjg32.exe	95
PID 3304 wrote to memory of 1976	3304	Mjhqjg32.exe	95
PID 3304 wrote to memory of 1976	3304	Mjhqjg32.exe	95
PID 1976 wrote to memory of 1420	1976	Mpaifalo.exe	97
PID 1976 wrote to memory of 1420	1976	Mpaifalo.exe	97
PID 1976 wrote to memory of 1420	1976	Mpaifalo.exe	97
PID 1420 wrote to memory of 4728	1420	Mcpebmkb.exe	98
PID 1420 wrote to memory of 4728	1420	Mcpebmkb.exe	98
PID 1420 wrote to memory of 4728	1420	Mcpebmkb.exe	98
PID 4728 wrote to memory of 4524	4728	Mjjmog32.exe	99
PID 4728 wrote to memory of 4524	4728	Mjjmog32.exe	99
PID 4728 wrote to memory of 4524	4728	Mjjmog32.exe	99
PID 4524 wrote to memory of 4516	4524	Mpdelajl.exe	100
PID 4524 wrote to memory of 4516	4524	Mpdelajl.exe	100
PID 4524 wrote to memory of 4516	4524	Mpdelajl.exe	100
PID 4516 wrote to memory of 4560	4516	Mcbahlip.exe	101
PID 4516 wrote to memory of 4560	4516	Mcbahlip.exe	101
PID 4516 wrote to memory of 4560	4516	Mcbahlip.exe	101
PID 4560 wrote to memory of 2008	4560	Njljefql.exe	102
PID 4560 wrote to memory of 2008	4560	Njljefql.exe	102
PID 4560 wrote to memory of 2008	4560	Njljefql.exe	102
PID 2008 wrote to memory of 1264	2008	Nqfbaq32.exe	103
PID 2008 wrote to memory of 1264	2008	Nqfbaq32.exe	103
PID 2008 wrote to memory of 1264	2008	Nqfbaq32.exe	103
PID 1264 wrote to memory of 2264	1264	Nceonl32.exe	105
PID 1264 wrote to memory of 2264	1264	Nceonl32.exe	105
PID 1264 wrote to memory of 2264	1264	Nceonl32.exe	105
PID 2264 wrote to memory of 976	2264	Njogjfoj.exe	106
PID 2264 wrote to memory of 976	2264	Njogjfoj.exe	106
PID 2264 wrote to memory of 976	2264	Njogjfoj.exe	106
PID 976 wrote to memory of 5000	976	Nqiogp32.exe	107

C:\Users\Admin\AppData\Local\Temp\2244101c6ce1f94358b8b4a35663eb0ae6ff4502e6d851c8dde069f7fd374e4c.exe
"C:\Users\Admin\AppData\Local\Temp\2244101c6ce1f94358b8b4a35663eb0ae6ff4502e6d851c8dde069f7fd374e4c.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\Lphfpbdi.exe
  C:\Windows\system32\Lphfpbdi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\SysWOW64\Lgbnmm32.exe
    C:\Windows\system32\Lgbnmm32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3740
  - - C:\Windows\SysWOW64\Mnlfigcc.exe
      C:\Windows\system32\Mnlfigcc.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3796
    - - C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2080
      - C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3636
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1832
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:976
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        23⤵
        Executes dropped EXE
        
        PID:5000
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        24⤵
        Executes dropped EXE
        
        PID:3488
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        25⤵
        Executes dropped EXE
        
        PID:4120
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        26⤵
        Executes dropped EXE
        
        PID:3532
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        27⤵
        Executes dropped EXE
        
        PID:3928
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        28⤵
        Executes dropped EXE
        
        PID:3212
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        30⤵
        Executes dropped EXE
        
        PID:4992
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        31⤵
        Executes dropped EXE
        
        PID:4008
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4828
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        33⤵
        Executes dropped EXE
        
        PID:3000
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        34⤵
        Executes dropped EXE
        
        PID:4408
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2968
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        36⤵
        Executes dropped EXE
        
        PID:2680
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        37⤵
        Executes dropped EXE
        
        PID:2620
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5004
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        39⤵
        Executes dropped EXE
        
        PID:4704
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        40⤵
        Executes dropped EXE
        
        PID:2456
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4016
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        42⤵
        Executes dropped EXE
        
        PID:4624
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        43⤵
        Executes dropped EXE
        
        PID:4696
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        44⤵
        Executes dropped EXE
        
        PID:4228
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        45⤵
        Executes dropped EXE
        
        PID:1140
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        46⤵
        Executes dropped EXE
        
        PID:868
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        47⤵
        Executes dropped EXE
        
        PID:1480
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        48⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2532
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        50⤵
        Executes dropped EXE
        
        PID:4608
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        51⤵
        Executes dropped EXE
        
        PID:5028
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        52⤵
        Executes dropped EXE
        
        PID:3716
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4240
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        54⤵
        Executes dropped EXE
        
        PID:2536
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        55⤵
        Executes dropped EXE
        
        PID:3664
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2880
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        57⤵
        Executes dropped EXE
        
        PID:1100
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        58⤵
        Executes dropped EXE
        
        PID:3860
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        59⤵
        Executes dropped EXE
        
        PID:3176
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        60⤵
        Executes dropped EXE
        
        PID:936
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        61⤵
        Executes dropped EXE
        
        PID:5040
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        62⤵
        Executes dropped EXE
        
        PID:2644
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2740
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        64⤵
        Executes dropped EXE
        
        PID:5080
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        65⤵
        Executes dropped EXE
        
        PID:3612
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        66⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        67⤵
        
        PID:924
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        68⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        69⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        70⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        71⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        72⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        73⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        74⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1300
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        76⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        77⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        78⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        79⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        80⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        81⤵
        Drops file in System32 directory
        
        PID:3992
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        82⤵
        Drops file in System32 directory
        
        PID:3312
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        83⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        84⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        85⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5020
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        87⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2704
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        88⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        89⤵
        Drops file in System32 directory
        
        PID:2220
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        90⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        91⤵
        Drops file in System32 directory
        
        PID:2040
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        92⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        93⤵
        Drops file in System32 directory
        
        PID:4552
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        94⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2140
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        96⤵
        
        PID:404
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        97⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1892
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        99⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        100⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        101⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        102⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        103⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        104⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        105⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        106⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        107⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        108⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        109⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        110⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        111⤵
        Drops file in System32 directory
        
        PID:5596
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5644
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        113⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        114⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        115⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        116⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        117⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        118⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5936
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        120⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        121⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        122⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        123⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5128
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        125⤵
        Modifies registry class
        
        PID:5180
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5236
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        127⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        128⤵
        Drops file in System32 directory
        
        PID:5392
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5452
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        130⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        131⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        132⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        133⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        134⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        135⤵
        Modifies registry class
        
        PID:5884
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        136⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        137⤵
        Drops file in System32 directory
        
        PID:6028
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        138⤵
        Drops file in System32 directory
        
        PID:6080
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6140
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        140⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        141⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        142⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        143⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        144⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5740
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        145⤵
        Drops file in System32 directory
        
        PID:5844
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        146⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        147⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        148⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        149⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        150⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        151⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        152⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        153⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        154⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        155⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        156⤵
        Drops file in System32 directory
        
        PID:6056
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        157⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        158⤵
        Drops file in System32 directory
        
        PID:5944
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        159⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5924
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5636
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        162⤵
        Drops file in System32 directory
        
        PID:6188
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        163⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        164⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        165⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        166⤵
        Drops file in System32 directory
        
        PID:6364
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        167⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        168⤵
        Modifies registry class
        
        PID:6452
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        169⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        170⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6580
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        172⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        173⤵
        Drops file in System32 directory
        
        PID:6664
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        174⤵
        Drops file in System32 directory
        
        PID:6708
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6744
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        176⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        177⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        178⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        179⤵
        Modifies registry class
        
        PID:6904
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        180⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        181⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        182⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7028
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        183⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        184⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        185⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        186⤵
        Drops file in System32 directory
        
        PID:6228
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        188⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        189⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        190⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        191⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        192⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        193⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        194⤵
        Modifies registry class
        
        PID:6848
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        195⤵
        Modifies registry class
        
        PID:6928
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        196⤵
        Drops file in System32 directory
        
        PID:7000
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        197⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        198⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        199⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        200⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        201⤵
        Drops file in System32 directory
        
        PID:6648
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        202⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        203⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7012
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        205⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        206⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        207⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        208⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6488
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        210⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6476
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        212⤵
        Drops file in System32 directory
        
        PID:6984
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        213⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        214⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        215⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        216⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        217⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        218⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        219⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        220⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        221⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        222⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        223⤵
        Modifies registry class
        
        PID:7560
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        224⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        225⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        226⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        227⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        228⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        229⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        230⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7884
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        232⤵
        Drops file in System32 directory
        
        PID:7928
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        233⤵
        Modifies registry class
        
        PID:7968
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8004
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        235⤵
        Drops file in System32 directory
        
        PID:8052
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8092
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        237⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        238⤵
        Modifies registry class
        
        PID:8168
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7172
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        240⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        241⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        242⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        243⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        244⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        245⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        246⤵
        Drops file in System32 directory
        
        PID:7660
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        247⤵
        Drops file in System32 directory
        
        PID:7720
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        248⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        249⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7876
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        250⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        251⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8076
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        253⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        254⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        255⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        256⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        257⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        258⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        259⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        260⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        261⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        262⤵
        Modifies registry class
        
        PID:8140
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7200
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        264⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        265⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        266⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        267⤵
        Drops file in System32 directory
        
        PID:7912
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        268⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        269⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        270⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        271⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        272⤵
        Modifies registry class
        
        PID:8164
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        273⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        274⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        275⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        276⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        277⤵
        Modifies registry class
        
        PID:8220
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        278⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8320
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8364
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        281⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        282⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8492
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        284⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        285⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8620
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8656
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        288⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        289⤵
        Modifies registry class
        
        PID:8756
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        290⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        291⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        292⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        293⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        294⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        295⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9064
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        297⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        298⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        299⤵
        Modifies registry class
        
        PID:9184
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        300⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8300
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        302⤵
        Modifies registry class
        
        PID:8352
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        303⤵
        Modifies registry class
        
        PID:8420
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8484
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        305⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        306⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        307⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8704
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        308⤵
        Modifies registry class
        
        PID:8772
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        309⤵
        Modifies registry class
        
        PID:8824
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        310⤵
        Modifies registry class
        
        PID:8924
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        311⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9056
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9132
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        314⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        315⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        316⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        317⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        318⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        319⤵
        Drops file in System32 directory
        
        PID:8716
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8828
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8964
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        322⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9176
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        324⤵
        Drops file in System32 directory
        
        PID:8328
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        325⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        326⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8744
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        328⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        329⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        330⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        331⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        332⤵
        Modifies registry class
        
        PID:9020
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        333⤵
        Drops file in System32 directory
        
        PID:8436
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        334⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8200
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        336⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        337⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9224
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        339⤵
        Modifies registry class
        
        PID:9268
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        340⤵
        Modifies registry class
        
        PID:9316
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        341⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        342⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        343⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        344⤵
        Drops file in System32 directory
        
        PID:9488
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        345⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9576
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9624
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        348⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9716
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        350⤵
        Modifies registry class
        
        PID:9756
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        351⤵
        Modifies registry class
        
        PID:9808
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        352⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        353⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9928
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        355⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        356⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        357⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        358⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        359⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        360⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        361⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        362⤵
        Modifies registry class
        
        PID:9276
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        363⤵
        Modifies registry class
        
        PID:9304
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        364⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        365⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        366⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        367⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        368⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        369⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        370⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        371⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        372⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        373⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        374⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        375⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        376⤵
        Drops file in System32 directory
        
        PID:10180
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        377⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        378⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        379⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        380⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        381⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        382⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        383⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        384⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        385⤵
        Drops file in System32 directory
        
        PID:10092
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        386⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        387⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9516
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        389⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        390⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9936
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        391⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        392⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        393⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        394⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        395⤵
        Drops file in System32 directory
        
        PID:9944
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        396⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        397⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10288
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        398⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        399⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        400⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        401⤵
        Modifies registry class
        
        PID:10468
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        402⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        403⤵
        Drops file in System32 directory
        
        PID:10556
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        404⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        405⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        406⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        407⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        408⤵
        Modifies registry class
        
        PID:10772
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10816
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        410⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        411⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        412⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10948
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        413⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        414⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        415⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        416⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        417⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        418⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        419⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        420⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        421⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        422⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        423⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        424⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10532
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        425⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        426⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        427⤵
        Modifies registry class
        
        PID:10764
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        428⤵
        Drops file in System32 directory
        
        PID:10824
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        429⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        430⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        431⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        432⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        433⤵
        Drops file in System32 directory
        
        PID:11164
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        434⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10284
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10404
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        437⤵
        Drops file in System32 directory
        
        PID:10536
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        438⤵
        Modifies registry class
        
        PID:10640
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        439⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        440⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        441⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        442⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        443⤵
        Drops file in System32 directory
        
        PID:11188
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        444⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        445⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        446⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        447⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        448⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        449⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        450⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        451⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        452⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        453⤵
        Modifies registry class
        
        PID:10488
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10804
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        455⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        456⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        457⤵
        Modifies registry class
        
        PID:10264
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        458⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11316
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        460⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        461⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11400
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        462⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        463⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        464⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        465⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        466⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11640
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        468⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        469⤵
        Drops file in System32 directory
        
        PID:11732
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        470⤵
        Modifies registry class
        
        PID:11776
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        471⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        472⤵
        Modifies registry class
        
        PID:11852
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        473⤵
        Modifies registry class
        
        PID:11888
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        474⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        475⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        476⤵
        Modifies registry class
        
        PID:12020
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        477⤵
        Drops file in System32 directory
        
        PID:12056
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        478⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        479⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        480⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        481⤵
        
        PID:12224
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        482⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11284
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        484⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        485⤵
        Modifies registry class
        
        PID:11384
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        486⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        487⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11548
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        488⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        489⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        490⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        491⤵
        
        PID:11840
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        492⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        493⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        494⤵
        Modifies registry class
        
        PID:12064
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        495⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        496⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        497⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        498⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        499⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11396 -s 396
        500⤵
        Program crash
        
        PID:11664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 11396 -ip 11396
1⤵
PID:11600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Dhidjpqc.exe

Filesize
64KB

MD5
3c8eee5daa21972ee154564ebbcb9eb9

SHA1
89167d58f2fee74f25e9725276a9159c85025bd5

SHA256
2686a1255d575606f9e0d1404caaa86cd1edb7594391062041565bd45c4380c5

SHA512
22e7125128b43d0f56269a161c7d799dc60d7be86d631ceff922391bb7f6bd42f6260693bf7226e50a8d9631bd379278c65a2cb2baa8ed8b9e6de869e199583b

Download Submit
C:\Windows\SysWOW64\Gkkojgao.exe

Filesize
64KB

MD5
ec28d8b7ee4be4a757250756c74485d0

SHA1
530f0cb4ad449df6ff563c2cfb4fac18fe336ba0

SHA256
7593bbe9e0ac4d0d8efb50736d83d194609e572d99d9a0c7c029bbd93294dd86

SHA512
bd2fa15d6a44882e5e36ecd8858626bffb27b08149d52cdf4613edee916ee0efc5f0e2cdefc87dcc4a01fd3bba0404b6d163a004933b8c4fa63d0dde72e79330

Download Submit
C:\Windows\SysWOW64\Hbgmcnhf.exe

Filesize
64KB

MD5
7b889be1e4c7fe03529c69d06372c8c5

SHA1
158030a8ee42fe794373f74184b594017b083201

SHA256
421c84a3b75692897e1c19f53fad4b7067d3a55192f288b588c6f64472ab5ce3

SHA512
a6d2030a122f41906b51bb7680345ab988f07a53e2f6f810cc58a8fb7024d977eca988450e5b738d7ac4bd83de7bd7f8144d15a24d75eaab48edb4b3c4a62932

Download Submit
C:\Windows\SysWOW64\Lgbnmm32.exe

Filesize
64KB

MD5
0b5f430cddb22195d7eeea3f0752fea9

SHA1
fdd4123658dd24108a7bf585724e3971e0795cc8

SHA256
5cf2cd8bbcd4ef3a50ac0b09c9b8dc116898237df1de3855f4cdd731785134b5

SHA512
ef7e755c52fc83f24af1c9fa3a1edde73531f547c9ebcf11c29e0189ea92991c8ab0aed6d0c1ec6dd9bbfc1d01e3b25dfee87a7601bf4b26e0a4621d67c12cf8

Download Submit
C:\Windows\SysWOW64\Lphfpbdi.exe

Filesize
64KB

MD5
35b34df35400f4a3c1bbd4985016c61d

SHA1
3ec86cb12310c20c75c182839efb63b66f006caa

SHA256
d23ee8333955580a6756766f9c29c047273539c71c84331d5c7bc602a4bf6d84

SHA512
faff04bce11eea1be42cb5be5f903d7bdab8e523aeb66c8b8ff3a58a85e85813f13a69fe9a57c055fcf1ca290d4ba49c4f5fcf0d19d016e83b113cc433e55962

Download Submit
C:\Windows\SysWOW64\Majopeii.exe

Filesize
64KB

MD5
adf9c761d24768c4d969023518c8af9d

SHA1
94b6fd48a3340a3f7fe2bfbe806548ba3ca9228e

SHA256
1cc096892e8a5cf4d46db8f6eb6789e780ee7a61ebbfa72a5ebf311fbf7d512e

SHA512
3acca4eacb29a30d57385973dcc620e57bd9f77ac0826d66fcbbb545cf19411ce4bf61a1a0969d916e55a7910d55d1df633d522f90fac354ace0b136f821aefa

Download Submit
C:\Windows\SysWOW64\Mamleegg.exe

Filesize
64KB

MD5
b77802dc4b3d88122e945a6cdf4e98e5

SHA1
9d885315ecd026edd5659abd7cfa81c69a08dafc

SHA256
4132ab181bc69afe87e0e662d36d5e6b8d230a964e2a68fa518a6eac650740ae

SHA512
94662e63cbc1afa2535754faee9e5ef7ba5ee05aa3b34182139e8fd08e3acbaa840f5c563a5ce32a814dbe07a2b8838279021edad78103671e28ff1d52324efd

Download Submit
C:\Windows\SysWOW64\Mcbahlip.exe

Filesize
64KB

MD5
f224d360d2a82ce3bdefe2e04f49a99d

SHA1
c70ad7f307aa6a1b1745b4e4c9397d74c1aa43c8

SHA256
948fa8575ae423b37000699d93cc2069e8483d50447a7f66f0f401971711bcf4

SHA512
c009cbdb7137d5132d16c494c1e4eeb105caaba7ee759fa1c72b26310d2b1400683b4bff5aaaecf5f8b9df5bc4738d2051937dc329352cb25858f75a996fbaad

Download Submit
C:\Windows\SysWOW64\Mcnhmm32.exe

Filesize
64KB

MD5
025020e76d304b1f1ab3b02561973a38

SHA1
c086e5b26f0969f7690128b44b291a622fa4d7ab

SHA256
9bf2a53cde79313382b289547d21b6bb9b35f560f5121a5638fb41d779366b20

SHA512
5d26696fe0dfaf82d1bea3f2b327f8d84b075fb6326bd3602d7481f4282f44d1d79d1370a3a1a7e2fc847e973bea3ef90b1e9742035869abfdad1084f8be1bfe

Download Submit
C:\Windows\SysWOW64\Mcpebmkb.exe

Filesize
64KB

MD5
2da37a6dfb0eae2033ce113c838c626c

SHA1
fb6a38c6a60c960fec6a87ae347f70f194c6ed3d

SHA256
bb1005de8c5a6b9a49f779ca89ac27041e99cdbcfbfd0946722828b5ef46efa7

SHA512
20eba1da8c75fd1db9ae1c8a098d22d7f9b50073c4ae36ccfbbbb9bbf349cbcb8f83a570a50695bb78d000a674e541dd3f952f76b3ee0f5543a7cfc6d70fe33e

Download Submit
C:\Windows\SysWOW64\Mdfofakp.exe

Filesize
64KB

MD5
e7425c737cf03e82683fcc118177f1e2

SHA1
3ea11aa67ca671b085f41d755e572d06954ab99b

SHA256
95df8b6759586896f671c5297da6a589fa2c46cb565c0ba6c561913860de5654

SHA512
5ccd0934bad33afa82ad0780ef29b50ea5cda54cbd7162f782739eae356abf504b088482d596efba1595a786f2dcfb79fe37c48dc54fae16a6ba2c9139d10855

Download Submit
C:\Windows\SysWOW64\Mdiklqhm.exe

Filesize
64KB

MD5
7eb2e0aaeb222b200e755e083f0e181e

SHA1
db0eea8220ce25f226737473c60d1ae342334ce6

SHA256
fac84d760e0651b25e4fd22d9743b776288e31b4c090ee7be966b8b482ac0707

SHA512
52f9f4579076ad81798bdad289bfeb650e75e5a9d4bc720496dfc8b0aff90755761f8e032604cee412f55c7df350d6f9299d7cfa6e89c97e367e70ac7119b0f6

Download Submit
C:\Windows\SysWOW64\Mjcgohig.exe

Filesize
64KB

MD5
4c398ddc95491000fb720211eab7b5d7

SHA1
326af43fe68b9598d8a7edd6a17f2a7b86b1f8cf

SHA256
863a4e0b92c9f2a2c291ae8f89ae2f34f556b5bb15c33a17652cef36c667a548

SHA512
309a8eca4bfdb24fcfc73ff622a2514aaa78e37c47000219ef4010760c1d13437d375f094c1a7eeef7fabfa9124677d9213cef8d304d39b54c3e0e1c4d253465

Download Submit
C:\Windows\SysWOW64\Mjeddggd.exe

Filesize
64KB

MD5
51aef6d772324630efb2fde03531a6ec

SHA1
c635cfa6e54a30c9d05ff578933c00d026ac2443

SHA256
c498d59da5667e89b3c755bc2aa11e2e401b7b6e10d63234dd30d6f93062fc22

SHA512
642fca2012018a63d96f05ae0f38858e63b3bf7db0585ae1fdfeafee2eb4f2ffdf62f159f72190e744d315e5305b9907c1833f655913c0a3570f86595937caca

Download Submit
C:\Windows\SysWOW64\Mjhqjg32.exe

Filesize
64KB

MD5
c6bee6730f3aaacb6bc37d43efc6fee1

SHA1
dab15926f0e14f54575f4d5d37ec03ee710cdf3b

SHA256
c18624ed5b74906e0070c5cc6b5110e2db992a6285df5e8202bf87e67e5a409b

SHA512
77689b62b12bcef15b27221fd41ba4c34d853de7b288466a7746591166ca2e029db7931943ca5c59fab58afa612feaa8e0e03f8753ae4ba06adb12cc7c3e2ed0

Download Submit
C:\Windows\SysWOW64\Mjjmog32.exe

Filesize
64KB

MD5
5c9cdf97859ff44db1d7544bfec8c1aa

SHA1
ce4fa34d1bc67ac337fed44ff8d2b1a4738d7d19

SHA256
ea943a8cc09a54257cf85947f33c2775029136e7089a469b2f778818ef8a1e43

SHA512
67fdf6f6e81c6068b0157995f60e77d04fd7a321125e4a547f53914d8ccf0853314136ffa8e0425cecaac6ea541739f523c2317f39fb46f3b4b1b83ea5ed4677

Download Submit
C:\Windows\SysWOW64\Mnlfigcc.exe

Filesize
64KB

MD5
6252399be6c00e456f8746050637caa3

SHA1
4d9d4fc08143d9c72e48078a14f148336279238c

SHA256
2aa577d7ccffd4eebfbf09c1230b8f48fff5ce6cd68294994539c5823a5d28e3

SHA512
73900dccf9f405efa02a4057e2e6a14ed19c0820b1526e8e40e98a8e24faa67dc2dcfb09de7acecbee232877a72998516a48935d97cf04149bbd7818478d218e

Download Submit
C:\Windows\SysWOW64\Mpaifalo.exe

Filesize
64KB

MD5
60beee4b5a00de0e27f46fc7db916128

SHA1
9b4cd01a2c831a6f3762bb03a804936ff85f8303

SHA256
e6679fa4eab5d6fe690354580a389a93c8d373b773cb0d73b0c7cdfce22848ba

SHA512
8871ef44b83c846cdf989c173d4a36ad0e145e8a04a91a6a3776b6ca1611c3da9fe57af502437c0cb540bffcfd997284a8df352384fa020c3a2dda653f80d4e3

Download Submit
C:\Windows\SysWOW64\Mpdelajl.exe

Filesize
64KB

MD5
6db80a59fbfbee0042c9ccf3d71f52db

SHA1
7273f026017118a193d1be1ed84a722bd314a382

SHA256
f1c6aeb5ff8c4a336de0d1c18da0b9a3c72211b738fa58f047bafde5612844cc

SHA512
26a7b99788c42619b25597e6fffca287c6f3beefd5904e65760e5bd8b4d809850ff9e2d657ac780558aada4c259a4459f10a6e161f47dadd5af86d251b04d4a0

Download Submit
C:\Windows\SysWOW64\Nbhkac32.exe

Filesize
64KB

MD5
643e78635af6cc91529248db826de0f5

SHA1
1f4d2ca1f35e72b22a2270c1e5c21758e6dcde5d

SHA256
06f8278239ffc26752f3eeaf882337edc6b9cf2069f77f0575fca8f81c8ebc6f

SHA512
06c7f27e49109898c7dc550855e1ca03b66f2f544d0e69414835dd2eafcb9e930b5c0f617eaa712d82b821ad3a3a4fa76d87d190f1e8dad666aafcd95946dac6

Download Submit
C:\Windows\SysWOW64\Nbkhfc32.exe

Filesize
64KB

MD5
2090afecea63a790bbfd3851b450ab1e

SHA1
f1417ac72ea3b53d89086c0eea50f3b0ce49df8b

SHA256
1c99bde7026d5d45886f67bbb5f5b2ae4c09093e708d5699539e43231caa757a

SHA512
8fd810b2a634917b37c016c56ad372e684b6ccdb4a10b9b5899dae587cab2ac02e8871598fef3834424b1faf1282e3d8450293972d2afcc23b2860c354a068a8

Download Submit
C:\Windows\SysWOW64\Nceonl32.exe

Filesize
64KB

MD5
7ff48b589acc26e46140a98de4394e0d

SHA1
1712337c3297a12847b891281948546c43bfca13

SHA256
476063760c1f5548c875321c06ec290475ab966be7f2b27f8894f4d74caa1f1a

SHA512
1bfe6659b3b4ef591482485ab317f8b5cbc071790abb12fa958883a964a8ec47dc2586242def5a64415928f4b10a8b56af1516e907c73dbba250008e80404e9f

Download Submit
C:\Windows\SysWOW64\Ncgkcl32.exe

Filesize
64KB

MD5
3ee1cd7a30f0dbc25448e03f2e6a9af7

SHA1
2f51ad8d5c36220a7a24d189bdca8b6150b685fd

SHA256
a739f99b2062f0e352c3a3fa79e633db6ac503b2e1ddc34b753bdfb6ceaae5ee

SHA512
2a126a1242ef19af4663edf87bcecf435ac3fb6b197d10fbc61a98d51f060c65bd2d2c8898eca45957613282506b25edbaba2fce69cd816775980171836a61da

Download Submit
C:\Windows\SysWOW64\Ngedij32.exe

Filesize
64KB

MD5
7e24b51223f11fa2b94daa6bf7391011

SHA1
0ef421a442d1905d491f11f79e9faf82f40c3e64

SHA256
5db53a68b475c22e64d0d70d626efb21d95009768442a9b4fef70f18af09f7fe

SHA512
f5ffcd2c8216e2aec13620225db5a5c12c293927706c0733e268626b3d73dba2cb4726ca418b295100d732c27ff4b21ed14976ed52a694ddfa22475dcebd8fb9

Download Submit
C:\Windows\SysWOW64\Nggqoj32.exe

Filesize
64KB

MD5
3f4644d77751d8d18c0b4b73c94107f0

SHA1
6d4aea00edfe1dd3212c8e7a012c0b85cf09a19e

SHA256
c81c722825211fa70ab635a9f19619cda9debafa7c1da9c3e27ab8ba0d7944cf

SHA512
5e36ec7f054107983a36bd7d87c9fe4f600e6ca3147dc1cc6403db63d0ebf99713773b1ab16471a807aedc762b4a02e88a88082dbe176929b7e6fc286c82f902

Download Submit
C:\Windows\SysWOW64\Njacpf32.exe

Filesize
64KB

MD5
b8d03b7a7b0ca8ab43d49a77e1a1b4ec

SHA1
d01f1e97f788002715bed46f89bd8d5b7aaddbc1

SHA256
e2a45d85352985ae6fa692cf1309e1b57dab1630e25db4c3019202fca6be593e

SHA512
700cd0b382f104d5ee08f3d268339191d1d8c32970c0df9f5196d55505e0405611df9e3c78efdd0414f77d568a392c253b208dc22b42cf687924a2fcb730582e

Download Submit
C:\Windows\SysWOW64\Njcpee32.exe

Filesize
64KB

MD5
f6cb0b3c64846cf30ffde532e8ca5782

SHA1
6c36f1c236730f200a68910539012d04f6af2258

SHA256
b349e003f4a4b9e067d8385d34f824d85cbee408f9b4a937bab29df745856cec

SHA512
7d8b352c0da1f10c6212e3692a9e71986c28c710c7cba2422b91775ee80765bfdfe3eb9240f22b63bf6a1bbdd68e304e12caa7b088bf68f0c03fe9c7d1b20c1b

Download Submit
C:\Windows\SysWOW64\Njljefql.exe

Filesize
64KB

MD5
a369ed8f07cd0b1d4f0fdda2bf421833

SHA1
88347432ead1c9a900772c8ccb9ae44f89a5f5fb

SHA256
a2870465a521953c08d918a7a9808960a368353b589c0535a2fb859b038afecc

SHA512
091db42a37089c0a157765276740c6e1a2f384da8c057f89f480f7a4f00f51a72802ce050b5c636d4412d0f6280c669d1baa0d54429a3ddbaa755e6ee8c76362

Download Submit
C:\Windows\SysWOW64\Njogjfoj.exe

Filesize
64KB

MD5
477c9d0bd7f00619900ecb6989b7826e

SHA1
de0a4a9275c6adee98b2a8d23a6207a4e37e67e3

SHA256
a60451bd6832053af485f6dddd8d95b70eb51026b0fdb07f494e42f4d4becf52

SHA512
cd24ebc183efd5b05fc7f1dcbfd2c768f66d55aabc8bf9039612a399dfa0f1145f35ad6a52475fb966dac9c3892c6b74db6ad3da57a731eda44efef2fda2503e

Download Submit
C:\Windows\SysWOW64\Nnaikd32.exe

Filesize
64KB

MD5
640704a417ba44eefafc1847a27db6c9

SHA1
1bab80eaac0018dc6dd86f404a2022baa9d6e6a9

SHA256
547954b10156f8e43652717aeb552486443c6499205bcb61dd069cd38a399c15

SHA512
ab377ca17b09818b16ba9781e0662d4edb2a1fcfd583a1146b987df2705fb6c8ef12a34113c702fbb291f58f005417b83ab4ac5d8e7fbff8f7cade27e2d9e74e

Download Submit
C:\Windows\SysWOW64\Nqfbaq32.exe

Filesize
64KB

MD5
36d760ebf101baad5b8c87d67d7aa96e

SHA1
560a5e1461f5ac9303dc6037fec038f129302aa7

SHA256
bd1191c8135d28bc1f7d6b909db18c09ab69aa631f7f7cfdf4ff12a7c1d739bd

SHA512
6cd583a5f37d636c22c6d52851237628505c6d0008099da1e87bd4d3e97bd8631f76453e37b55515b6c5f10608e635c15bfd404f05c28b10d4b54eeee1ee72c8

Download Submit
C:\Windows\SysWOW64\Nqiogp32.exe

Filesize
64KB

MD5
dc320fd57f750f7c4dd17d39fafee13d

SHA1
2f2c5c11bc72cd725c8e6308aea26094926bc6cf

SHA256
e43b6f1e98818712ca556b0141882e5531a61419d848d30e11d04a700aa36238

SHA512
b22b625e53a31a43b918aa9031a9e445734fc641e74cd26f718075fddf017282efddd3cdf797a0ebf036e89c990b4cb839421056f512e09788dcc5365aa9d332

Download Submit
C:\Windows\SysWOW64\Nqpego32.exe

Filesize
64KB

MD5
45cf559fbf0d92d56bd698a819cb0cf9

SHA1
0da6bc89f496498674d8d1a9d0ac1245d736e356

SHA256
f90f1187b5e96e7a5ae51f25838b51ed2d02284450f95f88e2ad0add19dcc360

SHA512
6f2e04416aa8142fac19b4a672fb8c7089d24adb77efa7ec346ddbeba1c9ae8677f89cf689a056321e1ab2843a38ce8172b0399c0a731b6947dcc1109d5c1ca1

Download Submit
C:\Windows\SysWOW64\Ogjmdigk.exe

Filesize
64KB

MD5
963c39c6d0a58349269df895f83ccbfd

SHA1
be8e918cdd2f2392b4297ce69fa2c189a518327d

SHA256
b4347ffdd0fc6d40c41f45930e592c785a2ea5045e62ad591c87fadf8f63eaa7

SHA512
f2e9a520f80f52581a27e55fd4d8203baeb4cd9a50b9054c928291df4e05a1b62b0eb1d00741920c61f100ee987356de6e48ae713ca2655eb1548485741f6947

Download Submit
C:\Windows\SysWOW64\Ondeac32.exe

Filesize
64KB

MD5
5e71166420e1d1550352760e05feb4bd

SHA1
5de98cdeb063aaa149b5135d353096abf7755ae6

SHA256
0389326158a9a01d2f2118437504b174c600398e2a45a7130519a8f720c8a53a

SHA512
dc6fa0f9e0b0dbf459811d9e6612efc16b95807f88c6b288db097fd6ffe0ac1642a85e6ca1813e844d6456052bf47944679d9465de8dcf1ae664b9744c632be6

Download Submit
memory/868-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/936-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/976-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1100-401-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1140-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1264-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1356-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1368-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1420-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1480-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1496-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1832-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1976-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2008-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2020-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2020-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2072-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2080-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2264-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2308-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2456-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2532-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2536-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2620-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2644-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2680-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2740-441-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2880-395-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2968-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3000-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3176-417-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3212-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3304-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3488-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3532-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3636-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3664-392-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3676-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3716-375-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3740-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3796-29-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3860-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3928-209-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4008-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4016-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4120-193-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4228-327-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4240-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4408-267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4508-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4516-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4524-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4560-137-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4608-363-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4624-315-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4696-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4704-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4728-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4828-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4992-233-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5000-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5004-291-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5028-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5040-425-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11268-3283-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11384-3296-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11396-3282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11476-3295-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11548-3294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11732-3312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11752-3291-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11840-3290-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11936-3307-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11964-3288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11976-3306-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/12092-3286-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/12140-3302-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/12172-3285-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/12180-3301-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads