4a43564fe40c28126b56a510d952de67f63b6b18ad78100665a05ec9c4ada1f1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

107a3bf0e5a0a1cd04de670a8ca45ecb.exe
Size

148KB
MD5

107a3bf0e5a0a1cd04de670a8ca45ecb
SHA1

544b794055c7f8973dfac0a90c04a11a906318be
SHA256

4a43564fe40c28126b56a510d952de67f63b6b18ad78100665a05ec9c4ada1f1
SHA512

62ce7910647d531577d4a86b2ddb525a2e2f2923aaf26be6c5d8603feb5a76503ced81b0a6837f75bdb1ce30dc6e1f2f7c0b08f8f3f9ba49a9218097e5427e58
SSDEEP

3072:UBVSWwlmoEhY5OdzOdjKtlDoNQQ9wlHOdj+UCRQKOdj+U:U3fwfEhKOdzOdkOdezOd

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onfbfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmdqgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehnglm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhcpgmjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imfdff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmbmibhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kknafn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eefhjc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikbnacmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpnchp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Miifeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndaggimg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhpjkojk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipknlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocgdji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eoolbinc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Meiaib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjmehkqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kiidgeki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flceckoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hflcbngh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icifbang.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jehokgge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcqjfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hibljoco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikbnacmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgokmgjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocqnij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcagkdba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldleel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnihcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdeqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcdmga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icifbang.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kefkme32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adcmmeog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gofkje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmknaell.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmdina32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnebeogl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnlhfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imbaemhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqgkhnjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eapedd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhcpgmjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iicbehnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jehokgge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpoefk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Impepm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcjapi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pabkdmpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eamhodmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdcdbl32.exe

Executes dropped EXE 64 IoCs

pid	Process
944	Habnjm32.exe
1996	Hcqjfh32.exe
3408	Hmioonpn.exe
3048	Hfachc32.exe
4740	Hippdo32.exe
3672	Haggelfd.exe
4228	Hcedaheh.exe
3076	Hibljoco.exe
4268	Icgqggce.exe
4452	Ijaida32.exe
1780	Impepm32.exe
1400	Ipnalhii.exe
4532	Ibmmhdhm.exe
216	Imbaemhc.exe
4660	Ipqnahgf.exe
2376	Ifjfnb32.exe
1104	Iiibkn32.exe
2248	Iapjlk32.exe
1800	Ibagcc32.exe
1980	Ijhodq32.exe
2300	Iabgaklg.exe
2652	Idacmfkj.exe
5024	Ijkljp32.exe
1088	Imihfl32.exe
3972	Jdcpcf32.exe
2504	Jjmhppqd.exe
5096	Jpjqhgol.exe
4676	Jbhmdbnp.exe
844	Jplmmfmi.exe
4296	Jbkjjblm.exe
4700	Jjbako32.exe
4932	Jaljgidl.exe
752	Jdjfcecp.exe
3148	Jigollag.exe
3748	Jangmibi.exe
4728	Jbocea32.exe
888	Jkfkfohj.exe
540	Kmegbjgn.exe
3932	Kpccnefa.exe
4040	Kbapjafe.exe
1200	Kkihknfg.exe
2716	Kilhgk32.exe
2532	Kpepcedo.exe
1956	Kdaldd32.exe
956	Kinemkko.exe
3104	Kdcijcke.exe
3680	Kgbefoji.exe
5104	Kknafn32.exe
452	Kmlnbi32.exe
1392	Kpjjod32.exe
3556	Kdffocib.exe
1272	Kgdbkohf.exe
3708	Kibnhjgj.exe
2540	Kajfig32.exe
3160	Kdhbec32.exe
3288	Kckbqpnj.exe
3488	Kgfoan32.exe
3424	Lmqgnhmp.exe
2384	Lcmofolg.exe
2876	Lgikfn32.exe
4484	Lmccchkn.exe
3152	Lpappc32.exe
4856	Lcpllo32.exe
4424	Lijdhiaa.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hoiafcic.exe	Hmjdjgjo.exe
File opened for modification	C:\Windows\SysWOW64\Lenamdem.exe	Ldleel32.exe
File opened for modification	C:\Windows\SysWOW64\Mmnldp32.exe	Mibpda32.exe
File opened for modification	C:\Windows\SysWOW64\Ijkljp32.exe	Idacmfkj.exe
File created	C:\Windows\SysWOW64\Hffdjk32.dll	Bjpaooda.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Ajfoiqll.exe	Acmflf32.exe
File created	C:\Windows\SysWOW64\Bneljh32.dll	Bfdodjhm.exe
File created	C:\Windows\SysWOW64\Okloegjl.exe	Ogaceh32.exe
File created	C:\Windows\SysWOW64\Ndhmhh32.exe	Nlaegk32.exe
File created	C:\Windows\SysWOW64\Pqnaim32.exe	Pjdilcla.exe
File opened for modification	C:\Windows\SysWOW64\Cdfbibnb.exe	Cahfmgoo.exe
File created	C:\Windows\SysWOW64\Eaklidoi.exe	Dlncan32.exe
File opened for modification	C:\Windows\SysWOW64\Jigollag.exe	Jdjfcecp.exe
File created	C:\Windows\SysWOW64\Kdaldd32.exe	Kpepcedo.exe
File created	C:\Windows\SysWOW64\Gdqgmmjb.exe	Gcojed32.exe
File opened for modification	C:\Windows\SysWOW64\Lpqiemge.exe	Lmbmibhb.exe
File created	C:\Windows\SysWOW64\Ndkqipob.dll	Cjinkg32.exe
File opened for modification	C:\Windows\SysWOW64\Idacmfkj.exe	Iabgaklg.exe
File created	C:\Windows\SysWOW64\Ekipni32.dll	Mcpebmkb.exe
File opened for modification	C:\Windows\SysWOW64\Jblpek32.exe	Jpnchp32.exe
File opened for modification	C:\Windows\SysWOW64\Cajlhqjp.exe	Ceckcp32.exe
File opened for modification	C:\Windows\SysWOW64\Kpepcedo.exe	Kilhgk32.exe
File opened for modification	C:\Windows\SysWOW64\Hmfkoh32.exe	Heocnk32.exe
File opened for modification	C:\Windows\SysWOW64\Iehfdi32.exe	Ifefimom.exe
File created	C:\Windows\SysWOW64\Dnqmalhn.dll	Dekhneap.exe
File created	C:\Windows\SysWOW64\Keblci32.dll	Ipknlb32.exe
File opened for modification	C:\Windows\SysWOW64\Laalifad.exe	Lijdhiaa.exe
File opened for modification	C:\Windows\SysWOW64\Baicac32.exe	Bfdodjhm.exe
File created	C:\Windows\SysWOW64\Ndninjfg.dll	Jjmhppqd.exe
File created	C:\Windows\SysWOW64\Iifokh32.exe	Iejcji32.exe
File opened for modification	C:\Windows\SysWOW64\Kplpjn32.exe	Klqcioba.exe
File created	C:\Windows\SysWOW64\Offdjb32.dll	Lmqgnhmp.exe
File created	C:\Windows\SysWOW64\Ocalcppo.dll	Ecjhcg32.exe
File created	C:\Windows\SysWOW64\Pkajcp32.dll	Pjhbgb32.exe
File created	C:\Windows\SysWOW64\Doqpak32.exe	Clbceo32.exe
File created	C:\Windows\SysWOW64\Lbjlfi32.exe	Kplpjn32.exe
File created	C:\Windows\SysWOW64\Daconoae.exe	Ddonekbl.exe
File opened for modification	C:\Windows\SysWOW64\Kdffocib.exe	Kpjjod32.exe
File opened for modification	C:\Windows\SysWOW64\Kckbqpnj.exe	Kdhbec32.exe
File created	C:\Windows\SysWOW64\Pdfjifjo.exe	Pmoahijl.exe
File created	C:\Windows\SysWOW64\Flqimk32.exe	Ffgqqaip.exe
File opened for modification	C:\Windows\SysWOW64\Pgllfp32.exe	Pqbdjfln.exe
File created	C:\Windows\SysWOW64\Gefncbmc.dll	Lgpagm32.exe
File created	C:\Windows\SysWOW64\Jcoegc32.dll	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Cbcilkjg.exe	Cklaknjd.exe
File created	C:\Windows\SysWOW64\Dekclg32.dll	Gcddpdpo.exe
File created	C:\Windows\SysWOW64\Ifllil32.exe	Icnpmp32.exe
File opened for modification	C:\Windows\SysWOW64\Kknafn32.exe	Kgbefoji.exe
File opened for modification	C:\Windows\SysWOW64\Aeopki32.exe	Andgoobc.exe
File created	C:\Windows\SysWOW64\Mjdgcbkb.dll	Bbgipldd.exe
File created	C:\Windows\SysWOW64\Llmglb32.dll	Opdghh32.exe
File created	C:\Windows\SysWOW64\Bhicommo.dll	Cabfga32.exe
File opened for modification	C:\Windows\SysWOW64\Qnkdhpjn.exe	Qjpiha32.exe
File created	C:\Windows\SysWOW64\Aeopki32.exe	Andgoobc.exe
File opened for modification	C:\Windows\SysWOW64\Ocnjidkf.exe	Odkjng32.exe
File created	C:\Windows\SysWOW64\Iapjlk32.exe	Iiibkn32.exe
File created	C:\Windows\SysWOW64\Oponmilc.exe	Nnqbanmo.exe
File opened for modification	C:\Windows\SysWOW64\Eemnjbaj.exe	Ecoangbg.exe
File created	C:\Windows\SysWOW64\Oggacefk.dll	Ffgqqaip.exe
File opened for modification	C:\Windows\SysWOW64\Lpfijcfl.exe	Lnhmng32.exe
File created	C:\Windows\SysWOW64\Ekiapn32.dll	Odgqdlnj.exe
File created	C:\Windows\SysWOW64\Aaiapmca.dll	Nggqoj32.exe
File opened for modification	C:\Windows\SysWOW64\Bdfibe32.exe	Bahmfj32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12708	6416	WerFault.exe	662

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajgblabf.dll"	Hmfkoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfckahdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdhdajea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dapgdeib.dll"	Ndaggimg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiopcppf.dll"	Jbeidl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdgdjjem.dll"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcdmga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbmgladp.dll"	Njnpppkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgngca32.dll"	Qfcfml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onfbfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eelcja32.dll"	Ehgqln32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eamhodmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdkldb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Balfaiil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Angddopp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Abngjnmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncnkogdb.dll"	Bbifelba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffkjlp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbiaapdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kajfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fkciihgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bbgipldd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Melnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldobbkdk.dll"	Kilhgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdfbibnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfenmm32.dll"	Mlcifmbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agffge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpjqhgol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpepcedo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpdelajl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oqgkhnjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbllbibl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbmhofmq.dll"	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efmolq32.dll"	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ijkljp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Milgab32.dll"	Kdcijcke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldleel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgdnaigp.dll"	Hcedaheh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnhjmp32.dll"	Kboljk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmjkjk32.dll"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqdoboli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qddina32.dll"	Hofdacke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlmllkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffddka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipkobd32.dll"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edbklofb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpgmha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anmcpemd.dll"	Jlednamo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qoecnk32.dll"	Kmdqgd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ligqhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekphijkm.dll"	Pdifoehl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oqbamo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajneip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmgfda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkckjila.dll"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eodpoobg.dll"	Bdfibe32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 944	1972	107a3bf0e5a0a1cd04de670a8ca45ecb.exe	86
PID 1972 wrote to memory of 944	1972	107a3bf0e5a0a1cd04de670a8ca45ecb.exe	86
PID 1972 wrote to memory of 944	1972	107a3bf0e5a0a1cd04de670a8ca45ecb.exe	86
PID 944 wrote to memory of 1996	944	Habnjm32.exe	87
PID 944 wrote to memory of 1996	944	Habnjm32.exe	87
PID 944 wrote to memory of 1996	944	Habnjm32.exe	87
PID 1996 wrote to memory of 3408	1996	Hcqjfh32.exe	88
PID 1996 wrote to memory of 3408	1996	Hcqjfh32.exe	88
PID 1996 wrote to memory of 3408	1996	Hcqjfh32.exe	88
PID 3408 wrote to memory of 3048	3408	Hmioonpn.exe	89
PID 3408 wrote to memory of 3048	3408	Hmioonpn.exe	89
PID 3408 wrote to memory of 3048	3408	Hmioonpn.exe	89
PID 3048 wrote to memory of 4740	3048	Hfachc32.exe	90
PID 3048 wrote to memory of 4740	3048	Hfachc32.exe	90
PID 3048 wrote to memory of 4740	3048	Hfachc32.exe	90
PID 4740 wrote to memory of 3672	4740	Hippdo32.exe	91
PID 4740 wrote to memory of 3672	4740	Hippdo32.exe	91
PID 4740 wrote to memory of 3672	4740	Hippdo32.exe	91
PID 3672 wrote to memory of 4228	3672	Haggelfd.exe	92
PID 3672 wrote to memory of 4228	3672	Haggelfd.exe	92
PID 3672 wrote to memory of 4228	3672	Haggelfd.exe	92
PID 4228 wrote to memory of 3076	4228	Hcedaheh.exe	94
PID 4228 wrote to memory of 3076	4228	Hcedaheh.exe	94
PID 4228 wrote to memory of 3076	4228	Hcedaheh.exe	94
PID 3076 wrote to memory of 4268	3076	Hibljoco.exe	96
PID 3076 wrote to memory of 4268	3076	Hibljoco.exe	96
PID 3076 wrote to memory of 4268	3076	Hibljoco.exe	96
PID 4268 wrote to memory of 4452	4268	Icgqggce.exe	97
PID 4268 wrote to memory of 4452	4268	Icgqggce.exe	97
PID 4268 wrote to memory of 4452	4268	Icgqggce.exe	97
PID 4452 wrote to memory of 1780	4452	Ijaida32.exe	98
PID 4452 wrote to memory of 1780	4452	Ijaida32.exe	98
PID 4452 wrote to memory of 1780	4452	Ijaida32.exe	98
PID 1780 wrote to memory of 1400	1780	Impepm32.exe	99
PID 1780 wrote to memory of 1400	1780	Impepm32.exe	99
PID 1780 wrote to memory of 1400	1780	Impepm32.exe	99
PID 1400 wrote to memory of 4532	1400	Ipnalhii.exe	100
PID 1400 wrote to memory of 4532	1400	Ipnalhii.exe	100
PID 1400 wrote to memory of 4532	1400	Ipnalhii.exe	100
PID 4532 wrote to memory of 216	4532	Ibmmhdhm.exe	101
PID 4532 wrote to memory of 216	4532	Ibmmhdhm.exe	101
PID 4532 wrote to memory of 216	4532	Ibmmhdhm.exe	101
PID 216 wrote to memory of 4660	216	Imbaemhc.exe	103
PID 216 wrote to memory of 4660	216	Imbaemhc.exe	103
PID 216 wrote to memory of 4660	216	Imbaemhc.exe	103
PID 4660 wrote to memory of 2376	4660	Ipqnahgf.exe	104
PID 4660 wrote to memory of 2376	4660	Ipqnahgf.exe	104
PID 4660 wrote to memory of 2376	4660	Ipqnahgf.exe	104
PID 2376 wrote to memory of 1104	2376	Ifjfnb32.exe	105
PID 2376 wrote to memory of 1104	2376	Ifjfnb32.exe	105
PID 2376 wrote to memory of 1104	2376	Ifjfnb32.exe	105
PID 1104 wrote to memory of 2248	1104	Iiibkn32.exe	107
PID 1104 wrote to memory of 2248	1104	Iiibkn32.exe	107
PID 1104 wrote to memory of 2248	1104	Iiibkn32.exe	107
PID 2248 wrote to memory of 1800	2248	Iapjlk32.exe	108
PID 2248 wrote to memory of 1800	2248	Iapjlk32.exe	108
PID 2248 wrote to memory of 1800	2248	Iapjlk32.exe	108
PID 1800 wrote to memory of 1980	1800	Ibagcc32.exe	109
PID 1800 wrote to memory of 1980	1800	Ibagcc32.exe	109
PID 1800 wrote to memory of 1980	1800	Ibagcc32.exe	109
PID 1980 wrote to memory of 2300	1980	Ijhodq32.exe	110
PID 1980 wrote to memory of 2300	1980	Ijhodq32.exe	110
PID 1980 wrote to memory of 2300	1980	Ijhodq32.exe	110
PID 2300 wrote to memory of 2652	2300	Iabgaklg.exe	111

C:\Users\Admin\AppData\Local\Temp\107a3bf0e5a0a1cd04de670a8ca45ecb.exe
"C:\Users\Admin\AppData\Local\Temp\107a3bf0e5a0a1cd04de670a8ca45ecb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\Habnjm32.exe
  C:\Windows\system32\Habnjm32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Windows\SysWOW64\Hcqjfh32.exe
    C:\Windows\system32\Hcqjfh32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Windows\SysWOW64\Hmioonpn.exe
      C:\Windows\system32\Hmioonpn.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3408
    - - C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3048
      - C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4740
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3076
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:216
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1104
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2652
        
        C:\Windows\SysWOW64\Ijkljp32.exe
        
        C:\Windows\system32\Ijkljp32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5024
        
        C:\Windows\SysWOW64\Imihfl32.exe
        
        C:\Windows\system32\Imihfl32.exe
        25⤵
        Executes dropped EXE
        
        PID:1088
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        26⤵
        Executes dropped EXE
        
        PID:3972
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2504
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        29⤵
        Executes dropped EXE
        
        PID:4676
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        30⤵
        Executes dropped EXE
        
        PID:844
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        31⤵
        Executes dropped EXE
        
        PID:4296
        
        C:\Windows\SysWOW64\Jjbako32.exe
        
        C:\Windows\system32\Jjbako32.exe
        32⤵
        Executes dropped EXE
        
        PID:4700
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        33⤵
        Executes dropped EXE
        
        PID:4932
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:752
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        35⤵
        Executes dropped EXE
        
        PID:3148
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        36⤵
        Executes dropped EXE
        
        PID:3748
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        37⤵
        Executes dropped EXE
        
        PID:4728
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        38⤵
        Executes dropped EXE
        
        PID:888
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        39⤵
        Executes dropped EXE
        
        PID:540
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        40⤵
        Executes dropped EXE
        
        PID:3932
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        41⤵
        Executes dropped EXE
        
        PID:4040
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        42⤵
        Executes dropped EXE
        
        PID:1200
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2716
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2532
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        45⤵
        Executes dropped EXE
        
        PID:1956
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        46⤵
        Executes dropped EXE
        
        PID:956
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3104
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3680
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5104
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        50⤵
        Executes dropped EXE
        
        PID:452
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1392
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        52⤵
        Executes dropped EXE
        
        PID:3556
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        53⤵
        Executes dropped EXE
        
        PID:1272
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        54⤵
        Executes dropped EXE
        
        PID:3708
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2540
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3160
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        57⤵
        Executes dropped EXE
        
        PID:3288
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        58⤵
        Executes dropped EXE
        
        PID:3488
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3424
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        60⤵
        Executes dropped EXE
        
        PID:2384
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        61⤵
        Executes dropped EXE
        
        PID:2876
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        62⤵
        Executes dropped EXE
        
        PID:4484
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3152
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        64⤵
        Executes dropped EXE
        
        PID:4856
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4424
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        66⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        67⤵
        
        PID:492
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        68⤵
        
        PID:928
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        69⤵
        Drops file in System32 directory
        
        PID:3896
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5048
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        71⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4988
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        72⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        73⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        74⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        75⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        76⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        77⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        78⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        79⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        80⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        81⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        82⤵
        Modifies registry class
        
        PID:4928
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        83⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        84⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        85⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4696
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        87⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        88⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        89⤵
        Drops file in System32 directory
        
        PID:1036
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        90⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        91⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        92⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        93⤵
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        94⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        95⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        96⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        97⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        98⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        99⤵
        Drops file in System32 directory
        
        PID:5532
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5592
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        101⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5680
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        103⤵
        Modifies registry class
        
        PID:5724
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        104⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        105⤵
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        106⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        107⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        108⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        109⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        110⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        111⤵
        Drops file in System32 directory
        
        PID:6044
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        112⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        113⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        114⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        115⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        116⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        117⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        118⤵
        Modifies registry class
        
        PID:5420
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5416
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        120⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        122⤵
        Modifies registry class
        
        PID:5712
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        123⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        124⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        125⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        126⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Oqgkhnjf.exe
        
        C:\Windows\system32\Oqgkhnjf.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        128⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        129⤵
        Drops file in System32 directory
        
        PID:5176
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        130⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        131⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        132⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5688
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        134⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        135⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        136⤵
        Drops file in System32 directory
        
        PID:6104
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3948
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        138⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        139⤵
        Drops file in System32 directory
        
        PID:5520
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        140⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        141⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        142⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        143⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        144⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        145⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        146⤵
        Drops file in System32 directory
        
        PID:6200
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        147⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6324
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        149⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        150⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        151⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        152⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        153⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        154⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6616
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        156⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        157⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        158⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        159⤵
        Drops file in System32 directory
        
        PID:6800
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        160⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        161⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        162⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        163⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        164⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        165⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        166⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        167⤵
        Modifies registry class
        
        PID:7124
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        168⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        169⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        170⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        171⤵
        Drops file in System32 directory
        
        PID:6356
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        172⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        173⤵
        Modifies registry class
        
        PID:6528
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        174⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        175⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        176⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        177⤵
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        178⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        179⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        180⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        181⤵
        Modifies registry class
        
        PID:7088
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        182⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6168
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        184⤵
        Modifies registry class
        
        PID:6372
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        185⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        186⤵
        Drops file in System32 directory
        
        PID:6632
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        187⤵
        Modifies registry class
        
        PID:6696
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        188⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        189⤵
        Drops file in System32 directory
        
        PID:6912
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        190⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7024
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        191⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        192⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        193⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        194⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        195⤵
        Modifies registry class
        
        PID:4632
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        196⤵
        Modifies registry class
        
        PID:6920
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        197⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        198⤵
        
        PID:448
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        199⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        200⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        201⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        202⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        203⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        204⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        205⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        206⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        207⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        208⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        209⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        210⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        211⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        212⤵
        Drops file in System32 directory
        
        PID:7440
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        213⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        214⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        215⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        216⤵
        Drops file in System32 directory
        
        PID:7608
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        217⤵
        Modifies registry class
        
        PID:7644
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        218⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        219⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        220⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        221⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        222⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        223⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        224⤵
        Modifies registry class
        
        PID:7924
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        225⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        226⤵
        Drops file in System32 directory
        
        PID:8004
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        227⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        228⤵
        Modifies registry class
        
        PID:8104
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        229⤵
        Drops file in System32 directory
        
        PID:8144
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        230⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        231⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        232⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        233⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        234⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        235⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        236⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        237⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        238⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        239⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        240⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        241⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        242⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        243⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        244⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        245⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        246⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6460
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        248⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        249⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        250⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        251⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        252⤵
        Drops file in System32 directory
        
        PID:8164
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        253⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7312
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        255⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        256⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        257⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8116
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        259⤵
        Drops file in System32 directory
        
        PID:7504
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7908
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        261⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        262⤵
        Modifies registry class
        
        PID:7872
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        263⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        264⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        265⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8280
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        267⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        268⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        269⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        270⤵
        Drops file in System32 directory
        
        PID:8432
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        271⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        272⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        273⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        274⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        275⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        276⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        277⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        278⤵
        Modifies registry class
        
        PID:8736
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8776
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        280⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        281⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        282⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        283⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        284⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        285⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        286⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        287⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        288⤵
        Modifies registry class
        
        PID:9124
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9160
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        290⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        291⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        292⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        293⤵
        Drops file in System32 directory
        
        PID:8308
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        294⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        295⤵
        Modifies registry class
        
        PID:8420
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        296⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        297⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8616
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        299⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        300⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        301⤵
        Modifies registry class
        
        PID:8812
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        302⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        303⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        304⤵
        Drops file in System32 directory
        
        PID:8996
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        305⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        306⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9196
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8248
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        309⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8388
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        311⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        312⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        313⤵
        Drops file in System32 directory
        
        PID:8728
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8876
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        315⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        316⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        317⤵
        Modifies registry class
        
        PID:7468
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        318⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        319⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        320⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        321⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        322⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        323⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        324⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        325⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        326⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        327⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8724
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        329⤵
        Drops file in System32 directory
        
        PID:9236
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        330⤵
        Modifies registry class
        
        PID:9280
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        331⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        332⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        333⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        334⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        335⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        336⤵
        Modifies registry class
        
        PID:9512
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        337⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        338⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        339⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        340⤵
        Drops file in System32 directory
        
        PID:9684
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        341⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9764
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        343⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        344⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        345⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        346⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9956
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        348⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        349⤵
        Drops file in System32 directory
        
        PID:10040
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        350⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10124
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10168
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        353⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9228
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        355⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        356⤵
        Drops file in System32 directory
        
        PID:9380
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        357⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        358⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        359⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        360⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        361⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        362⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        363⤵
        Drops file in System32 directory
        
        PID:9864
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        364⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        365⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10140
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        367⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        368⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        369⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        370⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        371⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        372⤵
        Modifies registry class
        
        PID:9824
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        373⤵
        Modifies registry class
        
        PID:9996
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        374⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10216
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        376⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        377⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        378⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        379⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        380⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10028
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        382⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10048
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        384⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        385⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        386⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        387⤵
        Modifies registry class
        
        PID:10352
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        388⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        389⤵
        Modifies registry class
        
        PID:10436
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        390⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        391⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10512
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        392⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10548
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        393⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        394⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        395⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        396⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        397⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        398⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        399⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        400⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        401⤵
        Modifies registry class
        
        PID:10900
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        402⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        403⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        404⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        405⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        406⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        407⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        408⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        409⤵
        Modifies registry class
        
        PID:11208
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11244
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        411⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10244
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        412⤵
        Drops file in System32 directory
        
        PID:10304
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        413⤵
        Drops file in System32 directory
        
        PID:10372
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        414⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        415⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        416⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        417⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        418⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        419⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        420⤵
        Modifies registry class
        
        PID:10856
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        421⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10928
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        422⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:11056
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        424⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11188
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        426⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        427⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        428⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        429⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        430⤵
        Modifies registry class
        
        PID:10632
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        431⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        432⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11020
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        434⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        435⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        436⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        437⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        438⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        439⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        440⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        441⤵
        Drops file in System32 directory
        
        PID:10300
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        442⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        443⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        444⤵
        Modifies registry class
        
        PID:11240
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        445⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9772
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        447⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        448⤵
        Modifies registry class
        
        PID:11284
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11320
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        450⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        451⤵
        Modifies registry class
        
        PID:11400
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        452⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        453⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11520
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11556
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        456⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        457⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        458⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11724
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        460⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        461⤵
        Modifies registry class
        
        PID:11812
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        462⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        463⤵
        Modifies registry class
        
        PID:11892
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        464⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        465⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        466⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12048
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        468⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        469⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        470⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        471⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        472⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        473⤵
        Drops file in System32 directory
        
        PID:12272
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        474⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        475⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        476⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        477⤵
        Drops file in System32 directory
        
        PID:6352
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        478⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        479⤵
        Drops file in System32 directory
        
        PID:11528
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        480⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        481⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        482⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        483⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        484⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        485⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        486⤵
        Drops file in System32 directory
        
        PID:11960
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        487⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        488⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        489⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        490⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        491⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        492⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        493⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        494⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        495⤵
        Drops file in System32 directory
        
        PID:11424
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        496⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        497⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        498⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        499⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        500⤵
        Modifies registry class
        
        PID:11924
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        501⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        502⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        503⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        504⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        505⤵
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        506⤵
        
        PID:11508
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        507⤵
        
        PID:11748
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        508⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11836
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        509⤵
        Drops file in System32 directory
        
        PID:12072
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        510⤵
        Modifies registry class
        
        PID:12260
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        511⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5392
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        512⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        513⤵
        
        PID:11840
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        514⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        515⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5692
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        516⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        517⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        518⤵
        Modifies registry class
        
        PID:11600
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        519⤵
        
        PID:12300
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        520⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        521⤵
        
        PID:12372
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        522⤵
        Modifies registry class
        
        PID:12404
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        523⤵
        Modifies registry class
        
        PID:12444
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        524⤵
        
        PID:12480
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        525⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12524
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        526⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        527⤵
        
        PID:12596
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        528⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        529⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        530⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        531⤵
        Modifies registry class
        
        PID:12748
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        532⤵
        
        PID:12784
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        533⤵
        
        PID:12820
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        534⤵
        
        PID:12856
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        535⤵
        
        PID:12892
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        536⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12928
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        537⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        538⤵
        
        PID:13000
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        539⤵
        
        PID:13036
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        540⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        541⤵
        
        PID:13108
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        542⤵
        
        PID:13144
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        543⤵
        
        PID:13180
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        544⤵
        Drops file in System32 directory
        
        PID:13216
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        545⤵
        Drops file in System32 directory
        
        PID:13252
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        546⤵
        
        PID:13288
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        547⤵
        
        PID:12308
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        548⤵
        
        PID:12368
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        549⤵
        Modifies registry class
        
        PID:12436
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        550⤵
        
        PID:12512
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        551⤵
        Drops file in System32 directory
        
        PID:12580
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        552⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        553⤵
        
        PID:12700
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        554⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        555⤵
        
        PID:12816
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        556⤵
        
        PID:12884
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        557⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        558⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:13020
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        559⤵
        
        PID:13096
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        560⤵
        
        PID:13164
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        561⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        562⤵
        
        PID:13284
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        563⤵
        Drops file in System32 directory
        
        PID:12356
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        564⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6416 -s 396
        565⤵
        Program crash
        
        PID:12708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6416 -ip 6416
1⤵
PID:12704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
148KB

MD5
68f7d67b94e7ed7508e361f05343d78b

SHA1
98f87f6da808f8834c3fca57be76361cef63787d

SHA256
52cae64e3bebf8877ca0fb59b72c1f6d2d8b8bf51510925c1f87232c845a1923

SHA512
39f24d0cdb83ba6aafc22e1f92a9deb331621a743cfa8c23a5e71478a94bb2cbf3b8c094ffeb36ecacfc4d343f4872ed4a15b1f783d80e2b55b0ce37c1681a3c

Download Submit
C:\Windows\SysWOW64\Baocghgi.exe

Filesize
148KB

MD5
21f248313e4f6aaf76290e074f069d2a

SHA1
4845f585773fa403ac1d1c015e630c8694d60577

SHA256
d78e8b8a225f55eb0af8919e08816019d3bcc2e9f2d6ff15bf9679c41c598358

SHA512
c38dd1b9c2c52bd412ae3976ddaf8ad699a4a3929e3b15b76aa61d567eae49fc5553a9bbe049ad2bfa757274e47379c18b09d0eba080c433e28c02e0375facf5

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
148KB

MD5
525c789cfc305470c0fe7102b6d48a00

SHA1
c3066a4a6d67e01892a667208957e9dbced1e19c

SHA256
95cc74f059f3d7deb98a9866c843447ce2bca5cbd814afbd0ea2519be665e6f0

SHA512
9150d7c5242e26e48d4d5dc736489615b43775028554b746fd878fa5c04eb7f3b390113185203745532d9308e5361ba43f9a7acbf8c65307c89472ffb0b7821e

Download Submit
C:\Windows\SysWOW64\Bjddphlq.exe

Filesize
148KB

MD5
b0ae5a308f1bc7737814d0c54c660238

SHA1
df36e99da201121422da32723b1fb44813ddd891

SHA256
37e0c03c09f0cc360d76387c4686f9e8e665037f54eb89ca628a466a5f972e4e

SHA512
a5be21204f5704c34b9a3b8e970193ecb34c27f93350dfb06c668ab0b3730831ecade4b4c232b94acef9bca0fe1d9168d497a8134281c6ae3d1978f417330c4a

Download Submit
C:\Windows\SysWOW64\Blpnib32.exe

Filesize
148KB

MD5
117f5ccf07abcd7dfc48fe6e7bf412b5

SHA1
cd43701541d80798b7f63435c3c0a72e9efe1efa

SHA256
1814e7287c9f43d47435db1bc5f60ca65da169303b0276ac3756f677debaa310

SHA512
cc76d1709d4943a5d2ecaff46a742e26c6022592b3681de46be695e7eeb1d566c6c17dbc6e7845540fd0a40f368ae39a550577da27f9039c424bea9cfec927fa

Download Submit
C:\Windows\SysWOW64\Cabfga32.exe

Filesize
148KB

MD5
d768a03c4a4c86ec9fb1b5fca38d95f5

SHA1
a8e4ab50229c3f9814571e5d5077ae20a98c52b9

SHA256
41b7a24cd2abcae5472f40b014b1aeb68869d264da19ba2d957ae13c1d68416e

SHA512
f4685ae95ab92e3d9c99fafc52f0cc6a846849e0a48a6df432825127961f8110d62da476e4f16e3561a664a63ad79ea84baa0cc66abde79ccdf0a0b7bb8ec036

Download Submit
C:\Windows\SysWOW64\Calhnpgn.exe

Filesize
148KB

MD5
4ba44492e9f4d8d2aa71b7e2e704cf78

SHA1
961d4e81445ba4c2f9a70be8a2b227eae22455cf

SHA256
14681f90f8f9857e9d62704bc4acef9dc39465ce1cdf544a2303ba663be81721

SHA512
569330f5d727e7c0225fa2775af631cf840f827617cb2844175b0f6a3795d94e65795591c8acb159ea2f4949617971a24cd6a47d3742a496ba21093c17c34e19

Download Submit
C:\Windows\SysWOW64\Ceckcp32.exe

Filesize
148KB

MD5
3d64883f57931573eea786e3b0da6a9e

SHA1
8a0d266c4cc6ab7193abad785bd025ff39dd3092

SHA256
fe0f46463f765aa58a1417d68d539ed67cee8213126a7e1dfb886cfee0c22714

SHA512
fbdc9181f8ae7b5aae563c4789d46473472c75768c111a08636118c2976acbbbde5f4a663e8ca6cc4500b57f1c7949ba0b7712f17e4edcf670c072c8b384fbfb

Download Submit
C:\Windows\SysWOW64\Chmeobkq.exe

Filesize
148KB

MD5
4017ffc97ab3774654192f55d8a82fa2

SHA1
7efb675976b72041fb60f2930c9b6505cc78c9f7

SHA256
1c54fc591bb73434a581da22d989dfe1b33dc28f6d972096aa1822621bdae5d3

SHA512
db6f83e59d3380883ec7a3b3456988a194f4c40119142fa61395e7bcd96dd80cffdc8c7a2536e20ccd79005daf2bf973543dac8b13b63e61c282db4f735da768

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
148KB

MD5
a5e5ba3d2b0518027d9489997e9596cb

SHA1
b2ac4dc487389c9848b57ddceb7a437e9ed3f9e7

SHA256
3db69bee501747152bb5e1698768b8c9bfb4470ff14ef9772c555d0b75004387

SHA512
534ae2bedc4536f5f875f12d2121e1d87b30ffdc49ec7b6ce4069e215d23af2cb7269a6f9df8e13a409966398c9c3431eaf716de402238a0e18bcff4283997c6

Download Submit
C:\Windows\SysWOW64\Ckpjfm32.exe

Filesize
148KB

MD5
55ed6d520e8401a27f597b532843294c

SHA1
c0a97fbaf4a05f9fd568b4d5485a9ccfd0243ef5

SHA256
f8325e002895e69be8ed9a2a01279cd3d97b3fea22fab567662d269b2fc48e8a

SHA512
e9be0a9a99b8e3107295ec75781e449f7b226a2b64a718cb5ce32197a155f80c1a706d6311463994026ebe0318d6870df653531affa5580decb9f5100f07740e

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
148KB

MD5
99c43f7ca9d2dbc75074733e0d26dd0d

SHA1
aac2efeefb86cc7bc9c7fb6a638508da72ad4978

SHA256
99202b31cee6b2162de5bbfc136a73525668d005d5904e355ddc43f7c1ee3764

SHA512
86abd477a4ff7b97ddd296e8486a1a6dc968db82579d59905469ea191aa443e5d5ac74abd2160bff596090a869313b309e89f218efff45194546d852e05f76bf

Download Submit
C:\Windows\SysWOW64\Deagdn32.exe

Filesize
148KB

MD5
bf1698115f3b44cd497acbeabf99ab50

SHA1
ab5c1521c5f5c5e332a715563c6d9664cc94ecf9

SHA256
9374d981dcc16a78cfc96a1b621ee672dbd74bec83eececa3ccb65c9a13da16a

SHA512
33bfa6275d61202f0bb15dd1ffefc3260a00de8cf88b4db46e6ae4bea7b5363003c255274351498eb0440e642885a0bb37c72d4a38ec19ca067f9efbd5cb6ce6

Download Submit
C:\Windows\SysWOW64\Eemnjbaj.exe

Filesize
148KB

MD5
50a910e0d5577cd043253de13ad1255a

SHA1
044113755251b913545649f551041e68141c4716

SHA256
bf20223e64a0a8c202b978bbe4f685d84e2b1947d21e4ae24bbf2c8ac55ba039

SHA512
126169b2f0875fb112a0403c1038548faf6499060c819673a1f85a8e281b37ab3199f030636442c66019dd65e68e586a3b6bd5f2aeda3d012234f253b3b2a9d5

Download Submit
C:\Windows\SysWOW64\Ehljfnpn.exe

Filesize
148KB

MD5
0bcf9eedf7edfa8502984ca4f464ed7d

SHA1
767560acf192060a413d11d92d1256717098e3ee

SHA256
b890eebcb91545df32ef79853991a9b4a09bf33373ec062c8fed4c13b45f9ecd

SHA512
25137f04713639155145b57973ea68536958d7a9a77cceeb5146df3357f34c1e60e7b07eaaab5e907151741946393191f482461a3fb90fc74bbcc6a5df6efbec

Download Submit
C:\Windows\SysWOW64\Glebhjlg.exe

Filesize
148KB

MD5
caea22450ad92d7e1ea2d31e09dd7956

SHA1
8eb7e7ad6e682b666831b29f4248ad52a19cfdfc

SHA256
b5a7e21debe4cc74baa1e500d7d2701d8df383397835841441f8b425eb58e56a

SHA512
a507609f0229d2abe5e4de8ced278f627f75dbdfba01234e29a4c1a8ab18136421d6d0517b4135997ba45e8647c54805ce866c0654df59545ce0cd9a9a117a3d

Download Submit
C:\Windows\SysWOW64\Habnjm32.exe

Filesize
148KB

MD5
506455f5f30c7a75129b82b75f7b560d

SHA1
2e198ebaa10c969893da691d5e52f97a78482077

SHA256
d07d96c8d19d228b8f3cd8d9bc68e0d0e02d99f910ec311c9c10e50ae6e1438c

SHA512
f73a614a4bd5c52c82da29b52295785ba7a861d6610e97857f8188c8973923db6694a25658e49699379abb93088fb2bc284198a66dc680f4c59904ab06204577

Download Submit
C:\Windows\SysWOW64\Haggelfd.exe

Filesize
148KB

MD5
3016adc6b98ca6a5623ded6e6c0e7631

SHA1
658cfcebbe33c053ad2037a69e8fc745cebe00c4

SHA256
29bafa3ed6103536cc87330d98a81b90ea305485c6d3661a3c48ca9ed126ea82

SHA512
b6f423d765015ac09a00f861e149ecddd2477c43c118124b00a35a1b01a176fe6bea1f319eb4e65a92eb1c0cf29f6f87ab7117cfe880a966725ba780ce55f6b3

Download Submit
C:\Windows\SysWOW64\Hcedaheh.exe

Filesize
148KB

MD5
3448e6320ab308a6ad4134ce69413d34

SHA1
4a5183a99413080d3ae5a3eeeb5af903be3e153e

SHA256
2380bd553c2fc093518e8fbb1dac3fa10d07fc90e783263a157eb188c3c306ca

SHA512
9466ff955cadabececd9be8acda397b962748ca6125dfbec017fc154a94e3440d4562831619da5d3795f0259d717f54ef612b037c81c606312e2f3d0ba636e4f

Download Submit
C:\Windows\SysWOW64\Hcqjfh32.exe

Filesize
148KB

MD5
38031b86ce48e18f6aacb954dc2a48b1

SHA1
3b2bf11fb0577ff53c68b34c176b98fdd12872b6

SHA256
5b33f2a758457201fb711d8c5fd10e2cc250605dfd9686c433209020e0afa639

SHA512
df55527aaf3e876a19949c8fe85d104eeffdb990e0077e524b7d3094c63f892230cbc9dec8b88a9944401ccdb95173c60b4247ad0ce0af54e4bc8c9d5e36b9ac

Download Submit
C:\Windows\SysWOW64\Hfachc32.exe

Filesize
148KB

MD5
e992fbb9d8437450579f7a23c0e87752

SHA1
b1d2f9ea28cbc611da832f86f3f1ceb79bbdc28e

SHA256
bee6052c8c07fd186c176ffc9066f7c8d6e61f8311bed658ce379f1cd483349e

SHA512
9d79751c08f8bb49b710f3165a35b217cf659f2c234b6efeb2dea42c3ab26204436be490ed2c8b16a19300211b3aa9ceee1df64ab05383b9fcec25f0e93cf2d4

Download Submit
C:\Windows\SysWOW64\Hibljoco.exe

Filesize
148KB

MD5
a076b26b1a45449d20dec2c63b43eb17

SHA1
88b08d9500fc5c9f97f9939b22ad8413800b3450

SHA256
900de8443c93f6fb488d37cd10eb7cc3f3688aa61c709d01a86c07982e45ce81

SHA512
80c5edef246a17c5a2e1e6b85a26acb12411f0c39e80e153dd2cbf37fbcff6cd1801cc06568ae19fd51ace0e8e9ef67693575f0a43a8d7466401ba3dd4e9446a

Download Submit
C:\Windows\SysWOW64\Hippdo32.exe

Filesize
148KB

MD5
0fbfbf692a783ec55cf29817290cac46

SHA1
4180ac4c9f621cdc54e5143b084e399f508b0061

SHA256
a658d31005aa154904bd453f6f3f497bf2dd0902212d5a566d468ac5e410e31a

SHA512
b26ca0bece06044d2038d7fd7f8769616ee7cf0095e1536131ea930c8294d807be4a9d4aea04aaa8dc779074e66985d159eae6b677a19591a008588e9ac6d3ea

Download Submit
C:\Windows\SysWOW64\Hmioonpn.exe

Filesize
148KB

MD5
5608f6b9142eee174e95e2feb737f832

SHA1
6c0b91f045d1c480d5bd18bb6cc988c551e3f5c3

SHA256
ea462ff0abdc7398cf0045d4b2a97ad2cd76402ba55107c962045b5857a73113

SHA512
15f3c2866d81105b617902e921bb4efa0dc059d98dcbc0ee7a58034c5e9e1437d99e2323d907d0edd636373cc9a36120f48f3720acaa0d217f7b8ee821c3c251

Download Submit
C:\Windows\SysWOW64\Iabgaklg.exe

Filesize
148KB

MD5
14671c19e722b57501aa723d6ab48389

SHA1
fc6cabd407f8bf84d072c7d9a24e8349c063e0e3

SHA256
bbe369013adbbaae73a21ffe178cd9707df0d4aba964d85f3855736a9afdeddf

SHA512
e24fbc47f3f9e886c86d6ef68d86065adfe93ec5e9b4f4ba7ba6f04ec82d21a93f1db1e729ca78a1c5e76deaa0dc736d7f232acf7fc1f09007c11645c8e0394c

Download Submit
C:\Windows\SysWOW64\Iapjlk32.exe

Filesize
148KB

MD5
9288b2e18ecd6d3e93626a37cf63e1e3

SHA1
c4ba1bfb5d3fc3658b0472532a43c7a23ae3a4c7

SHA256
9e576d62558df88040414e2154ed723a72b35fc9329ef9cabc04ef00417160d1

SHA512
a8b4741a369d8b04179b7b93591537ebf65452fd97f98e9bcfdca55abc8cfa19faf29ffa9202a39b41bcedb61f241a09193a5c3f5ad34a53f12d1bcbf46d8645

Download Submit
C:\Windows\SysWOW64\Ibagcc32.exe

Filesize
148KB

MD5
92c2f249fb294c670bfe260798052df5

SHA1
c19f84730f2a7674cea90569ce3760389a072efd

SHA256
bf4a68193830cd24e4f7eec45e3f1bc91ff31a3fec03e05128817f2ef6fbcd88

SHA512
47755f23e4d7c83b8b72fe2eb7a6f20dd062e683a6c79bb0e36e7c0cdc91a726718a6a9659bd8e4424efdbd99dfbc02f594c9b29d00b8e695c2cabfcc51be46b

Download Submit
C:\Windows\SysWOW64\Ibmmhdhm.exe

Filesize
148KB

MD5
45fe3ffc2025483469f5deb775be2bde

SHA1
fb176a53eed246028d2154a90720ed669184ce62

SHA256
3c7d4585b4b5c3eacc17bcccd22fcb84a41b616f336631312661cbe5d2bac32e

SHA512
2626e5dc87568c078252eb4d4f56cafd36f0a401d60be02796ff2d8133823560f91e4683e68ad96154d3ca2f8d47b207cb0a37d727ea4a37f94c0c46304d4295

Download Submit
C:\Windows\SysWOW64\Icgqggce.exe

Filesize
148KB

MD5
588f606fd9e7b6b527a0e9d238e5328d

SHA1
5aafe0d0f62055ca4fae516c063f04dfd2cf72b6

SHA256
8c645ea62ccb92a002b28579906b185d9281095aa7e5621836d50342f0bacd8a

SHA512
a6438d03c3128cdd01337ec4a896c94faf36c69984b7ae39bc2e4607228a5d12f1f2bcf8d18d70d464e0da91d6eb3c78c3234bed47bcad366e86d3fcfba580fd

Download Submit
C:\Windows\SysWOW64\Idacmfkj.exe

Filesize
148KB

MD5
805fa626b54d0b4a2e837f32c7efc610

SHA1
85e4bd7712aaf8d2a35c5745fbd84d77a351125a

SHA256
29f794f9576a9e13b41fd6d2cffb823abbc45f73e2d3eaf3f64bded819165435

SHA512
0e0c2567ea967adf669e2acb6fdb09caae7750645f9854b7c56c9a02f96f0fa4734b348982dcaebc09fb6f29470adbc2fc0c84da7f4d3e7a613d06f5e4f128a1

Download Submit
C:\Windows\SysWOW64\Ifjfnb32.exe

Filesize
148KB

MD5
ef59fe06e540802618d18dd65af44419

SHA1
88a6af6c8e9e0a8e2bb5331de65e3147378696ed

SHA256
4bc508da8de977c9d4ad76d6ced6ce0fd8e8a7b8dfff1472aa72a9904e87bcd4

SHA512
7fb2d9660e06549142b2ff410609dff818ab160d751ecb07529be52eaa0ef7200020f57d2146e3d00d4a5ac52d35af60613e932a3bcf02a64418779e3c139412

Download Submit
C:\Windows\SysWOW64\Iiibkn32.exe

Filesize
148KB

MD5
df3f33e62c7b8b143473aea892d5acc1

SHA1
ca33c81d1178bf96a1b21c7a3b7448ac9dd6cdd1

SHA256
95504fefc9f1f268ccca4c37271ac860c23ea017b7284f700d6dffe713f8cef6

SHA512
414c600f9c66713d2beef6f3c41ad59e8cf84d9edf144f7d82ebe81a441d40e19fe7e50070f543e11f0ce83ba0544573e3d7a76ddd1715b9de214f610f33af88

Download Submit
C:\Windows\SysWOW64\Ijaida32.exe

Filesize
148KB

MD5
878d185ff688ee0d600802ab0c7e8b4d

SHA1
71e19aad9e514167df2eebb3c26c648c51945e05

SHA256
3bc7b53f0b6d7ec41d2b19b969447d117f9c5cbfbfd3874c5dcd7a946241ba4a

SHA512
cd5481c4419a047c861188f6fd4f7609b3eb30aba56f7d74edecabefbfda228f1bc5d356b0f2b79286d7962cd26e245fd25baf45883121b36d1b180b7287490a

Download Submit
C:\Windows\SysWOW64\Ijhodq32.exe

Filesize
148KB

MD5
6674de6155a3344207ea4b60c58c3457

SHA1
306c0cf9300bacedf97ba7788e3506f9bbf9ea4d

SHA256
3944a7a00502c5f7356f8fa31fec93bd92e67c840f8ec3fc6531f384d808a9b0

SHA512
e46f234b98fb678eedabc5ca945961ef48dc7732a9dd95796587d995e9f29ba84e031af6646a1a921558be05109f0f0af1432e2385354e624a71eccf7877690f

Download Submit
C:\Windows\SysWOW64\Ijkljp32.exe

Filesize
148KB

MD5
7a6b40daa535810e7143f0db38c82bc2

SHA1
3fdb222c1723850ec8c461ee91963babfcb877db

SHA256
6d5ad374b3aaee5616eef615651c41f3f2cb36d6e78f4d3a4e2bb92e1e217ec5

SHA512
8bf80694da8423b706c3dfae57ad286a24577fc90de4e8687d66178505199a71dc48a0658705b91647418717ba77beceaa41c861a2af7bb81f2979907df79185

Download Submit
C:\Windows\SysWOW64\Imbaemhc.exe

Filesize
148KB

MD5
f0b83b15b51c563dd651bcf46bea26ee

SHA1
c62b06412416e6993fe8cb66f8c7338fced6be29

SHA256
2c81dbd532c292943dd5ccfc94a0a74bec798d5a15d23c146d530a01b05816e0

SHA512
6f2c18a783fe018caba832116e710d728d14c58bcc367ef09dfe78ff7701a39736d659d6bc09a0c3bb795d5e446f20599f27a3a904abd55d9d6657dd7e30575b

Download Submit
C:\Windows\SysWOW64\Imihfl32.exe

Filesize
148KB

MD5
c224b0fe3e83e2a76b0f0453aa125f58

SHA1
0738c894ade311889b9d53d5569daaa36a6e1042

SHA256
87817940a53cf0b4288bab28c666150c04a166c23826f63c4663be8c374dc023

SHA512
1112d05d5d6f260142e86c7441408659b9cbab9ac9a7dc1baca778f89c3c6f86e1153b37e871637fa9998481a9e0ec6b59c7c20ae35395bdd46066b0f3e9a925

Download Submit
C:\Windows\SysWOW64\Impepm32.exe

Filesize
148KB

MD5
5c6982e0f253bb2b6537cbb08ab03e1a

SHA1
3379a8678562abb7930fdfb5d1b32aba6134416f

SHA256
4c4ca52e50caa72b4e9ca506be9bf5cd8300649457c0656c434783b0ed7db6f8

SHA512
61c99dc6c6a9df47e32f715ad051b7b1171195bbf446a0f6dbc6ebd141ce96635a1b63c46c18cd92a7fd5aaa79bc3b6f76663ca7a932f92b4113dc33791804b5

Download Submit
C:\Windows\SysWOW64\Ipnalhii.exe

Filesize
148KB

MD5
c84a44353eaabae7427100c250db9729

SHA1
1e6257236480fa53056d70c79aa1a045a1f59dc4

SHA256
d336f29d764deb2fee07cac9740e718b7273ced223563dd8e33be2f3165ee381

SHA512
3b99ce11593196c920038812825833a5ad6301c3aba08f747235759e5c9e85ce2f18bdf742d7964f132f8a8a61e8be7181c77a57fd228f1c9bb1798f69df7e63

Download Submit
C:\Windows\SysWOW64\Ipqnahgf.exe

Filesize
148KB

MD5
2041c6460e3dcd1384354394f8e2d556

SHA1
43552b3876b55eb3e23017612ffbe8fac50652a6

SHA256
cbc60e7b57008ea28cb17ba7f3e0546f068698fcdf4cba149d6247b00ca489fc

SHA512
2998af292064000725ad5f437ce872dcdf34ef2d47ea6bb09bc29e81cf2b337a85b05f15a2f38ca59e434bc134da579851f5caacc8be46ef45b403dc8ac81ec2

Download Submit
C:\Windows\SysWOW64\Jaljgidl.exe

Filesize
148KB

MD5
48211d615248c713e41d4e7b66705eb3

SHA1
e2d0fbc753e354bbadd1856e86954452e44d0ec4

SHA256
69dd951e7a1829bdc35294ee2bb8663ef64c3788b1f1e22e0a2d23c322e536f3

SHA512
6e21667519920c969718312f7ceb6c95de5572cd1ca10389084493b6ea4192fd0d7ec061ce79cf2784dc3f3455b8414cdd244bf5b7ee7e04c901fca16fb35897

Download Submit
C:\Windows\SysWOW64\Jbhmdbnp.exe

Filesize
148KB

MD5
0475ad715d2f420ebc504765ae74712b

SHA1
bbff3586e61509081315d94a07b7fa1856169019

SHA256
2b00b6ed860329d2bc3f947fcc1c2f1e6e0c3485e6d3265c29ac7ebbb8240d9c

SHA512
78d5132f4557e30d88d9e42d2fd5a55e1fb2146b18e9c570a2d0a797dfcaab4a410d8d4f5c83edfa557319569a44168ee96c49b7ff69954a745dc4098d862b6c

Download Submit
C:\Windows\SysWOW64\Jbkjjblm.exe

Filesize
148KB

MD5
3c52288986d4217ffaafa3f57d1a7ed4

SHA1
bb88a99a879020e999ca29255ff9214727300b85

SHA256
3f2f84846d2274f8a77799db0bdf79b3372da7aaf52899a27db82cf08820bf2c

SHA512
e8eb6bf91af67c756cc68292ecbb5da3467905e671538c14cd6d08e075dd89e62a2023b8d1440f08af7381dba7200fb9c867092e9769cdcabbf5709dcf1a80ad

Download Submit
C:\Windows\SysWOW64\Jdcpcf32.exe

Filesize
148KB

MD5
628b90c60b13851a630abb8f524604c3

SHA1
5b308013229796cc52295584b616763cbced8657

SHA256
2d70c6503d91a3f9627c879a6fd12a2b9e6ae588387e38dcece1ad098cb2fb98

SHA512
c3cb1629c66c832ce88a762f85ee32d38a27b4714fd245997761d8e01faeda5b1f7e5740884f95fd33942dbf6f80de8d3f7c54295435b513c2bb265f125fb859

Download Submit
C:\Windows\SysWOW64\Jjbako32.exe

Filesize
148KB

MD5
548536dea19dd21e705b165c1a18b629

SHA1
e19eb3ea3eca5a0a47bf78d526da555e3df4f20e

SHA256
8fcb23a706738be304e3dd2835f01ceaeceb0ca1b5ad3777c5a03b3a6807a19d

SHA512
eca4ff18fa3742a6aa15b2de28796401b83eb6e48586696c827504c30c33d20429ff0201bc518b0a737c1027cc71092e4ca63869a21e5c035c6b738178f04c7e

Download Submit
C:\Windows\SysWOW64\Jjmhppqd.exe

Filesize
148KB

MD5
3286a1c57ddf9c391326240e7d52d6fa

SHA1
6b00c1c9c9d3aa053e6babded6e8fb49638a1ed7

SHA256
17b3ce3a8958e0e784b8dbf65b5e32c714c66be23efa6b886a0c4fd7c677ebec

SHA512
404d43907ee1f867a21b1c8223113c3eaed90ab3e51adcb5dc437ca327078c7dce550f99c25a3e5c1b510e50b69a383bf73f4d943b06c77dee352b8648a55c75

Download Submit
C:\Windows\SysWOW64\Jpjqhgol.exe

Filesize
148KB

MD5
3b8336366f4f239ded50aacb304c27e4

SHA1
1f11225cbde7e7dce0f404671e7cd5351c4f3cd2

SHA256
daec9e2ffd3862fdd59b0b1b5266a1432db8a982629099972a8f995626b3a766

SHA512
1df27c8be248b8964e9defc9d337cbd4a040a03997b78738e92187d04965b7f9426d1dcf22b4ddd277845a88a390201b6caaa073e2eab5a402f35028ce3dd52c

Download Submit
C:\Windows\SysWOW64\Jplmmfmi.exe

Filesize
148KB

MD5
ba7a56e9e293c1654aa9a5d63161b262

SHA1
92c1137d1e5db136539b766e733a5fc9f8a33f38

SHA256
7402bbff76409488f84f33885abb9fc3c591f4885fbc695f5d32835115f5c0fb

SHA512
b1000f4295e65fc0970fb726c5f19cae75540b36119669ffe16025b841f472305f951710b420c17bf40c2d1a21a36567f3d40ce81cfea6c84294e41b7a06a151

Download Submit
C:\Windows\SysWOW64\Jpnchp32.exe

Filesize
148KB

MD5
ee2b01e16264f6b0e08bd0d989d2a4b2

SHA1
b9299d7b845275580875724fc922f66e96fdb35d

SHA256
dc252f64364c389e9e6ceab8670be9e8d47b45365f88da69e77d67208de56f8e

SHA512
7e40a65620825d513ed04c6ec0d00fffbdeef2f7a564ab6de4ea81a576bf0ca7f7b102b89718cc22a96c4d13f802cb529def425b8f2558103fce41a0899324f2

Download Submit
C:\Windows\SysWOW64\Kinemkko.exe

Filesize
128KB

MD5
2d5c2f9d16ddc026e4128746662af877

SHA1
6aebe7ed63399137e1360a287d15fd012e29bd3c

SHA256
2743519c54a9cd7f54bb077e11792d9a2004a365636e17e26d555356d7b3d30b

SHA512
72ee6d7e88e1174d9b263fcc32fbfc56134772eb12fbd6d789e6eaaaa93199d5662f7f1f121cddca52ed649fdce1389163e3a5823100859ce57669108ea78466

Download Submit
C:\Windows\SysWOW64\Leihbeib.exe

Filesize
148KB

MD5
8465f0439a217afe5efc533e36938de7

SHA1
343b692c5d0f0061c4c862fb5a1d41df65e1eeae

SHA256
b19d65ad335184eab4c4b7cbed87cf7b090135cd70d8cd7386db41927380a9a8

SHA512
a5565abb25903b3f7b26dfb858e61484e057ed27f997560239d4180d8be78b091bd61667e677c810ab5f4bfcd3302b6098045eb0e545a02d1f51ba3d4aa4280a

Download Submit
C:\Windows\SysWOW64\Miemjaci.exe

Filesize
148KB

MD5
a31079d9f911809655a770b506784336

SHA1
eaa321ddda274c7097bb0c5f16c04b7e03143897

SHA256
862fb23c7d32942ae40fe1b8c55c5fbade25973ba66fb839cc33c06965a06d26

SHA512
622c49e59f9680c8c822d5ca25a064294a136bd5d5d33b53f6bf43d24cd658f8dcf1e4a162da6bb5e2cad197d0a1b9bef624dac8877779e8a33f6f0dd442ff43

Download Submit
C:\Windows\SysWOW64\Ocnjidkf.exe

Filesize
148KB

MD5
8a1194488f59d64c9a99268ad38c00d4

SHA1
f90bc0515f7657c7c84834163fff3b9981a4b4ae

SHA256
824d2af42c5ff2ab080271753bb363f05614f841ea1eb181e7b1ce3d2641e369

SHA512
aeb4499a8c06c4619fbd24321f77473fde62b723b2e180bbeb52ae38087561603933757ef54f2153dc8398af26a7563ec15a7edc8adee9d73006d0f8fa33afe2

Download Submit
C:\Windows\SysWOW64\Onjegled.exe

Filesize
148KB

MD5
8b8bd57a40d56d1c11f2b6da95f9685e

SHA1
c739f2e9476487ab95db5954771bd93ce48c5376

SHA256
3a753cfeacc87aeeb8fa1b7b9478c32ccf087b46390af9933fe69ef3a7773fba

SHA512
00082c09774983c9113d8c1119dd9fc1dc541e26457a4a7bfedf8d5d0a4ca21ef200a68fe46b0497271630a74dd8b2b2524cd53c6afb0e97563a8cf065bcca25

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
148KB

MD5
0d2274fe46952efbbb6ca6fe5ba320ff

SHA1
35af825ba4eabd2880fa11296036f7d995c7bf7b

SHA256
2f0d2ce0b9d01548cade58daaa17129eabe33e830db68b2c927f1b5b69224cec

SHA512
c922d8cef32d41bfd52e59d1570078e4f3b6fbd2b2c2392147f1e241407f54ad79a97e08bf5c1f612ebad734d4eafdc6fb7ee1f87e255ad6e95c3c0f191632ce

Download Submit
memory/216-113-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/452-354-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/492-452-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/540-290-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/752-265-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/888-288-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/928-458-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/944-9-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/956-331-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1088-191-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1104-136-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1200-311-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1272-371-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1400-97-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1432-487-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1780-89-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1800-153-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1956-325-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1972-0-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1972-81-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1972-5-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1980-165-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1996-17-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-145-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2300-169-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2376-129-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2384-415-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2504-208-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2532-319-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2584-451-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2716-313-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2876-417-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3048-32-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3076-64-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3148-271-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3152-429-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3160-393-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3288-398-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3408-24-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3488-400-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3556-365-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3672-49-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3680-346-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3708-381-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3896-464-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3972-203-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4040-301-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4228-57-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4268-73-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4296-239-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4484-423-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4532-105-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4660-121-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4676-223-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4700-247-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4728-282-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4740-41-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4856-435-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4932-255-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5004-481-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5024-184-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5048-474-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5096-216-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5104-352-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads