5ba87969d11c7a8d20b36e93ee0ffe7dcc1d94e5739e9ed0592f2df41aee7af7

Analysis

max time kernel
115s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ba87969d11c7a8d20b36e93ee0ffe7dcc1d94e5739e9ed0592f2df41aee7af7.exe
Size

104KB
MD5

e753b9e2fa1c991ae3325ee247044dfd
SHA1

b9d7cb2aa03f731fda8c16cf5e51f0249df1e22d
SHA256

5ba87969d11c7a8d20b36e93ee0ffe7dcc1d94e5739e9ed0592f2df41aee7af7
SHA512

0c9fcf6d9a73355fc5e47a51a484fce3ab1c15b6eee289710b0c5cf4e9cf1fc3ce28edcfa65c8ddbad3a84cf7e93e6c84ed8588f4b52339316c515aa0c6fca4f
SSDEEP

1536:CSkMtcBiXyZnHRRa+6FtJ10nx5RVkeyyVr3iwcH2ogHq/i352S:CZBiiZnHR0DMz3kremwc/gHq/e

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpkiph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imfdff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anfmjhmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlnbgddc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocihgnam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgmngglp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kcoccc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llnnmhfe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odmbaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jngjch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mmpmnl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngmgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gaadfkgc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mebcop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnoaaaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mmlpoqpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jekqmhia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjbcplpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Olkhmi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqiibjlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhdcmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlhqcgnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hdnldd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngaionfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kqfngd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hicpgc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbjelc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlgepanl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iialhaad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbbeml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ikbnacmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ehdmlhcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ioopml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mefmimif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbcjnilj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfhbga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hajkqfoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlefklpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbqklb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kifojnol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppdbgncl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ekiohclf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mefmimif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hpmhdmea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jfaedkdp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iohjlmeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hpcodihc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjoiil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmmolepp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogcnmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjlcjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ggqida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ifgldfio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fefedmil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hhdcmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fijkdmhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Manmoq32.exe

Executes dropped EXE 64 IoCs

pid	Process
1060	Clnjjpod.exe
2476	Cefoce32.exe
1940	Ckcgkldl.exe
4644	Cehkhecb.exe
4268	Dbllbibl.exe
4380	Ddmhja32.exe
4020	Dboigi32.exe
2492	Doeiljfn.exe
4596	Dhnnep32.exe
4368	Dccbbhld.exe
4444	Dllfkn32.exe
1536	Dahode32.exe
2312	Dlncan32.exe
3860	Eefhjc32.exe
3972	Edkdkplj.exe
3468	Eoaihhlp.exe
1796	Ehimanbq.exe
5068	Ekhjmiad.exe
4064	Elgfgl32.exe
4520	Eepjpb32.exe
1128	Hfcicmqp.exe
4620	Ikpaldog.exe
3716	Ikbnacmd.exe
3032	Iblfnn32.exe
492	Imakkfdg.exe
712	Iihkpg32.exe
1384	Ibqpimpl.exe
4016	Imfdff32.exe
680	Jfaedkdp.exe
564	Jpijnqkp.exe
1504	Jlpkba32.exe
2456	Jbjcolha.exe
1956	Jpnchp32.exe
4704	Kdnidn32.exe
3600	Kpeiioac.exe
1836	Kmijbcpl.exe
2516	Kbfbkj32.exe
1668	Kdeoemeg.exe
1612	Kibgmdcn.exe
1792	Liddbc32.exe
4940	Lfhdlh32.exe
2544	Lmbmibhb.exe
4460	Ldleel32.exe
4084	Liimncmf.exe
1740	Lgmngglp.exe
428	Lmgfda32.exe
2168	Lingibiq.exe
3588	Lphoelqn.exe
3408	Mgagbf32.exe
4636	Mmlpoqpg.exe
1916	Mchhggno.exe
4532	Mibpda32.exe
4824	Mplhql32.exe
788	Meiaib32.exe
4996	Mlcifmbl.exe
4516	Mgimcebb.exe
4724	Mlefklpj.exe
2248	Mcpnhfhf.exe
4456	Mlhbal32.exe
4340	Ngmgne32.exe
3824	Nngokoej.exe
4604	Nebdoa32.exe
3700	Nphhmj32.exe
436	Ocnjidkf.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jcgnbaeo.exe	Jlmfeg32.exe
File created	C:\Windows\SysWOW64\Neqopnhb.exe	Nmigoagp.exe
File opened for modification	C:\Windows\SysWOW64\Ocnabm32.exe	Oqoefand.exe
File created	C:\Windows\SysWOW64\Pmmlla32.exe	Pfccogfc.exe
File opened for modification	C:\Windows\SysWOW64\Lfodbqfa.exe	Loglacfo.exe
File created	C:\Windows\SysWOW64\Eghkjdoa.exe	Enpfan32.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Dmcibama.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Djfkblnn.dll	Hhbkinel.exe
File created	C:\Windows\SysWOW64\Iehjdl32.dll	Lmmolepp.exe
File created	C:\Windows\SysWOW64\Jjjojj32.dll	Nflkbanj.exe
File created	C:\Windows\SysWOW64\Kbfbkj32.exe	Kmijbcpl.exe
File created	C:\Windows\SysWOW64\Pmcclm32.exe	Pkegpb32.exe
File created	C:\Windows\SysWOW64\Klcekpdo.exe	Kjeiodek.exe
File opened for modification	C:\Windows\SysWOW64\Feqeog32.exe	Fijdjfdb.exe
File created	C:\Windows\SysWOW64\Pjlcjf32.exe	Pbekii32.exe
File opened for modification	C:\Windows\SysWOW64\Dbllbibl.exe	Cehkhecb.exe
File created	C:\Windows\SysWOW64\Olkhmi32.exe	Odmgcgbi.exe
File opened for modification	C:\Windows\SysWOW64\Pgioqq32.exe	Pjeoglgc.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Amddjegd.exe
File opened for modification	C:\Windows\SysWOW64\Mpghkf32.exe	Mimpolee.exe
File opened for modification	C:\Windows\SysWOW64\Gfjkjo32.exe	Fpkibf32.exe
File created	C:\Windows\SysWOW64\Qpeahb32.exe	Qmgelf32.exe
File opened for modification	C:\Windows\SysWOW64\Nfgklkoc.exe	Mqjbddpl.exe
File created	C:\Windows\SysWOW64\Gologg32.dll	Ikdcmpnl.exe
File created	C:\Windows\SysWOW64\Pjbcplpe.exe	Pmnbfhal.exe
File created	C:\Windows\SysWOW64\Eiidnkam.dll	Kcjjhdjb.exe
File created	C:\Windows\SysWOW64\Bpldbefn.dll	Ojnfihmo.exe
File opened for modification	C:\Windows\SysWOW64\Dccbbhld.exe	Dhnnep32.exe
File created	C:\Windows\SysWOW64\Bpdkcl32.dll	Kbfbkj32.exe
File opened for modification	C:\Windows\SysWOW64\Amddjegd.exe	Agglboim.exe
File created	C:\Windows\SysWOW64\Aboiil32.dll	Iohjlmeg.exe
File created	C:\Windows\SysWOW64\Gaebef32.exe	Gbbajjlp.exe
File created	C:\Windows\SysWOW64\Hicpgc32.exe	Hnnljj32.exe
File created	C:\Windows\SysWOW64\Ghdief32.dll	Lkeekk32.exe
File opened for modification	C:\Windows\SysWOW64\Mgclpkac.exe	Meepdp32.exe
File opened for modification	C:\Windows\SysWOW64\Pmnbfhal.exe	Pjpfjl32.exe
File created	C:\Windows\SysWOW64\Omgmeigd.exe	Ofmdio32.exe
File created	C:\Windows\SysWOW64\Kajimagp.dll	Amnlme32.exe
File created	C:\Windows\SysWOW64\Lbmolo32.dll	Lqojclne.exe
File created	C:\Windows\SysWOW64\Jenmcggo.exe	Jcoaglhk.exe
File opened for modification	C:\Windows\SysWOW64\Kcidmkpq.exe	Jlolpq32.exe
File opened for modification	C:\Windows\SysWOW64\Lqkqhm32.exe	Ljqhkckn.exe
File opened for modification	C:\Windows\SysWOW64\Ehdmlhcj.exe	Eajeon32.exe
File opened for modification	C:\Windows\SysWOW64\Neqopnhb.exe	Nmigoagp.exe
File opened for modification	C:\Windows\SysWOW64\Jlgepanl.exe	Jenmcggo.exe
File created	C:\Windows\SysWOW64\Lgpoihnl.exe	Loighj32.exe
File opened for modification	C:\Windows\SysWOW64\Lncjlq32.exe	Ljhnlb32.exe
File opened for modification	C:\Windows\SysWOW64\Lqbncb32.exe	Lndagg32.exe
File created	C:\Windows\SysWOW64\Fneggdhg.exe	Flfkkhid.exe
File created	C:\Windows\SysWOW64\Ljnlecmp.exe	Lgpoihnl.exe
File created	C:\Windows\SysWOW64\Edplhjhi.exe	Aonhghjl.exe
File created	C:\Windows\SysWOW64\Nohjfifo.dll	Pmmlla32.exe
File created	C:\Windows\SysWOW64\Hbcbgk32.dll	Eefhjc32.exe
File created	C:\Windows\SysWOW64\Djdmffnn.exe	Dhfajjoj.exe
File opened for modification	C:\Windows\SysWOW64\Inmgmijo.exe	Ikokan32.exe
File created	C:\Windows\SysWOW64\Lfodbqfa.exe	Loglacfo.exe
File created	C:\Windows\SysWOW64\Dgooajdl.dll	Neffpj32.exe
File created	C:\Windows\SysWOW64\Ljqhkckn.exe	Lfeljd32.exe
File created	C:\Windows\SysWOW64\Nmogab32.dll	Dboigi32.exe
File created	C:\Windows\SysWOW64\Lipdae32.dll	Pmidog32.exe
File opened for modification	C:\Windows\SysWOW64\Jlmfeg32.exe	Jjoiil32.exe
File created	C:\Windows\SysWOW64\Dlncan32.exe	Dahode32.exe
File created	C:\Windows\SysWOW64\Emamkgpg.dll	Enpfan32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7032	7772	WerFault.exe	684

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gahjgj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jknfcofa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglpdp32.dll"	Kegpifod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lodabb32.dll"	Omalpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lphoelqn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnbnhedj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qemhbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnijfj32.dll"	Edgbii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iajdgcab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inaoom32.dll"	Lejnmncd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hojpmg32.dll"	Peahgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aamknj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdkoch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Omdppiif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjagqbca.dll"	Ifgldfio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fpkibf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hajkqfoe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iacngdgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eefhjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Omfekbdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aafemk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hicpgc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Khgbqkhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpdkcl32.dll"	Kbfbkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gdncmghi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbbnpn32.dll"	Mljmhflh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anlkecaj.dll"	Pcbkml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Liddbc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngmgne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nfjola32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Halpnqlq.dll"	Pmoahijl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hpcodihc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gengje32.dll"	Pdkoch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Loighj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nflkbanj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Indmnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idllbp32.dll"	Aafemk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fneggdhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oppceehj.dll"	Nfohgqlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qedegh32.dll"	Oclkgccf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Paeelgnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Feqeog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	5ba87969d11c7a8d20b36e93ee0ffe7dcc1d94e5739e9ed0592f2df41aee7af7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jbgoof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olhldm32.dll"	Jlhljhbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Omjpeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkjpda32.dll"	Lljklo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jfaedkdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kmieae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmmncpmp.dll"	Ieagmcmq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dboigi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jcmdaljn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nqbpojnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hgabkoee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Klahfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohbkfake.dll"	Ocnjidkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Neffpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Joekag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	5ba87969d11c7a8d20b36e93ee0ffe7dcc1d94e5739e9ed0592f2df41aee7af7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lmgfda32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1060	2332	5ba87969d11c7a8d20b36e93ee0ffe7dcc1d94e5739e9ed0592f2df41aee7af7.exe	89
PID 2332 wrote to memory of 1060	2332	5ba87969d11c7a8d20b36e93ee0ffe7dcc1d94e5739e9ed0592f2df41aee7af7.exe	89
PID 2332 wrote to memory of 1060	2332	5ba87969d11c7a8d20b36e93ee0ffe7dcc1d94e5739e9ed0592f2df41aee7af7.exe	89
PID 1060 wrote to memory of 2476	1060	Clnjjpod.exe	90
PID 1060 wrote to memory of 2476	1060	Clnjjpod.exe	90
PID 1060 wrote to memory of 2476	1060	Clnjjpod.exe	90
PID 2476 wrote to memory of 1940	2476	Cefoce32.exe	91
PID 2476 wrote to memory of 1940	2476	Cefoce32.exe	91
PID 2476 wrote to memory of 1940	2476	Cefoce32.exe	91
PID 1940 wrote to memory of 4644	1940	Ckcgkldl.exe	92
PID 1940 wrote to memory of 4644	1940	Ckcgkldl.exe	92
PID 1940 wrote to memory of 4644	1940	Ckcgkldl.exe	92
PID 4644 wrote to memory of 4268	4644	Cehkhecb.exe	93
PID 4644 wrote to memory of 4268	4644	Cehkhecb.exe	93
PID 4644 wrote to memory of 4268	4644	Cehkhecb.exe	93
PID 4268 wrote to memory of 4380	4268	Dbllbibl.exe	94
PID 4268 wrote to memory of 4380	4268	Dbllbibl.exe	94
PID 4268 wrote to memory of 4380	4268	Dbllbibl.exe	94
PID 4380 wrote to memory of 4020	4380	Ddmhja32.exe	95
PID 4380 wrote to memory of 4020	4380	Ddmhja32.exe	95
PID 4380 wrote to memory of 4020	4380	Ddmhja32.exe	95
PID 4020 wrote to memory of 2492	4020	Dboigi32.exe	96
PID 4020 wrote to memory of 2492	4020	Dboigi32.exe	96
PID 4020 wrote to memory of 2492	4020	Dboigi32.exe	96
PID 2492 wrote to memory of 4596	2492	Doeiljfn.exe	97
PID 2492 wrote to memory of 4596	2492	Doeiljfn.exe	97
PID 2492 wrote to memory of 4596	2492	Doeiljfn.exe	97
PID 4596 wrote to memory of 4368	4596	Dhnnep32.exe	98
PID 4596 wrote to memory of 4368	4596	Dhnnep32.exe	98
PID 4596 wrote to memory of 4368	4596	Dhnnep32.exe	98
PID 4368 wrote to memory of 4444	4368	Dccbbhld.exe	99
PID 4368 wrote to memory of 4444	4368	Dccbbhld.exe	99
PID 4368 wrote to memory of 4444	4368	Dccbbhld.exe	99
PID 4444 wrote to memory of 1536	4444	Dllfkn32.exe	100
PID 4444 wrote to memory of 1536	4444	Dllfkn32.exe	100
PID 4444 wrote to memory of 1536	4444	Dllfkn32.exe	100
PID 1536 wrote to memory of 2312	1536	Dahode32.exe	101
PID 1536 wrote to memory of 2312	1536	Dahode32.exe	101
PID 1536 wrote to memory of 2312	1536	Dahode32.exe	101
PID 2312 wrote to memory of 3860	2312	Dlncan32.exe	102
PID 2312 wrote to memory of 3860	2312	Dlncan32.exe	102
PID 2312 wrote to memory of 3860	2312	Dlncan32.exe	102
PID 3860 wrote to memory of 3972	3860	Eefhjc32.exe	103
PID 3860 wrote to memory of 3972	3860	Eefhjc32.exe	103
PID 3860 wrote to memory of 3972	3860	Eefhjc32.exe	103
PID 3972 wrote to memory of 3468	3972	Edkdkplj.exe	104
PID 3972 wrote to memory of 3468	3972	Edkdkplj.exe	104
PID 3972 wrote to memory of 3468	3972	Edkdkplj.exe	104
PID 3468 wrote to memory of 1796	3468	Eoaihhlp.exe	105
PID 3468 wrote to memory of 1796	3468	Eoaihhlp.exe	105
PID 3468 wrote to memory of 1796	3468	Eoaihhlp.exe	105
PID 1796 wrote to memory of 5068	1796	Ehimanbq.exe	106
PID 1796 wrote to memory of 5068	1796	Ehimanbq.exe	106
PID 1796 wrote to memory of 5068	1796	Ehimanbq.exe	106
PID 5068 wrote to memory of 4064	5068	Ekhjmiad.exe	107
PID 5068 wrote to memory of 4064	5068	Ekhjmiad.exe	107
PID 5068 wrote to memory of 4064	5068	Ekhjmiad.exe	107
PID 4064 wrote to memory of 4520	4064	Elgfgl32.exe	108
PID 4064 wrote to memory of 4520	4064	Elgfgl32.exe	108
PID 4064 wrote to memory of 4520	4064	Elgfgl32.exe	108
PID 4520 wrote to memory of 1128	4520	Eepjpb32.exe	109
PID 4520 wrote to memory of 1128	4520	Eepjpb32.exe	109
PID 4520 wrote to memory of 1128	4520	Eepjpb32.exe	109
PID 1128 wrote to memory of 4620	1128	Hfcicmqp.exe	110

C:\Users\Admin\AppData\Local\Temp\5ba87969d11c7a8d20b36e93ee0ffe7dcc1d94e5739e9ed0592f2df41aee7af7.exe
"C:\Users\Admin\AppData\Local\Temp\5ba87969d11c7a8d20b36e93ee0ffe7dcc1d94e5739e9ed0592f2df41aee7af7.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\Clnjjpod.exe
  C:\Windows\system32\Clnjjpod.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\Cefoce32.exe
    C:\Windows\system32\Cefoce32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Windows\SysWOW64\Ckcgkldl.exe
      C:\Windows\system32\Ckcgkldl.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1940
    - - C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4644
      - C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4020
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2492
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2312
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3860
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        23⤵
        Executes dropped EXE
        
        PID:4620
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3716
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        25⤵
        Executes dropped EXE
        
        PID:3032
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        26⤵
        Executes dropped EXE
        
        PID:492
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        27⤵
        Executes dropped EXE
        
        PID:712
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        28⤵
        Executes dropped EXE
        
        PID:1384
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4016
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:680
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        31⤵
        Executes dropped EXE
        
        PID:564
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        32⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        33⤵
        Executes dropped EXE
        
        PID:2456
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        34⤵
        Executes dropped EXE
        
        PID:1956
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        35⤵
        Executes dropped EXE
        
        PID:4704
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        36⤵
        Executes dropped EXE
        
        PID:3600
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1836
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2516
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        39⤵
        Executes dropped EXE
        
        PID:1668
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        40⤵
        Executes dropped EXE
        
        PID:1612
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1792
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        42⤵
        Executes dropped EXE
        
        PID:4940
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        43⤵
        Executes dropped EXE
        
        PID:2544
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        44⤵
        Executes dropped EXE
        
        PID:4460
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        45⤵
        Executes dropped EXE
        
        PID:4084
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1740
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:428
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        48⤵
        Executes dropped EXE
        
        PID:2168
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3588
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        50⤵
        Executes dropped EXE
        
        PID:3408
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4636
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        52⤵
        Executes dropped EXE
        
        PID:1916
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        53⤵
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        54⤵
        Executes dropped EXE
        
        PID:4824
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        55⤵
        Executes dropped EXE
        
        PID:788
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        56⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        57⤵
        Executes dropped EXE
        
        PID:4516
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4724
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        59⤵
        Executes dropped EXE
        
        PID:2248
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        60⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4340
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        62⤵
        Executes dropped EXE
        
        PID:3824
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        63⤵
        Executes dropped EXE
        
        PID:4604
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        64⤵
        Executes dropped EXE
        
        PID:3700
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:436
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        66⤵
        Drops file in System32 directory
        
        PID:5128
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5172
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        68⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        69⤵
        Modifies registry class
        
        PID:5252
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        70⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        71⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        72⤵
        Drops file in System32 directory
        
        PID:5372
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        73⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        74⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        75⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        76⤵
        Drops file in System32 directory
        
        PID:5532
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        77⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        78⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        79⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5692
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        81⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        82⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        83⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        84⤵
        Drops file in System32 directory
        
        PID:5896
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5948
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        86⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        87⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        88⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6120
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        90⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5196
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        92⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        93⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        94⤵
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        95⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5568
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        97⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        98⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        99⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        100⤵
        Drops file in System32 directory
        
        PID:5868
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        102⤵
        Modifies registry class
        
        PID:6024
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        103⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        104⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        105⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        106⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        107⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        108⤵
        Drops file in System32 directory
        
        PID:5528
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        109⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        110⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        111⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        113⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Eajeon32.exe
        
        C:\Windows\system32\Eajeon32.exe
        114⤵
        Drops file in System32 directory
        
        PID:5324
        
        C:\Windows\SysWOW64\Ehdmlhcj.exe
        
        C:\Windows\system32\Ehdmlhcj.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5560
        
        C:\Windows\SysWOW64\Emaedo32.exe
        
        C:\Windows\system32\Emaedo32.exe
        116⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Egijmegb.exe
        
        C:\Windows\system32\Egijmegb.exe
        117⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Edmjfifl.exe
        
        C:\Windows\system32\Edmjfifl.exe
        118⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Eobocb32.exe
        
        C:\Windows\system32\Eobocb32.exe
        119⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Ekiohclf.exe
        
        C:\Windows\system32\Ekiohclf.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5672
        
        C:\Windows\SysWOW64\Feocelll.exe
        
        C:\Windows\system32\Feocelll.exe
        121⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Fkllnbjc.exe
        
        C:\Windows\system32\Fkllnbjc.exe
        122⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\Fnjhjn32.exe
        
        C:\Windows\system32\Fnjhjn32.exe
        123⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Fgbmccpg.exe
        
        C:\Windows\system32\Fgbmccpg.exe
        124⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Fedmqk32.exe
        
        C:\Windows\system32\Fedmqk32.exe
        125⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Fgeihcme.exe
        
        C:\Windows\system32\Fgeihcme.exe
        126⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Fajnfl32.exe
        
        C:\Windows\system32\Fajnfl32.exe
        127⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Fkcboack.exe
        
        C:\Windows\system32\Fkcboack.exe
        128⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Famjkl32.exe
        
        C:\Windows\system32\Famjkl32.exe
        129⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Fnckpmql.exe
        
        C:\Windows\system32\Fnckpmql.exe
        130⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Gdncmghi.exe
        
        C:\Windows\system32\Gdncmghi.exe
        131⤵
        Modifies registry class
        
        PID:6488
        
        C:\Windows\SysWOW64\Gaadfkgc.exe
        
        C:\Windows\system32\Gaadfkgc.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6552
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6596
        
        C:\Windows\SysWOW64\Gddinf32.exe
        
        C:\Windows\system32\Gddinf32.exe
        134⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Ggcfja32.exe
        
        C:\Windows\system32\Ggcfja32.exe
        135⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Gahjgj32.exe
        
        C:\Windows\system32\Gahjgj32.exe
        136⤵
        Modifies registry class
        
        PID:6732
        
        C:\Windows\SysWOW64\Ggeboaob.exe
        
        C:\Windows\system32\Ggeboaob.exe
        137⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Hffcmh32.exe
        
        C:\Windows\system32\Hffcmh32.exe
        138⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Hnagak32.exe
        
        C:\Windows\system32\Hnagak32.exe
        139⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Hdlpneli.exe
        
        C:\Windows\system32\Hdlpneli.exe
        140⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Hoadkn32.exe
        
        C:\Windows\system32\Hoadkn32.exe
        141⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Hdnldd32.exe
        
        C:\Windows\system32\Hdnldd32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6996
        
        C:\Windows\SysWOW64\Hglipp32.exe
        
        C:\Windows\system32\Hglipp32.exe
        143⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Hbbmmi32.exe
        
        C:\Windows\system32\Hbbmmi32.exe
        144⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Hgoeep32.exe
        
        C:\Windows\system32\Hgoeep32.exe
        145⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Hfpecg32.exe
        
        C:\Windows\system32\Hfpecg32.exe
        146⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Hgabkoee.exe
        
        C:\Windows\system32\Hgabkoee.exe
        147⤵
        Modifies registry class
        
        PID:6244
        
        C:\Windows\SysWOW64\Iohjlmeg.exe
        
        C:\Windows\system32\Iohjlmeg.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6332
        
        C:\Windows\SysWOW64\Idebdcdo.exe
        
        C:\Windows\system32\Idebdcdo.exe
        149⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Ikokan32.exe
        
        C:\Windows\system32\Ikokan32.exe
        150⤵
        Drops file in System32 directory
        
        PID:6500
        
        C:\Windows\SysWOW64\Inmgmijo.exe
        
        C:\Windows\system32\Inmgmijo.exe
        151⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Ifdonfka.exe
        
        C:\Windows\system32\Ifdonfka.exe
        152⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Idgojc32.exe
        
        C:\Windows\system32\Idgojc32.exe
        153⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        154⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Inpccihl.exe
        
        C:\Windows\system32\Inpccihl.exe
        155⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Ifgldfio.exe
        
        C:\Windows\system32\Ifgldfio.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6876
        
        C:\Windows\SysWOW64\Ighhln32.exe
        
        C:\Windows\system32\Ighhln32.exe
        157⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Ioopml32.exe
        
        C:\Windows\system32\Ioopml32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7036
        
        C:\Windows\SysWOW64\Ieliebnf.exe
        
        C:\Windows\system32\Ieliebnf.exe
        159⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Igjeanmj.exe
        
        C:\Windows\system32\Igjeanmj.exe
        160⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Indmnh32.exe
        
        C:\Windows\system32\Indmnh32.exe
        161⤵
        Modifies registry class
        
        PID:6336
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6392
        
        C:\Windows\SysWOW64\Jilnqqbj.exe
        
        C:\Windows\system32\Jilnqqbj.exe
        163⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Jfpojead.exe
        
        C:\Windows\system32\Jfpojead.exe
        164⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Jkmgblok.exe
        
        C:\Windows\system32\Jkmgblok.exe
        165⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Jbgoof32.exe
        
        C:\Windows\system32\Jbgoof32.exe
        166⤵
        Modifies registry class
        
        PID:6788
        
        C:\Windows\SysWOW64\Jgdhgmep.exe
        
        C:\Windows\system32\Jgdhgmep.exe
        167⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Jpmlnjco.exe
        
        C:\Windows\system32\Jpmlnjco.exe
        168⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Jghabl32.exe
        
        C:\Windows\system32\Jghabl32.exe
        169⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Kppici32.exe
        
        C:\Windows\system32\Kppici32.exe
        170⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Kfjapcii.exe
        
        C:\Windows\system32\Kfjapcii.exe
        171⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        172⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Kpbfii32.exe
        
        C:\Windows\system32\Kpbfii32.exe
        173⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Keonap32.exe
        
        C:\Windows\system32\Keonap32.exe
        174⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Klifnj32.exe
        
        C:\Windows\system32\Klifnj32.exe
        175⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Kngcje32.exe
        
        C:\Windows\system32\Kngcje32.exe
        176⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        177⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Kefdbo32.exe
        
        C:\Windows\system32\Kefdbo32.exe
        178⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\Lhdqnj32.exe
        
        C:\Windows\system32\Lhdqnj32.exe
        179⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Lpkiph32.exe
        
        C:\Windows\system32\Lpkiph32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4032
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4628
        
        C:\Windows\SysWOW64\Lehaho32.exe
        
        C:\Windows\system32\Lehaho32.exe
        182⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Lhfmdj32.exe
        
        C:\Windows\system32\Lhfmdj32.exe
        183⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Lpneegel.exe
        
        C:\Windows\system32\Lpneegel.exe
        184⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        185⤵
        Modifies registry class
        
        PID:6564
        
        C:\Windows\SysWOW64\Lfjjga32.exe
        
        C:\Windows\system32\Lfjjga32.exe
        186⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\Lhkgoiqe.exe
        
        C:\Windows\system32\Lhkgoiqe.exe
        187⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\Lpbopfag.exe
        
        C:\Windows\system32\Lpbopfag.exe
        188⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7072
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        190⤵
        
        PID:576
        
        C:\Windows\SysWOW64\Lhncdi32.exe
        
        C:\Windows\system32\Lhncdi32.exe
        191⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Loglacfo.exe
        
        C:\Windows\system32\Loglacfo.exe
        192⤵
        Drops file in System32 directory
        
        PID:7024
        
        C:\Windows\SysWOW64\Lfodbqfa.exe
        
        C:\Windows\system32\Lfodbqfa.exe
        193⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Mimpolee.exe
        
        C:\Windows\system32\Mimpolee.exe
        194⤵
        Drops file in System32 directory
        
        PID:7240
        
        C:\Windows\SysWOW64\Mpghkf32.exe
        
        C:\Windows\system32\Mpghkf32.exe
        195⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Mfaqhp32.exe
        
        C:\Windows\system32\Mfaqhp32.exe
        196⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Mlnipg32.exe
        
        C:\Windows\system32\Mlnipg32.exe
        197⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Mefmimif.exe
        
        C:\Windows\system32\Mefmimif.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7424
        
        C:\Windows\SysWOW64\Mbjnbqhp.exe
        
        C:\Windows\system32\Mbjnbqhp.exe
        199⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Mblkhq32.exe
        
        C:\Windows\system32\Mblkhq32.exe
        200⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Mockmala.exe
        
        C:\Windows\system32\Mockmala.exe
        201⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Nbadcpbh.exe
        
        C:\Windows\system32\Nbadcpbh.exe
        202⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Nbcqiope.exe
        
        C:\Windows\system32\Nbcqiope.exe
        203⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Nhpiafnm.exe
        
        C:\Windows\system32\Nhpiafnm.exe
        204⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7740
        
        C:\Windows\SysWOW64\Nlnbgddc.exe
        
        C:\Windows\system32\Nlnbgddc.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7784
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        207⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7828
        
        C:\Windows\SysWOW64\Nookip32.exe
        
        C:\Windows\system32\Nookip32.exe
        208⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        209⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Oigllh32.exe
        
        C:\Windows\system32\Oigllh32.exe
        210⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        211⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        212⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Bgbdcgld.exe
        
        C:\Windows\system32\Bgbdcgld.exe
        213⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Fpeafcfa.exe
        
        C:\Windows\system32\Fpeafcfa.exe
        214⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Hhbkinel.exe
        
        C:\Windows\system32\Hhbkinel.exe
        215⤵
        Drops file in System32 directory
        
        PID:3276
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        216⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        217⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        218⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        219⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Nbcjnilj.exe
        
        C:\Windows\system32\Nbcjnilj.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7496
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        221⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        222⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        223⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        224⤵
        
        PID:780
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        225⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        226⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        227⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        228⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        229⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        230⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        231⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        232⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        233⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        234⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        235⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        236⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        237⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        238⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        239⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3404
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        241⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        242⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        243⤵
        Drops file in System32 directory
        
        PID:1100
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        244⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        245⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        246⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        247⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        248⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        249⤵
        Modifies registry class
        
        PID:7680
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        250⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        251⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        252⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        253⤵
        
        PID:392
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        254⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1128
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        256⤵
        Drops file in System32 directory
        
        PID:1356
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        257⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        258⤵
        Modifies registry class
        
        PID:4432
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        259⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        260⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        261⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        262⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        263⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        264⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        265⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        266⤵
        Modifies registry class
        
        PID:664
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        267⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        268⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2372
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        270⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        271⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1532
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        273⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        274⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        275⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        276⤵
        
        PID:552
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        277⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        278⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        279⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        280⤵
        Drops file in System32 directory
        
        PID:4704
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        281⤵
        Drops file in System32 directory
        
        PID:4024
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        282⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        283⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        284⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        285⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        286⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        287⤵
        
        PID:768
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1472
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        289⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        290⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        291⤵
        Drops file in System32 directory
        
        PID:7112
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        292⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:632
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        294⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        295⤵
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        296⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        297⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        298⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        299⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        300⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        301⤵
        Drops file in System32 directory
        
        PID:4552
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        302⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        303⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        304⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        305⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        306⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4636
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        308⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        309⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        310⤵
        Modifies registry class
        
        PID:4832
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        311⤵
        Modifies registry class
        
        PID:1276
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        312⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        313⤵
        Modifies registry class
        
        PID:3032
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        314⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        315⤵
        Drops file in System32 directory
        
        PID:3824
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        316⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        317⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        318⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        319⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        320⤵
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        321⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        322⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        323⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        324⤵
        Modifies registry class
        
        PID:4144
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        325⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        326⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        327⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        328⤵
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        329⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        330⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        331⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        332⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        333⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        334⤵
        Drops file in System32 directory
        
        PID:4824
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        335⤵
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        336⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5124
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        338⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        339⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        340⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        341⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        342⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        343⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        344⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5796
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        346⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        347⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        348⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        349⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        350⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        351⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        352⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        353⤵
        Modifies registry class
        
        PID:5956
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5844
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        355⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        356⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        357⤵
        Drops file in System32 directory
        
        PID:5712
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        358⤵
        Drops file in System32 directory
        
        PID:5676
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5752
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        360⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        361⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        362⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        363⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        364⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        365⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        366⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        367⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        368⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        369⤵
        
        PID:848
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        370⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        371⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        372⤵
        Drops file in System32 directory
        
        PID:7048
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        373⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        374⤵
        Modifies registry class
        
        PID:5620
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        375⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        376⤵
        Modifies registry class
        
        PID:6612
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        377⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        378⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        379⤵
        Drops file in System32 directory
        
        PID:6044
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        380⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        381⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        382⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        383⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        384⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        385⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        386⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        387⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        388⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        389⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        390⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        391⤵
        Modifies registry class
        
        PID:6156
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        392⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7148
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        393⤵
        Drops file in System32 directory
        
        PID:6472
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        394⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        395⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        396⤵
        Drops file in System32 directory
        
        PID:5612
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        397⤵
        Drops file in System32 directory
        
        PID:6672
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        398⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        399⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        400⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        401⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6984
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        402⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        403⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        404⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        405⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        406⤵
        Drops file in System32 directory
        
        PID:5904
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        407⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        408⤵
        Drops file in System32 directory
        
        PID:6632
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        409⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        410⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        411⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        412⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        413⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        414⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        415⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        416⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        417⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        418⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        419⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        420⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        421⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        422⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6268
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        424⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5952
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        426⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        427⤵
        
        PID:436
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        428⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        429⤵
        Modifies registry class
        
        PID:6616
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        430⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        431⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        432⤵
        
        PID:576
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        433⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7200
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        434⤵
        
        PID:892
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        435⤵
        Modifies registry class
        
        PID:7292
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        436⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        437⤵
        Modifies registry class
        
        PID:7348
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        438⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        439⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        440⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        441⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        442⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        443⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        444⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6768
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        446⤵
        
        PID:980
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        447⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        448⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        449⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        450⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        451⤵
        Modifies registry class
        
        PID:6608
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        452⤵
        Modifies registry class
        
        PID:7644
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        453⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        454⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        455⤵
        Drops file in System32 directory
        
        PID:7744
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        456⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        457⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        458⤵
        Modifies registry class
        
        PID:5348
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        459⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        460⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        461⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        462⤵
        Drops file in System32 directory
        
        PID:6848
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        463⤵
        Drops file in System32 directory
        
        PID:7232
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        464⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6896
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        465⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        466⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        467⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        468⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        469⤵
        Drops file in System32 directory
        
        PID:8236
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        470⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        471⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8320
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        472⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        473⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        474⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        475⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        476⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        477⤵
        Drops file in System32 directory
        
        PID:8604
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        478⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        479⤵
        Drops file in System32 directory
        
        PID:8700
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        480⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        481⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8780
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        482⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        483⤵
        Modifies registry class
        
        PID:8860
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        484⤵
        Drops file in System32 directory
        
        PID:8900
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        485⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        486⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        487⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        488⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        489⤵
        Drops file in System32 directory
        
        PID:9100
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        490⤵
        Modifies registry class
        
        PID:9148
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        491⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        492⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        493⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        494⤵
        Drops file in System32 directory
        
        PID:8328
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        495⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        496⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        497⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        498⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8632
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        499⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8676
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        500⤵
        Drops file in System32 directory
        
        PID:8756
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        501⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8816
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        502⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8884
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        503⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        504⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        505⤵
        Modifies registry class
        
        PID:9088
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        506⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        507⤵
        Modifies registry class
        
        PID:9196
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        508⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        509⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        510⤵
        Modifies registry class
        
        PID:8440
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        511⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8600
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        512⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        513⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        514⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        515⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        516⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        517⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        518⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        519⤵
        Modifies registry class
        
        PID:8260
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        520⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        521⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        522⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        523⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        524⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        525⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        526⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        527⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        528⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        529⤵
        Drops file in System32 directory
        
        PID:8184
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        530⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        531⤵
        Modifies registry class
        
        PID:8164
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        532⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        533⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9028
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        534⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        535⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3276
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        536⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        537⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        538⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        539⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        540⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        541⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        542⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        543⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9560
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        544⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        545⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        546⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        547⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        548⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        549⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        550⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9864
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        551⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        552⤵
        Modifies registry class
        
        PID:9940
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        553⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        554⤵
        Drops file in System32 directory
        
        PID:10028
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        555⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        556⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        557⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10160
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        558⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        559⤵
        Drops file in System32 directory
        
        PID:8020
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        560⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        561⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        562⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        563⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        564⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9556
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        565⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        566⤵
        Modifies registry class
        
        PID:9700
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        567⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        568⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        569⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        570⤵
        Drops file in System32 directory
        
        PID:9980
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        571⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        572⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        573⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        574⤵
        Modifies registry class
        
        PID:10172
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        575⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10236
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        576⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        577⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        578⤵
        Modifies registry class
        
        PID:9412
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        579⤵
        Drops file in System32 directory
        
        PID:9544
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        580⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9624
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        581⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        582⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        583⤵
        Drops file in System32 directory
        
        PID:9968
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        584⤵
        Drops file in System32 directory
        
        PID:10040
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        585⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        586⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        587⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        588⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7772 -s 240
        589⤵
        Program crash
        
        PID:7032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3660 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:8
1⤵
PID:8420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7772 -ip 7772
1⤵
PID:9584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bgbdcgld.exe

Filesize
104KB

MD5
e8270f35db4015c02bc3b1678f7cea0b

SHA1
b8b7a311f0b14513e029b40c1ba5cdf938849a77

SHA256
59d5fdad0a2dd1508b3de3307c8f309c88ce5a4db51e6740a333ac972400af10

SHA512
c51e73f95ff125aaf9ab1cd9239c74e696f20f7762a64f985330cd8ac7e24dbb10c6deec0ea107aa2f7afffc6579b4ba5df11f2bc84026b22028b126a84de00b

Download Submit
C:\Windows\SysWOW64\Cefoce32.exe

Filesize
104KB

MD5
fc5f20a100e696221da58e4687fe6b43

SHA1
d8d1bed10661961883fc99c1f7e2342997a1de5c

SHA256
c86211ebf1450cca39121c098901f65c350e1912a16419dc3a4d79766bf7795e

SHA512
d5ec83cbb4c0e1d2b4925393e3ac0661f824b314326fa7b76521f4e3ac6e78d9d5d5d943523d7d88febbf13aad5035c95564a74f85ae8ed6517f2a5922bfe49d

Download Submit
C:\Windows\SysWOW64\Cehkhecb.exe

Filesize
104KB

MD5
b2bc22bc59071c6c42ed30a29a0e3814

SHA1
1b726605bd5785f07c1d2a9fa1179e251343c6bf

SHA256
0be7951aaf95ff7abb305112eefab0de4e1c37de1eebbd65ad722c6a0f51d931

SHA512
0ca6848174fcdafc4d4f092a368c2925de2d1bf7ecd72c683cb1b9fe310b22c86e68d83c894dfe5b13e0ccd8911c9f11bd44423003593ee375459d57f5f80db5

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
104KB

MD5
28761932b13d4543b7d251b37c951e31

SHA1
af8b36e108b5811c66cddcff9b4eb61a66c9375a

SHA256
cb1d622867768e94a41313fbffdbd9d7853b0313d4033ddd33db7452fceab1b2

SHA512
b72e9cf531577995c43e7882d173414613b5297b44d2366a46ccc64f51e71050783d6a3ad6788ff641db02e4ee5d6039b53971bfe4982a457aabdbc3edf34b34

Download Submit
C:\Windows\SysWOW64\Ckcgkldl.exe

Filesize
104KB

MD5
bf27a50bd47d91eb418bb3037473f813

SHA1
b0820b7c4b252873271c8f17f6c9c091f09e66e3

SHA256
41715d0527397d301f17810b777aa8707fc5efbad2ae3490da25ede6ab5f5b01

SHA512
6b6462c3d720257a94836aa26071405a500965c80102d0402b93ec375d142df1ed46826d64749f246c3b9d065a1d36b44b604935e438832ed76f192fb4d95fc4

Download Submit
C:\Windows\SysWOW64\Clnjjpod.exe

Filesize
104KB

MD5
62306a37ffbf5307b4268be799c7d08e

SHA1
3e1122c2f3125c5068dc87e68e6a7415072195b5

SHA256
68c439163937c10567ccc46b5a81a361d0fde2652dde0b7de298e46cf330824d

SHA512
da2eae6ca7235c9710c69bb98fac69ece593b5acc62db5e4c7dee47b895a257ea03544f428d37e3d1a1a69c885eed4ac94a080c3380da31808f47bd883600083

Download Submit
C:\Windows\SysWOW64\Dahode32.exe

Filesize
104KB

MD5
dda0a305baaf534b668de5a48ef9926f

SHA1
32f6ab3645052d51892da652b981a6a156771a73

SHA256
37dd120d5621dbfcd676d5acce82c9d8adfbc92a985396d291ceb203caa3c56a

SHA512
9975df520a87b740cb6fe6155c8c0b00f3c0cd0370485482e003970848ec17a41e0bafc74053b718f7d4e424e2aa2a09bd5bd59331520d03bea880ea6cc28ae4

Download Submit
C:\Windows\SysWOW64\Dbllbibl.exe

Filesize
104KB

MD5
b31190a6b9e316999a2280aaad138e0c

SHA1
6dcea034aeff6ec69f01964ec60bcf43001c6b36

SHA256
c84865307c7087161fd49a4fdb6a8266ef5610e666d99a4eef9eb6df5dceb8bb

SHA512
54750d488e8718252acb655c90db07c237dd45be4da40b680e9ef37fca8a46ebd355abf0a7b80a8fd545afde75aeaf25da6a36218e8a26d1b85137ec4b58e570

Download Submit
C:\Windows\SysWOW64\Dboigi32.exe

Filesize
104KB

MD5
b73bcd66ab7240772b21f5557bcf46f0

SHA1
80e247fbe67eec4099234b337ac334b45ccec1b5

SHA256
00ae0830c709dfe5495005ee23ff2c55b14365ea9df36c5728c42f5b10036ec1

SHA512
7bb79a9a8c1fe1626352450247e13bad8e11577651667073b5f72d505cf40494975a5204a73283fbd87937f1a63a95d6bc046e87557ababd31f04ac85b6e2aae

Download Submit
C:\Windows\SysWOW64\Dccbbhld.exe

Filesize
104KB

MD5
964fac7cd358aaf591bac96581e53798

SHA1
ca15332918d414e7c736d3c79ea96a960bd4079f

SHA256
afcf132186b0ecc70d47040e90aff57db5dc4844627d51c7cefd90656821ea80

SHA512
7a2a4ff398374fb1fa1aed303a25c14b24576ae2a8a9dd41ec33fc201bcb73d7a29aafcaa9a5694bee1d24d8b2d7073ae250ab07b1bd10e043f2aa2c51a768cb

Download Submit
C:\Windows\SysWOW64\Ddmhja32.exe

Filesize
104KB

MD5
3cd2817e080bbe3e46d90f4129ec0ab6

SHA1
f73b166d9c272d9f7bbf977c1d25f685b02309a6

SHA256
bbfdba1e1032c36c9a16e7d5ba93973267406bfe706fb0370d319ec07188b582

SHA512
0abc38a17c773ec2a203a49222d1bcb05aacdea2c164cc9d65735590f4a63dcb123fc4c86847a0a7cfcb8bcf4191905e29bc677e60f7f7a2248a082fffb1da75

Download Submit
C:\Windows\SysWOW64\Dhnnep32.exe

Filesize
104KB

MD5
15ada8375ca40ff59cf2342e2b41ceec

SHA1
2730180dd9e2df858ff48d51b8efd1a91777e7be

SHA256
0a9b2e5062907c3212cd22f931a4ba1458bec7c730c47089a9138919f80fe338

SHA512
7df282cbbbf4a4e5b7424917f04a3c6bae3d7d45a3aabace1cda1dcdaf6d6529046288f8104cf5a30e96ee7837e6443c4d9c00cece638d5e812f383430d75cd7

Download Submit
C:\Windows\SysWOW64\Dkkcge32.exe

Filesize
104KB

MD5
350bc9908a126cc433886bb409219ad1

SHA1
3a97f9b4c1f27a902b4c0ecf1b02c6d7a7a9b917

SHA256
e52aafbee072257926074ec815d67e8b7e5b0ccb813f0f5ad954ff8a85b655e8

SHA512
481d2d40e7f7094c946b7b5b82df20fd611a4dcf9e8ad11a0abf3443b425a307e135db0cbb737c1d61fb59f6a4faaa4af3abbbfd2ce3229d5b2152fe7d79faf7

Download Submit
C:\Windows\SysWOW64\Dllfkn32.exe

Filesize
104KB

MD5
9ea369912b6f6fb72a9a0402da3899ad

SHA1
7647a87cdce8b619abfabbb7261f8c72ba45f943

SHA256
e57c76218c6e27b0d056ad47b354f74977858bc354664d476b3a7dc888929e28

SHA512
d26a768bd5ec7142437605374e5304ddc737d9e9077060bdd85833b309e32fc546463952b267a1ffda37f6ac28ddd963c5e57e51bde65302f27b23f495c5b174

Download Submit
C:\Windows\SysWOW64\Dlncan32.exe

Filesize
104KB

MD5
b4d1fd911eee7560faf175c917f00a5a

SHA1
b03fd03bb1852c5d6a3fb1cdd96168cae7d034db

SHA256
7d29c0c191d04d473621c9db2cbd5bd4f8184f84aaa84022e292c732c72767d0

SHA512
8560c569280ac929619a0eb882b1c167ba312cb825caf6a5fa43a7cdc4b80e4452555139d5a9435bea75af1258af112b0750ba17ed4f91ea0437af7f1a27406f

Download Submit
C:\Windows\SysWOW64\Doeiljfn.exe

Filesize
104KB

MD5
a763fa99222ffdd71936624df2b35c7b

SHA1
0deb850c68e981210438a2e6f6946e4e75c828b1

SHA256
107ac3827a27cf3e5a1a7badcd99c0aa78326d8a6851650a629a696f0d8efa4a

SHA512
705a693c081bea7afd1e6cda6405c17283bfd31cb7324f05761c14a2216075bc5bdc689fd592ff397fe8e5655d0f92de1cc31ac27116ba8384a72ef76633c775

Download Submit
C:\Windows\SysWOW64\Edkdkplj.exe

Filesize
104KB

MD5
9ca30dd3196d536226e20f2885cd8dde

SHA1
cc27b89bc173baa9300f90993cfd9719d258063f

SHA256
49a9335e637ca1b1b78a4dda15abe2c51eaf984f77f93ad1e6c618c8e1455bc8

SHA512
7de526c004e39d7e74b406327523fa86899d8cd3682c394c3f18528ec4bce112ff16c8c3a6549fa62ad46fe84003d8264c90f44e589ef4164310d9788b0bda14

Download Submit
C:\Windows\SysWOW64\Eefhjc32.exe

Filesize
104KB

MD5
164eb8dd4d1ccf4f133fc1a74cc446b2

SHA1
d6991a60d8f4e3a04f30ad6777717b751283ea67

SHA256
5997657ca2de16db2ded98b6a75e0844224d6253f7f28ffdd1912e8fe806b1b8

SHA512
8863a739cbdf345a2e9fa81d462358c0040d37708cc26c87926d42bcfcfa35e9ec777504d2671484a28170597160b87bb1cb446611b15ad6becb8604767bb2d9

Download Submit
C:\Windows\SysWOW64\Eepjpb32.exe

Filesize
104KB

MD5
7aa13d0c3ab02cc507fcc6a0b5121557

SHA1
77e72e922bc76df35e6e9ef0f1d80066395ed362

SHA256
62bdef348e4bf8f3900cbc74f6a0758bb0f8477debe93ac902d92e559927b427

SHA512
70eae6d1081702a5bd203569d25c418a384f5e93ae0b43cc80a99205792d1780af87823d314a6b04d4a067b9a3582e9510ad67aa56b68fb40d590c12d872ba9f

Download Submit
C:\Windows\SysWOW64\Efpmmmoo.dll

Filesize
7KB

MD5
e7ab94f134fb89fa9ddb0661296a9c39

SHA1
335930a2c7a371170da89571d9e7ad442d0dd8fe

SHA256
2e2e0f78d389d9d80ae77402d3de51897314fd0aba24f3d7a8dcdd6bbb6774b1

SHA512
97d130359cd1458ebc873189111838ac0e1ca79c9451d3f068cfdef0f361062b3fad8e548334d3962e02cd4da58198b390cc6b71a5944bced8ab26d7fbb318a4

Download Submit
C:\Windows\SysWOW64\Ehimanbq.exe

Filesize
104KB

MD5
140de67fed7b31b4408a3383cd91e58a

SHA1
4e1938d2baff879c059674dcf0a028ae072cf72c

SHA256
6ac07a585d009fab303cf716016c398e05258b51d8c5bd4d7bc4474b68e1b817

SHA512
1d9a4fe9c76b97eb50ec4a545bd747e1cf8244256a17fe3fa9c3be41a98b8e1bfa245d21beba2ab6818d49398232164f031e46bb6e709e8b27798e96a08db49a

Download Submit
C:\Windows\SysWOW64\Ekhjmiad.exe

Filesize
104KB

MD5
573fde69574549ca4016f62f9e21cc2b

SHA1
53ce9b274b481489aee8eb6d9e828665b8ebe62a

SHA256
97d6fda01a6e379608604c6cbe4e0e758e6054eb7d08241e4316b837fd24e29f

SHA512
4f7b4c5193584a50c02732a15ae3d6a7b5eb05fd33ba5a1a9f069ebb30abcf577ac558cc60e6b603ed7b7b7ed61975c976c0bf26501ac434b9d1b784fe72b883

Download Submit
C:\Windows\SysWOW64\Elgfgl32.exe

Filesize
104KB

MD5
ac85494940bc389206d6e6677ab475d5

SHA1
4e94261dd672e8b5a9c19ed44c87d2435b53df0c

SHA256
a03f352d10693b3c1a2a54ea0c97a75c354249811f306fcae036ad7d1b5c6f6c

SHA512
2bc4ca1bfbc1bbc83d3dbe3b09e06e66d47ac8f74d882c8fdee4e8ff8bcd313577dcd9f1e51e07baec5c99a03a188f517bb507aa5765fc2d5fcf575f2c7f60ab

Download Submit
C:\Windows\SysWOW64\Eoaihhlp.exe

Filesize
104KB

MD5
ad0c42d9a95a9e96a7c629ec975b1eed

SHA1
cf749aea84b733a385100e4fa5a3349357460664

SHA256
d663bc2edf267868daff36d0e645d195284788cac3266a980c9b1b33c9d832f4

SHA512
867cf14f2fbcde3b0b8bfc1c865cf149bc0f1778b49e662f5ca5af871613bff242bee51f68c29224707d1652dc721e9132dcc4e190a8e83157b82a6bfe818a79

Download Submit
C:\Windows\SysWOW64\Fnjhjn32.exe

Filesize
104KB

MD5
8dff7a4c1ba3a0eca4d251178746c2ab

SHA1
3b6f0c267cc19a8ffe4cc14269f2fc9fdec88482

SHA256
c15239fca1c05cf425dd5f5960bb174a5a8195214b13eb2fb4c31f585ab20e83

SHA512
ebc2ab41b468cf9407f70b95e922d3ab897b65e0971d202f168a6a5f75cc9fd671a20b21b70b9a97e64f6867a6b364c02354f96fb7e1f959ee89f642ed6c0b13

Download Submit
C:\Windows\SysWOW64\Hfcicmqp.exe

Filesize
104KB

MD5
daac5ff81b31ef7af2ac72d73aa7928a

SHA1
5cc263a482746045abe680eb6ade2d3e58a8d261

SHA256
3e17bcaa1a6dc740ba2fd45f8eda7cde505e555f22d7df729d66f361a2e154e7

SHA512
cad554c0cebf0b2e916e02628cda25539a4e34ce661fdfaf6b377b38292582fac0dd4c462ec2edd32fffa736e430657f12a785ade36c693749a565b20d7c22f2

Download Submit
C:\Windows\SysWOW64\Hldiinke.exe

Filesize
104KB

MD5
bd6f7d6bcd26bed29d0098f7e933ae27

SHA1
1179c33daf4734a6ae9bfdf5aade736c3ba272a8

SHA256
67443558dc88d4cb2c6e26990dcdbb0636e96201603f0440fdb75cfd1b506c11

SHA512
dd42a8236a03fedcaa0330dc350d3239eb8be9d1493995c94119b61eea3453b177bbdc5be61e2ab60e0aac1b82368caa190a5cca7ffe63ba80458b942e8e9138

Download Submit
C:\Windows\SysWOW64\Iblfnn32.exe

Filesize
104KB

MD5
586e530ab528495d30a367e954f00ea3

SHA1
7b40da02348dc28c34e1005a7c9aa016756d39a0

SHA256
4b949fd5d3bb5f750223d29de775816c7a871872066a5b9c9366f1a2437d3fc0

SHA512
3a273d1df2f64a0d2a33dd4de9f5f968d05e9ebdb8f7d7decb3989bc7df0c1a038d6ebd4e43473b774f6cf4f4663b5c0f690444c3ebe9debdaf23255d98e5cce

Download Submit
C:\Windows\SysWOW64\Ibqpimpl.exe

Filesize
104KB

MD5
bda44b4633b64d4305500db86e1d7dd4

SHA1
dc5c1ba4ef5183389a44973e0b5efe375332daa1

SHA256
25e77182616fcaeef8b4ea509113bbe9ca1d1011e2e017e7b88ddf01a8543af6

SHA512
e5e72bc4106ad179075fff4785c740511f3f390ab3409638047b97c8bcb66b372a691cc7d464856e04897ca3aa62e941f6d4ceb7ce1aba2ff7c255ed2c34804f

Download Submit
C:\Windows\SysWOW64\Iihkpg32.exe

Filesize
104KB

MD5
6669bf64efb3e1c9ec0c0b7c3b84596b

SHA1
ecb1b7ac9236953bcb51e1552a0b26cc2048be22

SHA256
cb82fadd9684c78b7327baec3fc2ce47cffe54632de8714bfd44dba481262cca

SHA512
b4552ce15e1960b8205284a65454ecac5838ff121384a487c2d71d09472be6669cc726be97f0fff2118f3529c27620db6f6744874a0155cb122889f429918ef8

Download Submit
C:\Windows\SysWOW64\Ikbnacmd.exe

Filesize
104KB

MD5
df1b974c15cfbf582065b18874835f9a

SHA1
eece61a839977635206f6da2e7ed86d33c9eb443

SHA256
6017880d0dc99b3ff6a305c6c12624cf3471269ccf05852bbcaa48828bc4b37f

SHA512
32976ec782005b0ea3835d6ea2f18119e96aa732445245fa3490f71b73ba6126ea2b357ddd4a7f7a7376818d90936ff1fa85cee8519389f1680229526da52f9d

Download Submit
C:\Windows\SysWOW64\Ikpaldog.exe

Filesize
104KB

MD5
4350f35aaabc4c93979824ba6a2e9515

SHA1
aa63fe34eaf241fb21c1cc785aa230f5252e67a8

SHA256
a1ed6b7431beb321420b62946207d104c80c44db395a5449310f61b71583026f

SHA512
9b4e8c239bec53965f607a6ebc67ee7697ee8abafffe6ea748f5b5822e94ab4a278e22a13edc93a647b445cf000b1e5e95530e76154b7d1e5407f81094091575

Download Submit
C:\Windows\SysWOW64\Imakkfdg.exe

Filesize
104KB

MD5
2242f457c10e426bfb878342cc701d23

SHA1
13ec575f473fa473f312ced59dc01e1472b2407b

SHA256
44f266d709b1ad1580b2101ee694bc604f3f1b785bd1cfc7125b71af1fba37aa

SHA512
1f0e9e4464a38b3d865f6c52fb121853ebbac6b6711e443f0c51dd699128d4126604500d39aabf1a5109e1218a6626e29605bcabbc12e10f98b411d78d7be30e

Download Submit
C:\Windows\SysWOW64\Imfdff32.exe

Filesize
104KB

MD5
393616271f80a2b6618d3fe980df4ae9

SHA1
65c76abc14ffd4be4551d99a0f67a7e201616498

SHA256
3a4b87c8f0d4a7d206f97122724a47432b5b9d965291fc726638e92e67f76212

SHA512
52759f6211d774e0b197b707000d53ab225f94119edac6e781fda56a4adea4f69c82fb7593e0e7239fa9e255f888268eac0ddbb7d81a4f1efa6e8c733b7e35fa

Download Submit
C:\Windows\SysWOW64\Jbjcolha.exe

Filesize
104KB

MD5
707ceb4a2acad49c516b13e2b0c821a5

SHA1
78d877851c28c86078a913a6daca52b3ed3ced05

SHA256
eaa51004849ff98e1431ad19300d7968cf5aad6ae0704d79abcf124ba54c6735

SHA512
aa7acf46d766492303c1a699905195f6c0d0e27e9062fa3f4f303f6251c80e1fd26a12ae74a26be9ca05054c01d7c0fb2f445e44f84a79d82d3e5e5e9a4ac419

Download Submit
C:\Windows\SysWOW64\Jfaedkdp.exe

Filesize
104KB

MD5
93f7c49d0464d647cbedc684babd1e57

SHA1
45b27648856f3703bd7f34b00402cab4610a1438

SHA256
630b51abe9cf5ac4825eb17d920b2d38efe13bbd23a14c8e1e404254b57ab7cd

SHA512
efa7247a019fa95bccbb4a90f59f72d6183b244c2790a84aee73cfc8e47a3e4aec5e7a9a754a0c6e551ee0dbd75d3013bd075fb7ae17e26095f77a4fe3871521

Download Submit
C:\Windows\SysWOW64\Jlpkba32.exe

Filesize
104KB

MD5
1292406994d8a33d8b8ceb09415fb92b

SHA1
e0bb1178a4d2633d94b1c188e5f01ac100744834

SHA256
46bf3129b1bb7f727c6543739ff54cc738bd4f7e1260bdc98e9d699631448d3b

SHA512
cf2a2b1d933826833ffc97ca9649113b656ae2ddfea10ef4d4ca93804addb66d8f3a624c5f93e862f0f13f42d69dc373eec561a29677bf716e658b74fec4fd2d

Download Submit
C:\Windows\SysWOW64\Jpijnqkp.exe

Filesize
104KB

MD5
fb64c0e6fa9fbe3a43bb646a47368ee9

SHA1
193d94d16f9914bbfe39828a0fd5f72ef71242cf

SHA256
cf60b7268fc0f2b8307aa97ca6b958bb60f6ba108f987df9eb84156d1936e356

SHA512
2e246531b5bd8eef6c001d26d39236eda0a28b083b8e01e6f304c5441683f2c3413fa466b1714f68e412c9176a65eeb4a606b129b326daf2766e41234e3752c7

Download Submit
C:\Windows\SysWOW64\Kdnidn32.exe

Filesize
104KB

MD5
3068aefc4fdd4e0af4872f7dd8411c45

SHA1
50e7eb2aaf6222a5b35e8528ee1d4c307a70db3a

SHA256
5665a02b28413f887830681c73d998751823b71d8c88812fad913585a7fa52f8

SHA512
b83da6ed80451e3c313c2f616eb205ddca49b569847fa6d9f475d56b3d1e290ad2b1f01565e547198bed070c467c3e58590b26100e960908a1e7cdd05c01ff9b

Download Submit
C:\Windows\SysWOW64\Kedlip32.exe

Filesize
104KB

MD5
af61c362943a88d3ddc1fc8ea6556313

SHA1
9b06e0490b6d13f439c9e8a592847bfe6aae2242

SHA256
e4de224498e7dea118fb58a46b620f7783abe722d786bd2a37c01df2db9f1748

SHA512
6471e32d8d32e4739019fef7e921fa8357a5a7cb30b03503f929a24c165798fc5ce1451ca30508d6e60be2447675ddddc809d797622037f3343ccbca66b09258

Download Submit
C:\Windows\SysWOW64\Kmijbcpl.exe

Filesize
104KB

MD5
ad2acd3f50c103a0932a5dbb44a3dc57

SHA1
116c951ae70e8aba4abdafe083138250557a8196

SHA256
4a8063036899cce1bca4d78358f10a7dd3db0d6d801898761030d7b55ce4a5be

SHA512
ef5214e2a5d1e865daee2e41bef2f25aaa7a8b50294c89f417e63534fffce05f4f630745ad0327f1666c7808d85a44f3346f6656394552628b60b1d5a7bbf5b2

Download Submit
C:\Windows\SysWOW64\Lckboblp.exe

Filesize
104KB

MD5
49de30bd51232e60783d2747a6da3841

SHA1
5d9f0befa6cef139c690bbc4bf839b353bdb88e7

SHA256
5ffe32d3ce9b745b1d79f6b7bb616a2cffb976887200e78def73bcc800d4ab13

SHA512
8b73aaa5229eefd4c483e2deafaa72d32ff5db6c9e117eaa95c279512457b16f11c4a5608f0e8b6647d3eff9de4449c0c9172d5a19a87d5e65ae5ff7776e11eb

Download Submit
C:\Windows\SysWOW64\Liddbc32.exe

Filesize
104KB

MD5
b3c6ce2061e6f0ca76215898d241e8bd

SHA1
f908d08631671426eeeef4de885379d22fa928d2

SHA256
8aa50250827513c0808af78d2cdf74a03ac9fe86f3ce05711b078bb8a40e0853

SHA512
ddc3e0cad44b37a2ce7811fcbc94ca06f6ffa169176f9b158d9de63a8b88c1b14722cea0a3f7692a8e2cb8ada32ceef6531155318ace162e56e87b370c10dba8

Download Submit
C:\Windows\SysWOW64\Mbjnbqhp.exe

Filesize
104KB

MD5
76463e19ef59297cd6bc809c2fa25c77

SHA1
636b08d4971c304913b4b7cfef23dcf5cc239b1e

SHA256
38b820bea3d739b86bb3543a183b21d0a985815da177db0c1b33066897bb843e

SHA512
df13d484499d3b7360b7a8c399c52d7be78bfcd11ec751afd2eb6428b6f7aa10d16fe6e2ab535d7c8a0574db0e8bb5ccb93c37ef2a9e2f588609ded941901d7b

Download Submit
C:\Windows\SysWOW64\Mlhbal32.exe

Filesize
104KB

MD5
702b34249fc0b1be9b214e08b915804f

SHA1
7ceaadf24590cf7428d6f955ffc983531ca2c9c7

SHA256
2a29b5f06c684e059ba7c3efca948c6cec6bb0a3ee11d8e7339f0a4d284a0657

SHA512
a96515262380bdbc53e5a1e6f39b881a0ea0016ebd176433cde6a99962f096a715e05e556950eb26be41ab9cc5f54499b4ddb1647591ce8c63959cf6144b55ab

Download Submit
C:\Windows\SysWOW64\Neccpd32.exe

Filesize
104KB

MD5
05009dd960c403239ec38f75f7b577b8

SHA1
636661839dc26d6e3c4f619eae38ff6ca050b348

SHA256
8b558c0327e4ada58a67c8561d0e847fa9f86446ee9408f9b6763be8bb70213b

SHA512
c1ac92429666f55047f80b934eac0eca2557356afcc241a3605c7434854944c2a3cce224cc962fad80e6b50aa9e43f1c5ff93f43d5f07fa13a8aee4fcc1ddc04

Download Submit
C:\Windows\SysWOW64\Neffpj32.exe

Filesize
104KB

MD5
c1ba6ed00c460e014d8d6c31b6ff324f

SHA1
3cda41e332bebcde97e862afd2bc085a072b54bd

SHA256
e87a26a3da3fc8695a00b7d9606665693079c1d766c50eff6085b0fb8fe8fc6d

SHA512
2a0fc589104b7e7f1c349bbf834a644ea1086858e28208c4f784a1cfac6e2633b72eb11da257f5bd087d8a3161f96450073268bb468b5217eefc962401f173e7

Download Submit
C:\Windows\SysWOW64\Nngokoej.exe

Filesize
104KB

MD5
4c1788a1b3dfc39fe7f0c076a87953e8

SHA1
7cf476610fb634b6d49a3040cbb4ab6b209a0b38

SHA256
adea077c6a6de26badf5d01f991bae4289823ce65555813ba55ba9713cbbcfdf

SHA512
c8711783bca38c5bce4ee4de4304d182d36604ebe92cbb33e831e3cfcc2a99c17cd089fd8ff2a069fd2a6bb0e9797770c9921eae2234b7cc4848cc13ec54b195

Download Submit
C:\Windows\SysWOW64\Ohlimd32.exe

Filesize
104KB

MD5
b9a034c4a7b0875b8122151da21fc170

SHA1
a64ed3cb23f5268d1fda186df02fb73a856f567e

SHA256
dccf24c587ccfc5f6a3fbb7238f07aff636dd592bddd2e243cbec8be7428db3c

SHA512
736010a0c159746d537738e9ef98d2278c840421f6507de4b04af924a0d750a55542095253d3a70a12a332386b6e92be568bd16a19b51ed81c91906d672e2666

Download Submit
C:\Windows\SysWOW64\Olkhmi32.exe

Filesize
104KB

MD5
855288809f9a1eb514da21098dabea2a

SHA1
b4c06cff2e2742b1a4270cea992fc05495026d67

SHA256
a72ebf360a772a49f61f6bc336e63da615d307c6410a4cce38d4742dc74a5fcc

SHA512
57aec116517b6969d2b7d305176f7a6079527b42e93d8bd7e29e2712a4c61d17d6dc6686a71315c6461d6cba641b979c4f3d3a4bfcfaedb1bd5baeca8eec687e

Download Submit
C:\Windows\SysWOW64\Opogbbig.exe

Filesize
104KB

MD5
3dc0e6446d803fff6894f4b0842ebf86

SHA1
b8b9bb9ffe851fccbcad1321573457bf8a5620d3

SHA256
9af10d83aa2cf86b73cbd0ce20a2e3a27c985ae9d75e3a886ebb3a79c4e940e4

SHA512
cc2abe08f087a756caef987a75ce7ec90f8c7a49ea2107f6883134d0cf87431aa05800370660415526f74eea718a8ed22f17cd9cb19f96473d003b0f7b22b943

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
104KB

MD5
89f4c90294461374aedfd97b952b8eeb

SHA1
52e608ccda51e5e2425304732ac5729f254a7089

SHA256
74fccca3ab172681cde90329a0e04771745b7ea7c208d5ef6d07b3230955fd10

SHA512
bfc83c6459791476c7e760172e31557bd3426a61e79a306a6ce7913c5ab05cb26aab47cf1bd4f077a978b5c3ee58e9651ea1d3a9a0af858d9cea9929a3da1e6f

Download Submit
C:\Windows\SysWOW64\Pmmlla32.exe

Filesize
104KB

MD5
ecb340561c8a05c73e42b1aee7cfc6ca

SHA1
976563bd337082e9ae5645509090f663a0046525

SHA256
32887176df1609bc99b9b5274a2adb35d1a2dcaff3fba45df6a643aa598c61ae

SHA512
a6de41dfd60160a597451127d53463391e6db410a6241c575fa7574336fcb5937affc27e37db9d05e5605690f70af61246845c505e344d697b6ed383ff6968c1

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
104KB

MD5
46ac2d53bcde59c6f474abd54a93f02a

SHA1
5e3ea11f7249bf5be8ed3b9ec925984cb5455b1b

SHA256
48f841dffbaf925e6e31276468b4394b7b1f5718f7905f730071b8fd16e1c8a8

SHA512
6422e980fb48035782394c8552e600e5fcee45229f5ba1f2cf69eabdf8276e27de8262aa1ac424198098109cd7827f616b34f4b470a9fa6493411baeb9deb8c6

Download Submit
memory/428-340-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/492-200-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/564-239-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/680-231-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/712-208-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/788-388-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1060-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1128-168-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1384-215-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1504-248-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1536-100-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1612-298-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1668-292-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1740-334-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1792-304-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1796-141-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1836-280-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1916-370-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1940-24-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1956-262-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2168-346-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2248-412-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2312-104-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2332-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2456-255-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2476-16-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2492-64-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2516-286-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2544-316-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3032-192-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3408-358-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3468-132-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3588-352-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3600-274-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3700-442-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3716-184-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3824-430-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3860-112-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3972-119-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4016-223-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4020-55-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4064-156-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4084-328-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4268-40-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4340-424-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4368-80-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4380-48-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4444-88-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4456-418-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4460-326-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4516-400-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4520-160-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4532-376-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4596-72-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4604-436-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4620-175-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4636-364-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4644-32-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4704-268-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4724-406-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4824-386-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4940-310-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4996-397-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5068-143-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads