f9a75685e1632e57f3401678e16da4df36960f8e8a0f63dce8d586bd744306fa

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9a75685e1632e57f3401678e16da4df36960f8e8a0f63dce8d586bd744306fa.exe
Size

192KB
MD5

b94c5fb699e7f687732b2e7135bea17d
SHA1

b7211c467a62072ea731e4a64f9e0376d854b1e9
SHA256

f9a75685e1632e57f3401678e16da4df36960f8e8a0f63dce8d586bd744306fa
SHA512

9de50ac0c2a74619531beff657a2ef2bdb9773afa590c26edf31e18989c0ba017bdc6ff48ef6dc4d714a3a4ebaac5be910f74215428e4bcd8e857743d4b9ec6b
SSDEEP

3072:MnxqSCsAW0q0yGcXiR4Sp+7H7wWkqrifbdB7dYk1Bx8DpsV6OzrR:MxrDmyPXiRBOHhkym/89b0

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fohoigfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fchddejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hecmijim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anbkio32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcddpdpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbhoqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Onklabip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcimkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hioiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceehho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kbhoqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nggqoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acjjfggb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbnafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ilidbbgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kiidgeki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kgmlkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eapedd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekhjmiad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qnhahj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Okloegjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcgbco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmbmibhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkpnlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ekemhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmhhehlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jcgbco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndhmhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nggjdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pengdk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clkndpag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecoangbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hkikkeeo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kimnbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmiciaaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgdji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eocenh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fkffog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kboljk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajfoiqll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llcpoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pagdol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edkdkplj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ojjolnaq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bdfibe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ickchq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kedoge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgmngglp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojgbfocc.exe

Executes dropped EXE 64 IoCs

pid	Process
2752	Jiikak32.exe
1888	Kaqcbi32.exe
1568	Kgmlkp32.exe
2956	Kmgdgjek.exe
1580	Kacphh32.exe
4080	Kgphpo32.exe
1012	Kinemkko.exe
2880	Kaemnhla.exe
1708	Kbfiep32.exe
464	Kipabjil.exe
2424	Kpjjod32.exe
2668	Kkpnlm32.exe
4884	Kmnjhioc.exe
1208	Kckbqpnj.exe
4780	Kkbkamnl.exe
5036	Ldkojb32.exe
3332	Lgikfn32.exe
3952	Lmccchkn.exe
5016	Lcpllo32.exe
532	Lkgdml32.exe
2852	Laalifad.exe
4600	Lcbiao32.exe
4116	Lilanioo.exe
3280	Laciofpa.exe
3988	Laefdf32.exe
2452	Lddbqa32.exe
4684	Mdfofakp.exe
4192	Mkpgck32.exe
3180	Mnocof32.exe
4348	Mdiklqhm.exe
1664	Mnapdf32.exe
4056	Mncmjfmk.exe
4536	Maohkd32.exe
3620	Mkgmcjld.exe
4988	Maaepd32.exe
1236	Mdpalp32.exe
3640	Ndbnboqb.exe
3076	Nklfoi32.exe
4292	Nafokcol.exe
2488	Nddkgonp.exe
3020	Ncgkcl32.exe
4544	Nkncdifl.exe
4552	Nbhkac32.exe
1092	Ndghmo32.exe
4336	Ngedij32.exe
2480	Nnolfdcn.exe
4768	Nqmhbpba.exe
904	Nggqoj32.exe
3776	Njfmke32.exe
4956	Ndkahnhh.exe
4332	Okeieh32.exe
2516	Ondeac32.exe
3104	Odnnnnfe.exe
3520	Ogljjiei.exe
1076	Ojjffddl.exe
4532	Onfbfc32.exe
4808	Odpjcm32.exe
3692	Ogogoi32.exe
804	Ojmcld32.exe
4016	Obdkma32.exe
1648	Odbgim32.exe
1308	Ocegdjij.exe
3068	Okloegjl.exe
2528	Onklabip.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Oedbld32.dll	Mkpgck32.exe
File created	C:\Windows\SysWOW64\Dihcoe32.dll	Mdpalp32.exe
File created	C:\Windows\SysWOW64\Jinpgcmg.dll	Doqpak32.exe
File opened for modification	C:\Windows\SysWOW64\Immapg32.exe	Hbgmcnhf.exe
File opened for modification	C:\Windows\SysWOW64\Chmndlge.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Bopgjmhe.exe	Bhfonc32.exe
File created	C:\Windows\SysWOW64\Nmogab32.dll	Dlgmpogj.exe
File created	C:\Windows\SysWOW64\Fdgdgnbm.exe	Faihkbci.exe
File created	C:\Windows\SysWOW64\Fpeohm32.dll	Hecmijim.exe
File opened for modification	C:\Windows\SysWOW64\Llemdo32.exe	Lmbmibhb.exe
File opened for modification	C:\Windows\SysWOW64\Lmiciaaj.exe	Lgokmgjm.exe
File created	C:\Windows\SysWOW64\Pcbmka32.exe	Pqdqof32.exe
File created	C:\Windows\SysWOW64\Pfaigm32.exe	Pcbmka32.exe
File created	C:\Windows\SysWOW64\Odpjcm32.exe	Onfbfc32.exe
File created	C:\Windows\SysWOW64\Ahmlgd32.exe	Adapgfqj.exe
File created	C:\Windows\SysWOW64\Jihdea32.dll	Edihepnm.exe
File created	C:\Windows\SysWOW64\Icplcpgo.exe	Ilidbbgl.exe
File created	C:\Windows\SysWOW64\Pcijeb32.exe	Ogbipa32.exe
File created	C:\Windows\SysWOW64\Fkopnh32.exe	Febgea32.exe
File created	C:\Windows\SysWOW64\Lejfpelg.dll	Hckjacjg.exe
File opened for modification	C:\Windows\SysWOW64\Ipbdmaah.exe	Iihkpg32.exe
File created	C:\Windows\SysWOW64\Nggjdc32.exe	Ndhmhh32.exe
File opened for modification	C:\Windows\SysWOW64\Ofqpqo32.exe	Ognpebpj.exe
File opened for modification	C:\Windows\SysWOW64\Qdbiedpa.exe	Qmkadgpo.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Ocgdji32.exe	Oqihnn32.exe
File opened for modification	C:\Windows\SysWOW64\Pnihcq32.exe	Pgopffec.exe
File opened for modification	C:\Windows\SysWOW64\Ldleel32.exe	Llemdo32.exe
File created	C:\Windows\SysWOW64\Cffdpghg.exe	Ceehho32.exe
File created	C:\Windows\SysWOW64\Agjhgngj.exe	Aeklkchg.exe
File created	C:\Windows\SysWOW64\Kmgdgjek.exe	Kgmlkp32.exe
File opened for modification	C:\Windows\SysWOW64\Kckbqpnj.exe	Kmnjhioc.exe
File created	C:\Windows\SysWOW64\Hmjfkopm.dll	Flceckoj.exe
File opened for modification	C:\Windows\SysWOW64\Jbeidl32.exe	Jcbihpel.exe
File created	C:\Windows\SysWOW64\Aoohalad.dll	Klgqcqkl.exe
File created	C:\Windows\SysWOW64\Donfhp32.dll	Ognpebpj.exe
File created	C:\Windows\SysWOW64\Pqdqof32.exe	Pnfdcjkg.exe
File created	C:\Windows\SysWOW64\Bdfibe32.exe	Bahmfj32.exe
File created	C:\Windows\SysWOW64\Mlcadgkl.dll	Docmgjhp.exe
File opened for modification	C:\Windows\SysWOW64\Imakkfdg.exe	Iejcji32.exe
File opened for modification	C:\Windows\SysWOW64\Ifllil32.exe	Ipbdmaah.exe
File created	C:\Windows\SysWOW64\Jiopcppf.dll	Jbeidl32.exe
File created	C:\Windows\SysWOW64\Kgldjcmk.dll	Qmkadgpo.exe
File created	C:\Windows\SysWOW64\Lhibca32.dll	Obidhaog.exe
File created	C:\Windows\SysWOW64\Adapgfqj.exe	Abpcon32.exe
File created	C:\Windows\SysWOW64\Gqckln32.dll	Olmeci32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Odnnnnfe.exe	Ondeac32.exe
File opened for modification	C:\Windows\SysWOW64\Pcjapi32.exe	Oqkdcn32.exe
File created	C:\Windows\SysWOW64\Dekhneap.exe	Doqpak32.exe
File opened for modification	C:\Windows\SysWOW64\Jcgbco32.exe	Jmmjgejj.exe
File created	C:\Windows\SysWOW64\Ngbpidjh.exe	Ndcdmikd.exe
File created	C:\Windows\SysWOW64\Cagobalc.exe	Cnicfe32.exe
File opened for modification	C:\Windows\SysWOW64\Ibjjhn32.exe	Ipknlb32.exe
File opened for modification	C:\Windows\SysWOW64\Ogkcpbam.exe	Oncofm32.exe
File created	C:\Windows\SysWOW64\Ndghmo32.exe	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Lcjakp32.dll	Ahhblemi.exe
File created	C:\Windows\SysWOW64\Flnlhk32.exe	Fdgdgnbm.exe
File created	C:\Windows\SysWOW64\Dndgjk32.dll	Ifllil32.exe
File opened for modification	C:\Windows\SysWOW64\Kfoafi32.exe	Kpeiioac.exe
File opened for modification	C:\Windows\SysWOW64\Klngdpdd.exe	Kmkfhc32.exe
File created	C:\Windows\SysWOW64\Ojgbfocc.exe	Oponmilc.exe
File created	C:\Windows\SysWOW64\Pgmcqggf.exe	Pengdk32.exe
File created	C:\Windows\SysWOW64\Qchmagie.exe	Qnkdhpjn.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10864	10660	WerFault.exe	528

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjkolmml.dll"	Fchddejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Llgjjnlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enoogcin.dll"	Hkikkeeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eokchkmi.dll"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjelcfha.dll"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cecbmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jmbdbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fhjfhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmjapi32.dll"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kkpnlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ahmlgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpjgop32.dll"	Eocenh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Faihkbci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jehokgge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akmfnc32.dll"	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlcadgkl.dll"	Docmgjhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Edihepnm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jcbihpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jbhfjljd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpbbmhgf.dll"	Behbag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lgokmgjm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ogpmjb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jheiojpj.dll"	Nggqoj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cbcilkjg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hfnphn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfhkicbi.dll"	Mplhql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bblckl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdqfah32.dll"	Clpgpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phaedfje.dll"	Jmhale32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkmgakaf.dll"	Odpjcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ojmcld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Obdkma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eekaebcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pcbmka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dekhneap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqqlehck.dll"	Hfifmnij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Immapg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcpnhfhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfggmg32.dll"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfbhfihj.dll"	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opfkao32.dll"	Clnjjpod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fchddejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lfhdlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eohipl32.dll"	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpcqcc32.dll"	Heocnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifjigbdo.dll"	Hcbpab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejnjpohk.dll"	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qloebdig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjqehkaf.dll"	Ddpeoafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffcnippo.dll"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajneip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jinpgcmg.dll"	Doqpak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocalcppo.dll"	Ekcpbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lejfpelg.dll"	Hckjacjg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 2752	3156	f9a75685e1632e57f3401678e16da4df36960f8e8a0f63dce8d586bd744306fa.exe	85
PID 3156 wrote to memory of 2752	3156	f9a75685e1632e57f3401678e16da4df36960f8e8a0f63dce8d586bd744306fa.exe	85
PID 3156 wrote to memory of 2752	3156	f9a75685e1632e57f3401678e16da4df36960f8e8a0f63dce8d586bd744306fa.exe	85
PID 2752 wrote to memory of 1888	2752	Jiikak32.exe	86
PID 2752 wrote to memory of 1888	2752	Jiikak32.exe	86
PID 2752 wrote to memory of 1888	2752	Jiikak32.exe	86
PID 1888 wrote to memory of 1568	1888	Kaqcbi32.exe	87
PID 1888 wrote to memory of 1568	1888	Kaqcbi32.exe	87
PID 1888 wrote to memory of 1568	1888	Kaqcbi32.exe	87
PID 1568 wrote to memory of 2956	1568	Kgmlkp32.exe	88
PID 1568 wrote to memory of 2956	1568	Kgmlkp32.exe	88
PID 1568 wrote to memory of 2956	1568	Kgmlkp32.exe	88
PID 2956 wrote to memory of 1580	2956	Kmgdgjek.exe	89
PID 2956 wrote to memory of 1580	2956	Kmgdgjek.exe	89
PID 2956 wrote to memory of 1580	2956	Kmgdgjek.exe	89
PID 1580 wrote to memory of 4080	1580	Kacphh32.exe	90
PID 1580 wrote to memory of 4080	1580	Kacphh32.exe	90
PID 1580 wrote to memory of 4080	1580	Kacphh32.exe	90
PID 4080 wrote to memory of 1012	4080	Kgphpo32.exe	91
PID 4080 wrote to memory of 1012	4080	Kgphpo32.exe	91
PID 4080 wrote to memory of 1012	4080	Kgphpo32.exe	91
PID 1012 wrote to memory of 2880	1012	Kinemkko.exe	92
PID 1012 wrote to memory of 2880	1012	Kinemkko.exe	92
PID 1012 wrote to memory of 2880	1012	Kinemkko.exe	92
PID 2880 wrote to memory of 1708	2880	Kaemnhla.exe	94
PID 2880 wrote to memory of 1708	2880	Kaemnhla.exe	94
PID 2880 wrote to memory of 1708	2880	Kaemnhla.exe	94
PID 1708 wrote to memory of 464	1708	Kbfiep32.exe	95
PID 1708 wrote to memory of 464	1708	Kbfiep32.exe	95
PID 1708 wrote to memory of 464	1708	Kbfiep32.exe	95
PID 464 wrote to memory of 2424	464	Kipabjil.exe	96
PID 464 wrote to memory of 2424	464	Kipabjil.exe	96
PID 464 wrote to memory of 2424	464	Kipabjil.exe	96
PID 2424 wrote to memory of 2668	2424	Kpjjod32.exe	97
PID 2424 wrote to memory of 2668	2424	Kpjjod32.exe	97
PID 2424 wrote to memory of 2668	2424	Kpjjod32.exe	97
PID 2668 wrote to memory of 4884	2668	Kkpnlm32.exe	98
PID 2668 wrote to memory of 4884	2668	Kkpnlm32.exe	98
PID 2668 wrote to memory of 4884	2668	Kkpnlm32.exe	98
PID 4884 wrote to memory of 1208	4884	Kmnjhioc.exe	100
PID 4884 wrote to memory of 1208	4884	Kmnjhioc.exe	100
PID 4884 wrote to memory of 1208	4884	Kmnjhioc.exe	100
PID 1208 wrote to memory of 4780	1208	Kckbqpnj.exe	101
PID 1208 wrote to memory of 4780	1208	Kckbqpnj.exe	101
PID 1208 wrote to memory of 4780	1208	Kckbqpnj.exe	101
PID 4780 wrote to memory of 5036	4780	Kkbkamnl.exe	103
PID 4780 wrote to memory of 5036	4780	Kkbkamnl.exe	103
PID 4780 wrote to memory of 5036	4780	Kkbkamnl.exe	103
PID 5036 wrote to memory of 3332	5036	Ldkojb32.exe	104
PID 5036 wrote to memory of 3332	5036	Ldkojb32.exe	104
PID 5036 wrote to memory of 3332	5036	Ldkojb32.exe	104
PID 3332 wrote to memory of 3952	3332	Lgikfn32.exe	105
PID 3332 wrote to memory of 3952	3332	Lgikfn32.exe	105
PID 3332 wrote to memory of 3952	3332	Lgikfn32.exe	105
PID 3952 wrote to memory of 5016	3952	Lmccchkn.exe	106
PID 3952 wrote to memory of 5016	3952	Lmccchkn.exe	106
PID 3952 wrote to memory of 5016	3952	Lmccchkn.exe	106
PID 5016 wrote to memory of 532	5016	Lcpllo32.exe	107
PID 5016 wrote to memory of 532	5016	Lcpllo32.exe	107
PID 5016 wrote to memory of 532	5016	Lcpllo32.exe	107
PID 532 wrote to memory of 2852	532	Lkgdml32.exe	108
PID 532 wrote to memory of 2852	532	Lkgdml32.exe	108
PID 532 wrote to memory of 2852	532	Lkgdml32.exe	108
PID 2852 wrote to memory of 4600	2852	Laalifad.exe	109

C:\Users\Admin\AppData\Local\Temp\f9a75685e1632e57f3401678e16da4df36960f8e8a0f63dce8d586bd744306fa.exe
"C:\Users\Admin\AppData\Local\Temp\f9a75685e1632e57f3401678e16da4df36960f8e8a0f63dce8d586bd744306fa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\Jiikak32.exe
  C:\Windows\system32\Jiikak32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\Kaqcbi32.exe
    C:\Windows\system32\Kaqcbi32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\Windows\SysWOW64\Kgmlkp32.exe
      C:\Windows\system32\Kgmlkp32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1568
    - - C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2956
      - C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4080
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1012
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2668
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1208
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:532
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        23⤵
        Executes dropped EXE
        
        PID:4600
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        24⤵
        Executes dropped EXE
        
        PID:4116
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        25⤵
        Executes dropped EXE
        
        PID:3280
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        26⤵
        Executes dropped EXE
        
        PID:3988
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2452
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4684
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4192
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        30⤵
        Executes dropped EXE
        
        PID:3180
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        31⤵
        Executes dropped EXE
        
        PID:4348
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        32⤵
        Executes dropped EXE
        
        PID:1664
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4056
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4536
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        35⤵
        Executes dropped EXE
        
        PID:3620
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        36⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1236
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        38⤵
        Executes dropped EXE
        
        PID:3640
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        39⤵
        Executes dropped EXE
        
        PID:3076
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        40⤵
        Executes dropped EXE
        
        PID:4292
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2488
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        42⤵
        Executes dropped EXE
        
        PID:3020
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        43⤵
        Executes dropped EXE
        
        PID:4544
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4552
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        45⤵
        Executes dropped EXE
        
        PID:1092
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        46⤵
        Executes dropped EXE
        
        PID:4336
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        47⤵
        Executes dropped EXE
        
        PID:2480
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4768
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:904
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        50⤵
        Executes dropped EXE
        
        PID:3776
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        51⤵
        Executes dropped EXE
        
        PID:4956
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        52⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2516
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        54⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        55⤵
        Executes dropped EXE
        
        PID:3520
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        56⤵
        Executes dropped EXE
        
        PID:1076
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4532
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4808
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        59⤵
        Executes dropped EXE
        
        PID:3692
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:804
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4016
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        62⤵
        Executes dropped EXE
        
        PID:1648
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        63⤵
        Executes dropped EXE
        
        PID:1308
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3068
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2528
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        66⤵
        Drops file in System32 directory
        
        PID:1596
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:996
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        68⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        69⤵
        Drops file in System32 directory
        
        PID:4424
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        70⤵
        Drops file in System32 directory
        
        PID:4604
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        71⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        72⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        73⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        74⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        75⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        76⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        77⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        78⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        79⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        80⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        81⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1576
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        83⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        84⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        85⤵
        
        PID:452
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        86⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        87⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        88⤵
        Drops file in System32 directory
        
        PID:3492
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        89⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1624
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        91⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        92⤵
        Drops file in System32 directory
        
        PID:4012
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        93⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        94⤵
        Modifies registry class
        
        PID:2908
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        95⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        96⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5204
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        98⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        99⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        100⤵
        Drops file in System32 directory
        
        PID:5332
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5376
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5416
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        103⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        104⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        105⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        106⤵
        Drops file in System32 directory
        
        PID:5596
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        107⤵
        Drops file in System32 directory
        
        PID:5636
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        108⤵
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        109⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        110⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        111⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        112⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        113⤵
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        114⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        115⤵
        Drops file in System32 directory
        
        PID:5980
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6020
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        117⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        118⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        119⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        120⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        121⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        122⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        123⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        124⤵
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        125⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        126⤵
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        127⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        128⤵
        Modifies registry class
        
        PID:5768
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        129⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        130⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5964
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        132⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        133⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        134⤵
        Modifies registry class
        
        PID:5164
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        135⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        136⤵
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        137⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        138⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        139⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        140⤵
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        141⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        142⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        143⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5228
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        144⤵
        Modifies registry class
        
        PID:5452
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        145⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        146⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5836
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        147⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        148⤵
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        149⤵
        Drops file in System32 directory
        
        PID:5352
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        150⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        151⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        152⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        153⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        154⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        155⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        156⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        157⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        158⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        159⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        160⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        161⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        162⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6464
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        163⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        164⤵
        Modifies registry class
        
        PID:6548
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        165⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        166⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6680
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        168⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6784
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        170⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6864
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        172⤵
        Modifies registry class
        
        PID:6912
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        173⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7004
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7060
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7116
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        177⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        178⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        179⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        180⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        181⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        182⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        183⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6676
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        185⤵
        Drops file in System32 directory
        
        PID:6760
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        186⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        187⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        188⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        189⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        190⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        191⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6380
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        193⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        194⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6716
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        196⤵
        Drops file in System32 directory
        
        PID:6904
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7000
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        198⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        199⤵
        Modifies registry class
        
        PID:6320
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        200⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        201⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        202⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        203⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        204⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        205⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        206⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6664
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        208⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        209⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        210⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        211⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        212⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        213⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7408
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        215⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        216⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        217⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        218⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7576
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        219⤵
        Modifies registry class
        
        PID:7620
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        220⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        221⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        222⤵
        Modifies registry class
        
        PID:7740
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        223⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7824
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        225⤵
        Modifies registry class
        
        PID:7860
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7912
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        227⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        228⤵
        Modifies registry class
        
        PID:7996
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8044
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8084
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        231⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        232⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        233⤵
        Drops file in System32 directory
        
        PID:7184
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        234⤵
        Modifies registry class
        
        PID:7244
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        235⤵
        Drops file in System32 directory
        
        PID:7316
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        236⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        237⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        238⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        239⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        240⤵
        Drops file in System32 directory
        
        PID:7652
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        241⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        242⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7848
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        244⤵
        Drops file in System32 directory
        
        PID:7936
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        245⤵
        Drops file in System32 directory
        
        PID:8012
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        246⤵
        Drops file in System32 directory
        
        PID:8072
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8156
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        248⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        249⤵
        Modifies registry class
        
        PID:7400
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        250⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7516
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        251⤵
        Drops file in System32 directory
        
        PID:7604
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        252⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        253⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        254⤵
        Modifies registry class
        
        PID:7944
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        255⤵
        Drops file in System32 directory
        
        PID:8076
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7548
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        257⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        258⤵
        Modifies registry class
        
        PID:7564
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        259⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        260⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        261⤵
        Modifies registry class
        
        PID:8120
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7424
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        263⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8068
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        265⤵
        Drops file in System32 directory
        
        PID:7520
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        266⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        267⤵
        Drops file in System32 directory
        
        PID:8040
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        268⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8208
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        270⤵
        Modifies registry class
        
        PID:8252
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        271⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8336
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        273⤵
        Drops file in System32 directory
        
        PID:8376
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        274⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8464
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        276⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        277⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        278⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        279⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8684
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        281⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        282⤵
        Modifies registry class
        
        PID:8760
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        283⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8844
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        285⤵
        Drops file in System32 directory
        
        PID:8884
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        286⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        287⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        288⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        289⤵
        Modifies registry class
        
        PID:9056
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        290⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9132
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        292⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        293⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        294⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8248
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8316
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        296⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        297⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        298⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        299⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        300⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        301⤵
        Modifies registry class
        
        PID:8712
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        302⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        303⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        304⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        305⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        306⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        307⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        308⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        309⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        310⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        311⤵
        Modifies registry class
        
        PID:8452
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        312⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        313⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        314⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        315⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        316⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        317⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        318⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        319⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        320⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        321⤵
        Drops file in System32 directory
        
        PID:8752
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        322⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        323⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        324⤵
        Modifies registry class
        
        PID:8368
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        325⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8832
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        327⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        328⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:372
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9052
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        331⤵
        Modifies registry class
        
        PID:8344
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        332⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        333⤵
        Drops file in System32 directory
        
        PID:8492
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4836
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        335⤵
        Drops file in System32 directory
        
        PID:9256
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        336⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9380
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        338⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        339⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        340⤵
        Drops file in System32 directory
        
        PID:9536
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        341⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        342⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        343⤵
        Modifies registry class
        
        PID:9684
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        344⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        345⤵
        Drops file in System32 directory
        
        PID:9768
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        346⤵
        Drops file in System32 directory
        
        PID:9812
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        347⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        348⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        349⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        350⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        351⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        352⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        353⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        354⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10204
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        356⤵
        Drops file in System32 directory
        
        PID:840
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        357⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9244
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        358⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9472
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        360⤵
        Drops file in System32 directory
        
        PID:9516
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        361⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        362⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        363⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        364⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        365⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        366⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        367⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        368⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        369⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        370⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        371⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        372⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9620
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        374⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        375⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8932
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        376⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10092
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        378⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        379⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        380⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        381⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        382⤵
        Modifies registry class
        
        PID:9952
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        383⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        384⤵
        Modifies registry class
        
        PID:10228
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        385⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        386⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        387⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        388⤵
        Modifies registry class
        
        PID:9788
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        389⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        390⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        391⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        392⤵
        Modifies registry class
        
        PID:10280
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        393⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10368
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10404
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        396⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        397⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        398⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        399⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        400⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        401⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        402⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        403⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        404⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        405⤵
        Drops file in System32 directory
        
        PID:10828
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        406⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        407⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10912
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        408⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        409⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        410⤵
        Drops file in System32 directory
        
        PID:11036
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        411⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        412⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        413⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11208
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        415⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11248
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        416⤵
        Modifies registry class
        
        PID:10268
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        417⤵
        Modifies registry class
        
        PID:10312
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        418⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        419⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        420⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        421⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        422⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        423⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        424⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10856
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        426⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        427⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        428⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        429⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11116
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        430⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        431⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11244
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        432⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10448
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        434⤵
        Drops file in System32 directory
        
        PID:10560
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        435⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10660 -s 408
        436⤵
        Program crash
        
        PID:10864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 10660 -ip 10660
1⤵
PID:10820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
192KB

MD5
1f4ab8e9a7c4fd185dbff01756babbb7

SHA1
9443e22cfb8de7f0226d0412e63a98141df7d214

SHA256
f1dabd1b630858c1668efb8ff074d3541a75dab207048ebf03c7fd18daf22494

SHA512
f2d3f4942551e0456dafae0a6650d05994cb22596eff5f413a7a4a91d3873166b40e2bb22ff7233bef5ee114e0a2100a63163af0d92ec5da3dde5eb7a4d36833

Download Submit
C:\Windows\SysWOW64\Hfifmnij.exe

Filesize
192KB

MD5
c9b7a2cd717fd2fe464de5000975391c

SHA1
9d98e35bc1a3567b2b4ec6039d3e4fd719a09df3

SHA256
3d77ee536e6507838013d53d6c5a4787672ec4bff94f6880927e8ad0be111d50

SHA512
b3be47b3c8a5c5cc39cb5aa6f461c110d4cc1f6809f44238aa0ce14c42504a09a189bcfb3f49ece62feeea17a3da62fa6eef29df5e5efd6b99fcece96a36950d

Download Submit
C:\Windows\SysWOW64\Ippggbck.exe

Filesize
192KB

MD5
21c7bebeaff57c0378c1158a8867937f

SHA1
758963b0353c5ef223625558a691316c0a385bbb

SHA256
77823224c8017333487d85b0e6a7ed6895f149c19802e65383a45ca8cc66d719

SHA512
70dc8cf08cc330c404c2e01afe7817c45e24edcdbd929d7f24859b2195f7cec7abf769ef738f4cf281857ffe3b24b0c3f49a44a828d592f9c0cfd6f0eb63c3eb

Download Submit
C:\Windows\SysWOW64\Jiikak32.exe

Filesize
192KB

MD5
343d305bebfa570f270205aa0f7be336

SHA1
ae45e75b495c9d4339b5ad4b00a2d36153f65ec1

SHA256
263652a9dd71a3f19f13b3fa18826edc628972a5e2b894d98def00d10505a9d9

SHA512
ab6bc3fc60f89b7589474eeb67c248dfbd43b7066ae3315b202ce7586e49722f952f1b3472d7b53d2a7fb42b877851a17b354fd54b3d564b77d61e9f551ed646

Download Submit
C:\Windows\SysWOW64\Jjblgaie.dll

Filesize
7KB

MD5
98c06aee4abfe477f38e0495739a15f3

SHA1
1fa20a16ef8b2c233123bd719ce56cac51b1daf1

SHA256
373f91d4dec0c07860fe72c2de1766e210fbe85704a10256ce906c3ab053240c

SHA512
42f4d0d9cabd9c40483479c356fb59cdbb05708c312c0958eb31d29148007349c84cc526a3db03396b55199d4ce7d3c7295c6a68c06d8237c09526a5950be003

Download Submit
C:\Windows\SysWOW64\Kacphh32.exe

Filesize
192KB

MD5
f454614e4889f80c3263a520e17b7e96

SHA1
9fc9c93b1aedacd2aa092dd64145b2c1fcd95c9b

SHA256
40e7c16c6d530bcf8e77c8237fa24e0c73b852bf9f2d505291048f96c0f85efb

SHA512
f510237f62e88b4b257c893a2c2e29ef653a709595c6d46a0691f429ac63eeab2852225b87791bbc56553249a89b9b8077fb45453ba2f5516ad117f8e930b55a

Download Submit
C:\Windows\SysWOW64\Kaemnhla.exe

Filesize
192KB

MD5
a948b7122595a02c069975680f450b2b

SHA1
1d708c788cc9269e4e3c219f622b88b6884dfc74

SHA256
bc680af519b8fdcf7120ee01e13a4b011c80b6e97a283ab87536e36e5ed8c99f

SHA512
3d145d6f00d7ee3a4e5a982db2e8cd05659e0e35640f5068110222aaf18ee0ea844ffc4c2a80ae3717c73b8b4c7570469eb81bfbc6cda027e9ec19925e844c4b

Download Submit
C:\Windows\SysWOW64\Kaqcbi32.exe

Filesize
192KB

MD5
023388ef7dfb5b263d9301fe47ae4697

SHA1
f2b45dcfc574025958c7e1d7217d08336e202c76

SHA256
80ebc1223509cb80498e994306b3f5bcc495feb3d5a0b3c054614a7da70f5529

SHA512
03c54b9a3b0111b37418e1221248621909635f36c4bb3b3949adb8b1ddb097638acd88d9e7b37f0be7ca82050e5b894413e485ef4b517cec1aad596ff15edcbe

Download Submit
C:\Windows\SysWOW64\Kbfiep32.exe

Filesize
192KB

MD5
51a5c6b67d66d0bb7d12019fdad75b7a

SHA1
413069f78a8b60a2f736fb0e559c505eaf999635

SHA256
27f5e182c397618162ddd4fb7e80b805bdea259b135b40e5d3b25e63ef321f9a

SHA512
3bb21fb1d9a76632341ed1829d4c4df708b5f6b3fb1505b56e574ff92b60a1c2b471807a73ddfb78f5358a9ffcbbf73bb2845b78b2a56a8117620fe10c93d667

Download Submit
C:\Windows\SysWOW64\Kckbqpnj.exe

Filesize
192KB

MD5
92cc8d908578af435d55f7c922345289

SHA1
e62bdd57569d363b58e1380864a9327fa5676e47

SHA256
5929370e2428d0af8ad1e49ef823d395e759749ddd5c961f39b75e1d076c53e9

SHA512
6571615100f7d421e937abb080547787a07f13051a8cd19863e27a9da29d4e05b10d85413c18ca2513b7334c77e7023b6db8a7814b7fcc8e83e337d6009bddf3

Download Submit
C:\Windows\SysWOW64\Kgmlkp32.exe

Filesize
192KB

MD5
bbd02b73a261239d6b9a299bd4d67894

SHA1
2bc9798ec21d9827a0f4ec6eb288cb9815058335

SHA256
ef89efa2d1d1ae8de0ce6956a889f85c9eaa224df7b920007f1a5a48d3badf2f

SHA512
c33ed9f9147441b4868b453cd344c95b3eeb55671546c8f3139b7b92f8a1ce87b2d7b570ef29c7f3f34e0a7389512b05d94b2e2c08561584a91f80228233433c

Download Submit
C:\Windows\SysWOW64\Kgphpo32.exe

Filesize
192KB

MD5
42c39d98c1d37a64b162323d577e647e

SHA1
6884c080369a3e3888e2f93c66fa075c066d0a7f

SHA256
84838952c6b7393eb61801dcda1de19cdc81f04a67244477ed6010ec62808c6a

SHA512
486964243fa8bdfafffa878532db529349509f823bb9d91bde6558efcb52946332a20732e9dd10328b463faa64fe22d13b25bc8038db1c4c0be6c17299949553

Download Submit
C:\Windows\SysWOW64\Kiidgeki.exe

Filesize
192KB

MD5
da2f8a5245825063f26f6c50edb089c0

SHA1
af0784b07c16de962fd194f0b215aea14a35e679

SHA256
939b1c04c6caa3bdd0cf18724e901062def622375bc710e67f9c6476ad87826c

SHA512
a0167f5db57e28f91349b8fa591159acb9d41f791abf3c1deb8bc0c4e309e12804cacc091ec2b63408ccf81d2938049dd037000ef3443bf6927eca39517135af

Download Submit
C:\Windows\SysWOW64\Kinemkko.exe

Filesize
192KB

MD5
fd5fd6e165c25b49c781efc4d1915e05

SHA1
453dcc69681b65dac2270cce5a2be6f9d89bbbf7

SHA256
f6353572e23a2df2efa167553738947e2c8d2c6286bdef114461125c147c27d7

SHA512
ec8bb342e899fd49981d1e6b6f85a998d4f6c6b9910a69efe326f54abbbecb7723949338c1b1d830b66df9b51bc0768679f6e72681301cca7ee1f7cab818d40c

Download Submit
C:\Windows\SysWOW64\Kipabjil.exe

Filesize
192KB

MD5
c86a83ffc0698a365020d9b14a61cca2

SHA1
8d505a69b5ab923d00921b2f5c30748bf35d5b53

SHA256
607ca757563cff07a9ee0ee7077c675467739578c099cf0a45ac9e57b7429a55

SHA512
e4ee68eb170d28cd4925f98f51bbb230922df229f8ebb37856104c3b95e91f96511191b719d7ab90163d05b21fb073b87ad482feae5ec85f31655690a2aafa7a

Download Submit
C:\Windows\SysWOW64\Kkbkamnl.exe

Filesize
192KB

MD5
be8fecbec15864cd66cd2deb2e5fc12c

SHA1
96e5df0f6f93bcb3f617d714c834aa5458703c0d

SHA256
de1d00e574b0cbe8cb32e65aee2902725d5ea9740378fb5a74c6d50cacac083c

SHA512
6c85479778844ff6076dcd0fc1c007cb010d37a20c6ad74be0843aa01ceb49f42eb6d1ecbbd56ebbbfd4e700a16cafba41d94d70e5fac0d33543e32082435511

Download Submit
C:\Windows\SysWOW64\Kkpnlm32.exe

Filesize
192KB

MD5
c835c1321afacb8c5c62965f55373300

SHA1
4b0c1c50145a49eea96cf70c18a3d825ad03ac5a

SHA256
bda7d674456f14d3f758b0b05eed917a71ca67f51cb85161f303be0f8c7d4d2d

SHA512
25669dfc48e524d6dab39669965b85b17eb4287df1aa9314d089ac1e4e86bb9fa6f38e6fc54ddf09df7788dedd9b1f833d11a48699369ef108652a5a2ed08603

Download Submit
C:\Windows\SysWOW64\Kmgdgjek.exe

Filesize
192KB

MD5
0f8955e6ac6947fd9eea1e170f479d52

SHA1
12ae7eb9bb1d192e71455dd1675bcef7d0f07a09

SHA256
a39c1879d1330a46aac8c0c09b76f52546c19e6faf1822de0b80dd9abfbc2e99

SHA512
356c72b3f4843e6b213de4674b05350da1d1dd6e9bb8fb610741527c1e18315b4ff4f1f62bf3df10916ef0e17138b9bd26f76f6ad50847ed97b9692187589b83

Download Submit
C:\Windows\SysWOW64\Kmnjhioc.exe

Filesize
192KB

MD5
9fc7e84aeb96bb1ac50980abe95cc95c

SHA1
8fe4f52e4a710d292ac5f87cf5ae620643fc0937

SHA256
ffd04349df8d212bbfc3b3793882a494f2900142aca198be605783f3a63376ed

SHA512
7e78b747c99c85d3f5638d984446c7d198a5b7aa4559c2e4d2f5528edf3020fcdf232e70be23f1790d33efdc1b0396a690573bd5bb3ac0baac3ebe1a53777f89

Download Submit
C:\Windows\SysWOW64\Kpeiioac.exe

Filesize
192KB

MD5
814f6f0e6617376270d4dae1e3f1f1e4

SHA1
9374d7af7c1a67df77bdae1d1a569d0d003be9b2

SHA256
1d1a89ed53b3d9c6f668c36fbf2d5cc3b07d5c9864de4d71c7beeed2f74027ec

SHA512
4f5561d65cef301085f9054500d256f33ad050eff782b6fa637f122822870b8eb1ab162ddcd79ede7f38ea9e718ddf90f873e3c093e8fa2a90e6e28744b0314d

Download Submit
C:\Windows\SysWOW64\Kpjjod32.exe

Filesize
192KB

MD5
bfd20fc8142f3801d79ebc413a29957a

SHA1
da64d3dbf3398567b3531b1314918de62d3f1fba

SHA256
5d71b9ed1279959f5fb4fb7aa0c04ed1e3ecf9100d0ac4f87eabeb977d25fb22

SHA512
91e27cc71ca7e849c21cc390f8b3c537083477d485f5633921e71c2fc03ddefed2e21a15dafdc15f584a981c9d3ce961cfd4d21f9b53f27589ed45449061f9c1

Download Submit
C:\Windows\SysWOW64\Laalifad.exe

Filesize
192KB

MD5
e760931b6b39e6fc426374b1ee97503f

SHA1
a38399825f309d4702507cae03011e0de32832fb

SHA256
6a2f476c6c99d2ac09aa3deaef8402e7bede2ba22dff8e74401a244f297396a1

SHA512
73ae81d2600eb6e49adc6a150423a6e866e4f0174117eab0be4da015d9d024fd321246f28ce59e27776dd6d15430522de2db86aac0f8458ffc707492590c245c

Download Submit
C:\Windows\SysWOW64\Laciofpa.exe

Filesize
192KB

MD5
2ed71f59636981708c23bcf57ae4c682

SHA1
385d0523e8b779062fa2932c6edf5d5c040d38c3

SHA256
89f0f82e7e76077323a3a9ce56ccaecdd7851ef89e38914117febe52b5fcb094

SHA512
9790f6ed9865ddef433d285e6e810049a20de4273d9bb0673b3ee365aea06e6d4069153def5fe356a0f293cbf4bb44be27bbc1dddfbb0633cbdd7c0d1a53fa6e

Download Submit
C:\Windows\SysWOW64\Laefdf32.exe

Filesize
192KB

MD5
dbe392330101f8dd65dfebc7d63fb074

SHA1
28a532e4643fd7f6928c53a72fd73f03832ddd22

SHA256
c1e60b08d3ee56966f2ac15cf204f9a7aa182650eb780dab1e7fb4789fde413f

SHA512
f728c21e61a2c8486e0c059228405cf54f45e42717dc6b3d6c6755df821adf02c2bb87a94dc672accd84d1ce5b0a55693598036bde606047e6fd941cd0febd8e

Download Submit
C:\Windows\SysWOW64\Lcbiao32.exe

Filesize
192KB

MD5
0e2155329f00aad60b825342e35cbfb7

SHA1
662a2c00741d16675c409473100d6c80376f112c

SHA256
458633bc4ba183e8f1ae8104ef494b1128615c51ea03552de252273dd122ac07

SHA512
2e779347ebf86b44c6766896dc5077d45faa159b1bb2fcdae23a30eccacb0593e7695c94ef318e9ca7b384efeeb511e54b52d087659d1157e270c485b44239ab

Download Submit
C:\Windows\SysWOW64\Lcpllo32.exe

Filesize
192KB

MD5
4112cac62f919d9d52342a667ddb73d1

SHA1
cfa06041646ec66ac72294c5492db7e225dc2a96

SHA256
362ff9cc5166a574d2d33cd9680ffd7e0cd1dae7bc60d2b7cd82192ac55e9ba4

SHA512
e2ef0b2bb39edd593016aa5be03f960aa37ce790cc71d64020cdec4739a9a6c4882e3c4306124ba70054b40c2716170ede6976cd565789780d41ee7862a680f8

Download Submit
C:\Windows\SysWOW64\Lddbqa32.exe

Filesize
192KB

MD5
a46c97c59004ab5d8e35dd12b691f4d0

SHA1
86a6e4a3078f89b2288e4c4e9e3c6376e2139bb8

SHA256
2f865700b49886ff069bb8d839c792da3d8a478784ea52f0f3e4be975dea9b7a

SHA512
8519318c98c95b8c64403eb940249217feb49c173c37436fcbf12424cb16274cffe6471ee8315a8a88339e233d6fab9aea40028e4842afc67cdc40314a8cb168

Download Submit
C:\Windows\SysWOW64\Ldkojb32.exe

Filesize
192KB

MD5
8de47ff515e60f07b14bc4bbbee7f3d4

SHA1
cc859bbcab1645a18a81b935382411db056885d8

SHA256
1c3a8166a16985bed499c83a76577cb8f48dbcf23a24910f884fe2d13ae1aab2

SHA512
3db1f9c046bd55859c9efe073c3bc171e61acb9898702fec523e6c45790faa8bd5dea1477bbe0fe900a59e5f20b6c3ec17e121784efdc471552dbf6d8e46063b

Download Submit
C:\Windows\SysWOW64\Lgikfn32.exe

Filesize
192KB

MD5
c5110af7e0d46c1545a57709dc9962d1

SHA1
3f2f5af8648f0bbaa35177712ecabfefbec55ea2

SHA256
995434536ca2a271d14c90e764895a644d39bbbd00a5c34482cf4d90b3bc33dd

SHA512
02bdf6aee4526e64cd9dd01774feb4c50743f8337461dca9ed2912de5c1da42520ca930701937191d72873ad2f77f7cd0f47f079cda5d4440ae3f4d8bbd9b021

Download Submit
C:\Windows\SysWOW64\Lilanioo.exe

Filesize
192KB

MD5
7ae6b918f23469cf9bca7811d9c2085f

SHA1
56c24620e555468b6fe0198026ea071bfd9ed69c

SHA256
840fe9d8c4c0a3e455d74eed03b4f16d4b7d4ecaf0b03ca774aa7b6d199ea0d2

SHA512
8ce7156735fd7cb0fbe454b3de0d0e0cfbc61937c6fd2eb3e4c22240c4a2310d6588b63ab93ce8f60f5e3391ba9de1eca3c2e07d38ec6973aa8aa63f9818be0a

Download Submit
C:\Windows\SysWOW64\Lkgdml32.exe

Filesize
192KB

MD5
33a5316720c5bc3cecaefcfcb8f2b6da

SHA1
a7a54936cb7778f825db07bbdf4af49f45cee1a2

SHA256
40cef42fc32c8eec7e465dc323f8c042156257b8befa4a9f20c219a21435532a

SHA512
5d4a648e3f870392af82e9f753b6a1fb6c16753183c8f441bcb8f38986f8ed862757a58c3d308b58f93dcdfe936b02cb372a77af1f72bff38a207cf27d160973

Download Submit
C:\Windows\SysWOW64\Lmccchkn.exe

Filesize
192KB

MD5
a1c1307403f46e886ffd10199b10f0ed

SHA1
c057a0aacebe388339d7133aab292768b5b26452

SHA256
6ab8ef4dbc6f05c775a738a414afd6587a7d385d8f2c9219642bac7a3cd56890

SHA512
a26fd926ffdf0b0f0138f1bbe172180fd9bcd0358e572148b372006bb65ece7507969e779011bb5c5847203254ab421160f41373d19672957db547758c146a98

Download Submit
C:\Windows\SysWOW64\Mdfofakp.exe

Filesize
192KB

MD5
ee721b02e660e5008f0082d01abe9fa3

SHA1
a034c317bc05811d45c2da9e9bcf32dfaa88632a

SHA256
1395ba7f730e98f079bf38cbd2108740671f016a5a36f0d6bad89dc244113750

SHA512
b1dfe3bdaa42b921750a2504dd0a36449ca5d1fefedc1a28262c5a535cf6d85fbc5e68a4b3fe4efcd95789fea33dc391373f0a9e2bcc32e03f510d16673e3938

Download Submit
C:\Windows\SysWOW64\Mdiklqhm.exe

Filesize
192KB

MD5
9178a4a4f03b58b14c5a85e7fad6a28f

SHA1
827e937b522061c1ebea6dd9f9faa8b1f949ae4f

SHA256
1fef19e961aadf91c5c9791e5678dfd8ee423b9c61955cb0408d29947162c279

SHA512
306cbb43b4c970052400b9bbbbe514f7f59101d1e9657c4f968a7498b209d58ae2c5ed3359121b7264e24dbb158f710e7b1239f612f5df1a7b0d83de32f6b058

Download Submit
C:\Windows\SysWOW64\Mkpgck32.exe

Filesize
192KB

MD5
8a51f35d26e16e1a02bd90b5f046d5b4

SHA1
2f1f24af7dd063aa60f62d097d2859c4ff10c0e2

SHA256
6d96dfbe36ab19e28ca19186dbb7bc922e3a6d3d0ce2032fd488606c9dac3d3b

SHA512
8e74109f37971a357aed6831334a9fd0f3d4970d473cd339e5d4915481a7ee0d740c770deede656379f97adb6be6edd0dc58dd5a2a5cd121c631f8e9f15d8452

Download Submit
C:\Windows\SysWOW64\Mnapdf32.exe

Filesize
192KB

MD5
0977cf6884bda0d347f809af88614a88

SHA1
5579af48b0c5f5aaa899ceb7e45238917219bf7a

SHA256
597e0f925e3a5ff32d25e9f14bd86e1c026c976ceeee92fe9eb379d6d145e35e

SHA512
7d164deaa51173cf3cc6e0822d16095f14c67f8d7e7762f11801bba981bd366b37e58dbcd308cb8769a400ed79c22d320ee8b5f38ccf3c41b22a60356c8d1ad2

Download Submit
C:\Windows\SysWOW64\Mncmjfmk.exe

Filesize
192KB

MD5
173c20c2cd2d06881da0a921e15945df

SHA1
075d74eee26314b27cbdbc9945a555a8a739289e

SHA256
340305f9918a3a19ced7e9704a2ecd9ac1d13e3f7a06fba1a213d9ebac6d9668

SHA512
cf090535c43e5bda5a8caad46824cf27c09c18fb4f395a3f19a0701d3c997df10e9c102d78a72f6abd207bb02006a239243f056d6d6acbbc0fb945ce8aab1299

Download Submit
C:\Windows\SysWOW64\Mnocof32.exe

Filesize
192KB

MD5
05c824302582e66354a4d3b049698f84

SHA1
8bac3124f0d4b2959dbb5c18f2a75b4dfa45fc40

SHA256
0b87c97d75baaa13041d9141e771be29c84955912a2dc1f7e653ffbd6215d8a3

SHA512
fb54d27da19db5921ad094c4461475d4c05465b526e180da9b684bf4cf6f4fe29fd28b63b9b84ff0e95007c913f1f78c57ec3fa928ed1d3d985b338744c96f80

Download Submit
C:\Windows\SysWOW64\Ndbnboqb.exe

Filesize
192KB

MD5
bcb53b98470bc7bf0d66c6b98ca45e6a

SHA1
2e09dfdf61024e67b9ae769b001ec5f001a0220c

SHA256
f138ad10f1f93da4e6c4b7bf4b6593d3aa756c2857307b5e66270f7d1c85b720

SHA512
4c516f83dcb4afba533e5af69e1bf022f88805e8f980012ea0d70d51a5ec189758ccb5347a2a3869e3f2fb76002dff2563964947bb802af1d22157dd672ec023

Download Submit
C:\Windows\SysWOW64\Pdmpje32.exe

Filesize
192KB

MD5
2bc7f778d0b73ef522f331ec83d9136b

SHA1
6137ab700395df2250365f0b4e3f42d1b571fcc2

SHA256
671e562cf8fcae73c1d002dd0ecd93fd94d874023dbd45677e06d2c53ffdd5fe

SHA512
67a78e47a383ac44062b1db39e127962e502dad82b799a1b8188676aeb5e5676539cca176e50a019de8731fb55eaeb387181c9ccf8f3747eff31e2c5b6a1a671

Download Submit
C:\Windows\SysWOW64\Pengdk32.exe

Filesize
192KB

MD5
d41bcd16c9080b9448801585b5169a10

SHA1
c24035df147069b278b30d5a9cf5dcd5a386f5f7

SHA256
3e56e7d87770600eb6ae0c535e8d586437e4bac8ab996f45736e5c0f6aa66386

SHA512
3e70a819fa8d647552617230f60825491706ed068c8f1d8cbd5260422758b255b0927d1ceb81cce73bdab98c15bdc4eabbdb3d22fea4200279a95db0ac300559

Download Submit
memory/464-80-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/532-159-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/804-418-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/904-352-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1012-56-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1076-394-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1092-328-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1208-112-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1236-280-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1308-436-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1568-23-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1580-39-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1648-430-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1664-247-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1708-72-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1888-15-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2424-88-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2452-208-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2480-344-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2488-304-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2516-380-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2668-95-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2752-12-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2852-172-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2880-64-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2956-36-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3020-310-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3068-442-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3076-292-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3104-382-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3156-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3180-236-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3280-191-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3332-136-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3520-388-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3620-279-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3640-290-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3692-415-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3776-362-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3952-144-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3988-204-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4016-424-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4056-260-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4080-48-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4116-184-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4192-228-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4292-298-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4332-374-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4336-338-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4348-244-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4532-400-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4536-267-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4544-319-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4552-322-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4600-180-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4684-215-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4768-351-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4780-119-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4808-406-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4884-104-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4956-364-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4988-273-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5016-152-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5036-132-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads