6299839c6e772ce68435ecfc95a43f0979b339b0134d37cc5a5314156c6980fa

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3372fb359cb971ef5578915ebd2f464_JaffaCakes118.exe
Size

72KB
MD5

f3372fb359cb971ef5578915ebd2f464
SHA1

0baf1a378670b558d19d1161124d0b0b426a77d4
SHA256

6299839c6e772ce68435ecfc95a43f0979b339b0134d37cc5a5314156c6980fa
SHA512

fc5c04b896adb30715b906de7813c6ba2dc54051869aabc037a61f1374191fdb0ded426b64442f7f1f35967ab347d1abefdd88994912d2a71ffe70c28d60b76a
SSDEEP

1536:DNCt3fSfzng/QOd0RxGDyLBtmzOgUEnmIU+GLkzTIcJGJZ9Jx301j/F95:DERfSfs/QOdAGuLBtmqgU6mIpGLkzTtf

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bdgged32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qpcecb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmdonkgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hkbdki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Knkekn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncofplba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndflak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aojefobm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lokdnjkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgphpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhbfff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpqodfij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohiemobf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnbnhedj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bidqko32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cadlbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lbinam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnkggfkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ohiemobf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Megljppl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Baadiiif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jofalmmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kelalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lppbkgcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Olckbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cidjbmcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ljnlecmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjlpjm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emkndc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnmopk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oljaccjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amodep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lankbigo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nopfpgip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Noehba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Inainbcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlpokp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jddnfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fneggdhg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipgbdbqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Npbceggm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phelcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bqmeal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjfjka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejlbhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfendmoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njiegl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jdnoplhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bdagpnbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gnfhfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agbkmijg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmjaphek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iafonaao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogjdmbil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkqkhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmgabcge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmadco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Flfkkhid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnkpnclp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agbkmijg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnaqgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Malgcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hienlpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kbmoen32.exe

Executes dropped EXE 64 IoCs

pid	Process
1996	Famjkl32.exe
2184	Fkeodaai.exe
856	Gekcaj32.exe
4676	Gglpibgm.exe
3596	Gnfhfl32.exe
4840	Gdppbfff.exe
4572	Gnhdkl32.exe
2504	Ggqida32.exe
4624	Gafmaj32.exe
3396	Gojnko32.exe
4720	Ggeboaob.exe
3792	Hnoklk32.exe
312	Hghoeqmp.exe
1464	Hbmcbime.exe
1824	Hnddgjbj.exe
4268	Hkhdqoac.exe
4384	Hdpiid32.exe
4940	Hofmfmhj.exe
4224	Hfpecg32.exe
1340	Iohjlmeg.exe
3896	Idebdcdo.exe
1808	Iokgal32.exe
380	Ifdonfka.exe
4824	Iomcgl32.exe
4576	Iiehpahb.exe
4696	Ioopml32.exe
3068	Ifihif32.exe
936	Indmnh32.exe
1240	Ienekbld.exe
1736	Jkhngl32.exe
4980	Jbbfdfkn.exe
1844	Jeqbpb32.exe
4408	Jkkjmlan.exe
4396	Jfpojead.exe
2552	Jgakbm32.exe
532	Jfbkpd32.exe
2680	Jgdhgmep.exe
1784	Jnnpdg32.exe
3800	Jehhaaci.exe
2468	Jnpmjf32.exe
1436	Jfgdkd32.exe
432	Jghabl32.exe
4288	Knbiofhg.exe
1036	Kelalp32.exe
408	Kgknhl32.exe
220	Kimghn32.exe
3052	Kbekqdjh.exe
824	Kechmoil.exe
4236	Kpiljh32.exe
1756	Kfcdfbqo.exe
4040	Llpmoiof.exe
3176	Lbjelc32.exe
1692	Lhfmdj32.exe
3384	Lnqeqd32.exe
1660	Lejnmncd.exe
2604	Lppbkgcj.exe
1960	Lhkgoiqe.exe
2544	Lbqklb32.exe
1312	Lhncdi32.exe
2084	Mhppji32.exe
4632	Mefmimif.exe
2516	Mplafeil.exe
4988	Mhgfkg32.exe
4776	Mekgdl32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kelalp32.exe	Knbiofhg.exe
File created	C:\Windows\SysWOW64\Phelcc32.exe	Pgdokkfg.exe
File opened for modification	C:\Windows\SysWOW64\Lelchgne.exe	Lbngllob.exe
File created	C:\Windows\SysWOW64\Ghndhd32.dll	Nnojho32.exe
File opened for modification	C:\Windows\SysWOW64\Kniieo32.exe	Kgopidgf.exe
File created	C:\Windows\SysWOW64\Phodcg32.exe	Oacoqnci.exe
File opened for modification	C:\Windows\SysWOW64\Kofkbk32.exe	Kpcjgnhb.exe
File created	C:\Windows\SysWOW64\Nchjdo32.exe	Npjnhc32.exe
File created	C:\Windows\SysWOW64\Kclgmq32.exe	Kmaopfjm.exe
File created	C:\Windows\SysWOW64\Badanigc.exe	Baadiiif.exe
File created	C:\Windows\SysWOW64\Hbmcbime.exe	Hghoeqmp.exe
File created	C:\Windows\SysWOW64\Fmgejhgn.exe	Fkihnmhj.exe
File opened for modification	C:\Windows\SysWOW64\Jbdlop32.exe	Jhlgfj32.exe
File created	C:\Windows\SysWOW64\Gdglhf32.dll	Nfaemp32.exe
File opened for modification	C:\Windows\SysWOW64\Oileggkb.exe	Ogmijllo.exe
File opened for modification	C:\Windows\SysWOW64\Hgiepjga.exe	Hdkidohn.exe
File created	C:\Windows\SysWOW64\Kdpmbc32.exe	Kmieae32.exe
File created	C:\Windows\SysWOW64\Kmeddp32.dll	Akepfpcl.exe
File opened for modification	C:\Windows\SysWOW64\Ggpbjkpl.exe	Gacjadad.exe
File opened for modification	C:\Windows\SysWOW64\Hgelek32.exe	Gpkchqdj.exe
File created	C:\Windows\SysWOW64\Dihlbf32.exe	Dbndfl32.exe
File created	C:\Windows\SysWOW64\Igchfiof.exe	Iddljmpc.exe
File opened for modification	C:\Windows\SysWOW64\Jdgafjpn.exe	Jbiejoaj.exe
File opened for modification	C:\Windows\SysWOW64\Fjadje32.exe	Fdglmkeg.exe
File created	C:\Windows\SysWOW64\Gedobm32.dll	Bmofagfp.exe
File opened for modification	C:\Windows\SysWOW64\Knhakh32.exe	Kdpmbc32.exe
File created	C:\Windows\SysWOW64\Ehighp32.dll	Ihbdplfi.exe
File created	C:\Windows\SysWOW64\Nacmdf32.exe	Njiegl32.exe
File opened for modification	C:\Windows\SysWOW64\Pkhjph32.exe	Phincl32.exe
File opened for modification	C:\Windows\SysWOW64\Fnlmhc32.exe	Fiodpl32.exe
File created	C:\Windows\SysWOW64\Ndoell32.dll	Gihgfk32.exe
File created	C:\Windows\SysWOW64\Lhncdi32.exe	Lbqklb32.exe
File opened for modification	C:\Windows\SysWOW64\Hgnoki32.exe	Hhknpmma.exe
File opened for modification	C:\Windows\SysWOW64\Dhphmj32.exe	Dafppp32.exe
File opened for modification	C:\Windows\SysWOW64\Bfchidda.exe	Boipmj32.exe
File opened for modification	C:\Windows\SysWOW64\Hnaqgd32.exe	Hkbdki32.exe
File created	C:\Windows\SysWOW64\Igpoaebh.dll	Phaahggp.exe
File created	C:\Windows\SysWOW64\Hlnjbedi.exe	Hmkigh32.exe
File created	C:\Windows\SysWOW64\Gbemad32.dll	Gijekg32.exe
File created	C:\Windows\SysWOW64\Ecgflaec.dll	Gigaka32.exe
File created	C:\Windows\SysWOW64\Eejeiocj.exe	Enpmld32.exe
File created	C:\Windows\SysWOW64\Ichqihli.dll	Aagkhd32.exe
File created	C:\Windows\SysWOW64\Afjeceml.exe	Aopmfk32.exe
File created	C:\Windows\SysWOW64\Mnmmboed.exe	Mjaabq32.exe
File created	C:\Windows\SysWOW64\Aagkhd32.exe	Afbgkl32.exe
File created	C:\Windows\SysWOW64\Olfghg32.exe	Oelolmnd.exe
File opened for modification	C:\Windows\SysWOW64\Gafmaj32.exe	Ggqida32.exe
File created	C:\Windows\SysWOW64\Nkpcjeml.dll	Dpqodfij.exe
File created	C:\Windows\SysWOW64\Embccf32.dll	Edmclccp.exe
File created	C:\Windows\SysWOW64\Pfhkccfn.dll	Jnpmjf32.exe
File created	C:\Windows\SysWOW64\Kkfkkmmp.dll	Fibojhim.exe
File created	C:\Windows\SysWOW64\Nlkngo32.exe	Nliaao32.exe
File created	C:\Windows\SysWOW64\Cfapoa32.dll	Bfbaonae.exe
File opened for modification	C:\Windows\SysWOW64\Jnpmjf32.exe	Jehhaaci.exe
File opened for modification	C:\Windows\SysWOW64\Dikpbl32.exe	Dhjckcgi.exe
File opened for modification	C:\Windows\SysWOW64\Ejflhm32.exe	Edmclccp.exe
File opened for modification	C:\Windows\SysWOW64\Ocohmc32.exe	Oclkgccf.exe
File created	C:\Windows\SysWOW64\Ibajgf32.dll	Cqpbglno.exe
File opened for modification	C:\Windows\SysWOW64\Njinmf32.exe	Ncofplba.exe
File opened for modification	C:\Windows\SysWOW64\Pmoiqneg.exe	Phaahggp.exe
File created	C:\Windows\SysWOW64\Anhejhfp.dll	Jiiicf32.exe
File created	C:\Windows\SysWOW64\Figfoijn.dll	Mjaabq32.exe
File created	C:\Windows\SysWOW64\Igdnabjh.exe	Iciaqc32.exe
File created	C:\Windows\SysWOW64\Hmfdddkc.dll	Famjkl32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1064	5344	WerFault.exe	728

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Migidc32.dll"	Ggpbjkpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jlfpdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpihol32.dll"	Fmlneg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kjkpoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iomcgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naqbda32.dll"	Bfchidda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Inainbcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dimenegi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ipoopgnf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aajohjon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fmgejhgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkbado32.dll"	Idahjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddgplado.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glokko32.dll"	Hnoklk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hnoklk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpnpfack.dll"	Dikpbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emmoafdl.dll"	Iddljmpc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ljdceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fmfgek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Opcqnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Biadeoce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjfjka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cceddf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mifljdjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iohjlmeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jqcdkk32.dll"	Kgknhl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lbjelc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdodhh32.dll"	Ogmijllo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nainbl32.dll"	Jfpojead.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Algpao32.dll"	Jnnpdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmdonkgc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iddljmpc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Phaahggp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Famjkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ccqkigkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dabhdinj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fjadje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddgplado.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Flfkkhid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njhgbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jehhaaci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Edopabqn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pkhjph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlqjei32.dll"	Fdqfll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpkefnho.dll"	Nmlddqem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Phodcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgdkgc32.dll"	Niooqcad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lkalplel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gnhdkl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jdgafjpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejhmqp32.dll"	Fllkqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcaihm32.dll"	Mlmbfqoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ebejfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gihgfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hminmc32.dll"	Lhkgoiqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ljkifn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Milidebi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oblmdhdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lkchelci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ogjdmbil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idfjphid.dll"	Fdkpma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jhndljll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpcblj32.dll"	Jcbdgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjcejfha.dll"	Fdcjlb32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 1996	4852	f3372fb359cb971ef5578915ebd2f464_JaffaCakes118.exe	86
PID 4852 wrote to memory of 1996	4852	f3372fb359cb971ef5578915ebd2f464_JaffaCakes118.exe	86
PID 4852 wrote to memory of 1996	4852	f3372fb359cb971ef5578915ebd2f464_JaffaCakes118.exe	86
PID 1996 wrote to memory of 2184	1996	Famjkl32.exe	87
PID 1996 wrote to memory of 2184	1996	Famjkl32.exe	87
PID 1996 wrote to memory of 2184	1996	Famjkl32.exe	87
PID 2184 wrote to memory of 856	2184	Fkeodaai.exe	89
PID 2184 wrote to memory of 856	2184	Fkeodaai.exe	89
PID 2184 wrote to memory of 856	2184	Fkeodaai.exe	89
PID 856 wrote to memory of 4676	856	Gekcaj32.exe	90
PID 856 wrote to memory of 4676	856	Gekcaj32.exe	90
PID 856 wrote to memory of 4676	856	Gekcaj32.exe	90
PID 4676 wrote to memory of 3596	4676	Gglpibgm.exe	91
PID 4676 wrote to memory of 3596	4676	Gglpibgm.exe	91
PID 4676 wrote to memory of 3596	4676	Gglpibgm.exe	91
PID 3596 wrote to memory of 4840	3596	Gnfhfl32.exe	92
PID 3596 wrote to memory of 4840	3596	Gnfhfl32.exe	92
PID 3596 wrote to memory of 4840	3596	Gnfhfl32.exe	92
PID 4840 wrote to memory of 4572	4840	Gdppbfff.exe	93
PID 4840 wrote to memory of 4572	4840	Gdppbfff.exe	93
PID 4840 wrote to memory of 4572	4840	Gdppbfff.exe	93
PID 4572 wrote to memory of 2504	4572	Gnhdkl32.exe	94
PID 4572 wrote to memory of 2504	4572	Gnhdkl32.exe	94
PID 4572 wrote to memory of 2504	4572	Gnhdkl32.exe	94
PID 2504 wrote to memory of 4624	2504	Ggqida32.exe	95
PID 2504 wrote to memory of 4624	2504	Ggqida32.exe	95
PID 2504 wrote to memory of 4624	2504	Ggqida32.exe	95
PID 4624 wrote to memory of 3396	4624	Gafmaj32.exe	96
PID 4624 wrote to memory of 3396	4624	Gafmaj32.exe	96
PID 4624 wrote to memory of 3396	4624	Gafmaj32.exe	96
PID 3396 wrote to memory of 4720	3396	Gojnko32.exe	97
PID 3396 wrote to memory of 4720	3396	Gojnko32.exe	97
PID 3396 wrote to memory of 4720	3396	Gojnko32.exe	97
PID 4720 wrote to memory of 3792	4720	Ggeboaob.exe	99
PID 4720 wrote to memory of 3792	4720	Ggeboaob.exe	99
PID 4720 wrote to memory of 3792	4720	Ggeboaob.exe	99
PID 3792 wrote to memory of 312	3792	Hnoklk32.exe	100
PID 3792 wrote to memory of 312	3792	Hnoklk32.exe	100
PID 3792 wrote to memory of 312	3792	Hnoklk32.exe	100
PID 312 wrote to memory of 1464	312	Hghoeqmp.exe	101
PID 312 wrote to memory of 1464	312	Hghoeqmp.exe	101
PID 312 wrote to memory of 1464	312	Hghoeqmp.exe	101
PID 1464 wrote to memory of 1824	1464	Hbmcbime.exe	102
PID 1464 wrote to memory of 1824	1464	Hbmcbime.exe	102
PID 1464 wrote to memory of 1824	1464	Hbmcbime.exe	102
PID 1824 wrote to memory of 4268	1824	Hnddgjbj.exe	103
PID 1824 wrote to memory of 4268	1824	Hnddgjbj.exe	103
PID 1824 wrote to memory of 4268	1824	Hnddgjbj.exe	103
PID 4268 wrote to memory of 4384	4268	Hkhdqoac.exe	104
PID 4268 wrote to memory of 4384	4268	Hkhdqoac.exe	104
PID 4268 wrote to memory of 4384	4268	Hkhdqoac.exe	104
PID 4384 wrote to memory of 4940	4384	Hdpiid32.exe	106
PID 4384 wrote to memory of 4940	4384	Hdpiid32.exe	106
PID 4384 wrote to memory of 4940	4384	Hdpiid32.exe	106
PID 4940 wrote to memory of 4224	4940	Hofmfmhj.exe	107
PID 4940 wrote to memory of 4224	4940	Hofmfmhj.exe	107
PID 4940 wrote to memory of 4224	4940	Hofmfmhj.exe	107
PID 4224 wrote to memory of 1340	4224	Hfpecg32.exe	108
PID 4224 wrote to memory of 1340	4224	Hfpecg32.exe	108
PID 4224 wrote to memory of 1340	4224	Hfpecg32.exe	108
PID 1340 wrote to memory of 3896	1340	Iohjlmeg.exe	109
PID 1340 wrote to memory of 3896	1340	Iohjlmeg.exe	109
PID 1340 wrote to memory of 3896	1340	Iohjlmeg.exe	109
PID 3896 wrote to memory of 1808	3896	Idebdcdo.exe	110

C:\Users\Admin\AppData\Local\Temp\f3372fb359cb971ef5578915ebd2f464_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3372fb359cb971ef5578915ebd2f464_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\Famjkl32.exe
  C:\Windows\system32\Famjkl32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\Fkeodaai.exe
    C:\Windows\system32\Fkeodaai.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Windows\SysWOW64\Gekcaj32.exe
      C:\Windows\system32\Gekcaj32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:856
    - - C:\Windows\SysWOW64\Gglpibgm.exe
        
        C:\Windows\system32\Gglpibgm.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4676
      - C:\Windows\SysWOW64\Gnfhfl32.exe
        
        C:\Windows\system32\Gnfhfl32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Windows\SysWOW64\Gdppbfff.exe
        
        C:\Windows\system32\Gdppbfff.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Windows\SysWOW64\Gnhdkl32.exe
        
        C:\Windows\system32\Gnhdkl32.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4572
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Windows\SysWOW64\Gafmaj32.exe
        
        C:\Windows\system32\Gafmaj32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3396
        
        C:\Windows\SysWOW64\Ggeboaob.exe
        
        C:\Windows\system32\Ggeboaob.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\SysWOW64\Hnoklk32.exe
        
        C:\Windows\system32\Hnoklk32.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Windows\SysWOW64\Hghoeqmp.exe
        
        C:\Windows\system32\Hghoeqmp.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:312
        
        C:\Windows\SysWOW64\Hbmcbime.exe
        
        C:\Windows\system32\Hbmcbime.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\SysWOW64\Hkhdqoac.exe
        
        C:\Windows\system32\Hkhdqoac.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\SysWOW64\Hdpiid32.exe
        
        C:\Windows\system32\Hdpiid32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\SysWOW64\Hfpecg32.exe
        
        C:\Windows\system32\Hfpecg32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4224
        
        C:\Windows\SysWOW64\Iohjlmeg.exe
        
        C:\Windows\system32\Iohjlmeg.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Windows\SysWOW64\Idebdcdo.exe
        
        C:\Windows\system32\Idebdcdo.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3896
        
        C:\Windows\SysWOW64\Iokgal32.exe
        
        C:\Windows\system32\Iokgal32.exe
        23⤵
        Executes dropped EXE
        
        PID:1808
        
        C:\Windows\SysWOW64\Ifdonfka.exe
        
        C:\Windows\system32\Ifdonfka.exe
        24⤵
        Executes dropped EXE
        
        PID:380
        
        C:\Windows\SysWOW64\Iomcgl32.exe
        
        C:\Windows\system32\Iomcgl32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Iiehpahb.exe
        
        C:\Windows\system32\Iiehpahb.exe
        26⤵
        Executes dropped EXE
        
        PID:4576
        
        C:\Windows\SysWOW64\Ioopml32.exe
        
        C:\Windows\system32\Ioopml32.exe
        27⤵
        Executes dropped EXE
        
        PID:4696
        
        C:\Windows\SysWOW64\Ifihif32.exe
        
        C:\Windows\system32\Ifihif32.exe
        28⤵
        Executes dropped EXE
        
        PID:3068
        
        C:\Windows\SysWOW64\Indmnh32.exe
        
        C:\Windows\system32\Indmnh32.exe
        29⤵
        Executes dropped EXE
        
        PID:936
        
        C:\Windows\SysWOW64\Ienekbld.exe
        
        C:\Windows\system32\Ienekbld.exe
        30⤵
        Executes dropped EXE
        
        PID:1240
        
        C:\Windows\SysWOW64\Jkhngl32.exe
        
        C:\Windows\system32\Jkhngl32.exe
        31⤵
        Executes dropped EXE
        
        PID:1736
        
        C:\Windows\SysWOW64\Jbbfdfkn.exe
        
        C:\Windows\system32\Jbbfdfkn.exe
        32⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        33⤵
        Executes dropped EXE
        
        PID:1844
        
        C:\Windows\SysWOW64\Jkkjmlan.exe
        
        C:\Windows\system32\Jkkjmlan.exe
        34⤵
        Executes dropped EXE
        
        PID:4408
        
        C:\Windows\SysWOW64\Jfpojead.exe
        
        C:\Windows\system32\Jfpojead.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4396
        
        C:\Windows\SysWOW64\Jgakbm32.exe
        
        C:\Windows\system32\Jgakbm32.exe
        36⤵
        Executes dropped EXE
        
        PID:2552
        
        C:\Windows\SysWOW64\Jfbkpd32.exe
        
        C:\Windows\system32\Jfbkpd32.exe
        37⤵
        Executes dropped EXE
        
        PID:532
        
        C:\Windows\SysWOW64\Jgdhgmep.exe
        
        C:\Windows\system32\Jgdhgmep.exe
        38⤵
        Executes dropped EXE
        
        PID:2680
        
        C:\Windows\SysWOW64\Jnnpdg32.exe
        
        C:\Windows\system32\Jnnpdg32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1784
        
        C:\Windows\SysWOW64\Jehhaaci.exe
        
        C:\Windows\system32\Jehhaaci.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3800
        
        C:\Windows\SysWOW64\Jnpmjf32.exe
        
        C:\Windows\system32\Jnpmjf32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2468
        
        C:\Windows\SysWOW64\Jfgdkd32.exe
        
        C:\Windows\system32\Jfgdkd32.exe
        42⤵
        Executes dropped EXE
        
        PID:1436
        
        C:\Windows\SysWOW64\Jghabl32.exe
        
        C:\Windows\system32\Jghabl32.exe
        43⤵
        Executes dropped EXE
        
        PID:432
        
        C:\Windows\SysWOW64\Knbiofhg.exe
        
        C:\Windows\system32\Knbiofhg.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4288
        
        C:\Windows\SysWOW64\Kelalp32.exe
        
        C:\Windows\system32\Kelalp32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1036
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:408
        
        C:\Windows\SysWOW64\Kimghn32.exe
        
        C:\Windows\system32\Kimghn32.exe
        47⤵
        Executes dropped EXE
        
        PID:220
        
        C:\Windows\SysWOW64\Kbekqdjh.exe
        
        C:\Windows\system32\Kbekqdjh.exe
        48⤵
        Executes dropped EXE
        
        PID:3052
        
        C:\Windows\SysWOW64\Kechmoil.exe
        
        C:\Windows\system32\Kechmoil.exe
        49⤵
        Executes dropped EXE
        
        PID:824
        
        C:\Windows\SysWOW64\Kpiljh32.exe
        
        C:\Windows\system32\Kpiljh32.exe
        50⤵
        Executes dropped EXE
        
        PID:4236
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        51⤵
        Executes dropped EXE
        
        PID:1756
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        52⤵
        Executes dropped EXE
        
        PID:4040
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3176
        
        C:\Windows\SysWOW64\Lhfmdj32.exe
        
        C:\Windows\system32\Lhfmdj32.exe
        54⤵
        Executes dropped EXE
        
        PID:1692
        
        C:\Windows\SysWOW64\Lnqeqd32.exe
        
        C:\Windows\system32\Lnqeqd32.exe
        55⤵
        Executes dropped EXE
        
        PID:3384
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        56⤵
        Executes dropped EXE
        
        PID:1660
        
        C:\Windows\SysWOW64\Lppbkgcj.exe
        
        C:\Windows\system32\Lppbkgcj.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2604
        
        C:\Windows\SysWOW64\Lhkgoiqe.exe
        
        C:\Windows\system32\Lhkgoiqe.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1960
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2544
        
        C:\Windows\SysWOW64\Lhncdi32.exe
        
        C:\Windows\system32\Lhncdi32.exe
        60⤵
        Executes dropped EXE
        
        PID:1312
        
        C:\Windows\SysWOW64\Mhppji32.exe
        
        C:\Windows\system32\Mhppji32.exe
        61⤵
        Executes dropped EXE
        
        PID:2084
        
        C:\Windows\SysWOW64\Mefmimif.exe
        
        C:\Windows\system32\Mefmimif.exe
        62⤵
        Executes dropped EXE
        
        PID:4632
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        63⤵
        Executes dropped EXE
        
        PID:2516
        
        C:\Windows\SysWOW64\Mhgfkg32.exe
        
        C:\Windows\system32\Mhgfkg32.exe
        64⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Windows\SysWOW64\Mekgdl32.exe
        
        C:\Windows\system32\Mekgdl32.exe
        65⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\Niipjj32.exe
        
        C:\Windows\system32\Niipjj32.exe
        66⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\Noehba32.exe
        
        C:\Windows\system32\Noehba32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:760
        
        C:\Windows\SysWOW64\Ngmpcn32.exe
        
        C:\Windows\system32\Ngmpcn32.exe
        68⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        69⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        70⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\Niniei32.exe
        
        C:\Windows\system32\Niniei32.exe
        71⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        72⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Ncfmno32.exe
        
        C:\Windows\system32\Ncfmno32.exe
        73⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Nipekiep.exe
        
        C:\Windows\system32\Nipekiep.exe
        74⤵
        
        PID:412
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2968
        
        C:\Windows\SysWOW64\Npjnhc32.exe
        
        C:\Windows\system32\Npjnhc32.exe
        76⤵
        Drops file in System32 directory
        
        PID:548
        
        C:\Windows\SysWOW64\Nchjdo32.exe
        
        C:\Windows\system32\Nchjdo32.exe
        77⤵
        
        PID:428
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        78⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\Nplkmckj.exe
        
        C:\Windows\system32\Nplkmckj.exe
        79⤵
        
        PID:956
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        80⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        81⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Olckbd32.exe
        
        C:\Windows\system32\Olckbd32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4908
        
        C:\Windows\SysWOW64\Ooagno32.exe
        
        C:\Windows\system32\Ooagno32.exe
        83⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        84⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        85⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        86⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        87⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Oiihahme.exe
        
        C:\Windows\system32\Oiihahme.exe
        88⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        89⤵
        Modifies registry class
        
        PID:5228
        
        C:\Windows\SysWOW64\Ogmijllo.exe
        
        C:\Windows\system32\Ogmijllo.exe
        90⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        91⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Oljaccjf.exe
        
        C:\Windows\system32\Oljaccjf.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5360
        
        C:\Windows\SysWOW64\Oohnonij.exe
        
        C:\Windows\system32\Oohnonij.exe
        93⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Oebflhaf.exe
        
        C:\Windows\system32\Oebflhaf.exe
        94⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Ollnhb32.exe
        
        C:\Windows\system32\Ollnhb32.exe
        95⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        96⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Pjpobg32.exe
        
        C:\Windows\system32\Pjpobg32.exe
        97⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Ppjgoaoj.exe
        
        C:\Windows\system32\Ppjgoaoj.exe
        98⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        99⤵
        Drops file in System32 directory
        
        PID:5676
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5720
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        101⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Pfillg32.exe
        
        C:\Windows\system32\Pfillg32.exe
        102⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Phhhhc32.exe
        
        C:\Windows\system32\Phhhhc32.exe
        103⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        104⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Pflibgil.exe
        
        C:\Windows\system32\Pflibgil.exe
        105⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Pleaoa32.exe
        
        C:\Windows\system32\Pleaoa32.exe
        106⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Pcpikkge.exe
        
        C:\Windows\system32\Pcpikkge.exe
        107⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        108⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        109⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Plhnda32.exe
        
        C:\Windows\system32\Plhnda32.exe
        110⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        111⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Qjlnnemp.exe
        
        C:\Windows\system32\Qjlnnemp.exe
        112⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Qhonib32.exe
        
        C:\Windows\system32\Qhonib32.exe
        113⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Qoifflkg.exe
        
        C:\Windows\system32\Qoifflkg.exe
        114⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Qgpogili.exe
        
        C:\Windows\system32\Qgpogili.exe
        115⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Qjnkcekm.exe
        
        C:\Windows\system32\Qjnkcekm.exe
        116⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        117⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Aokcklid.exe
        
        C:\Windows\system32\Aokcklid.exe
        118⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5764
        
        C:\Windows\SysWOW64\Ajqgidij.exe
        
        C:\Windows\system32\Ajqgidij.exe
        120⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5908
        
        C:\Windows\SysWOW64\Aompak32.exe
        
        C:\Windows\system32\Aompak32.exe
        122⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Agdhbi32.exe
        
        C:\Windows\system32\Agdhbi32.exe
        123⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Ahfdjanb.exe
        
        C:\Windows\system32\Ahfdjanb.exe
        124⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Aopmfk32.exe
        
        C:\Windows\system32\Aopmfk32.exe
        125⤵
        Drops file in System32 directory
        
        PID:5208
        
        C:\Windows\SysWOW64\Afjeceml.exe
        
        C:\Windows\system32\Afjeceml.exe
        126⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Aihaoqlp.exe
        
        C:\Windows\system32\Aihaoqlp.exe
        127⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Aobilkcl.exe
        
        C:\Windows\system32\Aobilkcl.exe
        128⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Aflaie32.exe
        
        C:\Windows\system32\Aflaie32.exe
        129⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Aqaffn32.exe
        
        C:\Windows\system32\Aqaffn32.exe
        130⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Acpbbi32.exe
        
        C:\Windows\system32\Acpbbi32.exe
        131⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Ajjjocap.exe
        
        C:\Windows\system32\Ajjjocap.exe
        132⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Aimkjp32.exe
        
        C:\Windows\system32\Aimkjp32.exe
        133⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Bogcgj32.exe
        
        C:\Windows\system32\Bogcgj32.exe
        134⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Bfqkddfd.exe
        
        C:\Windows\system32\Bfqkddfd.exe
        135⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\Biogppeg.exe
        
        C:\Windows\system32\Biogppeg.exe
        136⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Boipmj32.exe
        
        C:\Windows\system32\Boipmj32.exe
        137⤵
        Drops file in System32 directory
        
        PID:5820
        
        C:\Windows\SysWOW64\Bfchidda.exe
        
        C:\Windows\system32\Bfchidda.exe
        138⤵
        Modifies registry class
        
        PID:5924
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        139⤵
        Modifies registry class
        
        PID:5196
        
        C:\Windows\SysWOW64\Bcghch32.exe
        
        C:\Windows\system32\Bcghch32.exe
        140⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Bfedoc32.exe
        
        C:\Windows\system32\Bfedoc32.exe
        141⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Bidqko32.exe
        
        C:\Windows\system32\Bidqko32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6000
        
        C:\Windows\SysWOW64\Bpnihiio.exe
        
        C:\Windows\system32\Bpnihiio.exe
        143⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\Bfhadc32.exe
        
        C:\Windows\system32\Bfhadc32.exe
        144⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\Bifmqo32.exe
        
        C:\Windows\system32\Bifmqo32.exe
        145⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Bqmeal32.exe
        
        C:\Windows\system32\Bqmeal32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3664
        
        C:\Windows\SysWOW64\Bclang32.exe
        
        C:\Windows\system32\Bclang32.exe
        147⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Cqpbglno.exe
        
        C:\Windows\system32\Cqpbglno.exe
        149⤵
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        150⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Ccqkigkp.exe
        
        C:\Windows\system32\Ccqkigkp.exe
        151⤵
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Cadlbk32.exe
        
        C:\Windows\system32\Cadlbk32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6248
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        153⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Caghhk32.exe
        
        C:\Windows\system32\Caghhk32.exe
        154⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        155⤵
        Modifies registry class
        
        PID:6376
        
        C:\Windows\SysWOW64\Cibmlmeb.exe
        
        C:\Windows\system32\Cibmlmeb.exe
        156⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        157⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Cgcmjd32.exe
        
        C:\Windows\system32\Cgcmjd32.exe
        158⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Cidjbmcp.exe
        
        C:\Windows\system32\Cidjbmcp.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6552
        
        C:\Windows\SysWOW64\Dcjnoece.exe
        
        C:\Windows\system32\Dcjnoece.exe
        160⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Dfhjkabi.exe
        
        C:\Windows\system32\Dfhjkabi.exe
        161⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        162⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Dpqodfij.exe
        
        C:\Windows\system32\Dpqodfij.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6748
        
        C:\Windows\SysWOW64\Dhhfedil.exe
        
        C:\Windows\system32\Dhhfedil.exe
        164⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Djfcaohp.exe
        
        C:\Windows\system32\Djfcaohp.exe
        165⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6888
        
        C:\Windows\SysWOW64\Dpckjfgg.exe
        
        C:\Windows\system32\Dpckjfgg.exe
        167⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Dhjckcgi.exe
        
        C:\Windows\system32\Dhjckcgi.exe
        168⤵
        Drops file in System32 directory
        
        PID:6976
        
        C:\Windows\SysWOW64\Dikpbl32.exe
        
        C:\Windows\system32\Dikpbl32.exe
        169⤵
        Modifies registry class
        
        PID:7016
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        170⤵
        Modifies registry class
        
        PID:7064
        
        C:\Windows\SysWOW64\Dhlpqc32.exe
        
        C:\Windows\system32\Dhlpqc32.exe
        171⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        172⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Ealkjh32.exe
        
        C:\Windows\system32\Ealkjh32.exe
        173⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        174⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Ejdocm32.exe
        
        C:\Windows\system32\Ejdocm32.exe
        175⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        176⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Edmclccp.exe
        
        C:\Windows\system32\Edmclccp.exe
        177⤵
        Drops file in System32 directory
        
        PID:6392
        
        C:\Windows\SysWOW64\Ejflhm32.exe
        
        C:\Windows\system32\Ejflhm32.exe
        178⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        179⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Edopabqn.exe
        
        C:\Windows\system32\Edopabqn.exe
        180⤵
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        181⤵
        Drops file in System32 directory
        
        PID:6628
        
        C:\Windows\SysWOW64\Fmgejhgn.exe
        
        C:\Windows\system32\Fmgejhgn.exe
        182⤵
        Modifies registry class
        
        PID:6756
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        183⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Fdamgb32.exe
        
        C:\Windows\system32\Fdamgb32.exe
        184⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        185⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7052
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        187⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        188⤵
        Modifies registry class
        
        PID:6168
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        189⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        190⤵
        Modifies registry class
        
        PID:5332
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        191⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Fdffbake.exe
        
        C:\Windows\system32\Fdffbake.exe
        192⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Fibojhim.exe
        
        C:\Windows\system32\Fibojhim.exe
        193⤵
        Drops file in System32 directory
        
        PID:6568
        
        C:\Windows\SysWOW64\Fmnkkg32.exe
        
        C:\Windows\system32\Fmnkkg32.exe
        194⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Fpmggb32.exe
        
        C:\Windows\system32\Fpmggb32.exe
        195⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Fhdohp32.exe
        
        C:\Windows\system32\Fhdohp32.exe
        196⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Fggocmhf.exe
        
        C:\Windows\system32\Fggocmhf.exe
        197⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        198⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        199⤵
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Ggilil32.exe
        
        C:\Windows\system32\Ggilil32.exe
        200⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        201⤵
        Drops file in System32 directory
        
        PID:6668
        
        C:\Windows\SysWOW64\Gpcmga32.exe
        
        C:\Windows\system32\Gpcmga32.exe
        202⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Ghkeio32.exe
        
        C:\Windows\system32\Ghkeio32.exe
        203⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        204⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        205⤵
        Drops file in System32 directory
        
        PID:6500
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        206⤵
        Modifies registry class
        
        PID:6492
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        207⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        208⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        209⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        210⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        211⤵
        Drops file in System32 directory
        
        PID:6972
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        212⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        213⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        214⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        215⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7284
        
        C:\Windows\SysWOW64\Hnaqgd32.exe
        
        C:\Windows\system32\Hnaqgd32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7332
        
        C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        218⤵
        Drops file in System32 directory
        
        PID:7376
        
        C:\Windows\SysWOW64\Hgiepjga.exe
        
        C:\Windows\system32\Hgiepjga.exe
        219⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Hjhalefe.exe
        
        C:\Windows\system32\Hjhalefe.exe
        220⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Hpbiip32.exe
        
        C:\Windows\system32\Hpbiip32.exe
        221⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        222⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Hpdfnolo.exe
        
        C:\Windows\system32\Hpdfnolo.exe
        223⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        224⤵
        Drops file in System32 directory
        
        PID:7656
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        225⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        226⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Hpfcdojl.exe
        
        C:\Windows\system32\Hpfcdojl.exe
        227⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        228⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Iafonaao.exe
        
        C:\Windows\system32\Iafonaao.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7892
        
        C:\Windows\SysWOW64\Iddljmpc.exe
        
        C:\Windows\system32\Iddljmpc.exe
        230⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7940
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        231⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Ijadbdoj.exe
        
        C:\Windows\system32\Ijadbdoj.exe
        232⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Inmpcc32.exe
        
        C:\Windows\system32\Inmpcc32.exe
        233⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Iqklon32.exe
        
        C:\Windows\system32\Iqklon32.exe
        234⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        235⤵
        Drops file in System32 directory
        
        PID:8160
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        236⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Iqmidndd.exe
        
        C:\Windows\system32\Iqmidndd.exe
        237⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7292
        
        C:\Windows\SysWOW64\Iqpfjnba.exe
        
        C:\Windows\system32\Iqpfjnba.exe
        239⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        240⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        241⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        242⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7640
        
        C:\Windows\SysWOW64\Jglklggl.exe
        
        C:\Windows\system32\Jglklggl.exe
        244⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Jjjghcfp.exe
        
        C:\Windows\system32\Jjjghcfp.exe
        245⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        246⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        247⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        248⤵
        Drops file in System32 directory
        
        PID:7976
        
        C:\Windows\SysWOW64\Jbdlop32.exe
        
        C:\Windows\system32\Jbdlop32.exe
        249⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        250⤵
        Modifies registry class
        
        PID:8108
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        251⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        252⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Jdedak32.exe
        
        C:\Windows\system32\Jdedak32.exe
        253⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        254⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Jjamia32.exe
        
        C:\Windows\system32\Jjamia32.exe
        255⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        256⤵
        Drops file in System32 directory
        
        PID:7564
        
        C:\Windows\SysWOW64\Jdgafjpn.exe
        
        C:\Windows\system32\Jdgafjpn.exe
        257⤵
        Modifies registry class
        
        PID:7624
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        258⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        259⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        260⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Kjffdalb.exe
        
        C:\Windows\system32\Kjffdalb.exe
        261⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Kbmoen32.exe
        
        C:\Windows\system32\Kbmoen32.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8100
        
        C:\Windows\SysWOW64\Kiggbhda.exe
        
        C:\Windows\system32\Kiggbhda.exe
        263⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        264⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        265⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Kgmcce32.exe
        
        C:\Windows\system32\Kgmcce32.exe
        266⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Kjkpoq32.exe
        
        C:\Windows\system32\Kjkpoq32.exe
        267⤵
        Modifies registry class
        
        PID:7756
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        268⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        269⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Kgopidgf.exe
        
        C:\Windows\system32\Kgopidgf.exe
        270⤵
        Drops file in System32 directory
        
        PID:7220
        
        C:\Windows\SysWOW64\Kniieo32.exe
        
        C:\Windows\system32\Kniieo32.exe
        271⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        272⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        273⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Knkekn32.exe
        
        C:\Windows\system32\Knkekn32.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7056
        
        C:\Windows\SysWOW64\Leenhhdn.exe
        
        C:\Windows\system32\Leenhhdn.exe
        275⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        276⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7752
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        278⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        279⤵
        Modifies registry class
        
        PID:7432
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8216
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        281⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        282⤵
        Drops file in System32 directory
        
        PID:8304
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        283⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        284⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        285⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        286⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        287⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        288⤵
        Modifies registry class
        
        PID:8572
        
        C:\Windows\SysWOW64\Milidebi.exe
        
        C:\Windows\system32\Milidebi.exe
        289⤵
        Modifies registry class
        
        PID:8616
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        290⤵
        Modifies registry class
        
        PID:8660
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        291⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8740
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        293⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Malgcg32.exe
        
        C:\Windows\system32\Malgcg32.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8828
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        295⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        296⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        297⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        298⤵
        Modifies registry class
        
        PID:8996
        
        C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        299⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        300⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Njiegl32.exe
        
        C:\Windows\system32\Njiegl32.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9120
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        302⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        303⤵
        Drops file in System32 directory
        
        PID:9204
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        304⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        305⤵
        Modifies registry class
        
        PID:8288
        
        C:\Windows\SysWOW64\Nkqkhk32.exe
        
        C:\Windows\system32\Nkqkhk32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8368
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        307⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        308⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        309⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        310⤵
        Modifies registry class
        
        PID:2644
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6784
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        312⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        313⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        314⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        315⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Pahpfc32.exe
        
        C:\Windows\system32\Pahpfc32.exe
        316⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        317⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        318⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Peieba32.exe
        
        C:\Windows\system32\Peieba32.exe
        319⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        320⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Pifnhpmi.exe
        
        C:\Windows\system32\Pifnhpmi.exe
        321⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        322⤵
        Drops file in System32 directory
        
        PID:8340
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        323⤵
        Modifies registry class
        
        PID:8488
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        324⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        325⤵
        
        PID:764
        
        C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        326⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        327⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Ahqddk32.exe
        
        C:\Windows\system32\Ahqddk32.exe
        328⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        329⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        330⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        331⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        332⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        333⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8656
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        335⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        336⤵
        Drops file in System32 directory
        
        PID:8940
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        337⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8312
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        339⤵
        Drops file in System32 directory
        
        PID:8560
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        340⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        341⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        342⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        343⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        344⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        345⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        346⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        347⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        348⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        349⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        350⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        351⤵
        Drops file in System32 directory
        
        PID:9348
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        352⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        353⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        354⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        355⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        356⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        357⤵
        Modifies registry class
        
        PID:9628
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        358⤵
        Modifies registry class
        
        PID:9676
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9712
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9760
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        361⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        362⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        363⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        364⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        365⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        366⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        367⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        368⤵
        Modifies registry class
        
        PID:10096
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        369⤵
        Modifies registry class
        
        PID:10136
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        370⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        371⤵
        Drops file in System32 directory
        
        PID:10236
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        372⤵
        Modifies registry class
        
        PID:9264
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        373⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        374⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        375⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        376⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        377⤵
        Drops file in System32 directory
        
        PID:9624
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        378⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        379⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9840
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        381⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        382⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        383⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        384⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        385⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        386⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        387⤵
        Modifies registry class
        
        PID:9416
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        388⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        389⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        390⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        391⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        392⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        393⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        394⤵
        Drops file in System32 directory
        
        PID:2556
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        395⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        396⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        397⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        398⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        399⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        400⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        401⤵
        Modifies registry class
        
        PID:9292
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        402⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        403⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        404⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        405⤵
        Modifies registry class
        
        PID:9288
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        406⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        407⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        408⤵
        Modifies registry class
        
        PID:9792
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        409⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9972
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        411⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        412⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        413⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        414⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        415⤵
        Drops file in System32 directory
        
        PID:10424
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        416⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        417⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        418⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        419⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        420⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        421⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        422⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        423⤵
        Drops file in System32 directory
        
        PID:10768
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        424⤵
        Drops file in System32 directory
        
        PID:10812
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        425⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        426⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        427⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        428⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        429⤵
        Modifies registry class
        
        PID:11024
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        430⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        431⤵
        Modifies registry class
        
        PID:11112
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        432⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11204
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        434⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        435⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        436⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        437⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        438⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        439⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        440⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10584
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        441⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        442⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        443⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10792
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        444⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        445⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10992
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11056
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        448⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        449⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        450⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        451⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        452⤵
        Modifies registry class
        
        PID:10436
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10544
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        454⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10776
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        456⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        457⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        458⤵
        Drops file in System32 directory
        
        PID:11092
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        459⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        460⤵
        Drops file in System32 directory
        
        PID:10172
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        461⤵
        Modifies registry class
        
        PID:10408
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        462⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        463⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10736
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        464⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        465⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        466⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10500
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        468⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        469⤵
        Modifies registry class
        
        PID:11036
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        470⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        471⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        472⤵
        Drops file in System32 directory
        
        PID:11200
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11048
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        474⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        475⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        476⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11316
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        477⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        478⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        479⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        480⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        481⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        482⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        483⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        484⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        485⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        486⤵
        Modifies registry class
        
        PID:11736
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        487⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        488⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        489⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11868
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        490⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        491⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        492⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        493⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        494⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        495⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        496⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        497⤵
        
        PID:12252
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        498⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        499⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        500⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        501⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        502⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        503⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        504⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        505⤵
        Drops file in System32 directory
        
        PID:11788
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        506⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        507⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        508⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        509⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        510⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        511⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        512⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11228
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        513⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11476
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        514⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        515⤵
        Modifies registry class
        
        PID:11772
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        516⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        517⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        518⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        519⤵
        Drops file in System32 directory
        
        PID:12096
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        520⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        521⤵
        
        PID:11472
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        522⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        523⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11768
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        524⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        525⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        526⤵
        Drops file in System32 directory
        
        PID:11408
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        527⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        528⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        529⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        530⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        531⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        532⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        533⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        534⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        535⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        536⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        537⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        538⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        539⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        540⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        541⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        542⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11804
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        543⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        544⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        545⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        546⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        547⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        548⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        549⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        550⤵
        Drops file in System32 directory
        
        PID:2884
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        551⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3828
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        552⤵
        
        PID:312
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        553⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        554⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        555⤵
        
        PID:672
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        556⤵
        
        PID:780
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        557⤵
        Drops file in System32 directory
        
        PID:4032
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        558⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        559⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        560⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        561⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4068
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        562⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12120
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        563⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        564⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        565⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        566⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        567⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        568⤵
        
        PID:720
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        569⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        570⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        571⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        572⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3052
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        573⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        574⤵
        Drops file in System32 directory
        
        PID:1436
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        575⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        576⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        577⤵
        
        PID:376
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        578⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        579⤵
        Drops file in System32 directory
        
        PID:11972
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        580⤵
        
        PID:1036
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        581⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1596
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        582⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        583⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        584⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        585⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3160
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        586⤵
        
        PID:12224
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        587⤵
        Modifies registry class
        
        PID:4360
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        588⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        589⤵
        
        PID:936
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        590⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        591⤵
        Drops file in System32 directory
        
        PID:4632
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        592⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        593⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        594⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        595⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        596⤵
        Drops file in System32 directory
        
        PID:2660
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        597⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        598⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2508
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        599⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        600⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        601⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        602⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        603⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5376
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        604⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        605⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        606⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        607⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4480
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        608⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        609⤵
        Drops file in System32 directory
        
        PID:2428
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        610⤵
        Drops file in System32 directory
        
        PID:5152
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        611⤵
        
        PID:824
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        612⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        613⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        614⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5592
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        615⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        616⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        617⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        618⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        619⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        620⤵
        
        PID:3804
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        621⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        622⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        623⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        624⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        625⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        626⤵
        Drops file in System32 directory
        
        PID:5568
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        627⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        628⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        629⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        630⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        631⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        632⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5344 -s 416
        633⤵
        Program crash
        
        PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5344 -ip 5344
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afgacokc.exe

Filesize
64KB

MD5
934b43178fd4bff2c5cdf6b14aefef95

SHA1
44eb5e3e5774a78148f1effe49278d9ef5cc1307

SHA256
dd79175129ab73c40a71c576374eed0bd9fe1d3e1bf0bcea93e8fd20b878eae4

SHA512
8d7d9d4f8d167c645a4f29b3e089e9d7fef3110251adfbc8cbe81588cf83ccb9c564c05d55bf128410b707a2e81425921c1f95dfbde2c3f5bdf4936a4a0c7c9e

Download Submit
C:\Windows\SysWOW64\Anaomkdb.exe

Filesize
72KB

MD5
879ab3cad2aa8e862db6fd69bddf7c3e

SHA1
86cb7c0c862be2664876648bcfb149bfb2ee5c25

SHA256
fe894c5256696ed1628b8ec706dcaeca0c4782f1ba645c6f98a5ffd5eddb77ea

SHA512
4e21295c8c06b3ba0bbf29988da071b8d1766d3f350c15bc7428fe14cbd0f63e57d934825a54491504b2fbcaaf781798a21362db394a445ce340e54436b8a9bf

Download Submit
C:\Windows\SysWOW64\Aojefobm.exe

Filesize
72KB

MD5
ba3860198478bdba3921a4da30d93dc0

SHA1
302f700aef883c9c05e61e9477d156a50fc67137

SHA256
daf49bbd9e63441b71e0a94c25de18897f881ce9244a697662a54c880cd8dccb

SHA512
a117ecf48a0702fdb6abf197ac3807cfe78204e99ce487f35a0faa91875949979946bad1e187f0823d28983d8a8219207e9334dbcab13482a52d198f82c8330b

Download Submit
C:\Windows\SysWOW64\Bdgged32.exe

Filesize
72KB

MD5
2a23a333374cf36f3f72463a0c6c6668

SHA1
2f6977098371655c192224bb823b3fe6a49c82dd

SHA256
c32b415b49c7167587002aaba19bcd88651ba14f6125c38977c6ea75f5c4a281

SHA512
aa86effb68aacecff768a67eb6ad6171e17e42b2179e5209864b39702d5acceb366d18f1b797d75f5fff5ecfad3ba8889c4a333b4c417ac53e1629ef9517ecb6

Download Submit
C:\Windows\SysWOW64\Bmlilh32.exe

Filesize
72KB

MD5
fb8d5fba636d3e8f185b5bd2a910a75a

SHA1
bc507ef485feea68c5f98a7ddbb137bdeabde4a4

SHA256
144236a7f118532b4b5d3873c324272020af7f9ec241eb4a16475ca935fd2939

SHA512
d8835098083a28b4ad4916afcf4f076f305a3e0ad24087b33c1e57b5120da6d05192dcf4fb9d03ba4e4e03811d94b5c6a859238e88818dc22f4343e8597a73b0

Download Submit
C:\Windows\SysWOW64\Cadlbk32.exe

Filesize
72KB

MD5
01d5675a8ba6ec335466261bec54f2a4

SHA1
f086ef9724cfb0bd3d532a631fc391346691f912

SHA256
c41d1a9037a7b82bee454409f2ab64fbb8c75b59d2a1731fb1f6ebbdc79388b2

SHA512
1b6c1a724930ea5abedae53f446ba281765e212471c9a2059f1d7d94e8f52cf9059346c70a640426ea7bb17ef31ff9ffb3830024ce092e566641d0a74c165cd4

Download Submit
C:\Windows\SysWOW64\Edmclccp.exe

Filesize
72KB

MD5
478936128ccf33dd823db99960f9ef5e

SHA1
60bc85c5b59fc607943fe8dca32c757e48c26ca2

SHA256
8d89c840d7e32fbf1e9a3284721efdc54bdb37fea7876608925e3c9759ff0b22

SHA512
36eaabe4b2feb24f9b3412dcebbcfe4ca9fb5d781cd45475d160012868ef7ba0530e488bd9cfdfd81d02b6da02b51bd51083d81576cb84abf17ca66d55ce5698

Download Submit
C:\Windows\SysWOW64\Famjkl32.exe

Filesize
72KB

MD5
e83794296a26e83dc6a4457d62105617

SHA1
094ba580f5dcea47041da70cc9f2e7971d2844be

SHA256
4b8c023570333cadd3d8ace2e4d010e377c683fc3ce8ec5cf71c8a7ea3623ca6

SHA512
0b41abb8212358180eec7504ee7aabe3826c3b9b6e1f1df031b6ae3da6bf488a6f5f9345c0ba7b6754d8a535a08837a9701b0a7ac24783cd95b8f5b55e3f3251

Download Submit
C:\Windows\SysWOW64\Fibhpbea.exe

Filesize
72KB

MD5
447d45ee81fbd38a39ee847637a47fca

SHA1
490e7a7148662ab04062dbdc2b269831a5ac2c07

SHA256
7f178bc8a5b8ce2bb37f4e13673e2d1d0fa07939ec87fb96d30a689f0335f0fd

SHA512
366908a4d8c3bc73575216bae1d046bdcbb8b4faccb6740bfcf3a7c6707cec4d3ed62b16fc9e16bb1d894c20ec57e8deeebe2e444a34d7843ed939647551dd6b

Download Submit
C:\Windows\SysWOW64\Fimhjl32.exe

Filesize
72KB

MD5
8670e0714ea9046bea452674f87d6928

SHA1
ae48071e6b6037ad9f43799d8b13941e2bd55a13

SHA256
826f091b03e08dfe383b2c9e8245a6f75eeeef99d417bb722429d83758278f8a

SHA512
959b24feebe8127e6bb2be5d735891e740c82c4cfeb323f7a82f3034d0d675218af8c578584d265dbc7b67f6a7135c205e897bd734f7151b23aa0f21e0882998

Download Submit
C:\Windows\SysWOW64\Fkeodaai.exe

Filesize
72KB

MD5
ad3da2679991588eedacd716469ca7a3

SHA1
77fa0e98799c2ddab39de2270542c25feccb5a91

SHA256
02f03a24ac8cec487cb3c51fcba1518acb37194dc101e15906d9e96369bc33a0

SHA512
2e4198fa17c19b3151a2ba6d5ec71bb579d156a1ed34768d40dcac94417fef4601a64c15c5953b32b6686454fb2c8768c8d64ea281d51e53a10d11d49bdba84d

Download Submit
C:\Windows\SysWOW64\Gafmaj32.exe

Filesize
72KB

MD5
de12ce9e2e4b927a2ecbb4de57123eab

SHA1
896d726f05df00ece019b8eee21a16da12f9338b

SHA256
3f49cfcf5724645f2602a8759cba7d73231de317f2abc989adc2f4bad7ecc5fb

SHA512
4237f58bf3e294a32bff81663da9b67dda9004dc747fc6cde79a33e0a2efbc3d3f02afb0bc14eb3c905c1a056445e03a897c59cd255fd148bb93fcc88be9a755

Download Submit
C:\Windows\SysWOW64\Gdppbfff.exe

Filesize
72KB

MD5
34586a066039b4260be7fd0c28ec33ba

SHA1
fa185b48aa6120ba5c7fedaf03d98cc396c17e4b

SHA256
57aa00c2d85e33e2ac5d6b51f9237a6c506595e1e62ce6199a6447616d137865

SHA512
77277ff8e87b1b79097ccd231bdfa28ca59abbb4e18f0b16f7691ec32b9b0c8aff487fa3d72936ffdc0785c8b6f3164017bf36f5472c6298438841124a2a1139

Download Submit
C:\Windows\SysWOW64\Gekcaj32.exe

Filesize
72KB

MD5
6eecc1ff6b329d4c6559337ec13ddafd

SHA1
9a5c4ad003644ac1333d26e02d5a94135485127f

SHA256
b6278d20f29f5cda89c01be05670dbea1c9b685bdd52935910c634446c763694

SHA512
35c1e753c15544b29eef50968a58acaad06cb273464b8153dc1877961ff06fe47e265ddc2b796951cc2ec3353c6e97e9fd9c30704719fad4bbf5f1caa897e6d8

Download Submit
C:\Windows\SysWOW64\Ggeboaob.exe

Filesize
72KB

MD5
e1a759631a04cdea2f6bb2a0717b2246

SHA1
294517cf7fec96b315c589dc667789aa1de76107

SHA256
2f17408d2731e3c77419c55b4d07d5a4c73036b6032666b820865a55125d64bc

SHA512
03a572e5ead43c3aba1234774c972199fe1738a5cdbf10f2149f3cbe5596d9d0d847d5975ca2b659aecef87588686bda6104f774fdb9cf855f44e1659b90e98c

Download Submit
C:\Windows\SysWOW64\Gglpibgm.exe

Filesize
72KB

MD5
5cd7fe5a5108b254e104ba79083dd5e7

SHA1
59d65753c45143d819d2afc01590b89776d4ab06

SHA256
e52df561ba459836ef190a80da02985f343579cd2de66c1d96c38c73a371f01c

SHA512
db21491050cff207fad21b89d7c208da11436bb736e1c2b381578c8c6c2700534159de6894da56f1e116908999fff042a0cd0a0983ae5e619d7742b4c60cb99c

Download Submit
C:\Windows\SysWOW64\Ggqida32.exe

Filesize
72KB

MD5
e9ef21b556a9550a5547557c83a56d7e

SHA1
c2b168ae345cfcd0f864ded7323c56359ac9b375

SHA256
c18e276e55467d136226d37fbc80d7bbe1e9fb48512f2e0fde1bf38a99dd63c6

SHA512
ac858036e261be1c4b7edc943fbd6a36c5d680ba15b974708055d6df67ce4ebf3565dbb87e78622712662bc08c0ab4575dd1b5c24abe89ef5cf294f70c13240e

Download Submit
C:\Windows\SysWOW64\Gnfhfl32.exe

Filesize
72KB

MD5
c1be947ecf00bcf986b681f49b81983d

SHA1
e83a2067999dadab462533f8b846c44526005394

SHA256
3260ee9ba272ebaf0222b5c2d759065ee6502ea3bea2df8b03c8a16c7ddd6800

SHA512
15ffd66149d6435a643df1f6f9080b472a5ec8754b6920711b1daf4e0997bf074e5afe6d04c2d7a27d7f7b902f94b20ae9631394ddcfa03bf2941b95f8ff87ea

Download Submit
C:\Windows\SysWOW64\Gnhdkl32.exe

Filesize
72KB

MD5
7de79ed04d1ea4713e22bb276556f414

SHA1
2426eb18920912f04291e39d0ba6eb13d470bdc7

SHA256
c475f33215e1292183f1d98c8309f9e74b5414c02bbe01ebfdce888ea3a8cc1a

SHA512
97893a3aa78fa23e51b8648e788c421fef5e14b791787d4f59800c10fbac3359f39e77ae37cd5e37bd0654dc9f55cff7eeb8473a7dccbf6f1d12496ad1915b4e

Download Submit
C:\Windows\SysWOW64\Gojnko32.exe

Filesize
72KB

MD5
503c182be185aa3ff779aa9d7a2e512b

SHA1
f55a1c1206307e3d6172614c7c4eacd711468bb2

SHA256
ccd6ced10e64525b5de314ea943a902f5de4ed7a4724ba2d65d4dfe77c1fe500

SHA512
689f3dd1e0aec012d7032c11ab1fca3cbca9446253da933272352376abd3ae5c4e342d44709e3a92fcd632c38d88568b14bef92c0b79e85ab3e7c94e062886d1

Download Submit
C:\Windows\SysWOW64\Hbmcbime.exe

Filesize
72KB

MD5
f20bc66cc2d114c9f2bb3c0b591e1eb8

SHA1
c335c4e3f82b410eb6f670378fdfcaace0a41819

SHA256
323708930512b970a9d83fc0e4b5dfdab2ec873e8522a73be2ec7351c4c287c2

SHA512
ace818a198a156a9ff8892ba1f56ec7a0070ce80cd487401ebcc0d1aef6dd2397fa39feac226b7b06385f7e4ea4320cc44730017ba9616e701297142b696b5f2

Download Submit
C:\Windows\SysWOW64\Hdpiid32.exe

Filesize
72KB

MD5
602ed684c0da7552b062f26596acce9e

SHA1
8634c16ecbe1cab87d19a17a5a1d45465c38a5b1

SHA256
34f16dd19051d718f7bc8db72f07622cb421cda755fbb484a36aa389a9ad1343

SHA512
0660452523e0a710ab7297eaa311c38ea0ecdc5d4a48281171304e4bb52ad730cd6b814139db250dd7df4164a0566e8756f49c0c1630e10eb06c13dcf8801d4b

Download Submit
C:\Windows\SysWOW64\Hfpecg32.exe

Filesize
72KB

MD5
3979e9d4d7f3c2632ae3ec91722b0936

SHA1
4f8035b99bdf93ccc41f28b9336a8922a7a3eddd

SHA256
bbe7597eb98650dc4c0870241f3f84073f3d2165653ed1258edf61bf2ef0963c

SHA512
01cdfd52136ec378e1bacf65e69c7b14544c7183daef48b1c10d2d2d6f948b0bd3dc6160bc46516bf04c9c53536705d73f9417035ccf5590c9ac25efed3bd693

Download Submit
C:\Windows\SysWOW64\Hghoeqmp.exe

Filesize
72KB

MD5
e71ebc1812eb8cebb199fd5c8315cb53

SHA1
d9674e8b846b0892ff2bd604eb8d3210820e7c7c

SHA256
2281520906071fbed08805d34b97e65d508e0794367cdb8ced082afede04bc70

SHA512
1b657d7b663ebcca7fdd07e10e569b5d1afa64bcd144276f5c7c0545fe4457c13d5f20d5f28182524f42ae56bedfae27f7349877f915a13652b9dbac1a9c373f

Download Submit
C:\Windows\SysWOW64\Hkhdqoac.exe

Filesize
72KB

MD5
26011d1daf407d89f3f49d0f0b6e4562

SHA1
47a380a69747cf953dcaba209ec6fc661ead37af

SHA256
a1811a70decd65f75939a9ef8ef060f6ecb1112897a08bda9ec65565d004079d

SHA512
edd21e7b229844d0eb9460a35b1e464b8e2b6d3782d5772063a800dc947cfe4a97a34ba888fe22d5dc4c96b3fc2d66982d0a5a563f6e9e37a7c94050ee7d2f2c

Download Submit
C:\Windows\SysWOW64\Hnddgjbj.exe

Filesize
72KB

MD5
827c091ba1cd9bcacf0e82980c358830

SHA1
347a27d9cf1362f49e20955a5b9de3664dcf827b

SHA256
8ebc17ce6c453429da8d3cd84a42f8e239f658fa6ce6a35e1cfefaceacab678c

SHA512
d50d1fb3b3034871d9c3a52b6c5075a0ef29431789626b988824f7f0eeeefd76f1b8e996c70e2d91053b943e738f1b28dc5ebcf8440c43f5dba82ef99192b418

Download Submit
C:\Windows\SysWOW64\Hnoklk32.exe

Filesize
72KB

MD5
ba6202408947df3e1391ebeecaf05bb9

SHA1
a903fbcef19340af36ebe9c27aafd53de8eb067a

SHA256
5d93035c6f9fa62c359b003c4b090f846b28b67bedd2cce1f28cb8a0ac2229d3

SHA512
f778255cd26824aa0326556820e24e3573a44dedf73f549a6fda4a2b0e9fbe17b782b1ebf796c5b952ae038ec5215f12d7b88e995e15a550fc0019bbc6aaa576

Download Submit
C:\Windows\SysWOW64\Hofmfmhj.exe

Filesize
72KB

MD5
a924a651edbf5c74af0cd771d2b74bb2

SHA1
b026a46a01be38960e278cb048d3d8d190cf3062

SHA256
37d3a4855f3faf6d686241456d0962a20b140bf968a72696f2cadef0ba4cd2a9

SHA512
0008b993e5ccd8fc2a234d8a64c84ee0bb9636eeff1fac39cfc8f1bd8fdcfd1a4e264d38d98949ec107b7328f37e1094758a5f21a4646b5bbf62b2f73d34bf8d

Download Submit
C:\Windows\SysWOW64\Idebdcdo.exe

Filesize
72KB

MD5
40a6d316cd4360b17441c7acc72e8b07

SHA1
4365e2bac76097d720f188e8be318c4f8b02263e

SHA256
db5ab77512b73266b4231fd7a5afca83a38227a562d6d95a10c1e66b6263676a

SHA512
96a067a5100c1769d92d42712a97e54556c31f1b0c55215a7a3ec02eae3dff487d4a6d36ef1ae8d8f459b22c5150616c7f78d534529badb9304ca30f2d3a644c

Download Submit
C:\Windows\SysWOW64\Ienekbld.exe

Filesize
72KB

MD5
9ba46ca0478aa06378387ef8f9d068b5

SHA1
02a279dfc3195baf1a8da4084b6cc11423560edc

SHA256
74f3a56abdb3f08827f7ebde351316b1cb373281e5fb3c847860ff463c6cec43

SHA512
e864843ebc7cdcd892a9684a8a0ceb6b686e195f7910d4067a611de11d7e849672c98e357bccd085c6b59ca5fe55ca176aaf8978fec1db0f0759d49ba0b69979

Download Submit
C:\Windows\SysWOW64\Ifdonfka.exe

Filesize
72KB

MD5
83ef00794e0ed5b9f292e66d1d2d905d

SHA1
f686786be8732be7198a410629b2321da1494e83

SHA256
cd805061629ef3d3f583982f1986419373f5228741b123b83c099bedd17c0faf

SHA512
a4a1ac615423aded600fc06253e4c19a64f3b83a16a038e9d4af8b6f6a4eb5978dc59471ddec1de7531b813ea7ce35f43b30486e07de309a5c6d7abe098fc94a

Download Submit
C:\Windows\SysWOW64\Ifihif32.exe

Filesize
72KB

MD5
0410775efeaecb0ddc1ef498b6f187ac

SHA1
f3ed4bce8ad023baf53cefb94e47aecd79daeb6d

SHA256
6f9200bd1c5d9ef0193ad83db0400c812b1a6147b78b6c0b79800eaed7a56829

SHA512
e35dfb2783c08191250b6d51905d381c4c44112a3d116072eeb63b227a69baecd1f96765f7c1d393589b28edec2309d7b85f61970875eca821f556b6398f2461

Download Submit
C:\Windows\SysWOW64\Iiehpahb.exe

Filesize
72KB

MD5
49d98fb4c63f6d115cd8b26fd9481bd2

SHA1
689e791114f13ea7963118279f7edcbd71a321a0

SHA256
924dc3580c1407ba50e13dd7eec9da122288dd30d3676ac179a4c8dfd2b496ea

SHA512
2493bd447ae5e1ea1bc83c1676698c5f7e2d2f63bbf978dcf6c72744682264b5b695d545068810d5eb189ddb70caf5278491526cba85615efd36b7c7b7356257

Download Submit
C:\Windows\SysWOW64\Indmnh32.exe

Filesize
72KB

MD5
a62e29c3a5933c55f66267721e243147

SHA1
bce9e14109c921df38edf141c5398a7b103e82c4

SHA256
14109d05b1ddcb4a9469e137b2c8007087e4e60657aeced73887bd5fe3d1b0ec

SHA512
aefc677792d94640cbfe20973c9ea021ca2857607f10561fe01b011b16a0c3dc82d069f80b06427ea31c4f6475acd031beeaade67d0d5ae0fd25905eb18c3754

Download Submit
C:\Windows\SysWOW64\Iohjlmeg.exe

Filesize
72KB

MD5
6c9aecca4367fd148455eac95a4d2b01

SHA1
e969b23ce168551ce975c083db4b40791b1a79a9

SHA256
c46168128e7777aeb4873c925f41e8db7157db3e3adb6385667fa6873fb216ec

SHA512
a31418a9b940f57f0ec2bf5d50c4554ed1db6f21a6453caa846c905d60d34a641848b9879847c2f190aac530d9401035538b7241c820cb55449ab99cc5536c39

Download Submit
C:\Windows\SysWOW64\Iokgal32.exe

Filesize
72KB

MD5
0d156e42d91d06724f8de9ebabc9c27b

SHA1
80ee8e1c1db7e700cca862971e9eb6677b338071

SHA256
a6308c7fc48a0f7ba19db08b357b36e5c408f55cd1061a649473fd94e3992863

SHA512
e973eca994077106c2d9259a51bc39fbb540676ef7dfac7877cba0a17586879a69ddd0ef5d21c1926f9f79f2b80794a6c707cc2f27eb8f152d2682d6aacf66c3

Download Submit
C:\Windows\SysWOW64\Iomcgl32.exe

Filesize
72KB

MD5
11b92a76f3ad78385fa391ac4b41ff7f

SHA1
a611fdee6092cdd2a93ec51d7292896688a0fab9

SHA256
c89c296ba1872838292cbe5ceb359d2060b5bc0d1a5f571d88d14ff963a0a9c1

SHA512
49259af799a2b0226a08d298de378a23c2873f6a8c9e71e3ff11b67725e201bf6e83b52782c0a6e066a5249454075497476a06ab80185fe9c4fb3b4c3ab41449

Download Submit
C:\Windows\SysWOW64\Ioopml32.exe

Filesize
72KB

MD5
5447db6588ddac98f37908fc5ab79712

SHA1
b5b1d5aebaff90979d7b488277620c5fae17e9ba

SHA256
bb9fe68078ffc9e0507a1a99e76258e7ae064559eddd754065eb2f7042721edf

SHA512
7e6c0b253d8ad487b71d2fc42ae0930b261661ed7b6386f9809adffe7c890a093935ffa8802386cfabb7e2fe706fa1573f100c7c6d022e91d9294f74ea2fdc09

Download Submit
C:\Windows\SysWOW64\Jbbfdfkn.exe

Filesize
72KB

MD5
11353b7c28a9a298eb828e290bd275c7

SHA1
d2d5e6e9294583650b3553eeedc1d5bc5406ad44

SHA256
bbfdb24b5e778ddc60b70794c377cff98f54930e5e7d0c214a517620d6f10e8c

SHA512
62a5007b13393d5e255a4b43b8444aff6a537529e0d618dc9438181680e4218f29f39c48d3675243ca8b083985d3b72f422550db06277681dfc8ed2217ce8c1d

Download Submit
C:\Windows\SysWOW64\Jeqbpb32.exe

Filesize
72KB

MD5
acade21e8e316516caf4b15ec64b55da

SHA1
fb76028e668947d5a5b25673067159707656231f

SHA256
af35570a7ca7d37ec2544557263e70d489bc9e06fbbcbb723a4cfa07a93cad86

SHA512
723c0155101e94d0af332bd04678aa27b3f574fb758cb813ee995bda1c1a95232a6c4675c0381cd2b3c47fdd7b9bab727ea9b023b0316f69fa594b387f67cb0d

Download Submit
C:\Windows\SysWOW64\Jkhngl32.exe

Filesize
72KB

MD5
2524d8a44c79272af15f791d50f34b8d

SHA1
faf5fc30e4fd940d26a580846a7100410d2f619f

SHA256
f764e67feb1ba3af64acee2498b370a70a2f868671fde16ba91e26050af50305

SHA512
e59c1424424c6a367f804163cf4975619b2157a8a931ccf66484543955b4fd138f9b83337025a72f610e43cd68ecbe6ea7e5d4e6566c6537617b2a4c9c080ca9

Download Submit
C:\Windows\SysWOW64\Knhakh32.exe

Filesize
72KB

MD5
950defa617afe8a74d8556c08ca36dd4

SHA1
e1910510b10b1535298122c9e2ff032ed2a5f785

SHA256
9ce4e98f1e230391161f80550ca19c883c9dadd1829c93505cd5f95a8865fcf4

SHA512
123df06f937db78f9b41fdeb20e7f2ee27de2654538cb4b2a3ccf882b02b0a4e3168fbfe66bb6225178837fde8c225bb6045aa91c54990c2bde62d22956d553c

Download Submit
C:\Windows\SysWOW64\Lejnmncd.exe

Filesize
72KB

MD5
9f40a39fb00c139bf7e234d095519258

SHA1
79302dfcf2dddaad2e320251c671fd34d23ac1ea

SHA256
af5cbf003d5547bb7f34fd048ed4897f30759bbd326599fa7175a45e3baa6857

SHA512
0775f1dfe31ddc4f1729d05032051402423bc0584366db73a309471c19c02871365b2a5825d979153a2d1592eae5d2ccbd25361ffa38c03439b8a110467c254e

Download Submit
C:\Windows\SysWOW64\Lghcocol.exe

Filesize
72KB

MD5
d28164d4e0476dbf8e9137b42ede71e9

SHA1
9d6954a50e882ada65ae1a5072109caca7623731

SHA256
1aa17806777a69767b3481f807ef95475443357ba85d20d2d1c7e66b1d06d555

SHA512
d58510ab70363379aa43df86c43f39c1e41a5cc3d9068d11664f7b8337301173da5c2eab3f3e703423fc50a38568bc2fcd7307d18d76ebf7942723d38f754585

Download Submit
C:\Windows\SysWOW64\Lklbdm32.exe

Filesize
72KB

MD5
5033e05ec13eb63a1aaede75327157c6

SHA1
9aa45fcf372f71c5ca77d42836098e72627ca4ed

SHA256
0f569a4f99abca223a0f6a6e35fe4958eaae6f3959232049b420b9cdd3d0bf97

SHA512
09e8d81bf77cd120e533b250dab46e4c6b07774e2a4571750b490631f16b508b87d29b6043489fd0bb2e2bdbec94c21207f4a0dda84b89c2dad98045f48f36fd

Download Submit
C:\Windows\SysWOW64\Lkofdbkj.exe

Filesize
72KB

MD5
b99147755a01554e88c139b39dbec074

SHA1
853554551fa323e42286d2c759628f1c368db68f

SHA256
041c35bb9e49102f3b3788addc9a3e33bd39457c2634e1ff9ef3379ed4693011

SHA512
413196bb21e9f67d4fe8dc9c05f776ee58868b5ebd6e899f4b36e4528428143f39abe5bd800e7b314b9005a0ae52254b3dd5564ec04abee1708b46748edd00cf

Download Submit
C:\Windows\SysWOW64\Lppbkgcj.exe

Filesize
72KB

MD5
17131fd57db90b3bbf9209e06a199a47

SHA1
eb0a265bd7ae46d28eb96e939840a979a9790a95

SHA256
34998f314a18db7182266ffe639cae3b0687d7dac99708466425fd5378599ab7

SHA512
94213790cd353841903e8d667f3c15652bf0ca0c030dd2ed6ad9c1d362cab02fc29e7464138537dcbf6cd535fef17cebd5bab79ed7a4dad5b09557ddf24dbf8a

Download Submit
C:\Windows\SysWOW64\Mhppji32.exe

Filesize
72KB

MD5
319aef3f8428dac0824663eacd2d1fb6

SHA1
4ba916e04b949c9c59604ab604c80ec0c95286a0

SHA256
1ded12387c8e347f60722708d1006d829a5950521921055fe17f4bd55418ad9d

SHA512
96f2b5abd3c3c86a699ecdf3758e53f67652a95151953d6fece514ebe7905d72deef9b5e36ac1f2c9a1dba06c509bb199de641af9ad6d5e60f221eadb61529b5

Download Submit
C:\Windows\SysWOW64\Objpoh32.exe

Filesize
72KB

MD5
fcb32271832d5791a6c8a9f45688497f

SHA1
6fd0bf2327826dcafd221dd0cb98f1579edfebca

SHA256
c1286259ad57907b8b17d1f17a076682e29c5c330f6bc9318e1f551b695873e2

SHA512
ce2b639f13aad67fc2d6a1b49f2f0380f86125fb4654a53096e7dfa2076f99e9595624628df198ecf50746547c4eeea5d693fbaa55ab7ed157a79cdc30212aea

Download Submit
C:\Windows\SysWOW64\Phaahggp.exe

Filesize
72KB

MD5
1b56692bdbc5608a68009ad2e039996b

SHA1
82fb520342521f7705398d3e9953518804f75c39

SHA256
68c6c6447c346a59f42dcad315049a14ea1debbe4901cffa59b5e75c33fd1598

SHA512
8bd7e3086aad6ee8c63a2516264c1fee9e7db707449eb97a809d90767cbaad0cfda40a025eaf21edfb0ac367fec08a2e6c1984ced76c7adc449e8e590052cb48

Download Submit
C:\Windows\SysWOW64\Pknlanaa.dll

Filesize
7KB

MD5
fbccfe1f1556f3227c6ad40626fad7a7

SHA1
10aeba715e2a380d3769d6f02268a4cd641ad7c8

SHA256
c786c7940277eee18c289330afcc72afa2e4f715ca394851c75b24bebf9a28c1

SHA512
c492c1ca4cb03f6accfd84ba130961cc9401630286c221bb1367d24fb52eab4ea14331646d27522976fc8288359bacd45aaf87bce36dea2c6a4d6abfd47fe183

Download Submit
memory/220-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/312-103-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/380-186-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/408-338-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/432-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/532-284-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/824-357-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/856-27-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/936-228-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1036-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1240-232-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1312-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1340-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1436-314-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1464-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1660-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1692-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1736-240-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1756-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1784-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1808-175-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1824-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1844-256-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1960-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1996-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2084-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2184-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2468-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2504-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2516-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2544-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2552-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2604-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2680-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3052-350-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3068-215-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3176-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3384-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3396-79-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3596-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3792-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3800-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3896-168-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4040-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4224-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4236-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4268-127-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4288-327-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4384-136-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4396-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4408-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4572-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4576-200-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4624-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4632-430-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4676-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4696-208-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4720-92-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4824-192-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4840-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4852-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4940-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4980-252-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4988-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/9104-2144-0x0000000077900000-0x0000000077963000-memory.dmp

Filesize
396KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads